Permhash 是一个可扩展的框架，用于对应用于基于 Chromium 的浏览器扩展和 APK 的已声明权限进行哈希处理，从而支持类似于导入哈希（import hashing）和富头部哈希（rich header hashing）的聚类、狩猎和枢轴分析（pivoting）。
Permhash 目前能够处理四种类型的文件，但在此基础上还可进一步扩展：
安装 permhash 库
pip install permhash
导入 permhash
from permhash import functions as permhash
使用 permhash
# The path variable should be the full path to the file you wish to use to calculate the permhash.
# Calculate the permhash for a CRX
ph = permhash.permhash_crx(path)
# Calculate the permhash for a CRX manifest
ph = permhash.permhash_crx_manifest(path)
# Calculate the permhash for an APK
ph = permhash.permhash_apk(path)
# Calculate the permhash for an APK manifest
ph = permhash.permhash_apk_manifest(path)
一个批量计算 permhash 的示例。
import csv
import os
from permhash import functions as permhash
def bulk_permhash_crx_manifest(path, output):
"""
Computes the permhash from a directory of CRX manifests
Outputs the results in a csv passed as input
:param path: The targeted directory
:type path: string
:param output:
:type path: string
"""
with open(output, mode="w", encoding="utf-8") as results:
out_writer = csv.writer(
results, delimiter=",", quotechar='"', quoting=csv.QUOTE_MINIMAL
)
out_writer.writerow(["filename", "permhash"])
for filename in os.listdir(path):
if path.endswith("/"):
full_path = path + filename
else:
full_path = path + "/" + filename
calculated_permhash = permhash.permhash_crx_manifest(full_path)
if calculated_permhash:
out_writer.writerow([filename, calculated_permhash])
Permhash 也可以作为命令行工具使用。在 --path/-p 开关中提供要计算 permhash 的文件的完整路径，并在 --type/-t 开关中提供所分析文件的类型。该命令将输出 permhash；如果文件无效，则输出 False。
permhash --type crx --path '[PATH TO CRX File]'
permhash --type crx_manifest --path '[PATH TO CRX Manifest File]'
permhash --type apk --path '[PATH TO APK File]'
permhash --type apk_manifest --path '[PATH TO APK Manifest Files]'
有关更多详细信息，请参阅 Mandiant Permhash 博客。
可通过 Permhash Google Group 进行讨论。
这不是 Google 官方支持的产品。