petriage 0.5.0

Cross-platform PE file surface analysis tool for malware analysts
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

use crate::analysis::AnalysisResult;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum Tab {
    FileInfo,
    Headers,
    Sections,
    Imports,
    Exports,
    Strings,
    Overlay,
    Resources,
    RichHeader,
    Tls,
    Debug,
    Authenticode,
    Opsec,
    BuildInfo,
}

impl Tab {
    pub const ALL: &[Tab] = &[
        Tab::FileInfo,
        Tab::Headers,
        Tab::Sections,
        Tab::Imports,
        Tab::Exports,
        Tab::Strings,
        Tab::Overlay,
        Tab::Resources,
        Tab::RichHeader,
        Tab::Tls,
        Tab::Debug,
        Tab::Authenticode,
        Tab::Opsec,
        Tab::BuildInfo,
    ];

    pub fn label(&self) -> &'static str {
        match self {
            Tab::FileInfo => "File Info",
            Tab::Headers => "Headers",
            Tab::Sections => "Sections",
            Tab::Imports => "Imports",
            Tab::Exports => "Exports",
            Tab::Strings => "Strings",
            Tab::Overlay => "Overlay",
            Tab::Resources => "Resources",
            Tab::RichHeader => "Rich",
            Tab::Tls => "TLS",
            Tab::Debug => "Debug",
            Tab::Authenticode => "Signing",
            Tab::Opsec => "OPSEC",
            Tab::BuildInfo => "Build",
        }
    }
}

#[derive(Debug, Clone)]
pub struct OptionsPanel {
    pub show_headers: bool,
    pub show_sections: bool,
    pub show_imports: bool,
    pub show_exports: bool,
    pub show_strings: bool,
    pub show_hashes: bool,
    pub show_overlay: bool,
    pub show_resources: bool,
    pub show_authenticode: bool,
    pub min_str_len: usize,
}

impl Default for OptionsPanel {
    fn default() -> Self {
        Self {
            show_headers: true,
            show_sections: true,
            show_imports: true,
            show_exports: true,
            show_strings: true,
            show_hashes: true,
            show_overlay: true,
            show_resources: true,
            show_authenticode: true,
            min_str_len: 4,
        }
    }
}

#[derive(Debug)]
pub enum AppState {
    NoFile,
    Loaded {
        file_name: String,
        data: Vec<u8>,
        result: Box<AnalysisResult>,
    },
    Error(String),
}