# Analyzing Rich Header And Compiler Artifacts

> Analyzes the PE Rich header and related compiler artifacts to fingerprint the build

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-rich-header-and-compiler-artifacts`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-rich-header-and-compiler-artifacts
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-rich-header-and-compiler-artifacts
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Rich Header and Compiler Artifacts

## When to Use

- You have a Windows PE and want to fingerprint its build toolchain (compiler/linker product IDs
  and build numbers) from the Rich header.
- You are clustering samples by toolchain or detecting Rich-header tampering/forgery.

**Do not use** the Rich header as definitive attribution — it can be copied or stripped. This skill
reads the PE statically and executes nothing.

## Prerequisites

- The PE sample (read inertly).

## Safety & Handling

- Read bytes statically; treat the sample as malicious data.

## Workflow

### Step 1: Parse and decode the Rich header

```bash
python scripts/analyst.py rich sample.exe
```

Locates the `Rich` marker, recovers the XOR key (the DWORD after `Rich`), decodes the `DanS`-
prefixed entries, and lists `(product_id, build_id, use_count)` tuples.

### Step 2: Fingerprint the toolchain

Map product IDs to compiler/linker products and build numbers to identify the Visual Studio
version(s) used.

### Step 3: Compute a clustering hash

Hash the decoded Rich entries to produce a toolchain fingerprint for grouping related samples.

### Step 4: Check for inconsistencies

Compare the Rich-derived linker version against the PE optional-header linker version; mismatches
suggest tampering or a copied header.

## Validation

- The XOR key correctly decodes the `DanS` signature at the start of the block.
- Decoded entries have plausible product IDs and use counts.
- The toolchain fingerprint is reproducible across identical builds.

## Pitfalls

- Samples with no Rich header (non-MSVC toolchains, stripped headers).
- Forged Rich headers copied from a benign binary.
- Confusing the Rich checksum/key handling and misdecoding entries.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the parser.
- PE format documentation (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-rich-header-and-compiler-artifacts
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.