summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorCoprDistGit <infra@openeuler.org>2023-05-31 06:28:35 +0000
committerCoprDistGit <infra@openeuler.org>2023-05-31 06:28:35 +0000
commit90dd0e1b830c70e5d51b8c5ba67c71ba7db596db (patch)
treecd2eb71e2d166fb2a8147d6553ca356debfb1584
parent570e3c488ce068617dbba5539d616c89e675126e (diff)
automatic import of python-dexofuzzy
-rw-r--r--.gitignore1
-rw-r--r--python-dexofuzzy.spec616
-rw-r--r--sources1
3 files changed, 618 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore
index e69de29..19c5647 100644
--- a/.gitignore
+++ b/.gitignore
@@ -0,0 +1 @@
+/dexofuzzy-1.7.1.tar.gz
diff --git a/python-dexofuzzy.spec b/python-dexofuzzy.spec
new file mode 100644
index 0000000..44b2795
--- /dev/null
+++ b/python-dexofuzzy.spec
@@ -0,0 +1,616 @@
+%global _empty_manifest_terminate_build 0
+Name: python-dexofuzzy
+Version: 1.7.1
+Release: 1
+Summary: Dexofuzzy : Dalvik EXecutable Opcode Fuzzyhash
+License: Apache License 2.0
+URL: https://github.com/lee1029ng/Dexofuzzy
+Source0: https://mirrors.nju.edu.cn/pypi/web/packages/fd/eb/a8fb5acaf784686cfbc304a354e4097ac54450db3eb25852ba515c6de290/dexofuzzy-1.7.1.tar.gz
+BuildArch: noarch
+
+Requires: python3-ssdeep
+
+%description
+
+# Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash
+
+Dexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.
+
+![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg) ![Latest Version](https://img.shields.io/badge/pypi-v3.3-blue.svg) ![Python Versions](https://img.shields.io/badge/python-3-blue.svg)
+
+## Requirements
+
+ Dexofuzzy requires the following modules:
+* ssdeep 3.3 or later
+
+## Install
+
+### Install on CentOS 6.10, 7.9, 8.5, Stream 8
+```console
+$ yum install epel-release
+$ yum install libffi-devel ssdeep ssdeep-devel python3-pip python3-devel libtool
+$ pip3 install dexofuzzy
+```
+
+### Install on Debian 8.11, 9.13, 10.11
+```console
+$ apt-get install libffi-dev libfuzzy-dev python3-pip
+$ pip3 install dexofuzzy
+```
+
+### Install on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS
+```console
+$ apt-get install libffi-dev libfuzzy-dev
+$ pip3 install dexofuzzy
+```
+
+### Install on Windows 7, 10
+* The ssdeep DLL binaries for Windows are included in ./dexofuzzy/bin/ directory.
+ * [intezer/ssdeep-windows](https://github.com/intezer/ssdeep-windows) is included.
+ * [MacDue/ssdeep-windows-32_64](https://github.com/MacDue/ssdeep-windows-32_64) is included.
+```console
+$ pip3 install dexofuzzy
+```
+
+## Usage
+```
+usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY] [-m] [-g N M]
+ [-s DEXOFUZZY DEXOFUZZY] [-c CSV_FILENAME] [-j JSON_FILENAME]
+ [-l]
+
+Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash
+
+optional arguments:
+ -h, --help show this help message and exit
+ -f SAMPLE_FILENAME, --file SAMPLE_FILENAME
+ the sample to extract dexofuzzy
+ -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY
+ the directory of samples to extract dexofuzzy
+ -m, --method-fuzzy extract the fuzzyhash based on method of the sample
+ (must include the -f or -d option by default)
+ -g N, --clustering N M N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy
+ (must include the -d option by default)
+ -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY
+ score the dexofuzzy of the sample
+ -c CSV_FILENAME, --csv CSV_FILENAME
+ output as CSV format
+ -j JSON_FILENAME, --json JSON_FILENAME
+ output as json format
+ (include method fuzzy or clustering)
+ -l, --error-log output the error log
+```
+
+### Output Format Example
+* *FileName, FileSha256, FileSize, DexoHash, Dexofuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE
+sample.apk,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,94d36ca47485ca4b1d05f136fa4d9473bb2ed3f21b9621e4adce47acbc999c5d,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+```
+* *Method Fuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE -m
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+[
+ "3:mWc0R2gLkcT2AVA:mWc51cTnVA",
+ "3:b0RdGMVAn:MA",
+ "3:y+6sMlHdNy+BGZn:y+6sMh5En",
+ "3:y4CdNy/GZn:y4C+En",
+ "3:dcpqn:WEn",
+ "3:EN:EN",
+ ...
