65 lines
2.1 KiB
Python
Executable File
65 lines
2.1 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Identify a .NET/managed assembly and surface basic CLR metadata signals.
|
|
|
|
Parses the PE far enough to detect the COM descriptor (CLR) data directory and searches for
|
|
the ``BSJB`` metadata-root signature. Static parsing only; the sample is never executed.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import struct
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
|
|
def identify(path: str) -> dict:
|
|
data = Path(path).read_bytes()
|
|
result = {"managed": False, "bsjb_metadata": False, "notes": []}
|
|
|
|
if data[:2] != b"MZ":
|
|
result["notes"].append("not a PE (no MZ)")
|
|
return result
|
|
|
|
e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
|
|
if data[e_lfanew:e_lfanew + 4] != b"PE\x00\x00":
|
|
result["notes"].append("no PE signature")
|
|
return result
|
|
|
|
coff = e_lfanew + 4
|
|
opt = coff + 20
|
|
magic = struct.unpack_from("<H", data, opt)[0]
|
|
pe32_plus = magic == 0x20B
|
|
# data directories start after the standard+windows optional header fields
|
|
dd_offset = opt + (112 if pe32_plus else 96)
|
|
# COM descriptor is data directory index 14
|
|
com_dir = dd_offset + 14 * 8
|
|
rva, size = struct.unpack_from("<II", data, com_dir)
|
|
if rva and size:
|
|
result["managed"] = True
|
|
result["notes"].append("CLR runtime header (COM descriptor) present")
|
|
|
|
if b"BSJB" in data:
|
|
result["bsjb_metadata"] = True
|
|
result["notes"].append("BSJB metadata root signature found")
|
|
|
|
if b"mscoree.dll" in data or b"_CorExeMain" in data:
|
|
result["notes"].append("mscoree / _CorExeMain reference")
|
|
|
|
result["managed"] = result["managed"] or result["bsjb_metadata"]
|
|
return result
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(description="Identify managed .NET assembly")
|
|
sub = parser.add_subparsers(dest="cmd", required=True)
|
|
p = sub.add_parser("identify")
|
|
p.add_argument("file")
|
|
args = parser.parse_args(argv)
|
|
print(json.dumps(identify(args.file), indent=2))
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|