pwn 0.5.739 → 0.5.741

data/spec/lib/pwn/plugins/gdbmi_spec.rb

@@ -1,8 +1,60 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'json'
+require 'open3'
 
 describe PWN::Plugins::GDBMI do
+  def with_fake_gdb
+    Dir.mktmpdir('pwn-gdbmi-') do |dir|
+      fake = File.join(dir, 'gdb')
+      File.write(fake, <<~RUBY)
+        #!/usr/bin/env ruby
+        $stdout.sync = true
+        $stdin.binmode
+        $stdout.puts '=thread-group-added,id="i1"'
+        $stdout.puts '(gdb) '
+        loop do
+          line = $stdin.gets
+          break if line.nil?
+
+          cmd = line.to_s.strip
+          break if cmd == '-gdb-exit' || cmd == 'quit'
+
+          case cmd
+          when /^-break-insert /
+            $stdout.puts '^done,bkpt={number="1",type="breakpoint",disp="keep",enabled="y",addr="0x401000",func="main"}'
+          when /^-exec-run/, /^-exec-continue/, /^-interpreter-exec console/
+            $stdout.puts '^running'
+            $stdout.puts '*stopped,reason="signal-received",signal-name="SIGSEGV",frame={addr="0x41414141",func="vuln",offset="0"}'
+          when /^-data-list-register-values/
+            $stdout.puts '^done,register-values=[{number="16",name="rip",value="0x41414141"},{number="7",name="rsp",value="0x7fffffffe000"}]'
+          when /^-data-read-memory-bytes/
+            $stdout.puts '^done,memory=[{begin="0x41414141",offset="0",end="0x41414145",contents="41414141"}]'
+          when /^-stack-list-frames/
+            $stdout.puts '^done,stack=[frame={level="0",addr="0x41414141",func="vuln"},frame={level="1",addr="0x401200",func="main"}]'
+          when /si_addr/
+            $stdout.puts '^done,value="0x41414141"'
+          else
+            $stdout.puts '^done'
+          end
+          $stdout.puts '(gdb) '
+        end
+      RUBY
+      File.chmod(0o755, fake)
+      path = File.join(dir, 'fixture.bin')
+      File.binwrite(path, 'ELF')
+      original = ENV.fetch('PATH', '')
+      ENV['PATH'] = "#{dir}:#{original}"
+      begin
+        yield path
+      ensure
+        ENV['PATH'] = original
+      end
+    end
+  end
+
   it 'should display information for authors' do
     expect(described_class).to respond_to :authors
   end
@@ -12,6 +64,52 @@ describe PWN::Plugins::GDBMI do
   end
 
   it 'break requires a location' do
-    expect { described_class.break(location: '') }.to raise_error(/location/)
+    expect { described_class.break(location: '') }.to raise_error(/location|addr/)
+  end
+
+  it 'is available as GDBMi and speaks mi3' do
+    expect(PWN::Plugins::GDBMi).to eq(described_class)
+    with_fake_gdb do |path|
+      sid = described_class.open(binary: path)
+      expect(described_class.session(session: sid)[:interpreter]).to eq('mi3')
+      described_class.close(session: sid)
+    end
+  end
+
+  it 'rejects injected breakpoint locations before spawning gdb' do
+    expect(Open3).not_to receive(:popen2)
+    expect { described_class.break(session: 'missing', location: 'main;!id') }.to raise_error(ArgumentError, /location|addr/)
+  end
+
+  it 'returns a structured crash report from run_to_crash' do
+    with_fake_gdb do |path|
+      crash = described_class.run_to_crash(binary: path, stdin: 'AAAA')
+      expect(crash).to include(signal: 'SIGSEGV', pc: '0x41414141', fault_addr: '0x41414141')
+      expect(crash[:exploitability]).to eq('pc_control')
+      expect(crash[:backtrace]).to be_an(Array)
+      expect(crash[:registers]).to include('rip' => '0x41414141')
+    end
+  end
+
+  it 'feeds ExploitDev a cyclic offset from the crash PC' do
+    payload = PWN::Plugins::ExploitDev.cyclic(length: 64)
+    crash = { signal: 'SIGSEGV', pc: '0x41414141', fault_addr: '0x41414141', exploitability: 'pc_control' }
+    row = PWN::Plugins::ExploitDev.from_crash(crash: crash, payload: payload)
+    expect(row[:offset]).to be_a(Integer)
+    expect(payload[row[:offset], 4]).to eq('AAAA')
+  end
+
+  it 'triages a compiled crashing binary to a structured report', :gdb_integration do
+    Dir.mktmpdir('pwn-gdb-real-') do |dir|
+      source = File.join(dir, 'crash.c')
+      path = File.join(dir, 'crash')
+      File.write(source, "int main(void) { *(volatile int *)0 = 1; return 0; }\n")
+      out, status = Open3.capture2e('cc', '-O0', '-g', '-fno-stack-protector', '-o', path, source)
+      expect(status.success?).to eq(true), out
+      crash = described_class.run_to_crash(binary: path)
+      expect(crash[:signal].to_s).to match(/SEGV/)
+      expect(crash[:pc].to_s).to match(/\A0x[0-9a-f]+\z/)
+      expect(crash).to include(:fault_addr, :exploitability)
+    end
   end
 end

