致谢

感谢杰哥不厌其烦地回答我的提问！
还帮我把逐个写入后排序，改成保存为二维数组后排序⬆⬇

兼容性更新

PE

无法计算ImpHash的PE文件

出现无法计算ImpHash的PE文件，会造成列表的元素数量不对
image.png

解决方案

重写计算ImpHash的逻辑，写在“try except异常处理”内，再加上对ImpHash的判断

🐍Python脚本🐍

逻辑

image.png

  1. 遍历文件夹

1.1 获取文件MD5
1.2 获取ImpHash
1.2.1 获取到ImpHash
if判断ImpHash是否为Null
非Null保存，Null同1.2.2
1.2.2 获取不到ImpHash
提示可能非PE文件

  1. 将数据保存到二维数组

2.1 以二维数组的第二元素排序（默认升序）
2.2 将排序后的数组写入Excel表格

  1. 表格处理

3.1 对表格第2列（ImpHash值）进行合并
3.2 对单元格设置样式为上下居中

代码

  1. #coding=utf-8
  2. import os
  3. import hashlib
  5. import goto
  6. import pefile
  7. import pandas as pd
  8. from openpyxl import load_workbook
  9. from openpyxl.styles import Alignment
  11. def Excel2Write(dataMD5, dataImpHash):
  12.     excel = pd.read_excel(pathExcel)
  14.     # 先创建一个DataFrame，用来增加进数据框的最后一行
  15.     newDF = pd.DataFrame({'MD5': dataMD5, 'ImpHash': dataImpHash}, index=[0])
  16.     #print(newDF)
  17.     excel = excel.append(newDF, ignore_index=True)
  18.     excel.to_excel(pathExcel, index=False)
  20. def Excel2Merge(pathExcel, nColumn):
  21.     # 列数映射为字母
  22.     strColumn = chr(nColumn + 64)
  24.     # 加载Excel和Sheet
  25.     wb = load_workbook(pathExcel)
  26.     sheet = wb["通过ImpHash聚类"]
  28.     # 获取列中单元格的数据
  29.     listCellValue = []
  30.     i = 2
  31.     while True:
  32.         valueCell = sheet.cell(i, nColumn).value
  33.         if valueCell:
  34.             listCellValue.append(valueCell)
  35.         else:
  36.             break
  37.         i += 1
  39.     # 判断合并单元格的始末位置
  40.     cellStart = 0
  41.     flag = listCellValue[0]
  42.     for i in range(len(listCellValue)):
  43.         if listCellValue[i] != flag:
  44.             flag = listCellValue[i]
  45.             cellEnd = i - 1
  46.             if cellEnd >= cellStart:
  47.                 # 合并
  48.                 sheet.merge_cells(strColumn + str(cellStart + 2) + ":" + strColumn + str(cellEnd + 2))
  49.                 cellStart = cellEnd + 1
  50.         if i == len(listCellValue) - 1:
  51.             cellEnd = i
  52.             sheet.merge_cells(strColumn + str(cellStart + 2) + ":" + strColumn + str(cellEnd + 2))
  54.     wb.save(pathExcel)
  56.     print("已按照" + strColumn + "列完成合并")
  58. def Excel2View(pathExcel):
  59.     # 加载Excel和Sheet
  60.     wb = load_workbook(pathExcel)
  61.     sheet = wb["通过ImpHash聚类"]
  62.     nRows = sheet.max_row
  63.     nCols = sheet.max_column
  65.     for j in range(1, nCols + 1):
  66.         for i in range(2, nRows + 1):
  67.             theCell = sheet.cell(row=i, column=j)
  68.             theCell.alignment = Alignment(vertical='center')
  69.     wb.save(pathExcel)
  70.     print("已居中处理")
  72. def GetFileMD5(filename):
  73.     if not os.path.isfile(filename):
  74.         # print(filename)
  75.         return
  76.     strMD5 = hashlib.md5()
  77.     f = open(filename, 'rb')
  78.     while True:
  79.         fContent = f.read()
  80.         if not fContent:
  81.             break
  82.         strMD5.update(fContent)
  83.     f.close()
  84.     return strMD5.hexdigest().upper()
  86. def PE_isPE(filename):
  87.     try:
  88.         file = pefile.PE(filename)
  89.         if file.is_exe():
  90.             return 1
  91.         if file.is_dll():
  92.             return 2
  93.         if file.is_driver():
  94.             return 3
  95.         else:
  96.             return 0
  97.     except:
  98.         return 0
  100. def PE_GetImpHash(filename):
  101.     file = pefile.PE(filename)
  102.     return file.get_imphash().upper()
  104. def EnumFile(pathDir):
  105.     array = []
  106.     for home, dirs, files in os.walk(pathDir):
  107.         for pathDir in dirs:
  108.             print("文件夹：" + pathDir)
  109.         for filename in files:
  110.             pathFile = os.path.join(home, filename)
  112.             # 获取MD5
  113.             fileMD5 = GetFileMD5(pathFile)
  114.             print("文件MD5：" + fileMD5)
  116.             # 查看是否是PE文件，是则获取其ImpHash
  117.             isPE = PE_isPE(pathFile)
  118.             try:
  119.                 # 尝试获取ImpHash
  120.                 fileImpHash = PE_GetImpHash(pathFile)
  121.                 msgImpHash = "PE文件ImpHash：" + fileImpHash
  122.                 # 有一种PE无法计算ImpHash，但值为空
  123.                 if (fileImpHash == ''):
  124.                     fileImpHash = "非PE"
  125.                     msgImpHash = pathFile + "非PE文件，请确认是否是压缩文件等情况"
  126.             except:
  127.                 # 提示非PE
  128.                 fileImpHash = "非PE"
  129.                 msgImpHash = pathFile + "非PE文件，请确认是否是压缩文件等情况"
  131.             print(msgImpHash + "\r\n")
  133.             # 将MD5和ImpHash写入Excel表格
  134.             # Excel2Write(fileMD5, fileImpHash)
  136.             # 保存为二维数组
  137.             array.append([fileMD5, fileImpHash])
  139.     # 对二位数组维度中第2个元素进行排序
  140.     dfSorted = pd.DataFrame(sorted(array, key=lambda x: x[1]))
  141.     ws = pd.ExcelWriter(pathExcel)
  142.     dfSorted.to_excel(ws, sheet_name="通过ImpHash聚类", index=None, header=["MD5", "ImpHash"])
  143.     ws.save()
  144.     print("\r\n全部MD5和ImpHash写入完成")
  146. # 输出的Excel路径
  147. pathExcel = '提取MD5和ImpHash.xlsx'
  148. # 此处输入文件夹路径
  149. pathFolder = (r'路径')
  151. if __name__ == '__main__':
  152.     EnumFile(pathFolder)
  153.     Excel2Merge(pathExcel, 1)
  154.     Excel2Merge(pathExcel, 2)
  155.     Excel2View(pathExcel)