NgoHuuLoc0612/PE-Visualizer
GitHub: NgoHuuLoc0612/PE-Visualizer
Stars: 2 | Forks: 0
# PE Visualizer v2.0
**Portable Executable (PE32/PE64) Static Analysis Platform**
A malware analysis and binary reverse engineering tool combining high-performance C++20 backend analysis with an intuitive Next.js/TypeScript frontend. Supports comprehensive PE parsing, x86/x64 disassembly, YARA scanning, entropy analysis, and anomaly detection.
## 📊 Project Statistics
| Metric | Value |
|--------|-------|
| **Total Files** | 31 |
| **Total Lines of Code** | 15,907 |
| **Frontend Files** | 15 |
| **Frontend Lines** | 11,457 |
| **Backend Files** | 16 |
| **Backend Lines** | 4,450 |
| **Frontend Language** | TypeScript/React (Next.js 14) |
| **Backend Language** | C++20 |
## 🏗️ Architecture
PE-Visualizer/
├── build.bat # Build automation script
├── README.md # Project documentation
│
├── frontend/ # Next.js 14 + TypeScript UI (11,457 LOC, 15 files)
│ ├── app/
│ │ ├── api/upload/route.ts # File upload API endpoint
│ │ ├── globals.css # Global styles
│ │ ├── layout.tsx # Root layout component
│ │ └── page.tsx # Main SPA application
│ ├── lib/
│ │ ├── api.ts # API client & utilities
│ │ ├── store.ts # Zustand state management
│ │ └── types.ts # TypeScript PE type definitions
│ ├── next.config.js # Next.js configuration
│ ├── package.json # Dependencies & scripts
│ ├── postcss.config.js # PostCSS configuration
│ ├── tailwind.config.ts # Tailwind CSS configuration
│ └── tsconfig.json # TypeScript configuration
│
└── server/ # C++20 High-Performance Backend (4,450 LOC, 16 files)
├── CMakeLists.txt # CMake build configuration
├── vcpkg.json # C++ dependency manifest
└── src/
├── main.cpp # Entry point & HTTP route handlers
├── pe_parser.hpp/.cpp # Comprehensive PE binary parser
├── disassembler.hpp/.cpp # x86/x64 disassembly engine (Zydis)
├── yara_scanner.hpp/.cpp # Threat intelligence rule engine
├── http_handler.hpp/.cpp # Boost.Beast HTTP server
├── anomaly_detector.cpp # Anomaly detection engine
├── entropy.cpp # Entropy calculation & analysis
├── string_extractor.cpp # String extraction & categorization
├── resource_parser.cpp # PE resource section parsing
└── rich_header.cpp # Rich header analysis
## ✨ Core Features
### 🔍 PE Parsing Engine
Complete PE32/PE64 binary analysis with 20+ sub-components:
| Component | Capabilities |
|-----------|--------------|
| **DOS Header** | Full IMAGE_DOS_HEADER extraction + stub analysis |
| **Rich Header** | XOR decryption, checksum validation, VS version detection (2002–2022) |
| **File Header** | Machine type, timestamp decoding, characteristics flags |
| **Optional Header** | PE32/PE64 detection, all standard fields, checksum validation |
| **Data Directories** | All 16 directory entries with RVA/size validation |
| **Sections** | RWX permissions, entropy metrics, MD5/SHA-256 hashing, anomaly detection |
| **Import Directory** | Full INT/IAT parsing, bound imports, ordinal resolution, API classification |
| **Delay Imports** | Attribute-based parsing, RVA/VA conversion, delay load tree |
| **Export Directory** | Function enumeration, forwarder detection, ordinal tracking |
| **Resources** | Recursive 3-level tree parsing, entropy/format analysis per resource |
| **Debug Directory** | PDB path extraction, GUID/age (CodeView RSDS), all debug types |
| **TLS Directory** | PE32/PE64 callback array enumeration |
| **Load Config** | CFG/SEH flags, /GS cookie detection, guard protection flags |
| **Exception Directory** | x64 RUNTIME_FUNCTION unwinding info |
| **Base Relocations** | Block-by-block parsing, relocation type decoding |
| **CLR/.NET Header** | Runtime version, managed code flags, entry point tokens |
| **Overlay Detection** | File tail analysis, entropy profiling, embedded file detection |
| **Hashing** | MD5, SHA-1, SHA-256 (OpenSSL), Import Hash (ImpHash) |
| **Signatures** | Authenticode certificate detection |
### 🎯 Anomaly Detection
15+ anomaly checks for malware identification:
- RWX sections (executable + writable)
- Entry point outside code sections
- Packed/suspicious sections (UPX, etc.)
