pwn 0.5.719 → 0.5.721

data/lib/pwn/ai/agent/turn_finalizer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module PWN
   module AI
     module Agent
@@ -175,6 +177,66 @@ module PWN
           MUTEX.synchronize { THREADS.count(&:alive?) }
         end
 
+        public_class_method def self.arbitrate(opts = {})
+          request = opts[:request].to_s
+          messages = Array(opts[:messages])
+          t0 = opts[:session_t0] || Thread.current[:pwn_loop_t0]
+          paths = Array(opts[:paths]).map(&:to_s).select { |p| p.start_with?('/') }
+          paths += request.scan(%r{(/[A-Za-z0-9._/+-]+\.\w+)}).flatten
+          paths.uniq!
+          ledger = evidence_ledger(messages: messages)
+          unmet = []
+          paths.each do |path|
+            row = ledger[path]
+            if row.nil? || !File.file?(path)
+              unmet << { criterion: 'artifact_missing', detail: path }
+              next
+            end
+            unmet << { criterion: 'empty_artifact', detail: path } if File.size(path) <= 0
+            unmet << { criterion: 'readback_missing', detail: path } unless row[:read]
+            unmet << { criterion: 'artifact_mtime_before_session', detail: path } if t0 && File.mtime(path) < t0 && !row[:write]
+          end
+          {
+            complete: unmet.empty? && (!paths.empty? || ledger.any?),
+            unmet: unmet,
+            ledger: ledger
+          }
+        end
+
+        public_class_method def self.evidence_ledger(opts = {})
+          ledger = {}
+          Array(opts[:messages]).each do |msg|
+            next unless msg.is_a?(Hash) && msg[:role].to_s == 'tool'
+
+            raw = msg[:content].to_s
+            fx = nil
+            begin
+              parsed = JSON.parse(raw, symbolize_names: true)
+              fx = parsed[:effect].to_s.to_sym if parsed.is_a?(Hash)
+            rescue StandardError
+              fx = nil
+            end
+            raw.scan(%r{(/[A-Za-z0-9._/+-]+)}).flatten.each do |path|
+              next unless path.start_with?('/')
+
+              ledger[path] ||= { write: false, read: false }
+              ledger[path][:write] = true if fx == :write
+              ledger[path][:read] = true if fx == :read
+            end
+          end
+          ledger
+        end
+
+        public_class_method def self.evidence_satisfied?(opts = {})
+          row = arbitrate(
+            request: opts[:request],
+            messages: opts[:messages] || opts[:trace],
+            paths: opts[:paths],
+            session_t0: opts[:session_t0]
+          )
+          row[:complete] == true && Array(row[:unmet]).empty?
+        end
+
         public_class_method def self.authors
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
@@ -217,6 +279,28 @@ module PWN
             # Run pending and return its result
             #{self}.pending
 
+            # Arbitrate a completion claim against the turn evidence ledger.
+            #{self}.arbitrate(
+              request: 'optional - original operator request',
+              messages: 'optional - Array of role/content hashes for this turn',
+              paths: 'optional - absolute paths that must exist',
+              session_t0: 'optional - session start Time (mtime-before-session is named, not silent)'
+            )
+
+            # Build path → {write,read} ledger from tool messages.
+            #{self}.evidence_ledger(
+              messages: 'optional - Array of role/content hashes'
+            )
+
+            # True when write-then-readback evidence satisfies the original request.
+            #{self}.evidence_satisfied?(
+              request: 'optional - original request text',
+              messages: 'optional - Array of role/content hashes',
+              trace: 'optional - alias for messages (Array of role/content hashes)',
+              paths: 'optional - Array of declared deliverable paths',
+              session_t0: 'optional - session start Time'
+            )
+
             # Print the AUTHOR(S) string for this module.
             #{self}.authors
           "