data/spec/lib/pwn/plugins/httpx_spec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+require 'tmpdir'
+
+describe PWN::Plugins::Httpx do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'parses httpx JSONL tech stack without a live probe' do
+    jsonl = "#{JSON.generate('url' => 'https://wp.example.test', 'status_code' => 200, 'title' => 'WordPress', 'tech' => %w[nginx PHP WordPress], 'webserver' => 'nginx')}\n"
+    row = described_class.probe(jsonl: jsonl)
+    expect(row[:hosts].first['url']).to include('wp.example.test')
+    expect(row[:techs].join).to match(/wordpress/i)
+    expect(row[:techs].join).to match(/nginx/i)
+  end
+end

data/spec/lib/pwn/plugins/jobs_spec.rb

@@ -3,6 +3,147 @@
 require 'spec_helper'
 
 describe PWN::Plugins::Jobs do
+  before do
+    @root = Dir.mktmpdir('pwn-jobs-')
+    stub_const('PWN::Plugins::Jobs::JOBS_DIR', @root)
+  end
+
+  after do
+    FileUtils.remove_entry(@root)
+  end
+
+  def fresh(code)
+    setup = "require 'pwn'; PWN::Plugins::Jobs.send(:remove_const, :JOBS_DIR); PWN::Plugins::Jobs.const_set(:JOBS_DIR, #{described_class::JOBS_DIR.inspect}); "
+    out, err, status = Open3.capture3(RbConfig.ruby, '-I', File.expand_path('../../../../lib', __dir__), '-e', setup + code)
+    raise err unless status.success?
+
+    JSON.parse(out, symbolize_names: true)
+  end
+
+  def finished(id)
+    Timeout.timeout(8) do
+      loop do
+        row = described_class.status(id: id)
+        return row unless row[:status] == 'RUNNING'
+
+        sleep 0.05
+      end
+    end
+  end
+
+  it 'survives an exited creator and records completion in a fresh session' do
+    row = fresh("puts JSON.generate(PWN::Plugins::Jobs.start(command: 'sleep 2; printf durable', max_runtime: 21600, session_id: 'old'))")
+    expect(row[:status]).to eq('RUNNING')
+    expect(row[:worker_pid]).to be_a(Integer)
+    expect(row[:worker_identity]).not_to be_nil
+    worker_session = Process.getsid(row[:worker_pid])
+    expect(fresh("puts JSON.generate(PWN::Plugins::Jobs.status(id: '#{row[:id]}'))")[:status]).to eq('RUNNING')
+    done = finished(row[:id])
+    expect(worker_session).to eq(row[:worker_pid])
+    expect(done).to include(status: 'COMPLETED', exit_code: 0, max_runtime: 21_600, session_id: 'old')
+    expect(done[:finished_at]).not_to be_nil
+    expect(fresh("puts JSON.generate(PWN::Plugins::Jobs.result(id: '#{row[:id]}'))")[:tail]).to eq('durable')
+  end
+
+  it 'enforces timeout without polling and kills a TERM-resistant process tree' do
+    marker = File.join(@root, 'escaped')
+    row = described_class.start(command: "trap '' TERM; (sleep 2; touch #{marker}) & wait", max_runtime: 0.2)
+    sleep 2.5
+    persisted = JSON.parse(File.read(File.join(@root, "#{row[:id]}.json")), symbolize_names: true)
+    expect(persisted).to include(status: 'TIMEOUT', signal: 9)
+    expect(File.exist?(marker)).to be(false)
+  end
+
+  it 'cancels durably without directly signaling a persisted PID' do
+    row = described_class.start(command: "trap '' TERM; sleep 10", max_runtime: 10)
+    expect(described_class.stop(handle: row[:id])).to be(true)
+    expect(File.exist?(File.join(@root, "#{row[:id]}.cancel"))).to be(true)
+    expect(finished(row[:id])).to include(status: 'STOPPED', signal: 9)
+    expect(described_class.stop(id: row[:id])).to be(false)
+  end
+
+  it 'pages binary logs with byte offsets and distinguishes EOF from completion' do
+    row = described_class.start(command: "printf 'abc\\377def'; sleep 1", max_runtime: 5)
+    first = described_class.job_tail(handle: row[:id], offset: 0, length: 4)
+    expect(first).to include(bytes: 4, next_offset: 4, encoding: 'base64', eof: false, status: 'RUNNING')
+    expect(Base64.strict_decode64(first[:data])).to eq("abc\xFF".b)
+    last = described_class.tail(id: row[:id], offset: 4, length: 100)
+    expect(last).to include(body: 'def', data: 'def', bytes: 3, next_offset: 7, eof: true, status: 'RUNNING')
+    finished(row[:id])
