loganleland / harvest-pe

Harvest the Portable Executable (PE) file format.

Harvest PE

Harvest PE provides a datatype for the PE format¹ that leverages Data.Binary² to provide a fast, accurate typed representation of PE with the goal to be resilient against maliciously crafted PE files.

TODO

• Add features as needed once disassembly work has started.

Tested on

• Emotet (Trojan)³

Documentation

• Ero Carrera Picture⁴
• Microsoft Documentation⁵
• Lost in the Loader: The Many Faces of the Windows PE File Format⁶

Footnotes

1. https://docs.microsoft.com/en-us/windows/win32/debug/pe-format ↩

2. https://hackage.haskell.org/package/binary-0.10.0.0/docs/Data-Binary.html ↩

3. https://www.virustotal.com/gui/file/15abd370b867de0223943f0ea149cddf2992b0341cf9420ed9bee3063727998e ↩

4. https://drive.google.com/file/d/0B3_wGJkuWLytbnIxY1J5WUs4MEk/view?resourcekey=0-n5zZ2UW39xVTH8ZSu6C2aQ ↩

5. https://docs.microsoft.com/en-us/windows/win32/debug/pe-format#optional-header-data-directories-image-only ↩

6. https://www.youtube.com/watch?v=oswbh4UnJFE ↩