| 30 | namespace LIEF::PE::py { |
| 31 | |
| 32 | void init_utils(nb::module_& m) { |
| 33 | using namespace LIEF::py; |
| 34 | |
| 35 | nb::enum_<IMPHASH_MODE>(m, "IMPHASH_MODE", |
| 36 | "Enum to define the behavior of :func:`~lief.PE.get_imphash`"_doc) |
| 37 | .value("DEFAULT", IMPHASH_MODE::DEFAULT, "Default implementation") |
| 38 | .value("LIEF", IMPHASH_MODE::LIEF, "Same as DEFAULT") |
| 39 | .value("PEFILE", IMPHASH_MODE::PEFILE, "Use pefile algorithm") |
| 40 | .value("VT", IMPHASH_MODE::VT, "Same as PEFILE since Virus Total is using pefile"); |
| 41 | |
| 42 | m.def("oid_to_string", &oid_to_string, |
| 43 | "Convert an OID to a human-readable string"_doc); |
| 44 | |
| 45 | |
| 46 | lief_mod->def("is_pe", |
| 47 | [] (nb::PathLike path) { return is_pe(path); }, |
| 48 | "Check if the given file is a ``PE``"_doc, |
| 49 | "file"_a); |
| 50 | |
| 51 | lief_mod->def("is_pe", |
| 52 | nb::overload_cast<const std::vector<uint8_t>&>(&is_pe), |
| 53 | "Check if the given raw data is a ``PE``"_doc, |
| 54 | "raw"_a); |
| 55 | |
| 56 | m.def("get_type", |
| 57 | [] (nb::PathLike file) { |
| 58 | return error_or(static_cast<result<PE_TYPE> (*)(const std::string&)>(&get_type), file); |
| 59 | }, |
| 60 | R"delim( |
| 61 | If the input file is a a valid ``PE``, return the :class:`~.lief.PE.PE_TYPE`. |
| 62 | Otherwise, return a :class:`lief.lief_errors`. |
| 63 | )delim"_doc, |
| 64 | "file"_a); |
| 65 | |
| 66 | |
| 67 | m.def("get_type", |
| 68 | [] (const std::vector<uint8_t>& raw) { |
| 69 | return error_or(static_cast<result<PE_TYPE> (*)(const std::vector<uint8_t>&)>(&get_type), raw); |
| 70 | }, |
| 71 | "raw"_a); |
| 72 | |
| 73 | m.def("get_imphash", |
| 74 | &get_imphash, |
| 75 | R"delim( |
| 76 | Compute the hash of imported functions |
| 77 | |
| 78 | Properties of the hash generated: |
| 79 | |
| 80 | * Order agnostic |
| 81 | * Casse agnostic |
| 82 | * Ordinal (**in some extent**) agnostic |
| 83 | |
| 84 | If one needs the same output as Virus Total (i.e. pefile), you can use :attr:`~lief.PE.IMPHASH_MODE.PEFILE` |
| 85 | as second parameter. |
| 86 | |
| 87 | .. warning:: |
| 88 | The algorithm used to compute the *imphash* value has some variations compared to Yara, pefile, |
| 89 | VT implementation |
no test coverage detected