+    expect(described_class.tail(id: row[:id], offset: 7)).to include(bytes: 0, eof: true, status: 'COMPLETED')
+    expect(described_class.tail(id: row[:id])).to be_a(String)
+  end
+
+  it 'filters and limits durable jobs across sessions' do
+    first = described_class.start(command: 'true', session_id: 'one')
+    finished(first[:id])
+    second = described_class.start(command: 'true', session_id: 'two')
+    finished(second[:id])
+    expect(described_class.list(session_id: 'one', limit: 1).map { |row| row[:id] }).to eq([first[:id]])
+    expect(described_class.list(limit: 1).size).to eq(1)
+  end
+
+  it 'records real nonzero exits, signals and spawn errors' do
+    row = described_class.start(command: 'exit 7')
+    expect(finished(row[:id])).to include(status: 'FAILED', exit_code: 7, signal: nil)
+    row = described_class.start(command: 'kill -TERM $$')
+    expect(finished(row[:id])).to include(status: 'FAILED', exit_code: nil, signal: 15)
+    row = described_class.start(command: 'true', cwd: File.join(@root, 'absent'))
+    expect(finished(row[:id])).to include(status: 'FAILED')
+    expect(finished(row[:id])[:error]).to include('ENOENT')
+  end
+
+  it 'reuses an idempotency key across concurrent fresh creators' do
+    command = "printf once >> #{@root}/runs"
+    code = "puts JSON.generate(PWN::Plugins::Jobs.start(command: #{command.inspect}, idempotency_key: 'retry'))"
+    rows = 2.times.map { Thread.new { fresh(code) } }.map(&:value)
+    expect(rows.map { |row| row[:id] }.uniq.size).to eq(1)
+    finished(rows.first[:id])
+    expect(File.read(File.join(@root, 'runs'))).to eq('once')
+  end
+
+  it 'marks a dead supervisor LOST and never signals a reused metadata PID' do
+    row = described_class.start(command: 'sleep 1', max_runtime: 5)
+    Process.kill('KILL', row[:worker_pid])
+    sleep 0.1
+    path = File.join(@root, "#{row[:id]}.json")
+    meta = JSON.parse(File.read(path))
+    meta['pid'] = Process.pid
+    File.write(path, JSON.generate(meta))
+    expect(described_class.status(id: row[:id])).to include(status: 'LOST')
+    expect(described_class.stop(id: row[:id])).to be(false)
+    expect(JSON.parse(File.read(path))['status']).to eq('LOST')
+    sleep 1
+  end
+
+  it 'honors cwd and string environment maps with private files and nil defaults' do
+    row = described_class.start(cmd: 'printf "$JOB_TEST:$PWD"', cwd: @root, env: { 'JOB_TEST' => 'value' }, max_runtime: nil, session_id: nil, idempotency_key: nil)
+    expect(finished(row[:id])).to include(max_runtime: 0)
+    expect(described_class.result(id: row[:id])[:tail]).to eq("value:#{@root}")
+    expect(File.stat(@root).mode & 0o777).to eq(0o700)
+    expect(File.stat(row[:log]).mode & 0o777).to eq(0o600)
+    expect(File.stat(File.join(@root, "#{row[:id]}.json")).mode & 0o777).to eq(0o600)
+    expect { described_class.status(handle: '../invalid') }.to raise_error(ArgumentError)
+    expect { described_class.start(command: 'true', env: { nope: 1 }) }.to raise_error(ArgumentError)
+  end
+
+  it 'preserves synchronous graph dependencies and drains skipped descendants' do
+    graph = described_class.graph(artifact_dir: @root, jobs: [
+                                    { id: 'a', command: 'exit 1' },
+                                    { id: 'b', command: 'true', needs: ['a'] },
+                                    { id: 'c', command: 'true', needs: ['b'] }
+                                  ])
+    expect(graph[:ok]).to be(false)
+    expect(graph[:jobs]['c'][:skipped]).to be(true)
+  end
+
+  it 'treats pre-supervisor metadata as unknown rather than inventing completion' do
+    id = '0123456789ab'
+    File.write(File.join(@root, "#{id}.json"), JSON.generate(id: id, pid: Process.pid, started_at: Time.now.utc.iso8601))
+    expect(described_class.status(id: id)).to include(status: 'LOST', alive: false)
+    expect(described_class.stop(id: id)).to be(false)
+  end
+
   it 'should display information for authors' do
     expect(described_class).to respond_to :authors
   end