- Anti-debug API imports
- Process injection patterns
- Suspicious registry access
- Network command & control patterns
- Unusual import chains
### 🔧 Disassembler (x86/x64)
- **Engine:** Zydis decoder library
- **Syntax:** Intel syntax with forced segment/size prefixes
- **Features:**
- Color-coded instruction classification (call, jmp, jcc, ret, nop, privileged, syscall, stack, mov)
- Branch target resolution with absolute address calculation
- Interactive navigation: click to follow calls/jumps
- Entry point auto-jump with configurable view
- RVA/size filtering
### 🛡️ YARA Threat Intelligence
Embedded detection engine with 14 rule categories:
- PE file structure validation
- Anti-debug API detection (IsDebuggerPresent, NtQueryInformationProcess, etc.)
- Process injection detection (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread)
- Network & C2 patterns (InternetOpenUrl, WSAConnect, WinHttp)
- Packer signatures (UPX, MPRESS, ASPack, VMProtect, Themida)
- Shellcode patterns (PEB access, Metasploit stagers)
- Cryptographic constants (AES S-box, SHA-256 init, RC4/RSA strings)
- Process hollowing sequences
- Credential harvesting & keyloggers
- Embedded/dropper PE detection
- Persistence registry keys
- PowerShell/script execution
- Custom rule support via web UI
- Per-match string location preview with hex/ASCII dump
### 📊 Entropy Analysis
- Block-by-block entropy calculation (256-byte chunks)
- Section-level entropy metrics
- Visual entropy map with area charts
- Packed/compressed section detection
### 🔎 String Extraction
- ASCII + UTF-16LE extraction
- Automatic categorization:
- URLs & domains
- IP addresses (IPv4/IPv6)
- Registry keys
- Email addresses
- File paths
- Paginated browser with search/filtering
## 🎨 Frontend UI Components
| Panel | Description |
|-------|-------------|
| **Overview** | Executive summary: file hashes, PE badges, security features grid, section entropy bar chart, security profile radar, anomaly summary |
| **Headers** | Tabbed view: DOS, Rich, File, Optional headers + all data directories |
| **Sections** | Table view with RWX flags, entropy bars, hashes, quick-launch disassembler/hex views |
| **Imports** | Collapsible DLL tree with function list, bound import detection, search |
| **Exports** | Directory metadata, searchable function table, forwarder analysis |
| **Resources** | Recursive tree view, per-resource entropy metrics, format detection |
| **Disassembler** | Full listing with color-coded instructions, branch following, entry point navigation |
| **Hex View** | 16-byte-wide hex dump with ASCII column, RVA-based navigation |
| **Strings** | Paginated display, category filters, encoding toggles, search functionality |
| **YARA Matches** | Built-in rules + custom rule editor, match details with string locations |
| **Anomalies** | Severity-filtered alerts with category badges and descriptions |
| **Entropy Map** | Visual area chart (256-byte blocks) + section entropy overlay |
| **Debug Info** | All debug entries: PDB path, GUID, age, debug type catalog |
## 🚀 Getting Started
### Requirements
- **Backend:** C++20, CMake 3.20+, vcpkg, Boost, OpenSSL, Zydis
- **Frontend:** Node.js 18+, npm/yarn
### Build & Run
# Execute build script
./build.bat
# Or manual backend build
cd server && cmake -B build && cmake --build build --config Release
# Frontend development
cd frontend && npm install && npm run dev
## 📦 Technology Stack
### Backend
- **Language:** C++20
- **HTTP Server:** Boost.Beast
- **PE Parsing:** Custom implementation
- **Disassembly:** Zydis library
- **Threat Scanning:** YARA engine
- **Cryptography:** OpenSSL
### Frontend
- **Framework:** Next.js 14
- **Language:** TypeScript
- **Styling:** Tailwind CSS
- **State:** Zustand
- **Visualization:** Recharts
- **UI:** Custom React components
## 📝 License & Attribution
Comprehensive binary analysis platform built with precision and professional-grade tooling for security researchers, malware analysts, and reverse engineers.
