QuasarApp/LIEF
4
0
Fork 0
mirror of https://github.com/QuasarApp/LIEF.git synced 2025-05-07 17:29:34 +00:00
Code Issues Projects Releases Wiki Activity

Add notice regarding LIEF imphash implementation

Browse Source 
Related to
This commit is contained in:
Romain Thomas 2019-06-26 09:10:35 +02:00
parent 7ff0859879
commit bd9be9a765
2 changed files with 5 additions and 0 deletions
api/python/PE
pyUtils.cpp
include/LIEF/PE
utils.hpp

3
api/python/PE/pyUtils.cpp

@ -54,6 +54,9 @@ void init_utils(py::module& m) {
"\t* Casse agnostic\n"
"\t* Ordinal (**in some extent**) agnostic\n\n"
".. warning::\n\n"
"\tThe algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation\n"
".. seealso::\n\n"
"\thttps://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html\n",
"binary"_a);

2
include/LIEF/PE/utils.hpp

@ -48,6 +48,8 @@ LIEF_API PE_TYPE get_type(const std::vector<uint8_t>& raw);
//! * Casse agnostic
//! * Ordinal (**in some extent**) agnostic
//!
//! @warning The algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, VT implementation
//!
//! @see https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html
LIEF_API std::string get_imphash(const Binary& binary);