yara-x
yara-x copied to clipboard
feat: implement dylib_hash function for macho
Implemented a macho similarity function dylib_hash() which is similar to imphash or similar.
This will hash dylib entries as defined in https://github.com/g-les/macho_similarity/blob/main/implementation.md#dylib-hashing.
- I verified the hashing is consistent in both implementation and output by using
python ~/src/macho_similarity/ktool_macho_bulk_hashing.py -f <macho>
I plan on implementing symtab_hash, import_hash, and export_hash in future PRs once I get each parsed out as well.