agentsclimarketplace
Sign in

Analyzing rich header and compiler artifacts

Skill meltedinhex/analyst-ai-pack/skills/analyzing-rich-header-and-compiler-artifacts

Analyzes the PE Rich header and related compiler artifacts to fingerprint the build toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by build toolchain.From its SKILL.md

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-rich-header-and-compiler-artifacts

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.7 KB, 418 tokens by cl100k_base, as published. Nobody here has run it

Analyzing Rich Header and Compiler Artifacts

When to Use

  • You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs and build numbers) from the Rich header.
  • You are clustering samples by toolchain or detecting Rich-header tampering/forgery.

Do not use the Rich header as definitive attribution — it can be copied or stripped. This skill reads the PE statically and executes nothing.

Prerequisites

  • The PE sample (read inertly).

Safety & Handling

  • Read bytes statically; treat the sample as malicious data.

Workflow

Step 1: Parse and decode the Rich header

python scripts/analyst.py rich sample.exe

Locates the Rich marker, recovers the XOR key (the DWORD after Rich), decodes the DanS- prefixed entries, and lists (product_id, build_id, use_count) tuples.

Step 2: Fingerprint the toolchain

Map product IDs to compiler/linker products and build numbers to identify the Visual Studio version(s) used.

Step 3: Compute a clustering hash

Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.

Step 4: Check for inconsistencies

Compare the Rich-derived linker version against the PE optional-header linker version; mismatches suggest tampering or a copied header.

Validation

  • The XOR key correctly decodes the DanS signature at the start of the block.
  • Decoded entries have plausible product IDs and use counts.
  • The toolchain fingerprint is reproducible across identical builds.

Pitfalls

  • Samples with no Rich header (non-MSVC toolchains, stripped headers).
  • Forged Rich headers copied from a benign binary.
  • Confusing the Rich checksum/key handling and misdecoding entries.

References

What ships with it: 3 files

4.1 KB alongside SKILL.md, 1 of them executable

references/

scripts/

Keep looking

Skills are one crate of 325,949. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.