why use imphash for elf file

[gaohang]

imphash is an effective way to identify binary files. In yarGen, I see imphash generated for pe file. But, why do generate imphash for elf files? how to generate imphash for elf files by python?

[seekamoon]

I am afraid that it is impossible to generate imphash (which has exactly the same definition of PE) for ELF since associating the imported functions with the corresponding libraries is non-trivial for ELF.

But there are some alternatives which have the similar effect (e.g., telfhash [1] and ImpELF [2]).

[1] https://github.com/trendmicro/telfhash [2] https://github.com/signalblur/impelf