detect-it-easy-windows

name

detect-it-easy-windows

description

Windows-only cheatsheet for Detect It Easy's console executable (`diec.exe`) to identify file formats, compilers, linkers, packers, protectors, and other signatures; run deep, heuristic, aggressive, recursive, entropy, and file-information scans; emit JSON, XML, CSV, TSV, or plain text; calculate hashes; inspect or override signature databases; and automate static file triage from PowerShell. Use for requests mentioning Detect It Easy, DiE/DIEC, diec.exe, binary or file identification, compiler/packer/protector detection, static sample triage, DiE JSON output, entropy, or DiE database selection on Windows. Target the CLI only, not `die.exe` or `diel.exe`. Assume the WinGet package is installed and `diec.exe` is available on PATH.

Detect It Easy on Windows — CLI cheatsheet

Use this as a jump-to syntax reference, not a fixed procedure. diec.exe reads a target; it does not launch it. Treat the installed binary's --help as the final authority because prerelease switches can change.

Install the dependency

Install the official WinGet package, open a new terminal, and verify the CLI:

winget install --id horsicq.DIE-engine --exact --source winget
diec.exe --version

Runtime assumption

Assume WinGet package horsicq.DIE-engine is installed and diec.exe is available on PATH. WinGet installs its adjacent databases and runtime files with it. After a fresh installation, open a new terminal so it inherits the updated PATH. Do not substitute the GUI die.exe.

Get-Command -Name 'diec.exe' -CommandType Application -ErrorAction Stop
diec.exe --version
diec.exe --help

If the command is still absent, report the missing installation instead of searching for arbitrary copies. Pass native arguments as separate array elements and put -- before the target.

$file = (Resolve-Path -LiteralPath 'C:\Samples\sample.exe' -ErrorAction Stop).Path
$dieArgs = @('-d', '-u', '-b', '-p', '--', $file)
& diec.exe @dieArgs
$exitCode = $LASTEXITCODE

Common commands

diec.exe -b -f -p -- $file                    # detailed, readable text
diec.exe -j -- $file                          # normal signature scan as JSON
diec.exe -d -u -j -- $file                    # include deep + heuristic signatures
diec.exe -r -d -u -g -a -j -- $file           # broad scan; slower and noisier
diec.exe -i -j -- $file                       # file metadata only
diec.exe -e -j -- $file                       # regional + total entropy only
diec.exe -S 'Hash' -j -- $file                # all supported hashes
diec.exe -S 'Hash#SHA256' -j -- $file         # one hash
diec.exe -S 'Info#File type' -j -- $file      # one special-info field
diec.exe -w                                   # list available special structures
diec.exe -s                                   # database paths + signature counts

Scan flags

Flag	Effect
-r, --recursivescan	Broaden recursive scanning, including embedded resources/overlays. See the directory caveat below.
-d, --deepscan	Enable deep-scan signatures such as DS.* and EP.*.
-u, --heuristicscan	Enable heuristic signatures such as HEUR.*.
-g, --aggressivecscan	Raise aggressive scan limits. The long option really contains the extra c; prefer -g.
-a, --alltypes	Also scan compatible/base formats, such as the DOS layer of a PE.
-b, --verbose	Add details such as OS, architecture, mode, and language.
-U, --hideunknown	Suppress records marked unknown.
-f, --format	Add human-friendly spacing to detection strings.
-M, --messages	Print database/scan messages and warnings to stdout. Use only for diagnosis.
-l, --profiling	Measure signature execution; pair with -M to display the very noisy timings.

-d, -u, -r, -g, and -a trade speed for coverage. Add them intentionally; do not imply that the broadest scan is automatically the most reliable result.

Select a report and output format

Choose one report selector:

Selector	Report
none	Signature detections: file type, compiler, linker, packer/protector, tool, and related records.
-i, --info	General file metadata.
-e, --entropy	Entropy report; this replaces rather than augments signature output.
-S, --struct NAME	Special file information. Use -w to discover names; common forms are Hash, Hash#SHA256, Info, and Info#File type.
-w, --showstructs	List available structure names; no target is required.

