Compute imphash about lief HOT 5 CLOSED

Given whatever PE, ELF or Mach-O you can compute an imhash (by using imported_functions) as follow:

import lief
from hashlib import md5
elf_pe_macho = lief.parse("/bin/ls")
imphash = md5(",".join(elf_pe_macho.imported_functions).encode()).hexdigest()
print(imphash)

But it doesn't take account of imports by ordinal (for PE files)

from lief.

Yeah, the lack import by ordinal will break quite a lot of hashes so I cannot really rely on it out-of-the-box.

I can just have a wrapper to do it on my end, it's not a big deal.

from lief.

What I could do is to implement this hash in the utils part of the format. Something like this:

import lief
from lief.PE import imphash
pe = lief.parse("...")
print(imphash(pe))

... and handle import by ordinal

from lief.

I'm totally with you on that :)

In the utils part, I could also contribute a MISP object export for example

from lief.

\o/

from lief.