data/spec/lib/pwn/plugins/method_catalog_spec.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+
+describe PWN::Plugins::MethodCatalog do
+  it 'should display information for authors' do
+    expect(described_class).to respond_to :authors
+  end
+
+  it 'should display information for existing help method' do
+    expect(described_class).to respond_to :help
+  end
+
+  it 'builds a JSON schema with side-effect class from YARD-style plugin docs' do
+    row = described_class.schema(mod: 'PWN::Plugins::BasicAuth', method: 'encode')
+    expect(row[:parameters][:properties].keys.map(&:to_s)).to include('username', 'password')
+    expect(row[:side_effect].to_s).to match(/read_only|active_scan|exploit|destructive/)
+    expect(row[:parameters][:additionalProperties]).to eq(false)
+  end
+
+  it 'rejects an unknown keyword arg pre-execution and echoes the schema' do
+    out = described_class.guard_eval(code: "PWN::Plugins::BasicAuth.encode(not_a_key: 1, username: 'a')")
+    expect(out[:error].to_s).to match(/unknown keyword/i)
+    expect(out[:error].to_s).to include('not_a_key')
+    expect(out[:schema]).to be_a(Hash)
+    expect(out[:schema][:parameters] || out[:schema]['parameters']).not_to be_nil
+  end
+end

data/spec/lib/pwn/plugins/nmap_it_spec.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'fileutils'
 