Choose one output format:

Flag	Format
none	Console-oriented colored text.
-p, --plaintext	Plain text; prefer this for redirection or logs.
-j, --json	JSON.
-x, --xml	XML.
-c, --csv	CSV.
-t, --tsv	TSV.

Do not combine report selectors or format flags. Their precedence differs by report type, so the result can be surprising even when the process succeeds.

Parse one JSON result safely

Use one file per structured invocation. Capture $LASTEXITCODE immediately, then require valid JSON.

$jsonText = (& diec.exe -d -u -j -- $file) -join "`n"
$exitCode = $LASTEXITCODE
if ($exitCode -ne 0) {
    throw "diec.exe failed for '$file' with exit code $exitCode"
}
$dieResult = $jsonText | ConvertFrom-Json -ErrorAction Stop
$dieResult.detects

Do not add -M or -l -M to a machine-readable run: diagnostics and profiling are printed to stdout and corrupt the document. Scan errors can also be appended after a structured result, so parsing the complete output is an intentional validation step.

Directories, multiple targets, and wildcards

For human output, a directory target is valid:

$root = (Resolve-Path -LiteralPath 'C:\Samples' -ErrorAction Stop).Path
diec.exe -r -d -u -p -- $root

For automation, enumerate files in PowerShell and invoke diec.exe once per file:

$results = Get-ChildItem -LiteralPath $root -File -Recurse | ForEach-Object {
    $path = $_.FullName
    $text = (& diec.exe -d -u -j -- $path) -join "`n"
    $code = $LASTEXITCODE
    if ($code -ne 0) { throw "diec.exe failed for '$path' with exit code $code" }
    [pscustomobject]@{ path = $path; die = ($text | ConvertFrom-Json -ErrorAction Stop) }
}

Important behavior verified in 3.21 stable and 4.0.0 Beta:

• Directory arguments are recursively enumerated even without -r; -r also broadens embedded resource/overlay scanning. Pass it when recursive analysis is intended, but do not treat it as only a filesystem-recursion switch.
• Multiple files produce a filename line followed by a separate result document for each file. Directory or multi-positional JSON/XML output is therefore not one valid aggregate document.
• diec.exe has no include/exclude or glob option. Do not pass *.exe; filter with Get-ChildItem and pass resolved literal paths.

Databases

diec.exe -s
diec.exe -D 'C:\DiE\db' -E 'C:\DiE\db_extra' -C 'C:\DiE\db_custom' -j -- $file

Flag	Meaning
-D, --database PATH	Main signature database directory.
-E, --extradatabase PATH	Extra database directory.
-C, --customdatabase PATH	Custom database directory.
-s, --showdatabase	Load databases and show resolved paths plus per-format signature counts.

Portable defaults are $data/db, $data/db_extra, and $data/db_custom, where $data is the application data directory beside the release. In 3.21, a normal scan with a missing main database can still return exit code 0 and an Unknown result. Diagnose database issues in a separate -M -s run and validate detections rather than trusting the exit code alone.

Exit status

The 3.21 source defines these codes; capture them immediately because another native command can overwrite $LASTEXITCODE.

Code	Meaning
0	Success.
1	Target not found; Qt also uses 1 for an unknown option.
2	Target could not be opened.
3	Database could not be found/loaded in a database-checking mode.
4	Invalid parameter.

Treat success as necessary, not sufficient: also require the expected output shape and useful detections.

Interpret results conservatively

• A packer, compiler, or protector match is a signature/heuristic identification, not a malware verdict.
• High entropy or an entropy status of packed can also come from compression, encryption, media, or ordinary resources.
• No detected packer does not prove that a file is unpacked, unobfuscated, or benign.
• Use -d/-u when extra coverage is useful, then corroborate important conclusions with another static or dynamic analysis tool.

Upstream references

• Read the bundled official RUN.md snapshot for upstream's minimal run guidance.
• Read the bundled diec.exe --help 3.21 snapshot when the installed binary is unavailable; otherwise run its own --help.
• Use the canonical Detect It Easy repository and official releases for current material.
• Treat signature-test switches as developer-only and version-sensitive: --addtest in 3.21 became --createtest in the 4.0.0 Beta, and the 3.21 source marks the implementation incomplete.

The bundled upstream material remains under Detect It Easy's MIT license; see UPSTREAM-LICENSE.txt.