Skip to content

Commit 62acf52

Browse files
DosX-devDosX-dev
committed
First commit
1 parent f8d39a7 commit 62acf52

File tree

13 files changed

+829
-2
lines changed

13 files changed

+829
-2
lines changed

‎README.md‎

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,24 @@
1-
# PE-LiteScan
2-
A simple heuristic PE file analyzer for Windows
1+
# PELS analyzer
2+
**PE-LiteScan** (or **PELS**) is a simple heuristic analyzer for common PE-anomalies, specifically focusing on the detection of packers and protectors. Designed for Windows.
3+
4+
![](pics/pic.png)
5+
6+
# Using
7+
```
8+
PE-LiteScan "file_to_check.exe"
9+
```
10+
11+
# Detection types
12+
| Detection Type | Description |
13+
|-----------------------------|-----------------------------------------------------------------------------|
14+
| `LAST_SECTION_ENTRYPOINT` | The entry point is located in the last section of the file. |
15+
| `NO_TEXT_SECTION` | The `.text` section is missing from the PE file. |
16+
| `STRANGE_OVERLAY` | Compressed data found in the overlay section of the file. |
17+
| `HIGH_ENTROPY` | High entropy detected, indicating possible packed data. |
18+
| `NET_ANTI_ILDASM` | The `.NET` binary has the `SuppressIldasmAttribute` attribute. |
19+
| `PUSHAL_AT_ENTRY` | Strange entry point detected (e.g., starts with `PUSHAL` instruction). |
20+
| `CUSTOM_DOS_STUB` | Unusual DOS stub found in the PE file. |
21+
| `IMPORT_TABLE_MISSING` | The import table is missing from the PE file. |
22+
| `SECTIONS_LIKE_*` | Section names match known packer signatures (e.g., `UPX`, `VMProtect`). |
23+
24+
> Powered by `PeNet` library.

‎pics/pic.png‎

40.6 KB
Loading

‎source/FodyWeavers.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
2+
<Costura />
3+
</Weavers>

‎source/FodyWeavers.xsd‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
3+
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
4+
<xs:element name="Weavers">
5+
<xs:complexType>
6+
<xs:all>
7+
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
8+
<xs:complexType>
9+
<xs:all>
10+
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
11+
<xs:annotation>
12+
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
13+
</xs:annotation>
14+
</xs:element>
15+
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
16+
<xs:annotation>
17+
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
18+
</xs:annotation>
19+
</xs:element>
20+
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeRuntimeAssemblies" type="xs:string">
21+
<xs:annotation>
22+
<xs:documentation>A list of runtime assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
23+
</xs:annotation>
24+
</xs:element>
25+
<xs:element minOccurs="0" maxOccurs="1" name="IncludeRuntimeAssemblies" type="xs:string">
26+
<xs:annotation>
27+
<xs:documentation>A list of runtime assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
28+
</xs:annotation>
29+
</xs:element>
30+
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
31+
<xs:annotation>
32+
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
33+
</xs:annotation>
34+
</xs:element>
35+
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
36+
<xs:annotation>
37+
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
38+
</xs:annotation>
39+
</xs:element>
40+
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
41+
<xs:annotation>
42+
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
43+
</xs:annotation>
44+
</xs:element>
45+
</xs:all>
46+
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
47+
<xs:annotation>
48+
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
49+
</xs:annotation>
50+
</xs:attribute>
51+
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
52+
<xs:annotation>
53+
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
54+
</xs:annotation>
55+
</xs:attribute>
56+
<xs:attribute name="IncludeRuntimeReferences" type="xs:boolean">
57+
<xs:annotation>
58+
<xs:documentation>Controls if runtime assemblies are also embedded.</xs:documentation>
59+
</xs:annotation>
60+
</xs:attribute>
61+
<xs:attribute name="UseRuntimeReferencePaths" type="xs:boolean">
62+
<xs:annotation>
63+
<xs:documentation>Controls whether the runtime assemblies are embedded with their full path or only with their assembly name.</xs:documentation>
64+
</xs:annotation>
65+
</xs:attribute>
66+
<xs:attribute name="DisableCompression" type="xs:boolean">
67+
<xs:annotation>
68+
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
69+
</xs:annotation>
70+
</xs:attribute>
71+
<xs:attribute name="DisableCleanup" type="xs:boolean">
72+
<xs:annotation>
73+
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
74+
</xs:annotation>
75+
</xs:attribute>
76+
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
77+
<xs:annotation>
78+
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
79+
</xs:annotation>
80+
</xs:attribute>
81+
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
82+
<xs:annotation>
83+
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
84+
</xs:annotation>
85+
</xs:attribute>
86+
<xs:attribute name="ExcludeAssemblies" type="xs:string">
87+
<xs:annotation>
88+
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
89+
</xs:annotation>
90+
</xs:attribute>
91+
<xs:attribute name="IncludeAssemblies" type="xs:string">
92+
<xs:annotation>
93+
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
94+
</xs:annotation>
95+
</xs:attribute>
96+
<xs:attribute name="ExcludeRuntimeAssemblies" type="xs:string">
97+
<xs:annotation>
98+
<xs:documentation>A list of runtime assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
99+
</xs:annotation>
100+
</xs:attribute>
101+
<xs:attribute name="IncludeRuntimeAssemblies" type="xs:string">
102+
<xs:annotation>
103+
<xs:documentation>A list of runtime assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
104+
</xs:annotation>
105+
</xs:attribute>
106+
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
107+
<xs:annotation>
108+
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
109+
</xs:annotation>
110+
</xs:attribute>
111+
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
112+
<xs:annotation>
113+
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
114+
</xs:annotation>
115+
</xs:attribute>
116+
<xs:attribute name="PreloadOrder" type="xs:string">
117+
<xs:annotation>
118+
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
119+
</xs:annotation>
120+
</xs:attribute>
121+
</xs:complexType>
122+
</xs:element>
123+
</xs:all>
124+
<xs:attribute name="VerifyAssembly" type="xs:boolean">
125+
<xs:annotation>
126+
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
127+
</xs:annotation>
128+
</xs:attribute>
129+
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
130+
<xs:annotation>
131+
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
132+
</xs:annotation>
133+
</xs:attribute>
134+
<xs:attribute name="GenerateXsd" type="xs:boolean">
135+
<xs:annotation>
136+
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
137+
</xs:annotation>
138+
</xs:attribute>
139+
</xs:complexType>
140+
</xs:element>
141+
</xs:schema>