 describe PWN::Plugins::NmapIt do
   it 'should display information for authors' do
@@ -23,4 +25,51 @@ describe PWN::Plugins::NmapIt do
   it 'to_findings returns [] for a missing xml file' do
     expect(described_class.to_findings(xml_file: '/tmp/no-such-nmap.xml')).to eq([])
   end
+
+  def write_nmap_xml(path, hosts)
+    body = +'<?xml version="1.0"?><nmaprun>'
+    hosts.each do |host|
+      body << %(<host><status state="up"/><address addr="#{host[:ip]}" addrtype="ipv4"/>)
+      body << '<ports>'
+      Array(host[:ports]).each do |port|
+        body << %(<port protocol="#{port[:proto] || 'tcp'}" portid="#{port[:id]}"><state state="#{port[:state] || 'open'}"/><service name="#{port[:service]}" version="#{port[:version]}"/>)
+        Array(port[:scripts]).each do |name, output|
+          body << %(<script id="#{name}" output="#{output}"/>)
+        end
+        body << '</port>'
+      end
+      body << '</ports>'
+      if host[:scripts]
+        body << '<hostscript>'
+        host[:scripts].each { |name, output| body << %(<script id="#{name}" output="#{output}"/>) }
+        body << '</hostscript>'
+      end
+      body << '</host>'
+    end
+    body << '</nmaprun>'
+    File.write(path, body)
+  end
+
+  it 'ingests XML into the engagement store and answers what changed since yesterday in one query' do
+    Dir.mktmpdir('pwn-nmap-store-') do |dir|
+      stub_const('PWN::AI::Agent::Engagement::ROOT', dir)
+      stub_const('PWN::AI::Agent::Engagement::ACTIVE_FILE', File.join(dir, 'active'))
+      PWN::Engagement.open(name: 'lab', scope_cidrs: ['10.0.0.0/8'])
+      yesterday = File.join(dir, 'yesterday.xml')
+      today = File.join(dir, 'today.xml')
+      write_nmap_xml(yesterday, [{ ip: '10.0.0.1', ports: [{ id: 22, service: 'ssh', version: 'OpenSSH' }], scripts: { 'smb-os-discovery' => 'Windows' } }])
+      write_nmap_xml(today, [{ ip: '10.0.0.1', ports: [{ id: 22, service: 'ssh', version: 'OpenSSH' }, { id: 80, service: 'http', scripts: { 'http-title' => 'Admin' } }] }])
+      first = described_class.scan(xml: yesterday, engagement: 'lab', override: true, at: Time.now.utc - (26 * 3600))
+      expect(first[:hosts].first[:host]).to eq('10.0.0.1')
+      expect(first[:hosts].first[:scripts].to_s).to include('smb-os-discovery')
+      stored = PWN::Engagement.hosts(name: 'lab')
+      expect(stored.values.first[:services]).to include('ssh')
+      second = described_class.scan(xml: today, engagement: 'lab', override: true, at: Time.now.utc)
+      expect(second[:diff][:added_ports].map { |row| row[:port] }).to include(80)
+      delta = described_class.changes(since: 'yesterday', engagement: 'lab')
+      expect(delta[:added_ports].map { |row| row[:port] }).to include(80)
+      expect(delta[:added_ports].map { |row| row[:port] }).not_to include(22)
+      expect(delta[:changed_scripts].any? { |row| row[:name].to_s.include?('http-title') || row[:after].to_s.include?('Admin') }).to eq(true)
+    end
+  end
 end

data/spec/lib/pwn/plugins/nuclei_spec.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'json'
 
 describe PWN::Plugins::Nuclei do
   it 'should display information for authors' do
@@ -12,8 +14,38 @@ describe PWN::Plugins::Nuclei do
   end
 
