reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/manually-unpacking-a-packed-binary/scripts/analyst.py

@@ -0,0 +1,86 @@
+#!/usr/bin/env python3
+"""Statically characterize a packed PE to plan manual unpacking.
+
+Parses the PE section table to report per-section entropy, writable+executable sections, unusual
+names, and import-table size — signals of a runtime packer. Uses pefile if available, otherwise a
+minimal built-in section parser. Reads bytes statically; executes nothing.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import math
+import struct
+import sys
+from collections import Counter
+from pathlib import Path
+
+KNOWN_PACKER_NAMES = ["upx", "aspack", "fsg", "mpress", "vmp", "themida", "petite", "nspack",
+                      "pec", "mew", "enigma"]
+
+
+def _entropy(chunk: bytes) -> float:
+    if not chunk:
+        return 0.0
+    counts = Counter(chunk)
+    total = len(chunk)
+    return round(-sum((c / total) * math.log2(c / total) for c in counts.values()), 3)
+
+
+def _parse_sections(data: bytes) -> list[dict]:
+    if data[:2] != b"MZ":
+        raise ValueError("not a PE")
+    e_lfanew = struct.unpack_from("<I", data, 0x3c)[0]
+    if data[e_lfanew:e_lfanew + 4] != b"PE\x00\x00":
+        raise ValueError("bad PE signature")
+    num_sections = struct.unpack_from("<H", data, e_lfanew + 6)[0]
+    opt_size = struct.unpack_from("<H", data, e_lfanew + 20)[0]
+    sect_off = e_lfanew + 24 + opt_size
+    sections = []
+    for i in range(num_sections):
+        base = sect_off + i * 40
+        raw = data[base:base + 40]
+        if len(raw) < 40:
+            break
+        name = raw[:8].rstrip(b"\x00").decode("latin-1", "ignore")
+        vsize, vaddr, rawsize, rawptr = struct.unpack_from("<IIII", raw, 8)
+        chars = struct.unpack_from("<I", raw, 36)[0]
+        body = data[rawptr:rawptr + rawsize]
+        sections.append({
+            "name": name,
+            "entropy": _entropy(body),
+            "writable": bool(chars & 0x80000000),
+            "executable": bool(chars & 0x20000000),
+            "raw_size": rawsize,
+        })
+    return sections
+
+
+def inspect(path: str) -> dict:
+    data = Path(path).read_bytes()
+    sections = _parse_sections(data)
+    wx = [s["name"] for s in sections if s["writable"] and s["executable"]]
+    odd = [s["name"] for s in sections
+           if any(k in s["name"].lower() for k in KNOWN_PACKER_NAMES)]
+    high = [s["name"] for s in sections if s["entropy"] > 7.0]
+    return {
+        "sections": sections,
+        "write_execute_sections": wx,
+        "known_packer_section_names": odd,
+        "high_entropy_sections": high,
+        "likely_packed": bool(wx or odd or len(high) >= 1),
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Characterize a packed PE")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("inspect")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(inspect(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())