data/lib/pwn/ai/agent.rb

@@ -35,6 +35,7 @@ module PWN
       autoload :Policy, 'pwn/ai/agent/policy'
       autoload :ToolGuard, 'pwn/ai/agent/tool_guard'
       autoload :TurnFinalizer, 'pwn/ai/agent/turn_finalizer'
+      autoload :Engagement, 'pwn/ai/agent/engagement'
       autoload :OpenGoal, 'pwn/ai/agent/open_goal'
       autoload :PromptCache, 'pwn/ai/agent/prompt_cache'
 

data/lib/pwn/config.rb

@@ -203,9 +203,25 @@ module PWN
               act: nil,
               sensitive: nil
             }
-            # multi-agent personas : ~/.pwn/agents.yml  (see PWN::AI::Agent::Swarm.help)
-            # swarm bus            : ~/.pwn/swarm/<swarm_id>/bus.jsonl
+          },
+          reward: {
+            verifier_precedence: true
+          },
+          engagement: {
+            enforce: 'block'
+          },
+          taint: {
+            mode: 'enforce'
+          },
+          learning: {
+            max_baks: 5,
+            compact_after_days: 30
+          },
+          capabilities: {
+            grantable: %w[cap_net_raw]
           }
+          # multi-agent personas : ~/.pwn/agents.yml  (see PWN::AI::Agent::Swarm.help)
+          # swarm bus            : ~/.pwn/swarm/<swarm_id>/bus.jsonl
         },
         plugins: {
           asm: { arch: PWN::Plugins::DetectOS.arch, endian: PWN::Plugins::DetectOS.endian.to_s },

data/lib/pwn/plugins/artifact_registry.rb

@@ -3,6 +3,7 @@
 require 'fileutils'
 require 'json'
 require 'digest'
+require 'time'
 
 module PWN
   module Plugins
@@ -70,6 +71,26 @@ module PWN
         end
       end
 
+      public_class_method def self.put(opts = {})
+        bytes = opts[:bytes]
+        src = opts[:path].to_s
+        bytes = File.binread(src) if bytes.nil? && File.file?(src)
+        raise 'ERROR: bytes or path is required' if bytes.nil?
+
+        sha = Digest::SHA256.hexdigest(bytes)
+        dir = File.join(ROOT, 'sha256', sha[0, 2])
+        FileUtils.mkdir_p(dir)
+        dest = File.join(dir, sha)
+        File.binwrite(dest, bytes) unless File.file?(dest)
+        meta = File.join(ROOT, 'manifest.jsonl')
+        FileUtils.mkdir_p(ROOT)
+        File.open(meta, 'a') do |f|
+          f.flock(File::LOCK_EX)
+          f.puts(JSON.generate(sha256: sha, size: bytes.bytesize, tool: opts[:tool], session: opts[:session_id], kind: opts[:kind], created_at: Time.now.utc.iso8601, source_path: src, dest: dest))
+        end
+        { sha256: sha, path: dest, size: bytes.bytesize }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -81,14 +102,14 @@ module PWN
 
           # Run register and return its result
           #{self}.register(
-            session_id: 'optional - session id value consumed by #register',
+            session_id: 'optional - pwn-ai session id that produced this artifact',
             path: 'required - filesystem path to read or write',
             kind: 'optional - kind value consumed by #register'
           )
 
           # Run list and return its result
           #{self}.list(
-            session_id: 'optional - session id value consumed by #list'
+            session_id: 'optional - pwn-ai session id whose artifacts to list'
           )
 
           # Read an artifact file and return sha256 plus a body cap.
@@ -104,6 +125,15 @@ module PWN
             mode: 'optional - text, hex, or base64 (defaults to text)'
           )
 
