pyssdeep模块

pyssdeep模块

python中可以通过pyssdeep模块调用ssdeep来计算文件的ssdeep值。pyssdeep模块的地址：https://github.com/bunzen/pySSDeep。

下载文件后，通过sudo python setup.py install来进行安装，不过安装后再使用时会报错：ImportError: libfuzzy.so.2: cannot open shared object file: No such file or directory。

错误原因：

1 sys.path is only searched forPython modules. For dynamic linked libraries, the paths searched must beinLD_LIBRARY_PATH. Checkif your LD_LIBRARY_PATH includes /usr/local/lib, andifit doesn't, add it and try again.

解决办法：

通过echo  $LD_LIBRARY_PATH命令查看$LD_LIBRARY_PATH是否为空，如果为空，执行命令

1 export LD_LIBRARY_PATH=/usr/local/lib

如果不为空，则执行

1 export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH

pyssdeep模块使用

1 >>> importpyssdeep
2 >>> sig1 = pyssdeep.fuzzy_hash_filename("ls_test1")
3 >>> sig2 = pyssdeep.fuzzy_hash_buf(open("ls_test2").read())
4 >>> pyssdeep.fuzzy_compare(sig1, sig2)
5 99

参考资料：

1、ssdeep检测webshell

2、模糊哈希算法的原理与应用

3、Why can’t Python find shared objects that are in directories in sys.path?

4、pySSDeep

原文链接

http://www.jinglingshu.org/?p=9775