# Advice on the PE Analyzer

**URL:** <https://community.zeek.org/t/advice-on-the-pe-analyzer/3841>\
**Category:** Development\
**Tags:** development\
**Created:** [September 21, 2015, 3:56pm UTC](https://community.zeek.org/t/advice-on-the-pe-analyzer/3841 "2015-09-21T15:56:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vlad\_Grigorescu1](https://avatars.discourse-cdn.com/v4/letter/v/f9ae1b/32.png) [@Vlad\_Grigorescu1](https://community.zeek.org/u/Vlad_Grigorescu1)\
**Post date:** [September 21, 2015, 3:56pm UTC](https://community.zeek.org/t/advice-on-the-pe-analyzer/3841/1 "2015-09-21T15:56:42Z")

</div>

For Bro 2.5, I’d like to add some more functionality to the Windows Portable Executable analyzer. I think there’s a lot of valuable data that could be extracted, but the format is rather challenging to work with. Some protocol pseudocode would be:

> 0000: import\_address\_table is at 0010  
> 0010: entry #1 is at 0030  
> 0020: entry #2 is at 0050  
> 0030: entry #1 address is at 0100  
> 0040: entry #1 name is at 0110  
> 0050: entry #2 address is at 0140  
> 0060: entry #2 name is at 0120

Much of the data is simply pointers to offsets in the file where the actual data resides. My thought for parsing this is to write two helper functions in C++:

> jump\_to\_next\_interesting\_offset()

> // Skips to the offset of the next thing I would like to parse

> get\_data\_context\_at\_current\_offset()

> // Get contextual information for how to parse the current data  
> // (e.g. this is the the address of entry #1 in the import address table).

Does anyone have suggestions for what data structures I should use to store the necessary data? Storing the offsets shouldn’t be very difficult, but each offset will need context associated with it in order to know how to parse it once the analyzer gets there, and how to associate the data residing there with data that’s already been parsed.

Thanks,

–Vlad

---

<div class="post-metadata">

**Author:** ![johanna](https://avatars.discourse-cdn.com/v4/letter/j/50afbb/32.png) [@johanna](https://community.zeek.org/u/johanna)\
**Post date:** [September 22, 2015, 8:25pm UTC](https://community.zeek.org/t/advice-on-the-pe-analyzer/3841/2 "2015-09-22T20:25:04Z")

</div>

> For Bro 2.5, I'd like to add some more functionality to the Windows  
> Portable Executable analyzer. I think there's a lot of valuable data that  
> could be extracted, but the format is rather challenging to work with. Some  
> protocol pseudocode would be:
> 
> \> 0000: import\_address\_table is at 0010  
> \> 0010: entry #1 is at 0030  
> \> 0020: entry #2 is at 0050  
> \> 0030: entry #1 address is at 0100  
> \> 0040: entry #1 name is at 0110  
> \> 0050: entry #2 address is at 0140  
> \> 0060: entry #2 name is at 0120
> 
> Much of the data is simply pointers to offsets in the file where the actual  
> data resides. My thought for parsing this is to write two helper functions  
> in C++:
> 
> \> jump\_to\_next\_interesting\_offset()  
> \> // Skips to the offset of the next thing I would like to parse
> 
> \> get\_data\_context\_at\_current\_offset()  
> \> // Get contextual information for how to parse the current data  
> \> // (e.g. this is the the address of entry #1 in the import address table).

I think this generally sounds like a sound approach. One thing that might  
help with this, if you are not already aware of this - it is a tad tricky  
to get binpac to use your file analyzer subclass of PE, instead of the  
base BroFileAnalyzer class - the SSL analyzer shows and example on how to  
get binpac to do this.

> Does anyone have suggestions for what data structures I should use to store  
> the necessary data? Storing the offsets shouldn't be very difficult, but  
> each offset will need context associated with it in order to know how to  
> parse it once the analyzer gets there, and how to associate the data  
> residing there with data that's already been parsed.

This might be a tad naive - but would a std::priorityqueue containing a  
class, that has the offset (which is used for sorting) as well as all the  
contextual information that you have to store make sense?

Generally - I think it would be really cool to have this feature in Bro 🙂

Johanna

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/advice-on-the-pe-analyzer/3841/3 "2022-05-06T15:43:06Z")

</div>