‎source/PE-LiteScan.csproj‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net8.0-windows</TargetFramework>
6+
<RootNamespace>PE_LiteScan</RootNamespace>
7+
<ImplicitUsings>enable</ImplicitUsings>
8+
<Nullable>enable</Nullable>
9+
10+
<PublishAot>true</PublishAot> <!-- Native compilation -->
11+
12+
<!-- Size optimization -->
13+
<DebuggerSupport>false</DebuggerSupport>
14+
<EnableUnsafeBinaryFormatterSerialization>false</EnableUnsafeBinaryFormatterSerialization>
15+
<EnableUnsafeUTF7Encoding>false</EnableUnsafeUTF7Encoding>
16+
<EventSourceSupport>false</EventSourceSupport>
17+
<HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
18+
<MetadataUpdaterSupport>false</MetadataUpdaterSupport>
19+
<StackTraceSupport>false</StackTraceSupport>
20+
<UseNativeHttpHandler>true</UseNativeHttpHandler>
21+
<UseSystemResourceKeys>true</UseSystemResourceKeys>
22+
<TrimmerRemoveSymbols>true</TrimmerRemoveSymbols>
23+
<TrimmerSingleWarn>false</TrimmerSingleWarn>
24+
<TrimMode>link</TrimMode>
25+
26+
<InvariantGlobalization>true</InvariantGlobalization>
27+
<StartupObject>PE_LiteScan.Program</StartupObject>
28+
<PublishTrimmed>True</PublishTrimmed>
29+
<ProduceReferenceAssembly>True</ProduceReferenceAssembly>
30+
<AssemblyName>PE-LiteScan</AssemblyName>
31+
<AllowUnsafeBlocks>False</AllowUnsafeBlocks>
32+
</PropertyGroup>
33+
34+
35+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|AnyCPU'">
36+
<DebugType>none</DebugType>
37+
<TreatWarningsAsErrors>False</TreatWarningsAsErrors>
38+
<WarningLevel>9999</WarningLevel>
39+
</PropertyGroup>
40+
41+
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|AnyCPU'">
42+
<DebugType>none</DebugType>
43+
<TreatWarningsAsErrors>False</TreatWarningsAsErrors>
44+
<WarningLevel>9999</WarningLevel>
45+
</PropertyGroup>
46+
47+
<ItemGroup>
48+
<Compile Remove="build_x64\**" />
49+
<EmbeddedResource Remove="build_x64\**" />
50+
<None Remove="build_x64\**" />
51+
</ItemGroup>
52+
53+
<ItemGroup>
54+
<PackageReference Include="Costura.Fody" Version="5.7.0">
55+
<PrivateAssets>all</PrivateAssets>
56+
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
57+
</PackageReference>
58+
<PackageReference Include="PeNet" Version="4.0.5" />
59+
</ItemGroup>
60+
61+
</Project>

