PE Stripper API — Bruno 手动测试指南

快速准备

建议先把测试样本 QQ.exe 放到本机某个固定目录，再执行以下初始化命令。后文所有 curl 命令均基于这些变量展开，复制后即可运行。

BASE_URL="http://192.168.99.220:8080"
FILE="./QQ.exe"
OUT_DIR="./out"
mkdir -p "$OUT_DIR"

Bruno Collection Setup

用途：健康检查。用于确认后端 HTTP 服务已启动并能正常返回 JSON。

curl -sS "$BASE_URL/health"

{
  "status": "ok"
}

用途：legacy 检测接口。上传 PE 文件，返回检测报告，适合快速确认样本包含哪些可疑元数据、PDB、版本信息、静态网络指标等。

curl -sS -X POST \
  -F "file=@$FILE" \
  "$BASE_URL/detect"

{
  "filename": "tmpxxxx.exe",
  "timestamp": "2022-01-15T09:44:12+00:00",
  "pdb_path": "D:\\devops\\workspace\\...\\QQ.pdb",
  "rich_header": { "raw": "...", "entries": [ ... ], "valid": true },
  "has_signature": false,
  "version_info": {
    "CompanyName": "Tencent",
    "FileDescription": "腾讯QQ",
    "FileVersion": "9.5.6.28129",
    "ProductName": "腾讯QQ",
    "ProductVersion": "9.5.6.28129"
  },
  "section_names": [".text", ".rdata", ".data", ".rsrc", ".reloc"],
  "static_ips": [],
  "static_domains": [],
  "static_urls": []
}

用途：legacy 一键清除接口。直接返回处理后的二进制文件，适合验证“全量清除”链路。

curl -sS -X POST \
  -F "file=@$FILE" \
  "$BASE_URL/strip" \
  -o "$OUT_DIR/QQ.cleaned.legacy.exe"

curl -sS -D - -o /dev/null -X POST \
  -F "file=@$FILE" \
  "$BASE_URL/strip"

HTTP/1.1 200 OK
content-disposition: attachment; filename="QQ.cleaned.exe"
content-type: application/octet-stream

用途：legacy 基本信息摘要接口。返回比 /detect 更精简的结果，适合做快速巡检。

curl -sS -X POST \
  -F "file=@$FILE" \
  "$BASE_URL/info"

{
  "filename": "tmpxxxx.exe",
  "timestamp": "2022-01-15T09:44:12+00:00",
  "sections": [".text", ".rdata", ".data", ".rsrc", ".reloc"],
  "has_signature": false,
  "has_rich_header": true,
  "pdb_path": "D:\\devops\\workspace\\...\\QQ.pdb",
  "static_ips": 0,
  "static_domains": 0,
  "static_urls": 0
}

用途：前端兼容检测接口。该接口是手工联调的核心入口，返回统一的 envelope，并把结果按 identity_trace、group_trace、control_trace 等分类。

curl -sS -X POST \
  -F "file=@$FILE" \
  -F "file_type=1" \
  -F "file_path=QQ.exe" \
  "$BASE_URL/api/v1/trace"

{
  "code": 0,
  "message": "success",
  "data": {
    "basic_info": {
      "file_size": 73288,
      "file_md5": "3a66e40ad49e7cb8ff0aa2aeffb40405",
      "file_name": "QQ.exe",
      "file_description": "QQ.exe",
      "trace_clear_count": 7,
      "file_format_name": "BinExecute/Microsoft.EXE[:X86]"
    },
    "trace_info": {
      "identity_trace": [
        {
          "trace_description": "编译时间戳",
          "value": "2022-01-15T09:44:12+00:00",
          "offset_start": 288,
          "offset_end": 292,
          "size": 4
        },
        {
          "trace_description": "PDB路径",
          "value": "D:\\devops\\workspace\\...\\QQ.pdb",
          "offset_start": 14572,
          "offset_end": 14650,
          "size": 78
        }
      ],
      "group_trace": [
        { "trace_description": "公司信息", "value": "Tencent", "offset_start": 57952, "offset_end": 57966 },
        { "trace_description": "产品信息", "value": "腾讯QQ", "offset_start": 58008, "offset_end": 58016 },
        { "trace_description": "文件版本信息", "value": "9.5.6.28129", "offset_start": 58052, "offset_end": 58074 },
        { "trace_description": "产品版本信息", "value": "9.5.6.28129", "offset_start": 58052, "offset_end": 58074 },
        { "trace_description": "资源语言", "value": "080404b0", "offset_start": 0, "offset_end": 0 }
      ],
      "control_trace": []
    }
  }
}

用途：前端兼容定向清除接口。根据 clear_info 中给出的偏移与替换规则，对指定痕迹做定点清除或替换；成功返回二进制文件流。

推荐联调步骤

1. 先请求 /api/v1/trace。
2. 复制一到多个带偏移的 trace 项。
3. 构造 clear_info，回传给 /api/v1/trace/clear。
4. 保存返回的二进制，再重新调用 /api/v1/trace 或 /detect 比对效果。

curl -sS -X POST \
  -F "file=@$FILE" \
  -F "file_type=1" \
  -F "file_md5=3a66e40ad49e7cb8ff0aa2aeffb40405" \
  -F 'clear_info=[{"checked":true,"clear_start":288,"clear_end":292,"clear_size":4,"clear_type":2,"clear_replace":"","trace_description":"编译时间戳"},{"checked":true,"clear_start":14572,"clear_end":14650,"clear_size":78,"clear_type":2,"clear_replace":"","trace_description":"PDB路径"}]' \
  "$BASE_URL/api/v1/trace/clear" \
  -o "$OUT_DIR/QQ.cleaned.targeted.exe"

curl -sS -D - -o /dev/null -X POST \
  -F "file=@$FILE" \
  -F "file_type=1" \
  -F "file_md5=3a66e40ad49e7cb8ff0aa2aeffb40405" \
  -F 'clear_info=[{"checked":true,"clear_start":288,"clear_end":292,"clear_size":4,"clear_type":2,"clear_replace":"","trace_description":"编译时间戳"}]' \
  "$BASE_URL/api/v1/trace/clear"

HTTP/1.1 200 OK
content-disposition: attachment; filename="QQ.cleaned.exe"
content-type: application/octet-stream

{
  "code": 1,
  "message": "invalid_clear_info: ...",
  "data": null
}

用途：检测并替换一体化接口。上传样本后，服务端先自动识别可替换项，再按表单字段执行 zero-fill 或定值替换，最后返回修改后的二进制文件。

curl -sS -X POST \
  -F "file=@$FILE" \
  -F "file_type=1" \
  -F "file_path=QQ.exe" \
  -F "replace_timestamp=2024-01-02T03:04:05+00:00" \
  -F "replace_pdb=zero" \
  -F "replace_company=zero" \
  -F "replace_product_name=PE Stripper Demo" \
  -F "replace_file_version=1.0.0.0" \
  -F "replace_product_version=1.0.0.0" \
  -F "replace_original_filename=demo.exe" \
  "$BASE_URL/api/v1/trace/replace" \
  -o "$OUT_DIR/QQ.replaced.exe"

curl -sS -D - -o /dev/null -X POST \
  -F "file=@$FILE" \
  -F "file_type=1" \
  -F "file_path=QQ.exe" \
  -F "replace_timestamp=1710000000" \
  -F "replace_company=zero" \
  "$BASE_URL/api/v1/trace/replace"

HTTP/1.1 200 OK
content-disposition: attachment; filename="QQ.replaced.exe"
content-type: application/octet-stream

测试用例

下表可直接作为 Bruno 手工回归清单。建议至少覆盖成功路径、典型错误路径以及前端真实链路三大类。

附：建议的 Bruno 请求命名

01 Health Check
02 Detect Legacy
03 Strip Legacy Download
04 Info Summary
05 Trace Detect Frontend
06 Trace Clear Targeted
07 Trace Replace One-shot
08 Trace Invalid File Type
09 Trace Clear Invalid clear_info
10 Replace Invalid Timestamp