I designed a 99‑fixture adversarial PE corpus, where each binary contains one controlled corruption pattern with full ground‑truth metadata. The goal was to answer a simple question:
How do PE tools behave when the binary stops playing by the rules?
The fixtures cover 8 anomaly classes:
- entrypoint manipulation
- section‑table corruption
- Optional Header inconsistencies
- directory contradictions
- TLS anomalies
- resource‑tree recursion
- Authenticode corruption
- entropy edge cases
I tested 6 tools representing the major parsing philosophies:
- IOCX
- Ghidra
- Detect It Easy
- radare2
- PEview
- CFF Explorer
The results were eye‑opening:
- Literal tools (r2, PEview) preserved bytes but gave no warnings
- Semantic tools (CFF) silently normalised corruption
- Heuristic tools (DIE) ignored structure entirely
- Reconstructive loaders (Ghidra) rewrote metadata, omitted fields, and crashed on entropy fixtures
- Hybrid literal‑semantic tools (IOCX) preserved raw metadata and surfaced anomalies explicitly
Full write-up:
The Adversarial PE Analysis Series, Part 1 — Why PE Parsers Break
Corpus and fixture spec: https://github.com/iocx-dev/iocx
(fixtures are under /tests/contract/fixtures/layer3_adversarial)
[link] [comments]
SOCIAL SHARE CARD GENERATOR