Implement peframe in r2

[radare]

Evaluate the list of checks from this tool and determine if we want/can have them in core or if they make more sense to be distributed in a separate script

https://github.com/guelfoweb/peframe

[Maijin]

We already have those features in r2core or r2-extras (yara). The behavior stuff shouldn't be in core imho. It's way too specialized for malware analysis and is very likely a matter of some yara rules.

[radare]

Ok i didnt checked but i thiugh we could get some ideas

…

On 18 Mar 2019, at 15:24, Maijin ***@***.***> wrote: We already have those features in r2core or r2-extras (yara). The behavior stuff shouldn't be in core imho. It's way too specialized for malware analysis and is very likely a matter of some yara rules. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[Maijin]

All the idea are already on #921 there is nothing new that what is already on our tracker :(

[Maijin]

Or that we already have.

[Maijin]

So I took some time today to evaluate and check what are the features of this tool.

After review there is nothing that we don't have already, already supported by Yara/Radare2 or already in the issue tracker.

The part related for the Macro analysis is irrelevant to radare2 or at least irrelevant for radare2 core for now.

I'm closing here