From 620b5a194ff68912644a3cda5011318e8821502d Mon Sep 17 00:00:00 2001
From: Miro <200482516+Mirochill@users.noreply.github.com>
Date: Sat, 23 May 2026 15:33:27 +0200
Subject: [PATCH] Replace pkg_resources resource lookups

---
 pecli/paths.py          | 8 ++++++++
 pecli/plugins/check.py  | 6 +++---
 pecli/plugins/crypto.py | 4 ++--
 3 files changed, 13 insertions(+), 5 deletions(-)
 create mode 100644 pecli/paths.py

diff --git a/pecli/paths.py b/pecli/paths.py
new file mode 100644
index 0000000..d5f9bc7
--- /dev/null
+++ b/pecli/paths.py
@@ -0,0 +1,8 @@
+import os
+
+
+PACKAGE_ROOT = os.path.dirname(os.path.abspath(__file__))
+
+
+def data_path(filename):
+    return os.path.join(PACKAGE_ROOT, "data", filename)
diff --git a/pecli/plugins/check.py b/pecli/plugins/check.py
index 8ad2d27..315df6f 100644
--- a/pecli/plugins/check.py
+++ b/pecli/plugins/check.py
@@ -3,9 +3,9 @@
 import datetime
 import os
 
-import pkg_resources
 import yara
 
+from pecli.paths import data_path
 from pecli.plugins.base import Plugin
 
 
@@ -233,7 +233,7 @@ def check_tls(self, pe):
 
     def check_peid(self, data):
         """Check on PEid signatures"""
-        peid_db = pkg_resources.resource_filename("pecli", 'data/PeID.yar')
+        peid_db = data_path("PeID.yar")
         rules = yara.compile(filepath=peid_db)
         matches = rules.match(data=data)
         if len(matches) > 0:
@@ -294,7 +294,7 @@ def check_pe_resource(self, pe) -> bool:
         return suspicious
 
     def check_yara(self, pe, data: bytes) -> None:
-        yara_rules = pkg_resources.resource_filename("pecli", "data/other.yar")
+        yara_rules = data_path("other.yar")
         if not os.path.isfile(yara_rules):
             print("Problem accessing the yara database")
             return
diff --git a/pecli/plugins/crypto.py b/pecli/plugins/crypto.py
index d6d1fa0..bf7218b 100644
--- a/pecli/plugins/crypto.py
+++ b/pecli/plugins/crypto.py
@@ -1,9 +1,9 @@
 #! /usr/bin/env python
 import os
 
-import pkg_resources
 import yara
 
+from pecli.paths import data_path
 from pecli.plugins.base import Plugin
 
 
@@ -25,7 +25,7 @@ def convert_physical_addr(self, pe, addr):
         return (None, None)
 
     def run(self, args, pe, data):
-        crypto_db = pkg_resources.resource_filename("pecli", "data/yara-crypto.yar")
+        crypto_db = data_path("yara-crypto.yar")
         if not os.path.isfile(crypto_db):
             print("Problem accessing the yara database")
             return