-
Notifications
You must be signed in to change notification settings - Fork 49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: implement dylib and entitlement hashing for macho #93
Conversation
i will get this PR fixed up this weekend :) |
Rust nightly channel is throwing up some weird compilation errors. Maybe a discussion for if nightly should be gated for the commits? @plusvic, thoughts on nightly not being a gated check for tests? |
I agree, we could run tests with nightly once a day, just like we run the coverage tests. |
@plusvic, this one is ready for review, the import and export parsing relies on me writing the trie parsing which requires uleb128 parsing among other things. I think it would be good to get these two in for detection opportunities while I get the imports and exports parsed :) |
Implemented a macho similarity function
dylib_hash()
andentitlement_hash()
which is similar toimphash
or any other attribute hashing mechanism.This will hash dylib entries as defined in https://github.com/g-les/macho_similarity/blob/main/implementation.md#dylib-hashing.
python ~/src/macho_similarity/ktool_macho_bulk_hashing.py -f <macho>
I plan on implementing symtab_hash, import_hash, and export_hash in future PRs once I get each parsed out as well.