Implement imphash about pelite HOT 4 CLOSED

Hello insanitybit,

Can you explain for what this function might be used for?

It seems to calculate some hash of all imported functions.

While this function can be implemented no problem using pelite, the python version has some problematic features (hardcoded list of extensions, hardcoded list of ordinals -> function names for some dlls, md5, lowercasing everything).

While these can be worked around, without knowing why one might use this function I don't feel I can make the right decision at the library level and feel it is better left over to the user of pelite to implement this feature.

from pelite.

I found this interesting article discussing get_imphash: https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html

This seems like a very specific feature for a very specific use case which I don't think is appropriate for pelite (the library).

That said making it easy to calculate imphash (making sure pelite supports this use case in a straightforward way) and eg. providing an example that does exactly that seems like a good idea.

from pelite.

Cool, yeah I think that makes sense - it's definitely very specific, but the primitives for implementing it seems relevant to the crate.

A separate crate that actually provides the implementation would probably be more reasonable.

from pelite.

I've implemented a simplified version of this feature as an example.

Uses the default hasher and not trying to be fancy with imports.

> cargo run --example imphash -- C:\Windows\System32\msvcp140.dll
Import hash is 66182F54652495EE for "C:\\Windows\\System32\\msvcp140.dll".

from pelite.