Skip to content

bring scan_pe (disabled) up to date with signify library#173

Open
mattbing wants to merge 1 commit intomainfrom
mbing.fix_scanpe
Open

bring scan_pe (disabled) up to date with signify library#173
mattbing wants to merge 1 commit intomainfrom
mbing.fix_scanpe

Conversation

@mattbing
Copy link
Copy Markdown

@mattbing mattbing commented Apr 8, 2026

Describe the change
The ScanPe module is disabled by default, we don't use it in production. Regardless it was already broken with changes to the signify library that parses PE files. With the latest bump to signify 0.9.2 it broken even more. This brings it to parity, just in case.

Describe testing procedures
I ran it via my own local harness:

$ ./strelka_client.py --host 127.0.0.1 --port 57314 Autoruns.exe | tail -n +3 | jq -C '.scan.pe' | head -20
Connecting to 127.0.0.1:57314...
Scanning Autoruns.exe (1758240 bytes)...
{
  "address_of_entry_point": 517725,
  "base_of_code": 4096,
  "base_of_data": 733184,
  "checksum": 1802854,
  "compile_time": "2024-02-01T10:45:10",
  "debug": {
    "age": 1,
    "guid": "ad14ff51-3fda-204a-8efac840b8b804b1",
    "pdb": "D:\\a\\1\\s\\Win32\\Release\\Autoruns.pdb",
    "type": "rsds"
  },
  "dll_characteristics": [
    "DYNAMIC_BASE",
    "NX_COMPAT",
    "TERMINAL_SERVER_AWARE"
  ],
  "elapsed": 0.25336,
  "file_alignment": 512,
  "file_info": {

Sample output
Nope.

Checklist

  • My code follows the style guidelines of this project
  • I have performed a self-review of and tested my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant