Skip to content

Latest commit

 

History

History
59 lines (48 loc) · 1.24 KB

README.md

File metadata and controls

59 lines (48 loc) · 1.24 KB
Raw

Rich Header

Description

This is a collection of the work performed investigating the PE32 Rich Header.

Standalone

To execute the standalone version please execute the following:

python3 standalone.py <filename>

Web Version

The web version can be run as a local tornado server or through the included dockerfile.

Output

{
    "compids": [
        {
            "mcv": "<str>",
            "pid": "<str>",
            "cnt": "<str>",
        }
    ],
    "compids_dup": "<boolean>",
    "csum_calc": "<int>",
    "csum_file": "<int>",
    "csum_valid": "<boolean>",
    "error": "<int>",
    "offset": "<int>",
}

Docker Usage

Build and start the docker container using the following commands

docker build -t richheader .
sudo docker run --name rich_header -v /tmp:/tmp:ro -p 8080:8080 richheader

Place the files you wish to extract the Rich Header from in /tmp and access using http://127.0.0.1:8080/analyze/?obj=<file_name>

To read about the service please see http://127.0.0.1:8080/

Acknowledgement

This work was created with the blood sweat and tears of mamy people. Thank you

  • Zachary Hanif
  • Julian Kirsch
  • Bojan Kolosnjaji
  • Christian von Pentz
  • Marcel Schumacher
  • George Webster
  • Huang Xiao