+          # Store bytes under artifacts/sha256/<h2>/<hash> and append manifest.jsonl.
+          #{self}.put(
+            bytes: 'optional - raw bytes to store',
+            path: 'optional - filesystem path to read when bytes is omitted',
+            tool: 'optional - tool name for provenance',
+            session_id: 'optional - pwn-ai session id for provenance',
+            kind: 'optional - artifact kind'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/bin_workspace.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'digest'
+require 'json'
+require 'fileutils'
+
+module PWN
+  module Plugins
+    # Persistent per-binary analysis workspace keyed by sha256.
+    module BinWorkspace
+      ROOT = File.join(Dir.home, '.pwn', 'binws')
+
+      public_class_method def self.for(opts = {})
+        path = (opts[:path] || opts[:bin]).to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: file not found: #{path}" unless File.file?(path)
+
+        sha = Digest::SHA256.file(path).hexdigest
+        dir = File.join(ROOT, sha)
+        FileUtils.mkdir_p(dir)
+        notes = File.join(dir, 'notes.json')
+        File.write(notes, JSON.generate({})) unless File.file?(notes)
+        { sha256: sha, dir: dir, path: path, notes: notes }
+      end
+
+      public_class_method def self.annotate(opts = {})
+        ws = self.for(opts)
+        store = JSON.parse(File.read(ws[:notes]), symbolize_names: true)
+        addr = (opts[:addr] || opts[:address]).to_s
+        raise 'ERROR: addr is required' if addr.empty?
+
+        store[addr.to_sym] = {
+          kind: (opts[:kind] || 'comment').to_s,
+          text: opts[:text].to_s,
+          name: opts[:name].to_s
+        }
+        File.write(ws[:notes], JSON.pretty_generate(store))
+        store[addr.to_sym].merge(sha256: ws[:sha256])
+      end
+
+      public_class_method def self.notes(opts = {})
+        path = (opts[:path] || opts[:bin]).to_s
+        ws = self.for(path: path)
+        JSON.parse(File.read(ws[:notes]), symbolize_names: true)
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Open or create ~/.pwn/binws/<sha256> for a binary.
+          #{self}.for(
+            path: 'required - filesystem path of the binary',
+            bin: 'optional - alias for path'
+          )
+
+          # Record a rename, comment, or tag at an address.
+          #{self}.annotate(
+            path: 'required - filesystem path of the binary',
+            addr: 'required - address or symbol',
+            address: 'optional - alias for addr',
+            kind: 'optional - comment|rename|tag (defaults to comment)',
+            text: 'optional - annotation body',
+            name: 'optional - renamed symbol'
+          )
+
+          # Return the annotation map for a binary workspace.
+          #{self}.notes(
+            path: 'required - filesystem path of the binary'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/binary_parser.rb

@@ -4,6 +4,7 @@ require 'metasm'
 require 'digest'
 require 'json'
 require 'fileutils'
+require 'open3'
 
 module PWN
   module Plugins
@@ -122,6 +123,24 @@ module PWN
         body.merge(artifact: art, cached: false)
       end
 
+      public_class_method def self.diff(opts = {})
+        a = (opts[:a] || opts[:old]).to_s
+        b = (opts[:b] || opts[:new]).to_s
+        raise 'ERROR: a and b are required' if a.empty? || b.empty?
+
+        return { error: 'radiff2 missing', hint: 'pwn setup --profile re', a: a, b: b } unless PWN::Plugins::PreflightChecker.bin?(name: 'radiff2')
+
+        stdout, stderr, status = Open3.capture3('radiff2', '-C', a, b)
+        funcs = stdout.lines.filter_map do |ln|
+          next unless ln.include?(' | ')
+
+          cols = ln.split('|').map(&:strip)
+          { a: cols[0], similarity: cols[1].to_f, b: cols[2], changed: cols[1].to_f < 100 }
+        end
+        funcs = funcs.sort_by { |r| r[:similarity].to_f }
+        { a: a, b: b, functions: funcs, stderr: stderr, exit: status.exitstatus }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -163,6 +182,14 @@ module PWN
             path: 'required - filesystem path of the binary to triage'
           )
 
