https://github.com/dosx-dev/zeus-file-identifier
A signature engine that makes it possible to recognize a file type based on a template. Can be used by antiviruses
https://github.com/dosx-dev/zeus-file-identifier
analysis detect-it-easy file identifier linux signature type windows zeus
Last synced: 10 months ago
JSON representation
A signature engine that makes it possible to recognize a file type based on a template. Can be used by antiviruses
- Host: GitHub
- URL: https://github.com/dosx-dev/zeus-file-identifier
- Owner: DosX-dev
- License: mit
- Created: 2024-01-03T16:10:10.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2024-02-12T18:58:06.000Z (about 2 years ago)
- Last Synced: 2025-05-07T04:58:25.352Z (10 months ago)
- Topics: analysis, detect-it-easy, file, identifier, linux, signature, type, windows, zeus
- Language: Visual Basic .NET
- Homepage: https://dosx.su
- Size: 46.9 KB
- Stars: 43
- Watchers: 2
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# 🔮 Zeus File Identifier (ZFI)
This program is designed to determine the file type using signatures according to certain rules. Can be used by antiviruses.
## 📑 About
This console program takes an argument `--file` which specifies the path to the file that needs to be examined. The output will contain the resulting format, description and some technical data (for example, the presence of compressed entropy data)
## 💼 Database rules format
```
{STRING_NAME}|{STRING_FILE_TYPE}|{STRING_DESCRIPTION}|{MASK_SIGNATURE}
```
* Use ".."/"??" to indicate an unknown byte (like "0000..29..11...00")
* Use the ' character to wrap an ASCII string (like "000000'String in the file!'000029")
The signature is read only from the beginning of the file.
Example of rule:
```
Lua Bytecode|Script|Lua machine code|1B'Lua'..00
```
## 🐧 Run on Linux
Use the `mono-complete` package to use the program on Linux:
```
mono Zeus_File_Identifier.app --file "application.exe"
```
## ✨ What about...
[Detect It Easy](https://github.com/horsicq/DIE-engine) will soon support Zeus File Identifier formats