PE analyzer
This repository contains a Spicy-based analyzer for the Portable Executable (PE) image file format,
- PE format specification
- Tour of the Win32 Portable Executable File Format
- Wikipedia: Portable Executable
This analyzer replaces the builtin Zeek PE analyzer.
Options
Some fields in the logs are disabled by default, but they can be enabled with the following redefinitions.
| Option | Description |
|---|---|
PE::pe_log_section_entropy=T | Log the Shannon entropy for every section in the section_info field. |
PE::pe_log_section_flags=T | Log whether sections are (r)eadable, (e)xecutable and/or (w)ritable in the section_info field. |
PE::pe_log_import_table=T | Log all the imported function names in the PE, prepended with the source file, to the import_table field. |
PE::pe_log_export_table=T | Log all the exported function names in the PE to the export_table field. |
TODOs
- parse the data from remaining directory sections
- allowing tuning/control of parsing contraints would be nice, but something that Spicy would have to support, see this discussion