FileAlyzer - Revision history

CCRDude: added tutorials

2008-05-27T18:30:33Z

added tutorials

← Older revision		Revision as of 18:30, 27 May 2008
Line 42:		Line 42:
	* Functions to create adv. file parameters for detection by [[md5(version)\|version resources]]		* Functions to create adv. file parameters for detection by [[md5(version)\|version resources]]
	* Functions to create adv. file parameters for detection by [[authx509\|authenticode signatures]]		* Functions to create adv. file parameters for detection by [[authx509\|authenticode signatures]]


	===FoldAlyzer===		===FoldAlyzer===
Line 50:		Line 49:
	* Functions to create adv. file parameters for detection by [[md5(sections)\|PE sections]]		* Functions to create adv. file parameters for detection by [[md5(sections)\|PE sections]]
	* Functions to create adv. file parameters for detection by [[authx509\|authenticode signatures]]		* Functions to create adv. file parameters for detection by [[authx509\|authenticode signatures]]

			===Tutorials===
			* [[Choosing advanced file parameters]]

CCRDude: added screenshot

2008-05-27T18:21:39Z

added screenshot

← Older revision		Revision as of 18:21, 27 May 2008
Line 1:		Line 1:
			[[Image:FileAlyzer-intro-tab.png\|thumb\|300px\|General properties]]
	FileAlyzer is our file analysis tool, initially created as our internal helper in updating our detection database, published in a generalized version, and now, since version 1.6, improved with functions that do support [[OpenSBI]].		FileAlyzer is our file analysis tool, initially created as our internal helper in updating our detection database, published in a generalized version, and now, since version 1.6, improved with functions that do support [[OpenSBI]].

CCRDude: New page: FileAlyzer is our file analysis tool, initially created as our internal helper in updating our detection database, published in a generalized version, and now, since version 1.6, improved ...

2008-05-23T19:33:52Z

New page: FileAlyzer is our file analysis tool, initially created as our internal helper in updating our detection database, published in a generalized version, and now, since version 1.6, improved ...

New page

FileAlyzer is our file analysis tool, initially created as our internal helper in updating our detection database, published in a generalized version, and now, since version 1.6, improved with functions that do support [[OpenSBI]].

==Recognized contents==
* Generic file attributes, including CRC-32, MD5 and SHA-1 hashes ([[OpenSBI]] compatible export)
* File signatures
* Version resource (multilingual) ([[OpenSBI]] compatible export)
* Link destinations
* Authenticode signatures ([[OpenSBI]] compatible export)
* Resources ([[OpenSBI]] compatible export)
* Streams (including Alternate Data Streams)
* PE file headers
* PE file sections ([[OpenSBI]] compatible export)
* ELF file headers
* ELF file sections
* x86 code (shown disassembled)
* Import table
* Export tables ([[OpenSBI]] compatible export)
* Hex dump with pattern recognition (GUIDs, filenames, &c.)
* Image preview
* EXIF information
* Text preview
* INI file contents
* HTML preview
* Archive preview
* Database preview (dBase, CSV, Tab)
* ID3 tags (v1 and v2)
* RIFF structure (AVI containers)

Many of these sections might be improved by adding direct OpenSBI support as well in the future.

==OpenSBI==
===FileAlyzer===
FileAlyzer 1.6 adds the following features that are intended to help in creating and maintaining OpenSBI files:

* Functions to create OpenSBI [[Advanced file parameters|advanced file parameters]] for the current file
* Hash sums shown for resources
* Functions to create adv. file parameters for detection by [[md5(res)|resource]]
* Functions to create adv. file parameters for detection by [[md5(sections)|PE section]]
* Functions to create adv. file parameters for detection by [[md5(exports)|export table]]
* Functions to create adv. file parameters for detection by [[exists(export)|export function]]
* Functions to create adv. file parameters for detection by [[md5(version)|version resources]]
* Functions to create adv. file parameters for detection by [[authx509|authenticode signatures]]

===FoldAlyzer===
Similar functions have been added to the included FoldAlyzer application:

* Functions to create OpenSBI advanced file parameters for all selected files
* Functions to create adv. file parameters for detection by [[md5(sections)|PE sections]]
* Functions to create adv. file parameters for detection by [[authx509|authenticode signatures]]