reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-rich-header-and-compiler-artifacts/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: analyzing-rich-header-and-compiler-artifacts
+description: 'Analyzes the PE Rich header and related compiler artifacts to fingerprint the build
+  toolchain, cluster related samples, and detect inconsistencies that suggest tampering. Activates
+  for requests to analyze a Rich header, fingerprint the compiler/linker, or cluster samples by
+  build toolchain.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - pe
+  - rich-header
+  - toolchain
+  - clustering
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1027
+  - T1587.001
+  - T1036
+d3fend:
+  - D3-SDA
+  - D3-FA
+references:
+  - 'PE Format — https://learn.microsoft.com/windows/win32/debug/pe-format'
+  - 'Rich header structure (public reverse-engineering research) — https://learn.microsoft.com/windows/win32/debug/pe-format'
+---
+
+# Analyzing Rich Header and Compiler Artifacts
+
+## When to Use
+
+- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
+  and build numbers) from the Rich header.
+- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.
+
+**Do not use** the Rich header as definitive attribution — it can be copied or stripped. This skill
+reads the PE statically and executes nothing.
+
+## Prerequisites
+
+- The PE sample (read inertly).
+
+## Safety & Handling
+
+- Read bytes statically; treat the sample as malicious data.
+
+## Workflow
+
+### Step 1: Parse and decode the Rich header
+
+```bash
+python scripts/analyst.py rich sample.exe
+```
+
+Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`-
+prefixed entries, and lists `(product_id, build_id, use_count)` tuples.
+
+### Step 2: Fingerprint the toolchain
+
+Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
+version(s) used.
+
+### Step 3: Compute a clustering hash
+
+Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.
+
+### Step 4: Check for inconsistencies
+
+Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
+suggest tampering or a copied header.
+
+## Validation
+
+- The XOR key correctly decodes the `DanS` signature at the start of the block.
+- Decoded entries have plausible product IDs and use counts.
+- The toolchain fingerprint is reproducible across identical builds.
+
+## Pitfalls
+
+- Samples with no Rich header (non-MSVC toolchains, stripped headers).
+- Forged Rich headers copied from a benign binary.
+- Confusing the Rich checksum/key handling and misdecoding entries.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the parser.
+- PE format documentation (linked in frontmatter).