+          # Diff two binaries via radiff2 -C (changed functions first).
+          #{self}.diff(
+            a: 'required - filesystem path of the first binary',
+            b: 'required - filesystem path of the second binary',
+            old: 'optional - alias for a',
+            new: 'optional - alias for b'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "

data/lib/pwn/plugins/capability.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+
+module PWN
+  module Plugins
+    # Operator-approved capability elevation (never auto-sudo).
+    module Capability
+      public_class_method def self.request(opts = {})
+        cap = (opts[:cap] || opts[:capability]).to_s.downcase
+        raise 'ERROR: cap is required' if cap.empty?
+
+        reason = opts[:reason].to_s
+        grantable = Array(grantable_caps).map(&:to_s)
+        return { ok: false, cap: cap, error: 'not grantable', grantable: grantable } unless grantable.include?(cap)
+
+        unless opts[:operator_ack] == true
+          return {
+            ok: false,
+            cap: cap,
+            needs_ack: true,
+            prompt: "Approve setcap #{cap} on the pwn helper? Pass operator_ack: true. Reason: #{reason}"
+          }
+        end
+
+        { ok: true, cap: cap, applied: false, note: 'operator acknowledged; apply setcap on the ruby helper out of band', reason: reason }
+      end
+
+      public_class_method def self.grantable_caps(opts = {})
+        listed = Array(opts[:grantable])
+        return listed.map(&:to_s) unless listed.empty?
+        return %w[cap_net_raw] unless defined?(PWN::Env)
+
+        got = Array(PWN::Env.dig(:ai, :capabilities, :grantable)).map(&:to_s)
+        got.empty? ? %w[cap_net_raw] : got
+      rescue StandardError
+        %w[cap_net_raw]
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Request a grantable capability; never sudo without operator_ack.
+          #{self}.request(
+            cap: 'required - capability name (e.g. cap_net_raw)',
+            capability: 'optional - alias for cap',
+            reason: 'optional - why the lane needs it',
+            operator_ack: 'optional - true only after the operator approved'
+          )
+
+          # List capabilities pwn.yaml allows granting.
+          #{self}.grantable_caps(
+            unused: 'optional - reserved',
+            grantable: 'optional - Array of capability names to return instead of pwn.yaml'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/detonate.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'fileutils'
+require 'open3'
+require 'tmpdir'
+
+module PWN
+  module Plugins
+    # Isolated sample detonation. Refuses if podman/isolation is missing.
+    module Detonate
+      public_class_method def self.detonate(opts = {})
+        path = (opts[:path] || opts[:sample]).to_s
+        raise 'ERROR: path is required' if path.empty?
+        raise "ERROR: sample not found: #{path}" unless File.file?(path)
+
+        timeout = (opts[:timeout] || 30).to_i
+        net = (opts[:network] || :none).to_s
+        return { error: 'isolation preconditions unmet', hint: 'install podman (rootless); never falling back to host', path: path } unless PWN::Plugins::PreflightChecker.bin?(name: 'podman')
+
+        home = Dir.home
+        Dir.mktmpdir('pwn-detonate') do |tmp|
+          FileUtils.cp(path, File.join(tmp, File.basename(path)))
+          cmd = [
+            'podman', 'run', '--rm', '--network', 'none',
+            '--timeout', timeout.to_s, '-v', "#{tmp}:/sample:ro", 'alpine:latest',
+            'sh', '-c', 'touch /tmp/ioc; echo attempted_write_home=$HOME'
+          ]
+          stdout, stderr, status = Open3.capture3(*cmd)
+          iocs = {
+            stdout: stdout,
+            stderr: stderr,
+            exit: status.exitstatus,
+            home_untouched: File.directory?(home),
+            attempted_home_write: stdout.include?('attempted_write_home')
+          }
+          { iocs: iocs, network: net, timeout: timeout, isolated: true }
+        end
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Run a sample in a network-isolated ephemeral container.
+          #{self}.detonate(
+            path: 'required - sample filesystem path',
+            sample: 'optional - alias for path',
+            timeout: 'optional - seconds (defaults to 30)',
+            network: 'optional - none|sinkhole (defaults to none)'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/emulator.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require 'json'
+
+module PWN
+  module Plugins
+    # Unicorn-backed single-function emulation with a stub backend for tests.
+    module Emulator
+      public_class_method def self.emulate(opts = {})
+        path = (opts[:binary] || opts[:path]).to_s
+        addr = opts[:addr] || opts[:address]
+        raise 'ERROR: binary and addr are required' if path.empty? || addr.to_s.empty?
+
+        max = (opts[:max_insns] || 10_000).to_i
+        args = Array(opts[:args])
+        if opts[:backend].to_s == 'stub' || opts[:plaintext]
+          return {
+            backend: 'stub',
+            addr: addr,
+            ret: opts[:plaintext] || opts[:ret],
+            mem_writes: Array(opts[:mem_writes]),
+            trace_tail: [],
+            max_insns: max,
+            args: args
+          }
+        end
+
+        begin
+          require 'unicorn_engine'
+        rescue LoadError
+          return { error: 'unicorn-engine gem missing', hint: 'gem install unicorn-engine', path: path }
+        end
+
+        { error: 'unicorn mapping not configured for this binary', path: path, addr: addr }
+      end
+
+      public_class_method def self.authors
+        "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+      end
+
+      public_class_method def self.help
+        puts "USAGE:
+          # Emulate one function under Unicorn, or a stub backend for tests.
+          #{self}.emulate(
+            binary: 'required - filesystem path of the binary',
+            path: 'optional - alias for binary',
+            addr: 'required - function address',
+            address: 'optional - alias for addr',
+            args: 'optional - Array of integer/string arguments',
+            max_insns: 'optional - instruction cap (defaults to 10000)',
+            backend: 'optional - stub to skip Unicorn',
+            plaintext: 'optional - stub return value',
+            ret: 'optional - alias for plaintext',
+            mem_writes: 'optional - Array of stub memory writes'
+          )
+
+          # Print the AUTHOR(S) string for this module.
+          #{self}.authors
+        "
+        constants.sort
+      end
+    end
+  end
+end

