{"id":15713722,"url":"https://github.com/caustickirbyz/crystalpe","last_synced_at":"2026-07-03T15:31:32.883Z","repository":{"id":223326431,"uuid":"515377107","full_name":"CausticKirbyZ/CrystalPE","owner":"CausticKirbyZ","description":"Crystal Lang library for parsing of x64/x86 Windows PE files. ","archived":false,"fork":false,"pushed_at":"2024-02-19T16:27:52.000Z","size":2875,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-30T18:47:05.858Z","etag":null,"topics":["binary-analy","crystal","crystal-lang","crystal-language","malware","malware-analysis","parsing","pe","pe-file","pe-format","pe-parser","pefile","reverse-engineering"],"latest_commit_sha":null,"homepage":"","language":"Crystal","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/CausticKirbyZ.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-07-19T00:01:12.000Z","updated_at":"2024-02-19T15:14:20.000Z","dependencies_parsed_at":null,"dependency_job_id":"1b73f6de-6eb2-4c5d-926a-417185905b63","html_url":"https://github.com/CausticKirbyZ/CrystalPE","commit_stats":null,"previous_names":["caustickirbyz/crystalpe"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CausticKirbyZ%2FCrystalPE","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CausticKirbyZ%2FCrystalPE/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CausticKirbyZ%2FCrystalPE/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/CausticKirbyZ%2FCrystalPE/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/CausticKirbyZ","download_url":"https://codeload.github.com/CausticKirbyZ/CrystalPE/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246365640,"owners_count":20765546,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-analy","crystal","crystal-lang","crystal-language","malware","malware-analysis","parsing","pe","pe-file","pe-format","pe-parser","pefile","reverse-engineering"],"created_at":"2024-10-03T21:33:06.431Z","updated_at":"2026-07-03T15:31:32.815Z","avatar_url":"https://github.com/CausticKirbyZ.png","language":"Crystal","funding_links":[],"categories":[],"sub_categories":[],"readme":"# CrystalPE\n\nCrystalPE is a windows [PE](https://docs.microsoft.com/en-us/windows/win32/debug/pe-format) parsing library for Crystal. This shard is designed with the goal of malware analysis/research and threat hunting capabilities. The lilbrary supports both x86/64 pe files. \n\nSeveral executables are included in the \"demope\" folder. These were used for testing and can be built or downloaded for additional tests. \n\n## Installation\nAs with all crystal shards:\n1. Add the dependency to your `shard.yml`:\n\n   ```yaml\n   dependencies:\n     crystalpe:\n       github: CausticKirbyZ/CrystalPE\n   ```\n2. Run `shards install`\n\n\n## Usage\nExample of itterating through the strings in a pe file to identify a potential compiler used: \n```crystal\nrequire \"crystalpe\"\n\npefile = CrystalPE::PEFile.new( \"HelloWorld.exe\" )\npefile.strings().each do |str| \n    if str.includes? \"GCC\"\n        puts \"This file was likely compiled with GCC\" \n    end \nend \n```\n\n\n\n## Supports: \n### Parsing: \n- Basic PE Parsing.\n  - Dos Headers\n  - Dos Stub \n  - Rich headers\n  - nt/pe headers \n  - nt/pe optional headers \n  - data directories \n  - import table \n  - export table \n  - overlay(as a blob)\n\n### Info: \n- basic hashing functions ( md5, sha1, sha256, sha512 )\n- shannon entropy calculation \n\n\n### Modifying \n- PE Checksum fixing/modification. \n- Modification of headers. \n- writing files  back to disk without breaking execution. \n- Updating DOS Stubs. \n- inserting Rich header stubs (be careful with .net executables)\n\n\n## Some Support \n- .NET headers: basic parsing support but needs to be expanded and clarified. \n- section headers: these are parsed out as Byte chunks and need to be turned into classes to be easier to work with. \n\n## ToDo: \nAdd parsing/classes for: \n- Debug table \n- reloacations \n- security table \n- resource table \n- Add more .net calculations \n\nAdd validation functions for checksums and offsets.\n\nupdate the project to be more inline with crystal code guidelines.... yes im bad at things \n\ndocument more things.\n\n\n## Feature Requests/Bugs \nIf you have feature requests / bugs submit an issue or (even better) a pull request. \n\nif its a bug, please specify what it is, how you found it, and how it can be fixed(if you know).\n\nFor feature requests please describe in detail, the feature you want and the reason it should be in the core library. \n\n\n\n## Development\n\nTODO: Write development instructions here\n\n\n\n\n\n\n\n\n\n## Contributing\n\n1. Fork it ([https://github.com/your-github-user/crystalpe/fork](https://github.com/your-github-user/crystalpe/fork))\n2. Create your feature branch (`git checkout -b my-new-feature`)\n3. Commit your changes (`git commit -am 'Add some feature'`)\n4. Push to the branch (`git push origin my-new-feature`)\n5. Create a new Pull Request\n\n## Contributors\n\n- [CausticKirbyZ](https://github.com/CausticKirbyZ) - creator and maintainer\n\n\n## References: \n- While this project is not a direct port, the go [pe](https://github.com/saferwall/pe) package was refernced several times as i was writing this. \n- Microsofts [PE File](https://docs.microsoft.com/en-us/windows/win32/debug/pe-format) format docs. \n- [NTCore](https://ntcore.com) has a TON of documentation and breakdowns for various formats and pe structures. \n- ","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcaustickirbyz%2Fcrystalpe","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcaustickirbyz%2Fcrystalpe","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcaustickirbyz%2Fcrystalpe/lists"}