Lab 01 — PE/ELF Format Analyzer

Parse synthetic binary metadata, compute imphash, classify tooling type, and extract OPSEC indicators from header fields.

What it builds

A static-analysis engine that ingests a dict representation of PE or ELF binary metadata and produces a structured triage report: file type, architecture, imphash (for PE), export function names, and a list of OPSEC indicator flags (PDB path present, reflective export name, timestamp not zeroed, suspicious subsystem).

Why it matters

Binary format triage is the first step in any DFIR tooling analysis and in any engagement-tool OPSEC review. The import table and debug directory are observable without executing the binary. Understanding which fields matter — and which detection each maps to — is the literacy this lab builds.

Files

FilePurpose
lab.pyYour implementation — fill in the TODO stubs
solution.pyReference implementation — all tests pass
test_lab.pyAdversarial tests (run against both lab.py and solution.py)
requirements.txtpytest only — pure stdlib

Running

# Verify the reference passes all 14 tests:
LAB_MODULE=solution python3 -m pytest -q

# Run against your implementation after filling in the TODOs:
python3 -m pytest -q

API

analyze(meta: dict) -> dict
    # Returns: {file_type, imphash, exports, pdb_path, opsec_flags, architecture, subsystem}

compute_imphash(imports: list[tuple[str, str]]) -> str
    # imports: [(dll_name, func_name), ...]
    # Returns: MD5 hex of normalized comma-joined import list

extract_pdb_path(meta: dict) -> str | None

opsec_flags(meta: dict) -> list[str]
    # Returns zero or more flags from:
    # "pdb_path_present", "timestamp_not_zeroed", "reflective_export",
    # "empty_import_table", "unusual_subsystem"

classify_file_type(meta: dict) -> str
    # "PE32+" | "PE32" | "ELF64" | "ELF32" | "Unknown"