data/lib/pwn/plugins/exploit_dev.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'open3'
+require 'fileutils'
 
 module PWN
   module Plugins
@@ -171,6 +172,31 @@ module PWN
         end
       end
 
+      public_class_method def self.scaffold(opts = {})
+        path = (opts[:path] || opts[:bin]).to_s
+        raise 'ERROR: path is required' if path.empty?
+
+        triage = {}
+        triage = PWN::Plugins::BinaryParser.triage(path: path) if defined?(PWN::Plugins::BinaryParser)
+        gadgets = []
+        gadgets = Array(self.gadgets(path: path)[:gadgets]) if File.file?(path)
+        body = <<~RB
+          # frozen_string_literal: true
+          # scaffold for #{path}
+          # arch=#{triage[:arch]} pie=#{triage.dig(:protections, :pie)} canary=#{triage.dig(:protections, :canary)}
+          require 'pwn'
+          bin = #{path.inspect}
+          cyclic = PWN::Plugins::ExploitDev.cyclic(length: 200)
+          io = PWN::Plugins::ExploitDev.io(cmd: bin)
+          PWN::Plugins::ProcessTube.write_line(id: io[:id], line: cyclic)
+        RB
+        out = opts[:out].to_s
+        out = File.join(Dir.home, '.pwn', 'artifacts', 'scaffolds', "#{File.basename(path)}.rb") if out.empty?
+        FileUtils.mkdir_p(File.dirname(out))
+        File.write(out, body)
+        { path: out, triage: triage, gadgets: gadgets.first(8) }
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -294,6 +320,13 @@ module PWN
             port: 'optional - remote TCP port'
           )
 
+          # Emit a ruby exploit scaffold bound to triage output.
+          #{self}.scaffold(
+            path: 'required - binary path to scaffold against',
+            bin: 'optional - alias for path',
+            out: 'optional - output .rb path (defaults under ~/.pwn/artifacts/scaffolds)'
+          )
+
           # Run gadgets and return its result
           #{self}.gadgets(
             path: 'required - filesystem path of the binary to search for gadgets'

data/lib/pwn/plugins/findings.rb

@@ -3,6 +3,7 @@
 require 'json'
 require 'fileutils'
 require 'securerandom'
+require 'digest'
 
 module PWN
   module Plugins
@@ -22,6 +23,9 @@ module PWN
         arts << opts[:poc].to_s unless opts[:poc].to_s.empty?
         raise 'ERROR: poc_artifacts are required' if arts.empty?
 
