erocarrera / pefile

pefile is a Python module to read and work with PE (Portable Executable) files
MIT License
1.83k stars 516 forks source link

Exphash from sha256 to md5 to match imphash #377

Closed N0fix closed 6 months ago

N0fix commented 1 year ago

PR #354 added exphash using the sha256 function instead of md5, which creates two issues:

This PR proposes using md5 instead of sha256 for exphash to maintain consistency.

Note: I believe this confusion stems from a discrepancy between the original blog post about exphash, which mentions the usage of sha256, and its integration into public community projects.

erocarrera commented 6 months ago

I'm a bit torn in this case: I see the rationale in staying consistent with imphash, even more in the case that yara is also using md5. Ideally all these methods would be using sha256, but one can't update imphash without causing major issues, I'd say it's not worth the pain. Hence I'm leaning towards merging and using md5 and hoping not many people have started relying on the sha256 results.