+]
+```
+* *Clustering using N-Gram and M-Partial Matching*
+```bash
+$ dexofuzzy -d SAMPLE_DIRECTORY -g 7 3
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,46504,4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f,48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5
+[
+ {
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q",
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "clustering": [
+ {
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY",
+ "signature": [
+ "U7uPrEM",
+ "7uPrEMc",
+ "uPrEMc0"
+ ]
+ },
+ {
+ "file_name": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_sha256": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_size": "46504",
+ "dexohash": "4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f",
+ "dexofuzzy": "B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5",
+ "signature": [
+ "2KmUCNc",
+ "KmUCNc2",
+ "mUCNc2F"
+ ]
+ }
+ ]
+ },
+ {
+ ...
+ }
+]
+```
+
+### Python API
+To compute a Dexofuzzy of ``dex file``, use ``hash`` function:
+* *dexofuzzy(dex_binary_data)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> dexofuzzy.hash(dex_data)
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+* *dexofuzzy_from_file(apk_file_path or dex_file_path)*
+```python
+>>> import dexofuzzy
+>>> dexofuzzy.hash_from_file('Sample.apk')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> dexofuzzy.hash_from_file('classes.dex')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+The ``compare`` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.
+* *compare(dexofuzzy_1, dexofuzzy_2)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> hash1 = dexofuzzy.hash(dex_data)
+>>> hash1
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')
+>>> hash2
+'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'
+>>> dexofuzzy.compare(hash1, hash2)
+50
+```
+
+## Tested on
+* CentOS 6.10, 7.7, 8.5, Stream 8
+* Debian 8.11, 9.13, 10.11
+* Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS
+* Windows 7, 10
+
+## Publication
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim, [Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index](https://ieeexplore.ieee.org/iel7/8932631/8939563/08939894.pdf), In: Proceedings of the 2019 International Conference on Information and Communication Technology Convergence, ICTC, 16-18 October 2019.
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Jihyun Lee, Jun-Seob Kim, [Dexofuzzy: Android Malware Similarity Clustering Method using Opcode Sequence](https://www.virusbulletin.com/uploads/pdf/magazine/2019/201911-Dexofuzzy-Android-Malware-Similarity-Clustering-Method.pdf), Virus Bulletin, 25 October 2019.
+* Shinho Lee, Wookhyun Jung, Wonrak Lee, HyungGeun Oh, Eui Tak Kim, [Android Malware Dataset Construction Methodology to Minimize Bias-Variance Tradeoff](https://www.sciencedirect.com/science/article/pii/S2405959521001351/pdfft?md5=62c643429a39f8f7e31609fbd89c56a0&pid=1-s2.0-S2405959521001351-main.pdf), ICT Express, 8 October 2021.
+
+## License
+Dexofuzzy is licensed under the terms of the Apache license. See [LICENSE](https://github.com/lee1029ng/Dexofuzzy/blob/master/LICENSE) for more information.
+
+
+%package -n python3-dexofuzzy
+Summary: Dexofuzzy : Dalvik EXecutable Opcode Fuzzyhash
+Provides: python-dexofuzzy
+BuildRequires: python3-devel
+BuildRequires: python3-setuptools
+BuildRequires: python3-pip
+%description -n python3-dexofuzzy
+
+# Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash
+
+Dexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.
