#!/usr/bin/env python3
"""Compute real byte-entropy fingerprints + PE section data for the Reverse Lab site."""
import json, math, os, hashlib
import pefile

FILES = {
    "internal.exe":    "/root/internal.exe",
    "skinchanger.exe": "/root/skinchanger.exe",
    "free_int.dll":    "/root/free_int.dll",
    "hookloader.exe":  "/root/hookloader.exe",
    "svc_stealer.exe": "/root/svc_stealer.exe",
}
BUCKETS = 192

def entropy(b):
    if not b:
        return 0.0
    c = [0] * 256
    for x in b:
        c[x] += 1
    n = len(b)
    e = 0.0
    for v in c:
        if v:
            p = v / n
            e -= p * math.log2(p)
    return e

out = {}
for name, path in FILES.items():
    data = open(path, "rb").read()
    size = len(data)
    step = max(1, size // BUCKETS)
    strip = []
    for i in range(BUCKETS):
        chunk = data[i * step:(i + 1) * step]
        if not chunk:
            break
        strip.append(round(entropy(chunk), 2))
    rec = {
        "size": size,
        "sha256": hashlib.sha256(data).hexdigest(),
        "entropy": round(entropy(data), 3),
        "strip": strip,
        "sections": [],
    }
    try:
        pe = pefile.PE(path, fast_load=True)
        rec["machine"] = hex(pe.FILE_HEADER.Machine)
        rec["timestamp"] = pe.FILE_HEADER.TimeDateStamp
        for s in pe.sections:
            nm = s.Name.rstrip(b"\x00").decode("latin-1", "replace")
            d = s.get_data()
            rec["sections"].append({
                "name": nm,
                "vaddr": hex(s.VirtualAddress),
                "vsize": s.Misc_VirtualSize,
                "rsize": s.SizeOfRawData,
                "entropy": round(entropy(d), 2),
                "flags": hex(s.Characteristics),
            })
        pe.close()
    except Exception as e:
        rec["pe_error"] = str(e)
    out[name] = rec
    print(f"{name:18} {size/1048576:7.2f} MB  H={rec['entropy']:.3f}  "
          f"{len(rec['sections'])} sections  sha={rec['sha256'][:16]}")

json.dump(out, open("/root/re_site/tools/fingerprints.json", "w"), indent=1)