impexp.txt

#This project is mainly for simplicity and to have quick access to the imphash, exphash was made for fun...
#If you are reading this, you have passed the static analysis check.
#Achievement Unlocked: Read the code before you execute the code.
#Experience: +50 points
#Level: Expert

function Get-ImpHash {
    param (
        [Parameter(Mandatory=$true, Position=0)]
        [string]$FilePath,
        [string]$Algorithm = "md5",
        [string]$Delimiter = ", ",
        [switch]$ShowTable
    )

    if ($FilePath -eq "-h" -or $FilePath -eq "--help" -or $FilePath -eq "imphash--help") {
        Show-Help "Get-ImpHash"
        return
    }

    if ($FilePath -eq "*") {
        Get-ChildItem | ForEach-Object {
            Get-ImpHash -FilePath $_.FullName -Algorithm $Algorithm -Delimiter $Delimiter -ShowTable:$ShowTable
        }
        return
    }

    if (-not (Test-Path $FilePath)) {
        Write-Host "File not found: $FilePath"
        return
    }

    $pythonScript = @"
import sys
import pefile
import hashlib

def calculate_hash(file_path, algorithm, delimiter, show_table):
    try:
        pe = pefile.PE(file_path)
        impstrs = []
        exts = ["ocx", "sys", "dll"]
        if not hasattr(pe, "DIRECTORY_ENTRY_IMPORT"):
            return ""
        for entry in pe.DIRECTORY_ENTRY_IMPORT:
            if isinstance(entry.dll, bytes):
                libname = entry.dll.decode().lower()
            else:
                libname = entry.dll.lower()
            parts = libname.rsplit(".", 1)
            if len(parts) > 1 and parts[1] in exts:
                libname = parts[0]
            entry_dll_lower = entry.dll.lower()
            for imp in entry.imports:
                funcname = None
                if not imp.name:
                    funcname = ordlookup.ordLookup(
                        entry_dll_lower, imp.ordinal, make_name=True
                    )
                    if not funcname:
                        raise PEFormatError(
                            f"Unable to look up ordinal {entry.dll}:{imp.ordinal:04x}"
                        )
                else:
                    funcname = imp.name
                if not funcname:
                    continue
                if isinstance(funcname, bytes):
                    funcname = funcname.decode()
                impstrs.append("%s.%s" % (libname.lower(), funcname.lower()))

        impstrs_str = ",".join(impstrs)  # Join import strings with commas
        impstrs_display = delimiter.join(impstrs) if show_table else impstrs_str  # Join with custom delimiter for display

        if algorithm.lower() == "md5":
            hash_val = hashlib.md5(impstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha1":
            hash_val = hashlib.sha1(impstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha256":
            hash_val = hashlib.sha256(impstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha512":
            hash_val = hashlib.sha512(impstrs_str.encode()).hexdigest()
        else:
            return "Invalid algorithm specified."

        return hash_val, impstrs_display

    except pefile.PEFormatError:
        return "Not a valid PE file", ""
    except Exception as e:
        return "Error: " + str(e), ""

file_path = sys.argv[1]
algorithm = sys.argv[2]
delimiter = sys.argv[3]
show_table = sys.argv[4].lower() == "true"
hash_val, impstrs_str = calculate_hash(file_path, algorithm, delimiter, show_table)
print(hash_val)
print(impstrs_str)
"@

    $pythonScriptPath = Join-Path -Path $env:TEMP -ChildPath "pe_hash_script.py"
    $pythonScript | Out-File -FilePath $pythonScriptPath -Encoding utf8

    $pythonCommand = "python $pythonScriptPath ""$FilePath"" ""$Algorithm"" ""$Delimiter"" ""$ShowTable"""
    $result = Invoke-Expression -Command $pythonCommand

    $output = $result -split "`n"
    $hash = $output[0]
    $impstrs = $output[1]

    if ($hash -like "Error:*") {
        Write-Host "Error: $hash"
    } else {
        if ($ShowTable) {
            Write-Host "IAT Table:`n`"$impstrs`""
        }

        Write-Host "$Algorithm`t$hash`t$FilePath"
    }
}

function Get-ExpHash {
    param (
        [Parameter(Mandatory=$true, Position=0)]
        [string]$FilePath,
        [string]$Algorithm = "sha256",
        [string]$Delimiter = ", ",
        [switch]$ShowTable
    )

    if ($FilePath -eq "-h" -or $FilePath -eq "--help" -or $FilePath -eq "exphash--help") {
        Show-Help "Get-ExpHash"
        return
    }

    if ($FilePath -eq "*") {
        Get-ChildItem | ForEach-Object {
            Get-ExpHash -FilePath $_.FullName -Algorithm $Algorithm -Delimiter $Delimiter -ShowTable:$ShowTable
        }
        return
    }

    if (-not (Test-Path $FilePath)) {
        Write-Host "File not found: $FilePath"
        return
    }