+
+![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg) ![Latest Version](https://img.shields.io/badge/pypi-v3.3-blue.svg) ![Python Versions](https://img.shields.io/badge/python-3-blue.svg)
+
+## Requirements
+
+ Dexofuzzy requires the following modules:
+* ssdeep 3.3 or later
+
+## Install
+
+### Install on CentOS 6.10, 7.9, 8.5, Stream 8
+```console
+$ yum install epel-release
+$ yum install libffi-devel ssdeep ssdeep-devel python3-pip python3-devel libtool
+$ pip3 install dexofuzzy
+```
+
+### Install on Debian 8.11, 9.13, 10.11
+```console
+$ apt-get install libffi-dev libfuzzy-dev python3-pip
+$ pip3 install dexofuzzy
+```
+
+### Install on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS
+```console
+$ apt-get install libffi-dev libfuzzy-dev
+$ pip3 install dexofuzzy
+```
+
+### Install on Windows 7, 10
+* The ssdeep DLL binaries for Windows are included in ./dexofuzzy/bin/ directory.
+ * [intezer/ssdeep-windows](https://github.com/intezer/ssdeep-windows) is included.
+ * [MacDue/ssdeep-windows-32_64](https://github.com/MacDue/ssdeep-windows-32_64) is included.
+```console
+$ pip3 install dexofuzzy
+```
+
+## Usage
+```
+usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY] [-m] [-g N M]
+ [-s DEXOFUZZY DEXOFUZZY] [-c CSV_FILENAME] [-j JSON_FILENAME]
+ [-l]
+
+Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash
+
+optional arguments:
+ -h, --help show this help message and exit
+ -f SAMPLE_FILENAME, --file SAMPLE_FILENAME
+ the sample to extract dexofuzzy
+ -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY
+ the directory of samples to extract dexofuzzy
+ -m, --method-fuzzy extract the fuzzyhash based on method of the sample
+ (must include the -f or -d option by default)
+ -g N, --clustering N M N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy
+ (must include the -d option by default)
+ -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY
+ score the dexofuzzy of the sample
+ -c CSV_FILENAME, --csv CSV_FILENAME
+ output as CSV format
+ -j JSON_FILENAME, --json JSON_FILENAME
+ output as json format
+ (include method fuzzy or clustering)
+ -l, --error-log output the error log
+```
+
+### Output Format Example
+* *FileName, FileSha256, FileSize, DexoHash, Dexofuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE
+sample.apk,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,94d36ca47485ca4b1d05f136fa4d9473bb2ed3f21b9621e4adce47acbc999c5d,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+```
+* *Method Fuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE -m
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+[
+ "3:mWc0R2gLkcT2AVA:mWc51cTnVA",
+ "3:b0RdGMVAn:MA",
+ "3:y+6sMlHdNy+BGZn:y+6sMh5En",
+ "3:y4CdNy/GZn:y4C+En",
+ "3:dcpqn:WEn",
+ "3:EN:EN",
+ ...
+]
+```
+* *Clustering using N-Gram and M-Partial Matching*
+```bash
+$ dexofuzzy -d SAMPLE_DIRECTORY -g 7 3
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,46504,4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f,48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5
+[
+ {
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q",
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "clustering": [
+ {
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY",
+ "signature": [
+ "U7uPrEM",
+ "7uPrEMc",
+ "uPrEMc0"
+ ]
+ },
+ {
+ "file_name": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_sha256": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_size": "46504",
+ "dexohash": "4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f",
+ "dexofuzzy": "B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5",
+ "signature": [
+ "2KmUCNc",
+ "KmUCNc2",
+ "mUCNc2F"
+ ]
+ }
+ ]
+ },
+ {
+ ...
+ }
+]
+```
+
+### Python API
+To compute a Dexofuzzy of ``dex file``, use ``hash`` function:
+* *dexofuzzy(dex_binary_data)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> dexofuzzy.hash(dex_data)
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+* *dexofuzzy_from_file(apk_file_path or dex_file_path)*
+```python
+>>> import dexofuzzy
+>>> dexofuzzy.hash_from_file('Sample.apk')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> dexofuzzy.hash_from_file('classes.dex')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+The ``compare`` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.
+* *compare(dexofuzzy_1, dexofuzzy_2)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> hash1 = dexofuzzy.hash(dex_data)
+>>> hash1
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')
+>>> hash2
+'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'
+>>> dexofuzzy.compare(hash1, hash2)
+50
+```
+
+## Tested on
+* CentOS 6.10, 7.7, 8.5, Stream 8
+* Debian 8.11, 9.13, 10.11
+* Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS
+* Windows 7, 10
+
+## Publication
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim, [Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index](https://ieeexplore.ieee.org/iel7/8932631/8939563/08939894.pdf), In: Proceedings of the 2019 International Conference on Information and Communication Technology Convergence, ICTC, 16-18 October 2019.
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Jihyun Lee, Jun-Seob Kim, [Dexofuzzy: Android Malware Similarity Clustering Method using Opcode Sequence](https://www.virusbulletin.com/uploads/pdf/magazine/2019/201911-Dexofuzzy-Android-Malware-Similarity-Clustering-Method.pdf), Virus Bulletin, 25 October 2019.
+* Shinho Lee, Wookhyun Jung, Wonrak Lee, HyungGeun Oh, Eui Tak Kim, [Android Malware Dataset Construction Methodology to Minimize Bias-Variance Tradeoff](https://www.sciencedirect.com/science/article/pii/S2405959521001351/pdfft?md5=62c643429a39f8f7e31609fbd89c56a0&pid=1-s2.0-S2405959521001351-main.pdf), ICT Express, 8 October 2021.
+
+## License
+Dexofuzzy is licensed under the terms of the Apache license. See [LICENSE](https://github.com/lee1029ng/Dexofuzzy/blob/master/LICENSE) for more information.
+
+
+%package help
+Summary: Development documents and examples for dexofuzzy
+Provides: python3-dexofuzzy-doc
+%description help
+
+# Dexofuzzy: Dalvik EXecutable Opcode Fuzzyhash
+
+Dexofuzzy is a similarity digest hash for Android. It extracts Opcode Sequence from Dex file based on Ssdeep and generates hash that can be used for similarity comparison of Android App. Dexofuzzy created using Dex's opcode sequence can find similar apps by comparing hash.
+
+![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg) ![Latest Version](https://img.shields.io/badge/pypi-v3.3-blue.svg) ![Python Versions](https://img.shields.io/badge/python-3-blue.svg)
+
+## Requirements
+
+ Dexofuzzy requires the following modules:
+* ssdeep 3.3 or later
+
+## Install
+
+### Install on CentOS 6.10, 7.9, 8.5, Stream 8
+```console
+$ yum install epel-release
+$ yum install libffi-devel ssdeep ssdeep-devel python3-pip python3-devel libtool
+$ pip3 install dexofuzzy
+```
+
+### Install on Debian 8.11, 9.13, 10.11
+```console
+$ apt-get install libffi-dev libfuzzy-dev python3-pip
+$ pip3 install dexofuzzy
+```
+
+### Install on Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS
+```console
+$ apt-get install libffi-dev libfuzzy-dev
+$ pip3 install dexofuzzy
+```
+
+### Install on Windows 7, 10
+* The ssdeep DLL binaries for Windows are included in ./dexofuzzy/bin/ directory.
+ * [intezer/ssdeep-windows](https://github.com/intezer/ssdeep-windows) is included.
+ * [MacDue/ssdeep-windows-32_64](https://github.com/MacDue/ssdeep-windows-32_64) is included.
