iled PE Structure Parsing**: DOS Header, NT Headers (File Header, Optional Header), Data Directories, Section Table. * **Hashing**: MD5, SHA1, SHA256 for the full file and individual sections. Includes an integrated pure-Python **SSDeep** for fuzzy hashing. * **Import/Export Analysis**: Detailed listing of imported DLLs and functions (including delay-loaded imports) and exported functions. * **Resource Analysis**: Summary of embedded resources. * **Signature-Based Detection**: * **PEiD Signatures**: Matches packer/compiler signatures using `userdb.txt`. * **YARA Scanning**: If `yara-python` is installed and rule files are provided. * **Capability and String Analysis**: * **Capa**: If `flare-capa` is installed, it identifies program capabilities. * **FLOSS**: If `flare-floss` is installed, it performs advanced string extraction (static, stack, tight, and decoded). * **Other PE Features**: Rich Header decoding, Version Information, Digital Signatures, Debug Information (PDB paths), TLS Callbacks, Load Configuration, and more. * **String & Hex Utilities (CLI Mode)**: Options to extract strings, search for specific strings, and perform hex dumps are available as command-line flags. ## **CLI Mode Command-Line Usage** The primary mode for direct, command-line based analysis of a single PE file. **Full Usage:** ```bash python PeMCP.py --input-file [options] * `--input-file `: **(Required)** Path to the PE file to analyze. [cite: 24] * `-v, --verbose`: Enable more detailed output. [cite: 25] * `-d, --db `: Custom path to PEiD `userdb.txt`. [cite: 26] * `-y, --yara-rules `: Path to a YARA rule file or directory. [cite: 28] * `--capa-rules-dir `: Directory containing Capa rule files. [cite: 29] * `--capa-sigs-dir `: Directory for Capa library identification signature files. * `--skip-capa`: Skip Capa capability analysis entirely. [cite: 30] * `--skip-floss`: Skip FLOSS advanced string analysis entirely. * `--skip-full-peid-scan`: Limits PEiD scan to the entry point only. [cite: 31] #### **FLOSS Specific Options (CLI):** * `--floss-min-length `: Minimum string length for FLOSS. [cite: 863] * `--floss-format `: File format hint for FLOSS (e.g., `pe`, `sc32`, `sc64`). [cite: 864] * `--floss-no-static`, `--floss-no-stack`, etc.: Disable specific FLOSS string extraction methods. [cite: 874] * `--floss-only-static`, `--floss-only-stack`, etc.: Only run a specific FLOSS extraction method. [cite: 874] #### **String & Hex Utilities (CLI):** * `--extract-strings`: Enables string extraction from the entire file. [cite: 33, 891] * `--min-str-len `: Sets the minimum length for extracted strings (default: 5). [cite: 34, 891] * `--search-string "TEXT"`: Search for one or more specific ASCII strings. [cite: 36, 891] * `--hexdump-offset `: Hexadecimal or decimal offset to start a hex dump. [cite: 37, 891] * `--hexdump-length `: Number of bytes to dump. [cite: 38, 891] ``` *For a complete and current list of all command-line options, run:* ```bash python PeMCP.py --help ## **MCP Server Mode Operation** ``` When run with `--mcp-server`, the script pre-analyzes the specified input file and starts an MCP server, allowing programmatic access to analysis results via a rich set of tools. This mode is ideal for integration with other systems. * **Single File Focus**: The server pre-analyzes one PE file at startup, and all tool calls operate on this file's data. * **Comprehensive Tools**: A large set of tools is available to retrieve specific parts of the analysis (e.g., `get_sections_info`, `get_imports_info`), re-trigger analysis, search for strings, get hex dumps, and even query VirusTotal for the loaded file's hash. ## **How It Works (General Principles)** * **PE Analysis**: Primarily uses the `pefile` library for parsing PE structures. [cite: 92] Hashes are calculated using `hashlib` and the integrated `SSDeep` class. * **Signature Scanning**: Employs a custom parser for the `userdb.txt` format and applies regex-compiled sig

#malware-analysis

PeMCP

OLETools Secure MCP Server

MalwareBazaar_MCP