   it 'to_findings maps JSONL rows into report-shaped hashes' do
-    rows = [{ 'info' => { 'name' => 'xss', 'severity' => 'high' }, 'matched-at' => 'https://x/' }]
+    rows = [{ 'info' => { 'name' => 'xss', 'severity' => 'high' }, 'matched-at' => 'https://x/', 'template-id' => 'xss-generic' }]
     out = described_class.to_findings(rows: rows)
     expect(out.first).to include(:title, :severity, :url)
+    expect(out.first[:template_id] || out.first[:template]).to eq('xss-generic')
+  end
+
+  it 'ingests nuclei JSONL into the findings store with matched-at, template id, and severity' do
+    Dir.mktmpdir('pwn-nuclei-') do |dir|
+      stub_const('PWN::Plugins::Findings::FILE', File.join(dir, 'findings.jsonl'))
+      jsonl = File.join(dir, 'hits.jsonl')
+      File.write(jsonl, "#{JSON.generate(
+        'template-id' => 'cve-2024-wordpress-rce',
+        'matched-at' => 'https://wp.example.test/xmlrpc.php',
+        'host' => 'https://wp.example.test',
+        'info' => { 'name' => 'WordPress XML-RPC RCE', 'severity' => 'high', 'description' => 'RCE via xmlrpc' }
+      )}\n")
+      row = described_class.scan(jsonl: jsonl, record: true)
+      finding = Array(row[:findings]).first
+      expect(finding[:url] || finding[:matched_at]).to include('https://wp.example.test/xmlrpc.php')
+      expect(finding[:template_id] || finding[:template]).to eq('cve-2024-wordpress-rce')
+      expect(finding[:severity].to_s).to match(/high/i)
+      stored = PWN::Plugins::Findings.report
+      expect(stored.map { |item| item[:title] }.join).to include('WordPress')
+      expect(stored.first[:matched_at] || stored.first[:url]).to include('xmlrpc.php')
+      expect(stored.first[:template_id]).to eq('cve-2024-wordpress-rce')
+    end
+  end
+
+  it 'selects nuclei tags from httpx-detected tech stack' do
+    tags = described_class.select_templates(techs: %w[nginx WordPress PHP])
+    blob = Array(tags[:tags] || tags).join(',')
+    expect(blob).to match(/wordpress/i)
+    expect(blob).to match(/nginx/i)
   end
 end

data/spec/lib/pwn/plugins/radare2_spec.rb

@@ -1,8 +1,56 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
+require 'tmpdir'
+require 'json'
+require 'open3'
 
