repository·master·Indexed 10 days ago
https://github.com/horsicq/detect-it-easyA cross-platform file identification tool for malware analysts and reverse engineers. DiE uses signature-based and heuristic analysis to identify executable formats, archives, and other file types. It is available in three versions: a full GUI (die), a CLI for batch processing (diec), and a lightweight scanner GUI (diel). The tool supports Windows, Linux, and macOS, and provides a dedicated API library for developers.
Detect It Easy provides three distinct versions depending on your workflow requirements:
die: The full Graphical User Interface (GUI) version.diec: The Command-Line Interface (CLI) version, optimized for batch processing files.diel: A lightweight GUI version that functions as a scanner only.JAR class provides specialized functions for analyzing JAR files. It inherits all functionality from the Binary class, but uses the JAR prefix for its methods (e.g., instead of Binary.compare(), use JAR.compare()).DEX class provides specialized functions for analyzing Android Dalvik Executable (DEX) files. It inherits the capabilities of the Binary class but adds DEX-specific inspection methods. Use this class when you need to verify the internal structure or content of a DEX file, such as checking for specific strings or overlay presence.ZIP class provides functionality for handling ZIP archives. It inherits or mirrors the capabilities of the Binary class, but with a ZIP prefix applied to its methods (for example, Binary.compareEP becomes ZIP.compareEP).Detect It Easy uses two primary methods to identify files:
This combination is designed to minimize false positives and support a wide range of platforms including Windows, Linux, and MacOS.
The DOTNET class provides analysis for .NET / CLI (Common Language Infrastructure) assemblies. It is backed by the XCLIAssembly format and allows access to CLI metadata such as streams, tables, strings, and blobs.
Important Usage Note: The DOTNET class is only available when the file being analyzed is detected as a CLI assembly (FT_CLI_ASSEMBLY). In signature scripts, you should typically call meta() first to ensure the environment is prepared.
Delta signatures allow you to match byte sequences based on mathematical differences rather than absolute values. This is useful for matching increasing or decreasing byte sequences.
Example: CD+EB matches the byte 0xCD followed by any byte that is greater than or equal to 0xEB.
Binary.compare("CD+EB")The PE class is designed for analyzing Windows Portable Executable files (EXE, DLL, SYS). It inherits functionality from two other classes:
Binary functions are available with a PE prefix (e.g., Binary.compareEP becomes PE.compareEP).MSDOS functions are available with a PE prefix (e.g., MSDOS.isDosStubPresent becomes PE.isDosStubPresent).The PE class supports advanced analysis workflows for security and reverse engineering:
The PYC class provides specialized functions for analyzing Python bytecode. It functions as a specialized extension of the Binary class; you can use any function available in the Binary class by prefixing it with PYC (e.g., Binary.compare becomes PYC.compare).
// Example of the prefix pattern
// Binary.compare(...) -> PYC.compare(...)Signatures in Detect-It-Easy are hexadecimal patterns used to match byte sequences in binary files. A signature can be composed of:
4D 5A).'MZ').Multiple formats are equivalent. For example, the following all match a DOS/PE executable header:
4D 5A 90 ?? ?? 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00
4D 5A 90 .. .. 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00
'MZ'90....00000004000000FFFF0000B80000004D 5A 90 ?? ?? 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00MSDOS class inherits from the Binary class. This means all functions available in the Binary class are accessible within the MSDOS class, prefixed with MSDOS (e.g., Binary.compareEP becomes MSDOS.compareEP).