+```console
+$ pip3 install dexofuzzy
+```
+
+## Usage
+```
+usage: dexofuzzy [-h] [-f SAMPLE_FILENAME] [-d SAMPLE_DIRECTORY] [-m] [-g N M]
+ [-s DEXOFUZZY DEXOFUZZY] [-c CSV_FILENAME] [-j JSON_FILENAME]
+ [-l]
+
+Dexofuzzy - Dalvik EXecutable Opcode Fuzzyhash
+
+optional arguments:
+ -h, --help show this help message and exit
+ -f SAMPLE_FILENAME, --file SAMPLE_FILENAME
+ the sample to extract dexofuzzy
+ -d SAMPLE_DIRECTORY, --directory SAMPLE_DIRECTORY
+ the directory of samples to extract dexofuzzy
+ -m, --method-fuzzy extract the fuzzyhash based on method of the sample
+ (must include the -f or -d option by default)
+ -g N, --clustering N M N-Gram Tokenizer and M-Partial Matching clustering based on the sample's dexofuzzy
+ (must include the -d option by default)
+ -s DEXOFUZZY DEXOFUZZY, --score DEXOFUZZY DEXOFUZZY
+ score the dexofuzzy of the sample
+ -c CSV_FILENAME, --csv CSV_FILENAME
+ output as CSV format
+ -j JSON_FILENAME, --json JSON_FILENAME
+ output as json format
+ (include method fuzzy or clustering)
+ -l, --error-log output the error log
+```
+
+### Output Format Example
+* *FileName, FileSha256, FileSize, DexoHash, Dexofuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE
+sample.apk,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,94d36ca47485ca4b1d05f136fa4d9473bb2ed3f21b9621e4adce47acbc999c5d,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+```
+* *Method Fuzzy*
+```bash
+$ dexofuzzy -f SAMPLE_FILE -m
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+[
+ "3:mWc0R2gLkcT2AVA:mWc51cTnVA",
+ "3:b0RdGMVAn:MA",
+ "3:y+6sMlHdNy+BGZn:y+6sMh5En",
+ "3:y4CdNy/GZn:y4C+En",
+ "3:dcpqn:WEn",
+ "3:EN:EN",
+ ...
+]
+```
+* *Clustering using N-Gram and M-Partial Matching*
+```bash
+$ dexofuzzy -d SAMPLE_DIRECTORY -g 7 3
+80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835,42959,d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38,48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q
+ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3,46504,4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f,48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5
+[
+ {
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q",
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "clustering": [
+ {
+ "file_name": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_sha256": "80cd7786fa42a257dcaddb44823a97ff5610614d345e5f52af64da0ec3e62835",
+ "file_size": "42959",
+ "dexohash": "d89c3b2c2620b77b1c0df7ef66ecde6d70f30b8a3ca15c21ded4b1ce1e319d38",
+ "dexofuzzy": "U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY",
+ "signature": [
+ "U7uPrEM",
+ "7uPrEMc",
+ "uPrEMc0"
+ ]
+ },
+ {
+ "file_name": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_sha256": "ffe8c426c3a8ade648666bb45f194c1e84fb499b126932997c4d50cdfc4cc8f3",
+ "file_size": "46504",
+ "dexohash": "4a7039eefb7a8c292bcbd3e9fa232f4e6b136eedb9a114eb32aa360742b3f28f",
+ "dexofuzzy": "B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5",
+ "signature": [
+ "2KmUCNc",
+ "KmUCNc2",
+ "mUCNc2F"
+ ]
+ }
+ ]
+ },
+ {
+ ...
+ }
+]
+```
+
+### Python API
+To compute a Dexofuzzy of ``dex file``, use ``hash`` function:
+* *dexofuzzy(dex_binary_data)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> dexofuzzy.hash(dex_data)
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+* *dexofuzzy_from_file(apk_file_path or dex_file_path)*
+```python
+>>> import dexofuzzy
+>>> dexofuzzy.hash_from_file('Sample.apk')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> dexofuzzy.hash_from_file('classes.dex')
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+```
+The ``compare`` function returns the match between 2 hashes, an integer value from 0 (no match) to 100.
