SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-rich-header-and-compiler-artifacts
0
Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Rich Header and Compiler Artifacts ## When to Use - You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs and build numbers) from the Rich header. - You are clustering samples by toolchain or detecting Rich-header tampering/forgery. **Do not use** the Rich header as definitive attribution — it can be copied or stripped. This skill reads the PE statically and executes nothing. ## Prerequisites - The PE sample (read inertly). ## Safety & Handling - Read bytes statically; treat the sample as malicious data. ## Workflow ### Step 1: Parse and decode the Rich header ```bash python scripts/analyst.py rich sample.exe ``` Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`- prefixed entries, and lists `(product_id, build_id, use_count)` tuples. ### Step 2: Fingerprint the toolchain Map product IDs to compiler/linker products and build numbers to identify the Visual Studio version(s) used. ### Step 3: Compute a clustering hash Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples. ### Step 4: Check for inconsistencies Compare the Rich-derived linker version against the PE optional-header linker version; mismatches suggest tampering or a copied header. ## Validation - The XOR key correctly decodes the `DanS` signature at the start of the block. - Decoded entries have plausible product IDs and use counts. - The toolchain fingerprint is reproducible across identical builds. ## Pitfalls - Samples with no Rich header (non-MSVC toolchains, stripped headers). - Forged Rich headers copied from a benign binary. - Confusing the Rich checksum/key handling and misdecoding entries. ## References - See [`references/api-reference.md`](references/api-reference.md) for the parser. - PE format documentation (linked in frontmatter).