 describe PWN::Plugins::Radare2 do
+  def with_fake_r2
+    Dir.mktmpdir('pwn-r2pipe-') do |dir|
+      fake = File.join(dir, 'r2')
+      File.write(fake, <<~'RUBY')
+        #!/usr/bin/env ruby
+        $stdout.binmode
+        $stdin.binmode
+        $stdout.write("\x00")
+        $stdout.flush
+        loop do
+          line = $stdin.gets
+          break if line.nil?
+
+          cmd = line.chomp
+          break if cmd == 'q'
+
+          out = case cmd
+                when 'aaa' then ''
+                when 'aflj' then '[{"name":"main","offset":4198400,"size":32}]'
+                when /^pdfj/ then '{"name":"main","addr":4198400,"ops":[{"offset":4198400,"opcode":"push rbp","type":"rpush"}]}'
+                when /^pdj/ then '[{"offset":4198400,"opcode":"push rbp"}]'
+                when /^axtj/ then '[{"from":4198432,"type":"CALL","name":"sym.main"}]'
+                when /^wx/, /^s / then ''
+                when 's' then '0x401000'
+                when /^pxj/ then '[144,144]'
+                when 'pd 2 @ main' then "0x00401000  push rbp\n"
+                else '{}'
+                end
+          $stdout.write("#{out}\x00")
+          $stdout.flush
+        end
+      RUBY
+      File.chmod(0o755, fake)
+      path = File.join(dir, 'fixture.bin')
+      File.binwrite(path, 'MZ')
+      original = ENV.fetch('PATH', nil)
+      ENV['PATH'] = "#{dir}:#{original}"
+      begin
+        yield path
+      ensure
+        ENV['PATH'] = original
+      end
+    end
+  end
+
   it 'should display information for authors' do
     expect(described_class).to respond_to :authors
   end
@@ -10,4 +58,71 @@ describe PWN::Plugins::Radare2 do
   it 'should display information for existing help method' do
     expect(described_class).to respond_to :help
   end
+
+  it 'rejects injected addresses before any r2pipe command is written' do
+    expect(Open3).not_to receive(:popen2)
+    %i[disasm xrefs_to seek patch_bytes].each do |name|
+      expect { described_class.public_send(name, session: 'missing', addr: 'main;!id', n: 8, hex: '90') }.to raise_error(ArgumentError, /addr|address|hex/)
+    end
+  end
+
+  it 'enumerates functions and returns structured main disassembly from two JSON helpers' do
+    with_fake_r2 do |path|
+      sid = described_class.open(bin: path)
+      functions = described_class.functions(session: sid)
+      disasm = described_class.disasm(session: sid, addr: 'main')
+      described_class.close(session: sid)
+      expect(functions).to be_an(Array)
+      expect(functions.first).to include('name' => 'main')
+      expect(disasm).to be_a(Hash)
+      expect(disasm.fetch('ops')).not_to be_empty
+    end
+  end
+
+  it 'keeps cmd raw, cmdj parsed, seek JSON, and write-gated patch_bytes' do
+    with_fake_r2 do |path|
+      sid = described_class.open(bin: path)
+      expect(described_class.cmd(session: sid, cmd: 'pd 2 @ main')).to include('push rbp')
+      expect(described_class.cmdj(session: sid, cmd: 'afl')).to be_an(Array)
+      expect(described_class.xrefs_to(session: sid, addr: 'main')).to be_an(Array)
+      expect(described_class.seek(session: sid, addr: 'main')).to include(addr: '0x401000', offset: 0x401000)
+      expect { described_class.patch_bytes(session: sid, addr: 'main', hex: '9090') }.to raise_error(ArgumentError, /write/)
+      described_class.close(session: sid)
+      write = described_class.open(bin: path, write: true)
+      expect(described_class.patch_bytes(session: write, addr: 'main', hex: '9090')).to eq([144, 144])
+      described_class.close(session: write)
+    end
+  end
+
+  it 'lets the agent enumerate functions and disassemble main in two structured tool calls' do
+    PWN::AI::Agent::Registry.discover(force: true)
+    load '/opt/pwn/lib/pwn/ai/agent/tools/radare2.rb'
+    with_fake_r2 do |path|
+      functions = PWN::AI::Agent::Registry.lookup(name: 'r2_functions').handler.call('bin' => path)
+      disasm = PWN::AI::Agent::Registry.lookup(name: 'r2_disasm').handler.call('session' => functions[:session], 'addr' => 'main')
+      expect(functions[:command]).to eq('aflj')
+      expect(functions[:functions].first).to include('name' => 'main')
+      expect(disasm[:command]).to eq('pdfj')
+      expect(disasm[:disasm].fetch('ops')).not_to be_empty
+    end
+  end
+
+  it 'enumerates functions and pulls main disassembly from a compiled binary', :radare2_integration do
+    Dir.mktmpdir('pwn-r2-real-') do |dir|
+      source = File.join(dir, 'fixture.c')
+      path = File.join(dir, 'fixture')
+      File.write(source, "int main(void) { return 0; }\n")
+      out, status = Open3.capture2e('cc', '-O0', '-g', '-o', path, source)
+      expect(status.success?).to eq(true), out
+      sid = described_class.open(bin: path)
+      functions = described_class.functions(session: sid)
+      disasm = described_class.disasm(session: sid, addr: 'main')
+      described_class.close(session: sid)
+      expect(functions).to be_an(Array)
+      expect(functions.any? { |row| row['name'].to_s.include?('main') }).to eq(true)
+      expect(disasm).to be_a(Hash)
+      expect(disasm['ops']).to be_an(Array)
+      expect(disasm['ops']).not_to be_empty
+    end
+  end
 end

data/spec/lib/pwn/plugins/recon_spec.rb

@@ -23,4 +23,19 @@ describe PWN::Plugins::Recon do
     names = described_class.crt_sh(domain: '0dayinc.com')
     expect(names).to include('www.0dayinc.com', 'vpn.0dayinc.com')
   end
+
+  it 'harvests recon banners into the loot store' do
+    Dir.mktmpdir('pwn-recon-loot-') do |dir|
+      allow(Dir).to receive(:home).and_return(dir)
+      described_class.harvest_loot(
+        engagement_id: 'lab',
+        assets: [{
+          address: 'app.example.test',
+          observations: [{ banner: "SSH-2.0\nusername=admin\npassword=hunter2\n" }]
+        }]
+      )
+      offered = PWN::Plugins::Vault.offer(host: 'app.example.test', engagement: 'lab')
+      expect(offered.first[:secret]).to eq('hunter2')
+    end
+  end
 end