yara-x icon indicating copy to clipboard operation
yara-x copied to clipboard

feat: implement dylib_hash function for macho

Open latonis opened this issue 1 year ago • 0 comments

Implemented a macho similarity function dylib_hash() which is similar to imphash or similar.

This will hash dylib entries as defined in https://github.com/g-les/macho_similarity/blob/main/implementation.md#dylib-hashing.

  • I verified the hashing is consistent in both implementation and output by using python ~/src/macho_similarity/ktool_macho_bulk_hashing.py -f <macho>

I plan on implementing symtab_hash, import_hash, and export_hash in future PRs once I get each parsed out as well.

latonis avatar Mar 21 '24 22:03 latonis