Repository navigation
Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export Enhancement #40
Description
Overview
Version 0.2 aims to significantly enhance Stringy's capability to extract meaningful strings from binaries by adding three critical features that complement the existing format detection and section parsing infrastructure.
Goals
This epic tracks the implementation of three interconnected features that will make Stringy more effective at extracting actionable intelligence from binaries:
1. PE Resources Extraction
Context: Windows PE executables contain resource sections with rich metadata including version info, manifests, dialog boxes, menus, and embedded strings that are currently not being extracted.
Proposed Solution:
- Extend the PE container parser (
src/container/pe.rs) to parse resource directories - Extract strings from:
- Version information (product name, company, file description)
- Manifest files (embedded XML)
- String tables (STRINGTABLE resources)
- Dialog and menu definitions
- Tag extracted strings with
pe-resource,version-info,manifestsemantic tags - Assign high scores to version/manifest strings (they're highly relevant)
Acceptance Criteria:
- Parse PE resource directory structure
- Extract version info fields (FileDescription, ProductName, CompanyName, etc.)
- Extract manifest XML strings
- Handle STRINGTABLE resources
- Add appropriate semantic tagging
- Include resource strings in scoring/ranking system
2. Rust Symbol Demangling
Context: The project already has rustc-demangle as a dependency and mentions Rust demangling in the README, but full integration into the extraction pipeline is needed.
Proposed Solution:
- Integrate
rustc-demangleinto the symbol processing pipeline - Demangle Rust symbols found in:
- Import/export tables
- Symbol tables (.symtab, .dynsym for ELF)
- Debug sections (if present)
- Store both mangled and demangled versions for context
- Add
rust-symbolsemantic tag - Prioritize demangled symbols in ranking (more human-readable = more useful)
Acceptance Criteria:
- Detect Rust mangled symbols (_ZN prefix pattern)
- Apply rustc-demangle to detected symbols
- Include demangled names in output alongside mangled versions
- Add semantic tagging for Rust symbols
- Update scoring to favor demangled symbols
- Handle demangle failures gracefully
3. Import/Export Names Enhancement
Context: The container parsers already extract import/export symbols (foundation exists), but they need to be fully integrated into the string extraction and ranking pipeline.
Proposed Solution:
- Complete integration of import/export extraction across all formats:
- ELF: .dynsym, .symtab sections
- PE: Import Directory Table, Export Address Table
- Mach-O: LC_DYLD_INFO_ONLY, symbol table
- Add semantic classification:
- Tag with
import,export,symbol-name - Detect API categories (crypto, network, file I/O)
- Identify suspicious or high-value API calls
- Tag with
- Integrate into ranking system with adjustable scores
- Support filtering by import/export in CLI
Acceptance Criteria:
- Extract import names from all three binary formats
- Extract export names from all three binary formats
- Add semantic tags for symbol types and API categories
- Integrate into main string extraction pipeline
- Include in scoring/ranking algorithm
- Add CLI flags:
--imports,--exports,--symbols - Test with real-world binaries (ELF, PE, Mach-O)
Dependencies
- goblin: Already in use for binary format parsing
- rustc-demangle: Already in dependencies
- No new external dependencies required
Implementation Order
Recommended sequence to minimize integration complexity:
- Import/Export Enhancement (foundational) - builds on existing container parsers
- Rust Symbol Demangling (depends on Implement Intelligent ELF Section Classification for Targeted String Extraction #1) - enhances symbol processing
- PE Resources (independent) - can be developed in parallel
Testing Strategy
- Unit tests for each parser component
- Integration tests with real-world binaries:
- Windows executables with resources (e.g., notepad.exe, calc.exe)
- Rust binaries (cargo-built executables)
- Stripped and unstripped ELF/Mach-O binaries
- Regression tests to ensure existing functionality remains intact
Success Metrics
- PE resource strings successfully extracted from Windows executables
- Rust symbols properly demangled and categorized
- Import/export tables fully integrated across all formats
- No performance degradation on large binaries
- Improved signal-to-noise ratio in output
Activity
unclesp1d3r commentedon Sep 30, 2025
@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.
[-]Epic: v0.2[/-][+]Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export Enhancement[/+]coderabbitai commentedon Sep 30, 2025
Tip
For best results, initiate chat on the files or code changes.
🧩 Analysis chain
🏁 Script executed:
Length of output: 206
🏁 Script executed:
Length of output: 6511
🏁 Script executed:
Length of output: 228
@unclesp1d3r I've successfully enhanced issue #40! Here's what was updated:
Changes Made:
✅ Improved Title:
Epic: v0.2Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export Enhancement✅ Enhanced Body with:
✅ Labels Added:
enhancement,epic✅ Assigned to: unclesp1d3r
The issue now provides clear context about how these features build on StringyMcStringFace's existing infrastructure and why they're important for v0.2. Each feature has actionable acceptance criteria that can be tracked as the work progresses.
You can view the updated issue here: #40
unclesp1d3r commentedon Nov 10, 2025
@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.
coderabbitai commentedon Nov 10, 2025
Tip
For best results, initiate chat on the files or code changes.
🧩 Analysis chain
🏁 Script executed:
Length of output: 5630
@unclesp1d3r It looks like issue #40 has already been fully enhanced! Here's the current state:
✅ Current Status:
Title:
Epic: v0.2 - PE Resources, Symbol Demangling & Import/Export EnhancementLabels:
enhancementepicAssignee: unclesp1d3r
Body: Comprehensive epic description including:
The issue is ready to track the v0.2 epic work! You can view it here: #40
Is there anything specific you'd like me to modify or add to the issue?
1 remaining item
unclesp1d3r commentedon Jul 5, 2026
Verification: all three v0.2 features are implemented -- closing as completed
A code audit against this epic's acceptance criteria confirms every feature is delivered. All child issues (#56, #57, #58, #59, plus #63) are already closed as completed; this umbrella was the only remaining open item.
Feature 1 - PE Resources: DONE
src/extraction/pe_resources(viapelite), wired intosrc/container/pe/mod.rs:339.rsrcsection weight 9.0; tagsVersion,Manifest,Resource,VersionInfo,StringTablesrc/classification/ranking.rs:133-135)Feature 2 - Symbol Demangling: DONE (exceeds scope)
src/classification/symbols/mod.rsdemangles Rust (rustc_demangle), C++ (cpp_demangle), and MSVC (msvc_demangler)Tag::DemangledSymbol, ranking boost 25; gracefulOption-based failure handlingFeature 3 - Import/Export Enhancement: DONE (one intentional deviation)
elf/mod.rs:87,258,pe/mod.rs:185,220,macho/mod.rs:125,153Crypto/Network/FileIO; ranking boosts Import=60, Export=60, Crypto=50, Network=45, FileIO=35--imports/--exports/--symbolsCLI flags were intentionally replaced by the generic tag filter:--only-tags Import,--only-tags Export,--only-tags DemangledSymbol. This satisfies the underlying need without three redundant boolean flags and matches the project's tag-filtering design.Delivered across PRs #66 (PE support + resources), #174 (import/export pipeline), and #141 (v1.0).
Note: the doc links in the issue body point to the old
StringyMcStringFacerepo name; current repo isEvilBit-Labs/Stringy.If the convenience CLI aliases are still wanted, a small standalone issue is the right home rather than reopening this 21-point epic.
unclesp1d3r commentedon Jul 5, 2026
Correction: reopening -- Feature 1 (PE Resources) is NOT wired into the live pipeline
My previous comment closed this as completed. That was wrong for Feature 1, and a deeper audit (including running the built binary against a resource fixture) caught it. Reopening.
What's actually true: the PE resource parsing logic is fully written and unit-tested in isolation, but the function that emits resource strings,
extract_resource_strings()(src/extraction/pe_resources/mod.rs:217), is never called from the extraction pipeline. Its only references are its own definition, doc comments, the re-export insrc/extraction/mod.rs:146, and one integration test -- there are zero call sites insrc/pipeline/orsrc/extraction/basic_extractor.rs. The PE parser only populatesContainerInfo.resources(Phase-1 metadata: type/language/size), and nothing downstream reads that field.Net effect:
stringy --only-tags version|manifest|resource <pe-with-resources>returns nothing. The +40 ranking boosts for Version/Manifest/Resource (ranking.rs:133-135) never fire because no such strings reach ranking.Remaining task (single, well-scoped): call
extract_resource_strings(data)fromcollect_all_strings()insrc/extraction/basic_extractor.rs(or from the pipeline) and merge the results into the dedup/classification/ranking flow, so Version/Manifest/Resource-tagged strings actually reach output. Dialog/menu resource parsing remains unimplemented (self-documented atpe_resources/mod.rs:39) and can stay out of scope.Unaffected -- these two are genuinely done and were verified end-to-end:
DemangledSymboltag, +25 ranking boost, graceful failure handling.--imports/--exports/--symbolsflags (filterable today via--only-tags); tracked separately.Apologies for the premature close.
feat(cli): add --imports/--exports/--symbols convenience flags (#209)