mandiant / mandiant/VM-Packages

DLest

Open
#194 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

:cyclone: FLARE-VM :grey_question: discussion :new: package
Dominant language
PowerShell
Stars
246
Forks
98
Avg merge
9h 30m
Merged PRs (30d)
7

Description

### Package Name

dlest

### Tool Name

DLest

### Package type

ZIP_EXE

### Tool's version number

1.0

### Category

Utilities

### Tool's authors

Jean-Pierre LESUEUR

### Tool's description

DLest is a new open-source tool for analysing and manipulating exported functions in PE files. It is efficient for processing large numbers of files and useful for developers and malware analysts.

### Download URL

https://github.com/DarkCoderSc/DLest/releases/tag/1-0

### Download SHA256 Hash

7f81163dfcc2e76b08eb3fedc4c5f812da58c84046da596b8f856b737e05233a

### Why is this tool a good addition?

DLest is a tool that can be used to analyze and manipulate exported functions in Portable Executable (PE) files, particularly dynamic link library (DLL) files. This can be useful for developers and malware analysts in a number of ways.

For developers, DLest can be a helpful tool for analyzing and manipulating exported functions in PE files as part of the development process. For example, a developer may use DLest to enumerate exported functions in a DLL file in order to understand how the DLL is intended to be used or to make changes to the exported functions.

For malware analysts, DLest can be a valuable tool for reverse engineering and incident response. By allowing the analysis of memory-loaded modules in real time, DLest allows malware analysts to analyze and manipulate exported functions in DLL files that may be loaded into memory as part of a malware attack. This can help analysts understand how the malware is functioning and potentially identify ways to mitigate the attack.

Overall, DLest can be a useful tool for anyone working with PE files, particularly DLL files, as it allows for the efficient and fast analysis and manipulation of exported functions. Its ability to analyze memory-loaded modules in real time makes it particularly useful for malware analysts.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue provides DLest's package metadata, release URL, and SHA256 hash, but names no files, tests, or entry points. Start by reviewing how existing ZIP_EXE submissions are represented in VM-Packages and compare this metadata with those entries. Done means DLest is represented consistently and its release archive matches the supplied hash.

Written by the indexing model from the issue text.

Assessment

Domain
reverse-engineering, tooling
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.