So here is the promised update, in assembler code:
Before Toolbar v2.0.114, this was basically the code to calculate the CH:
PHP Code:
CHStart:
mov esi, 0E6359A60h ; GOOGLE_MAGIC
push esi
push dword ptr [ebp-3Ch] ; info:URL size
push eax ; info:URL
call _bobJenkinsHash
After that, one only had to convert eax to unsigned integer and prepand CH=6.
In Toolbar v2.0.114, Google doesn't stop here. The code goes on:
PHP Code:
newCode:
push eax ; resulting 32bit hash (used as final hash in toolbar < 2.0.114
call _32bitMutation
add esp, 10h
mov [ebp+0Ch], eax
xor eax, eax
lea ecx, [ebp-0B0h]
generate80ByteTable:
mov edx, [ebp+0Ch]
sub edx, eax
mov [ecx], edx
add eax, 9
add ecx, 4
cmp eax, 180
jb short generate80ByteTable
push esi ; GOOGLE_MAGIC (0xE6359A60)
lea eax, [ebp-0B0h]
push 80 ; Table size
push eax ; Table offset
call _bobJenkinsHash
with function generate80ByteTable:
PHP Code:
_32bitMutation proc near
hash = dword ptr 4
mov eax, [esp+4]
push esi
push 0Dh
pop ecx
xor edx, edx
div ecx
mov eax, [esp+4+hash]
push 7
pop esi
mov ecx, edx
xor edx, edx
div esi
and ecx, 7
pop esi
shl eax, 2
or eax, ecx
retn
_32bitMutation endp
So as I said before, the Bob Jenkins hash is applied twice now:
1. bobJenkinsHash(info:url)
2. the resulting hash (32bit) undergoes a small modification
3. generate a 80 byte table from the modified hash in 1.
4. bobJenkinsHash(80 byte table)
After that, like in previous toolbar versions, you convert eax to unsigned integer and prepand CH=6.
The remaining step is to transcode the assembler snippets into high-level again.