From 08533f3ee29144f8dbb03bb88ae07f03a6efd4a7 Mon Sep 17 00:00:00 2001 From: venus Date: Sat, 18 Jul 2026 03:10:17 -0500 Subject: [PATCH] [GEMINI] Record future metadata parsing features in status roadmap and architecture documentation --- ARCHITECTURE.md | 6 ++++++ project_status.md | 8 +++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md index 411c7df..754a600 100644 --- a/ARCHITECTURE.md +++ b/ARCHITECTURE.md @@ -74,6 +74,12 @@ Implements specialized forensic inspection utilities registered as a nested subg ### A. Forensics Pipeline & Extended Metadata * **Pipeline Coordination**: A central runner that coordinates file inspections, signature verification, and string searches sequentially on target files. * **Carving & Extraction Toolkit**: Deep inspection and carving utilities (such as archive extracting, custom chunk/payload carvers, and EXIF/metadata header decoders). +* **Targeted Forensic Metadata Parsing**: Implement decoders/parsers for high-signal forensics structures: + * *PNG*: `tEXt`, `zTXt`, `iTXt` metadata chunks. + * *PDF*: `/Info` dictionaries and `/Metadata` XML streams. + * *GIF*: Comment extensions and application loop extensions. + * *ELF/PE*: Executable header offsets, architectures, and section headers. + * *MP3*: ID3v1 and ID3v2 tag blocks (Title, Artist, custom Comments). ### B. Core Solving Infrastructure & QOL * **Solving Assistants**: Standard templates and modular helper scripts for repeating CTF patterns (e.g., base conversions, cipher decoding, and request generation). diff --git a/project_status.md b/project_status.md index 80baf2d..3be262a 100644 --- a/project_status.md +++ b/project_status.md @@ -21,7 +21,13 @@ This file tracks the completed progress and upcoming development milestones for ### 📅 Phase 1: Functional Forensics Pipeline & Toolkit * **Pipeline Automation**: Integrate the existing forensics command-line utilities into a cohesive analysis pipeline where files are automatically checked for magic bytes, file extensions, and flag patterns. -* **Metadata & Extraction Toolkit**: Extend forensics tools to extract specific metadata (e.g., EXIF records, archive tables) and automate extraction/carving of nested data structures (e.g., binwalk-like carving, automated unzipping, extraction of hidden payloads). +* **Metadata & Extraction Toolkit**: Extend forensics tools to extract specific metadata and automate extraction/carving of nested data structures (e.g., binwalk-like carving, automated unzipping, extraction of hidden payloads). +* **Targeted Forensic Metadata Parsing**: Implement pure-Python parsers for high-signal forensics structures: + * *PNG Text Chunks*: Extract metadata from `tEXt`, `zTXt`, and `iTXt` blocks. + * *PDF Catalog Info*: Extract `/Info` and `/Metadata` XML properties. + * *GIF Application Extensions*: Extract comments and loop delays. + * *ELF/PE Executable Headers*: Read architecture, entry points, and section identifiers. + * *MP3 ID3 Tags*: Extract Title, Artist, Album, and standard Comment frames. * **QOL Utilities**: Add standard format outputs (JSON, Rich logs) and automatic logging of analysis artifacts to speed up user-led inspections. ### 📅 Phase 2: Core CTF Solving & Solver QOL