    $pythonScript = @"

import sys
import pefile
import hashlib

def calculate_hash(file_path, algorithm, delimiter, show_table):
    try:
        pe = pefile.PE(file_path)
        expstrs = []
        exts = ["ocx", "sys", "dll"]
        if not hasattr(pe, "DIRECTORY_ENTRY_EXPORT"):
            return ""
        for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
            if isinstance(exp.name, bytes):
                expname = exp.name.decode().lower()
            else:
                expname = exp.name.lower()
            if isinstance(expname, bytes):
                expname = expname.decode()
            expstrs.append(expname)

        expstrs_str = ",".join(expstrs)  # Join export strings with commas
        expstrs_display = delimiter.join(expstrs) if show_table else expstrs_str  # Join with custom delimiter for display

        if algorithm.lower() == "md5":
            hash_val = hashlib.md5(expstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha1":
            hash_val = hashlib.sha1(expstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha256":
            hash_val = hashlib.sha256(expstrs_str.encode()).hexdigest()
        elif algorithm.lower() == "sha512":
            hash_val = hashlib.sha512(expstrs_str.encode()).hexdigest()
        else:
            return "Invalid algorithm specified."

        return hash_val, expstrs_display

    except pefile.PEFormatError:
        return "Not a valid PE file", ""
    except Exception as e:
        return "Error: " + str(e), ""

file_path = sys.argv[1]
algorithm = sys.argv[2]
delimiter = sys.argv[3]
show_table = sys.argv[4].lower() == "true"
hash_val, expstrs_str = calculate_hash(file_path, algorithm, delimiter, show_table)
print(hash_val)
print(expstrs_str)
"@

    $pythonScriptPath = Join-Path -Path $env:TEMP -ChildPath "pe_hash_script.py"
    $pythonScript | Out-File -FilePath $pythonScriptPath -Encoding utf8

    $pythonCommand = "python $pythonScriptPath ""$FilePath"" ""$Algorithm"" ""$Delimiter"" ""$ShowTable"""
    $result = Invoke-Expression -Command $pythonCommand

    $output = $result -split "`n"
    $hash = $output[0]
    $expstrs = $output[1]

    if ($hash -like "Error:*") {
        Write-Host "Error: $hash"
    } else {
        if ($ShowTable) {
            Write-Host "EAT Table:`n`"$expstrs`""
        }

        Write-Host "$Algorithm`t$hash`t$FilePath"
    }
}

function Show-Help {
    param (
        [string]$Command
    )

    if ($Command -eq "Get-ImpHash") {
        Write-Host ""
        Write-Host "Usage: Get-ImpHash <FilePath> [-Algorithm <Algorithm>] [-Delimiter <Delimiter>] [-ShowTable]"
        Write-Host "       Get-ImpHash * -Algorithm sha512 -Delimiter '  |  ' -ShowTable"
        Write-Host ""
        Write-Host "       --help -> Get the help manual"
        Write-Host "       -Algorithm -> Specify the algorithm (MD5, SHA1, SHA256, SHA512). Default: MD5"
        Write-Host "       -Delimiter -> Specify the delimiter for the IAT table entries. Default: ', '"
        Write-Host "        * -> Get the hash of all files in the present directory."
        Write-Host "        -ShowTable -> Print the IAT Table."
        Write-Host ""
    } elseif ($Command -eq "Get-ExpHash") {
        Write-Host ""
        Write-Host "Usage: Get-ExpHash <FilePath> [-Algorithm <Algorithm>] [-Delimiter <Delimiter>] [-ShowTable]"
        Write-Host "       Get-ExpHash * -Algorithm sha512 -Delimiter '  |  ' -ShowTable"
        Write-Host ""
        Write-Host "       --help -> Get the help manual"
        Write-Host "       -Algorithm -> Specify the algorithm (MD5, SHA1, SHA256, SHA512). Default: SHA256"
        Write-Host "       -Delimiter -> Specify the delimiter for the EAT table entries. Default: ', '"
        Write-Host "        * -> Get the hash of all files in the present directory."
        Write-Host "        -ShowTable -> Print the EAT Table."
        Write-Host ""
    }
}