Module rich_header 

Rich header parsing — compiler fingerprint between DOS stub and PE signature.

The Rich header records every compiler/linker tool version used to build the binary, XOR-encoded with a 4-byte key. It is an invaluable attribution signal: identical (product_id, build_id) tuples across samples indicate the same toolchain, and therefore likely the same threat actor or campaign.

Format (all DWORDs are little-endian)

  [XOR(DanS, key)] [pad0^key] [pad1^key] [pad2^key]
  [XOR(comp_id0, key)] [XOR(use_count0, key)]
  ...
  "Rich"  [xor_key]

• DanS = 0x536E_6144 (DanS read as u32 LE)
• comp_id = (product_id << 16) | build_id
• use_count = number of objects compiled with that tool version
• xor_key = raw DWORD after the Rich terminator

Structs

RichEntry

One entry in the Rich header: a specific compiler/linker tool version.

RichHeader

Decoded Rich header — compiler fingerprint from the DOS stub area.

Functions

parse_rich_header

Parse the Rich header from raw PE bytes.