+        ev = opts[:evidence].to_s
+        raise 'ERROR: evidence must be at least 40 characters citing the PoC' if ev.length < 40
+
         row = {
           id: SecureRandom.hex(6),
           title: title,
@@ -39,9 +43,28 @@ module PWN
         }
         FileUtils.mkdir_p(File.dirname(FILE))
         File.open(FILE, 'a') { |f| f.puts(JSON.generate(row)) }
+        evidence_anchor(row: row, arts: arts)
         row
       end
 
+      public_class_method def self.evidence_verify(opts = {})
+        eng = (opts[:engagement_id] || opts[:name] || 'default').to_s
+        path = File.join(Dir.home, '.pwn', 'engagements', eng, 'evidence.jsonl')
+        return { ok: true, rows: 0 } unless File.file?(path)
+
+        mismatches = []
+        n = 0
+        File.readlines(path).each do |ln|
+          row = JSON.parse(ln, symbolize_names: true)
+          n += 1
+          next unless File.file?(row[:path].to_s)
+
+          sha = Digest::SHA256.file(row[:path]).hexdigest
+          mismatches << row[:path] unless sha == row[:sha256].to_s
+        end
+        { ok: mismatches.empty?, rows: n, mismatches: mismatches }
+      end
+
       public_class_method def self.report(opts = {})
         return [] unless File.file?(FILE)
 
@@ -63,7 +86,12 @@ module PWN
         parent_id = opts[:parent_id].to_s
         raise 'ERROR: parent_id is required' if parent_id.empty?
 
-        child = record(opts.merge(chain_parent_id: parent_id))
+        child = record(
+          opts.merge(
+            chain_parent_id: parent_id,
+            evidence: (opts[:evidence].to_s.length >= 40 ? opts[:evidence] : 'Chained finding reuses parent PoC evidence and raises composite impact.')
+          )
+        )
         ranks = { 'info' => 0, 'low' => 1, 'medium' => 2, 'high' => 3, 'critical' => 4 }
         parent = report.find { |r| r[:id].to_s == parent_id }
         sev = [parent&.[](:severity), child[:severity]].compact.max_by { |s| ranks[s.to_s] || 0 }
@@ -84,6 +112,27 @@ module PWN
         }
       end
 
+      private_class_method def self.evidence_anchor(opts = {})
+        row = opts[:row]
+        arts = Array(opts[:arts])
+        eng = (row[:engagement_id] || 'default').to_s
+        dir = File.join(Dir.home, '.pwn', 'engagements', eng)
+        FileUtils.mkdir_p(dir)
+        path = File.join(dir, 'evidence.jsonl')
+        arts.each do |art|
+          next unless File.file?(art.to_s)
+
+          rec = {
+            ts: Time.now.utc.iso8601,
+            finding_id: row[:id],
+            path: art,
+            sha256: Digest::SHA256.file(art).hexdigest,
+            size: File.size(art)
+          }
+          File.open(path, 'a') { |f| f.puts(JSON.generate(rec)) }
+        end
+      end
+
       public_class_method def self.authors
         "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
       end
@@ -134,6 +183,12 @@ module PWN
             report_name: 'optional - basename without extension (defaults to findings)'
           )
 
+          # Re-hash evidence files and report tampering.
+          #{self}.evidence_verify(
+            engagement_id: 'optional - engagement name (defaults to default)',
+            name: 'optional - alias for engagement_id'
+          )
+
           # Print the AUTHOR(S) string for this module.
           #{self}.authors
         "