PE exception class

Class representing resource data

Structure representing message table string

Helper: finder of section* in sections list

Extract useful features from a PE file, and return as a vector of fixed size.

Extract useful features from a PE file, and return as a vector of fixed size.

Simple import directory rebuilder Class representing import rebuilder advanced settings

Portable executable class

Class representing resource data entry

Class representing image section

Section by file offset finder helper (4gb max)

r""" Black box detector that intends to mimic an antivirus/anti-Malware program that detects whether a specific program is either malware or

2d byte/entropy histogram based roughly on (Saxe and Berlin, 2015). This roughly approximates the joint probability of byte value and local entro

2d byte/entropy histogram based roughly on (Saxe and Berlin, 2015). This roughly approximates the joint probability of byte value and local entro

Byte histogram (normalized to sum to unity) over the entire binary file.

Byte histogram (normalized to sum to unity) over the entire binary file.

r""" MalGAN discriminator (substitute detector). Simple feed forward network.

Information about exported functions. Note that the total number of exported functions is contained in GeneralFileInfo.

General information about the file.

r""" MalGAN generator block

Machine, architecure, OS, linker and other information extracted from header.

Information about imported libraries and functions from the import address table. Note that the total number of imported functions is contai

r""" Malware Generative Adversarial Network based on the work of Hu & Tan.

r""" Encapsulates a malware dataset. All elements in the dataset will be either malware or benign

Information about section names, sizes and entropy. Uses hashing trick to summarize all this section info into a feature vector.

Extracts strings from raw byte stream

r""" Helper class used to visualize the computation graph

r""" Encapsulates either PyTorch DataLoaders or Datasets. This class is intended only for internal use by MalGAN.

Class representing basic .NET header information

Class representing bound import reference

Helper: sorts resource directory entries

Class representing exception directory entry

Structure representing fixed file version info

Class representing advanced misc (IMAGE_DEBUG_TYPE_MISC) info

Helper: sorts exported function list by ordinals

Class representing advanced NB10 (PDB 2.0) information

Class representing advanced RSDS (PDB 7.0) information

Class representing relocation entry RVA of relocation is not actually RVA, but (real RVA) - (RVA of table)

Forward declaration

Information about exported functions. Note that the total number of exported functions is contained in GeneralFileInfo.

Base class from which each feature type may inherit

Base class from which each feature type may inherit

General information about the file.

Machine, architecure, OS, linker and other information extracted from header.

Information about imported libraries and functions from the import address table. Note that the total number of imported functions is contai

r""" Label value assigned to malware and benign examples

directory structure The data in this structure is used to reference the data for each subsection of the CodeView Debug OMF information. Tables that a

directory information structure This structure contains the information describing the directory. It is pointed to by the signature at the base addres

CodeView Debug OMF signature. The signature at the end of the file is a negative offset from the end of the file to another signature. At the negativ

Information about section names, sizes and entropy. Uses hashing trick to summarize all this section info into a feature vector.

Extracts strings from raw byte stream

r""" Learner algorithm to be used by the black-box detector

Class representing image bound import information

Class representing COFF (IMAGE_DEBUG_TYPE_COFF) debug info

Structure representing CURSOR file header

Structure representing CURSOR directory entry inside CURSOR file

Class representing debug information

Class representing export information

Class representing exported function

Windows GUID structure

Structure representing ICON file header

Structure that is stored in icon group directory in PE resources

Structure representing ICON directory entry inside ICON file

Based relocation format ///