| **TLS** | Directory fields + callback address list |
| **Load Config** | CFG/SEH/Cookie flags, guard flags decoded |
| **.NET CLR** | Runtime version, flags |
| **Overlay** | Offset, size, entropy, format, hex preview |
| **Relocations** | Block table: VA, size, entry count |
| **Signature** | Signed/verified status |
## Build & Run
### Prerequisites
**Backend (Windows with MSVC or MinGW, or cross-compile):**
- CMake 3.20+
- Boost 1.82+ (system, filesystem)
- OpenSSL 3.x
- nlohmann/json 3.11+
- YARA 4.4+ (libyara)
- Zydis 4.x
- C++20 compiler (MSVC 19.29+ / GCC 12+ / Clang 15+)
**Frontend:**
- Node.js 18+
- npm / yarn
### Backend Build
cd server
# Configure (example with vcpkg)
cmake -B build \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_TOOLCHAIN_FILE=$VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake \
-DVCPKG_TARGET_TRIPLET=x64-windows
cmake --build build --config Release
# Run
./build/Release/pe_server.exe --host 127.0.0.1 --port 8765 --threads 8
**vcpkg packages to install:**
vcpkg install boost-beast boost-asio boost-filesystem openssl nlohmann-json yara zydis
**Linux/macOS (cross-compile for Windows analysis):**
sudo apt install libboost-all-dev libssl-dev libyara-dev
# Zydis: cmake install from https://github.com/zyantific/zydis
### Frontend
cd frontend
npm install
npm run dev # Development: http://localhost:3000
npm run build && npm start # Production
## API Reference
All endpoints return `application/json`. CORS is fully open for development.
| Method | Endpoint | Description |
|--------|----------|-------------|
| `POST` | `/api/upload` | Upload PE file (base64), returns `session_id` |
| `GET` | `/api/analyze?session=ID` | Full PE analysis JSON |
| `GET` | `/api/disasm?session=ID&rva=N&size=N&max=N` | Disassemble at RVA |
| `GET` | `/api/hexdump?session=ID&rva=N&size=N` | Hex dump rows |
| `POST` | `/api/yara` | `{session, rules}` — YARA scan |
| `GET` | `/api/strings?session=ID&filter=CAT&q=QUERY&limit=N&offset=N` | Extracted strings |
| `GET` | `/api/section_data?session=ID&name=.text` | Raw section hex |
| `GET` | `/api/entropy_map?session=ID` | Block + section entropy |
| `GET` | `/api/sessions` | List all sessions |
| `DELETE` | `/api/session?id=ID` | Delete session |
| `GET` | `/health` | Server health check |
### Upload Request
{
"filename": "malware.exe",
"data": ""
}
### Upload Response
{
"session_id": "1a2b3c4d5e6f7a8b",
"filename": "malware.exe",
"file_size": 102400,
"pe_type": "EXE",
"valid": true
}
## Anomaly Detection Rules
| Rule | Severity | Description |
|------|----------|-------------|
| Zero timestamp | MEDIUM | TimeDateStamp stripped |
| Implausible timestamp | HIGH | Far-future date |
| RWX section | HIGH | Writable + executable |
| High section entropy | MEDIUM | >7.0 bits |
| Raw data beyond EOF | HIGH | Malformed PE |
| EP in non-executable section | HIGH | Packer indicator |
| EP outside all sections | CRITICAL | Shellcode/stub |
| No imports | HIGH | Packed/obfuscated |
| Very few imports | MEDIUM | Possibly packed |
| TLS callbacks | MEDIUM | Pre-EP execution |
| No Rich header | LOW | Non-MSVC tool |
| Invalid checksum | MEDIUM | Post-build modification |
| Overlay data | MEDIUM/HIGH | Appended payload |
| High file entropy | MEDIUM | >7.2 bits |
| Suspicious APIs | MEDIUM | Injection/anti-debug APIs found |
## Session Management
Sessions are held in-memory on the server with no disk writes. Each session stores:
- Raw file bytes
- Parsed PE structure
- Pre-computed JSON response
Sessions persist until explicitly deleted or server restart. Max recommended concurrent sessions: ~20 (RAM-dependent).
## Security Note
## Technology Stack
| Layer | Technology |
|-------|-----------|
| Backend language | C++20 |
| HTTP server | Boost.Beast 1.82 |
| PE parsing | Custom (windows.h / winnt.h structs) |
| Disassembler | Zydis 4.x |
| YARA | libyara 4.4 |
| Hashing | OpenSSL 3.x (MD5/SHA1/SHA256) |
| JSON | nlohmann/json 3.11 |
| Frontend framework | Next.js 14 (App Router) |
| Language | TypeScript 5 |
| State management | Zustand |
| UI components | shadcn/ui + Radix UI |
| Charts | Recharts |
| Animations | Framer Motion |
| Styling | Tailwind CSS |
| Data fetching | Axios + SWR |
| File upload | react-dropzone |
## LICENSE
MIT