analyzing-rich-header-and-compiler-artifacts

Name: analyzing-rich-header-and-compiler-artifacts
Author: meltedinhex

18stars5forks

How to install analyzing-rich-header-and-compiler-artifacts?

meltedinhex/analyst-ai-pack/analyzing-rich-header-and-compiler-artifacts

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rich-header-and-compiler-artifacts

Installs into the current project.

Summary

Analyzes the PE Rich header and related compiler artifacts to fingerprint the build

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Rich Header and Compiler Artifacts
2
3	## When to Use
4
5	- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
6	and build numbers) from the Rich header.
7	- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.
8
9	Do not use the Rich header as definitive attribution — it can be copied or stripped. This skill
10	reads the PE statically and executes nothing.
11
12	## Prerequisites
13
14	- The PE sample (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; treat the sample as malicious data.
19
20	## Workflow
21
22	### Step 1: Parse and decode the Rich header
23
24	```bash
25	python scripts/analyst.py rich sample.exe
26	```
27
28	Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`-
29	prefixed entries, and lists `(product_id, build_id, use_count)` tuples.
30
31	### Step 2: Fingerprint the toolchain
32
33	Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
34	version(s) used.
35
36	### Step 3: Compute a clustering hash
37
38	Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.
39
40	### Step 4: Check for inconsistencies
41
42	Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
43	suggest tampering or a copied header.
44
45	## Validation
46
47	- The XOR key correctly decodes the `DanS` signature at the start of the block.
48	- Decoded entries have plausible product IDs and use counts.
49	- The toolchain fingerprint is reproducible across identical builds.
50
51	## Pitfalls
52
53	- Samples with no Rich header (non-MSVC toolchains, stripped headers).
54	- Forged Rich headers copied from a benign binary.
55	- Confusing the Rich checksum/key handling and misdecoding entries.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the parser.
60	- PE format documentation (linked in frontmatter).

People who liked this also viewed

6 picks

Type

analyzing-rich-header-and-compiler-artifacts

18stars5forks

View on GitHub

How to install analyzing-rich-header-and-compiler-artifacts?

meltedinhex/analyst-ai-pack/analyzing-rich-header-and-compiler-artifacts

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rich-header-and-compiler-artifacts

Installs into the current project.

Summary

Analyzes the PE Rich header and related compiler artifacts to fingerprint the build

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Rich Header and Compiler Artifacts
2
3	## When to Use
4
5	- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
6	and build numbers) from the Rich header.
7	- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.
8
9	Do not use the Rich header as definitive attribution — it can be copied or stripped. This skill
10	reads the PE statically and executes nothing.
11
12	## Prerequisites
13
14	- The PE sample (read inertly).
15
16	## Safety & Handling
17
18	- Read bytes statically; treat the sample as malicious data.
19
20	## Workflow
21
22	### Step 1: Parse and decode the Rich header
23
24	```bash
25	python scripts/analyst.py rich sample.exe
26	```
27
28	Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`-
29	prefixed entries, and lists `(product_id, build_id, use_count)` tuples.
30
31	### Step 2: Fingerprint the toolchain
32
33	Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
34	version(s) used.
35
36	### Step 3: Compute a clustering hash
37
38	Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.
39
40	### Step 4: Check for inconsistencies
41
42	Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
43	suggest tampering or a copied header.
44
45	## Validation
46
47	- The XOR key correctly decodes the `DanS` signature at the start of the block.
48	- Decoded entries have plausible product IDs and use counts.
49	- The toolchain fingerprint is reproducible across identical builds.
50
51	## Pitfalls
52
53	- Samples with no Rich header (non-MSVC toolchains, stripped headers).
54	- Forged Rich headers copied from a benign binary.
55	- Confusing the Rich checksum/key handling and misdecoding entries.
56
57	## References
58
59	- See [`references/api-reference.md`](references/api-reference.md) for the parser.
60	- PE format documentation (linked in frontmatter).

People who liked this also viewed

6 picks

Type