+* *compare(dexofuzzy_1, dexofuzzy_2)*
+```python
+>>> import dexofuzzy
+>>> with open('classes.dex', 'rb') as dex:
+... dex_data = dex.read()
+>>> hash1 = dexofuzzy.hash(dex_data)
+>>> hash1
+'48:U7uPrEMc0HZj0/zeGnD2KmUCNc2FuGgy9fY:UHMHZ4/zeGD2+Cap3y9Q'
+>>> hash2 = dexofuzzy.hash_from_file('classes2.dex')
+>>> hash2
+'48:B2KmUCNc2FuGgy9fbdD7uPrEMc0HZj0/zeGn5:B2+Cap3y9pDHMHZ4/zeG5'
+>>> dexofuzzy.compare(hash1, hash2)
+50
+```
+
+## Tested on
+* CentOS 6.10, 7.7, 8.5, Stream 8
+* Debian 8.11, 9.13, 10.11
+* Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS
+* Windows 7, 10
+
+## Publication
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Eui Tak Kim, [Android Malware Similarity Clustering using Method based Opcode Sequence and Jaccard Index](https://ieeexplore.ieee.org/iel7/8932631/8939563/08939894.pdf), In: Proceedings of the 2019 International Conference on Information and Communication Technology Convergence, ICTC, 16-18 October 2019.
+* Shinho Lee, Wookhyun Jung, Sangwon Kim, Jihyun Lee, Jun-Seob Kim, [Dexofuzzy: Android Malware Similarity Clustering Method using Opcode Sequence](https://www.virusbulletin.com/uploads/pdf/magazine/2019/201911-Dexofuzzy-Android-Malware-Similarity-Clustering-Method.pdf), Virus Bulletin, 25 October 2019.
+* Shinho Lee, Wookhyun Jung, Wonrak Lee, HyungGeun Oh, Eui Tak Kim, [Android Malware Dataset Construction Methodology to Minimize Bias-Variance Tradeoff](https://www.sciencedirect.com/science/article/pii/S2405959521001351/pdfft?md5=62c643429a39f8f7e31609fbd89c56a0&pid=1-s2.0-S2405959521001351-main.pdf), ICT Express, 8 October 2021.
+
+## License
+Dexofuzzy is licensed under the terms of the Apache license. See [LICENSE](https://github.com/lee1029ng/Dexofuzzy/blob/master/LICENSE) for more information.
+
+
+%prep
+%autosetup -n dexofuzzy-1.7.1
+
+%build
+%py3_build
+
+%install
+%py3_install
+install -d -m755 %{buildroot}/%{_pkgdocdir}
+if [ -d doc ]; then cp -arf doc %{buildroot}/%{_pkgdocdir}; fi
+if [ -d docs ]; then cp -arf docs %{buildroot}/%{_pkgdocdir}; fi
+if [ -d example ]; then cp -arf example %{buildroot}/%{_pkgdocdir}; fi
+if [ -d examples ]; then cp -arf examples %{buildroot}/%{_pkgdocdir}; fi
+pushd %{buildroot}
+if [ -d usr/lib ]; then
+ find usr/lib -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/lib64 ]; then
+ find usr/lib64 -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/bin ]; then
+ find usr/bin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+if [ -d usr/sbin ]; then
+ find usr/sbin -type f -printf "/%h/%f\n" >> filelist.lst
+fi
+touch doclist.lst
+if [ -d usr/share/man ]; then
+ find usr/share/man -type f -printf "/%h/%f.gz\n" >> doclist.lst
+fi
+popd
+mv %{buildroot}/filelist.lst .
+mv %{buildroot}/doclist.lst .
+
+%files -n python3-dexofuzzy -f filelist.lst
+%dir %{python3_sitelib}/*
+
+%files help -f doclist.lst
+%{_docdir}/*
+
+%changelog
+* Wed May 31 2023 Python_Bot <Python_Bot@openeuler.org> - 1.7.1-1
+- Package Spec generated
diff --git a/sources b/sources
new file mode 100644
index 0000000..c4e5d99
--- /dev/null
+++ b/sources
@@ -0,0 +1 @@
+19de45f8523218ff5761307c2d209b2d dexofuzzy-1.7.1.tar.gz