SalSA

SalSA copied to clipboard

Add support for `__str__`, `__repr__` and static class methods. Basically make this class more "pythonic"

a-rey

need to define custom exception for PE class instead of just catching all exceptions.

a-rey

Need to add unit test functionality.

a-rey

Timestamp filed doesn't always hold time stamp of the image. It could hold a hash value.

1

According to Microsoft the timestamp fields in the PE header could contain a hash instead of the actual build timestamp: https://msdn.microsoft.com/en-us/library/windows/desktop/ms680547(v=vs.85).aspx#debug_type

alexandrw

Resource tree walk to check for Microsoft spec compliance and interesting types/values. This will be a complex rule. Need some industry white-papers/research on this subject to give more guidance.

a-rey

Check each header for invalid values (detect tampering). This won't be easy and will probably require a rule per each unique header...

a-rey

Check for invalid data directory entries (not in a valid section) and alert on them.

a-rey

Need to add validation of certificates to `pe.py` functionality. Allows for rules to examine the signatures embedded inside the executable.

a-rey