‎source/PE-LiteScan.sln‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.8.34525.116
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "PE-LiteScan", "PE-LiteScan.csproj", "{7A2273E3-89D0-4063-BF5C-ED3A19E9FFA4}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{7A2273E3-89D0-4063-BF5C-ED3A19E9FFA4}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15+
{7A2273E3-89D0-4063-BF5C-ED3A19E9FFA4}.Debug|Any CPU.Build.0 = Debug|Any CPU
16+
{7A2273E3-89D0-4063-BF5C-ED3A19E9FFA4}.Release|Any CPU.ActiveCfg = Release|Any CPU
17+
{7A2273E3-89D0-4063-BF5C-ED3A19E9FFA4}.Release|Any CPU.Build.0 = Release|Any CPU
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
GlobalSection(ExtensibilityGlobals) = postSolution
23+
SolutionGuid = {AFA03399-41E7-4FB5-A146-698633D2C814}
24+
EndGlobalSection
25+
EndGlobal

‎source/Properties/PublishProfiles/FolderProfile.pubxml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<!--
3+
https://go.microsoft.com/fwlink/?LinkID=208121.
4+
-->
5+
<Project>
6+
<PropertyGroup>
7+
<Configuration>Release</Configuration>
8+
<Platform>Any CPU</Platform>
9+
<PublishDir>bin\Release\net8.0-windows\publish\win-x64\</PublishDir>
10+
<PublishProtocol>FileSystem</PublishProtocol>
11+
<_TargetId>Folder</_TargetId>
12+
<TargetFramework>net8.0-windows</TargetFramework>
13+
<RuntimeIdentifier>win-x64</RuntimeIdentifier>
14+
<SelfContained>true</SelfContained>
15+
<PublishSingleFile>false</PublishSingleFile>
16+
<PublishReadyToRun>false</PublishReadyToRun>
17+
</PropertyGroup>
18+
</Project>

‎source/build_release.cmd‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
dotnet publish -o build_x64\
2+
upx "build_x64\PE-LiteScan.exe" --lzma

‎source/source/ColoredConsole.cs‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
namespace PE_LiteScan {
2+
/// <summary>
3+
/// Provides methods for writing colored messages to the console.
4+
/// </summary>
5+
public static class ColoredConsole {
6+
7+
/// <summary>
8+
/// Represents the different types of messages that can be written.
9+
/// </summary>
10+
private enum ColoredConsoleType {
11+
info = 0,
12+
detection = 1,
13+
success = 2
14+
}
15+
16+
/// <summary>
17+
/// Writes an informational message to the console.
18+
/// </summary>
19+
/// <param name="message">The message to write.</param>
20+
public static void WriteInfo(string message) {
21+
WriteColoredMessage(ColoredConsoleType.info, message, String.Empty, ConsoleColor.Cyan);
22+
}
23+
24+
/// <summary>
25+
/// Writes a success message to the console.
26+
/// </summary>
27+
/// <param name="message">The message to write.</param>
28+
public static void WriteSuccess(string message) {
29+
WriteColoredMessage(ColoredConsoleType.success, message, String.Empty, ConsoleColor.White);
30+
}
31+
32+
/// <summary>
33+
/// Writes a bad detection message to the console.
34+
/// </summary>
35+
/// <param name="message">The message to write.</param>
36+
/// <param name="tip">The tip to write.</param>
37+
public static void WriteBadDetection(string message, string tip) {
38+
WriteColoredMessage(ColoredConsoleType.detection, message, tip, ConsoleColor.Red);
39+
}
40+
41+
/// <summary>
42+
/// Writes a colored message to the console.
43+
/// </summary>
44+
/// <param name="type">The type of message to write.</param>
45+
/// <param name="message">The message to write.</param>
46+
/// <param name="tip">The tip to write.</param>
47+
/// <param name="color">The color of the message.</param>
48+
private static void WriteColoredMessage(ColoredConsoleType type, string message, string tip, ConsoleColor color) {
49+
Console.ResetColor(); // Reset the color before writing the message
50+
51+
char messageTypeChar = '-'; // Default message type character
52+
53+
switch (type) { // Set the message type character based on the type
54+
case ColoredConsoleType.info:
55+
messageTypeChar = 'I'; // Informational
56+
break;
57+
case ColoredConsoleType.detection:
58+
messageTypeChar = 'X'; // Detection
59+
break;
60+
case ColoredConsoleType.success:
61+
messageTypeChar = '@'; // Success
62+
break;
63+
}
64+
65+
Console.Write($"[{messageTypeChar}] "); // Write the message type character
66+
Console.ForegroundColor = color;
67+
Console.Write(message);
68+
Console.ForegroundColor = ConsoleColor.White;
69+
70+
if (type == ColoredConsoleType.detection) {
71+
Console.Write(" :: ");
72+
Console.ForegroundColor = ConsoleColor.Yellow;
73+
Console.Write(tip);
74+
}
75+
76+
Console.WriteLine();
77+
78+
Console.ResetColor();
79+
}
80+
}
81+
}

0 commit comments

Comments
 (0)