PE: parse Rich headers

[daladim]

A PE rich header is a not-officially-documented header that the Microsoft linker adds between the DOS stub and the PE NT headers.

It has been widely reversed-engineered and documented. Several Python parsers are available.

That would be good that object implements such a parser as well.

It's on my todo-list to add this to object one day and upstream it here, unless someone wants to do so more quickly than I will.

[philipc]

This is really only useful for malware researchers?

[bjorn3]

If you don't want to add a parser for it to object, maybe object could the return rich headers as raw bytes and leave it up for interpretation by the user?

[daladim]

Well, I've written a quick and dirty implementation that kind of works. Give me a few days to polish it and I'll make a MR :-)