@ebowwa/mcp-nm 1.1.0 → 2.0.0

package/src/index.ts

@@ -1,8 +1,17 @@
 #!/usr/bin/env node
 /**
- * @ebowwa/nm-mcp - Binary analysis MCP server
+ * @ebowwa/mcp-nm - Comprehensive binary analysis MCP server
  *
- * Provides tools for analyzing binaries using nm (symbols) and xxd (hex dumps)
+ * Provides tools for:
+ * - Symbol analysis (nm): list, external, undefined, defined, dynamic, search
+ * - Hex operations (xxd): hexdump, plain, C include, binary, extract, find pattern
+ * - Extended analysis: strings, file info, section sizes, disassembly
+ * - Security audit: ASLR, PIE, RELRO, stack canary, NX bit
+ * - Entropy analysis: detect packed/encrypted sections
+ * - Import/export: dependency analysis
+ * - Binary diff: byte-level comparison
+ * - Archive extraction: extract from .a files
+ * - Binary patching: patch bytes, NOP sled, hex editor
  */
 
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -19,8 +28,8 @@ const execAsync = promisify(exec);
 // Server instance
 const server = new Server(
   {
-    name: "@ebowwa/nm-mcp",
-    version: "1.1.0",
+    name: "@ebowwa/mcp-nm",
+    version: "2.0.0",
   },
   {
     capabilities: {
@@ -54,6 +63,78 @@ interface XxdResult {
   startOffset: number;
 }
 
+// ============================================================================
+// File type detection
+// ============================================================================
+
+interface FileAnalysis {
+  hasDynamicSymbols: boolean;
+  fileType: "elf-shared" | "elf-executable" | "mach-o" | "static-library" | "object-file" | "unknown";
+  format: string;
+}
+
+async function analyzeFile(filePath: string): Promise<FileAnalysis> {
+  try {
+    // Use file command to get basic type
+    const { stdout: fileInfo } = await execAsync(`file "${filePath}"`);
+    const info = fileInfo.toLowerCase();
+
+    // Determine file type
+    let fileType: FileAnalysis["fileType"] = "unknown";
+    let hasDynamicSymbols = false;
+
+    // ELF shared libraries and dynamically linked executables
+    if (info.includes("elf")) {
+      if (info.includes("shared object") || info.includes("dynamically linked")) {
+        fileType = info.includes("shared object") ? "elf-shared" : "elf-executable";
+        hasDynamicSymbols = true;
+      } else if (info.includes("statically linked")) {
+        fileType = "elf-executable";
+        hasDynamicSymbols = false;
+      } else if (info.includes("relocatable")) {
+        fileType = "object-file";
+        hasDynamicSymbols = false;
+      }
+    }
+    // Mach-O (macOS)
+    else if (info.includes("mach-o")) {
+      if (info.includes("dynamically linked") || info.includes("shared library") || info.includes("dylib")) {
+        fileType = "mach-o";
+        hasDynamicSymbols = true;
+      } else if (info.includes("bundle") || info.includes("statically linked")) {
+        fileType = "mach-o";
+        hasDynamicSymbols = false;
+      } else {
+        // Most Mach-O executables on macOS are dynamically linked
+        fileType = "mach-o";
+        hasDynamicSymbols = info.includes("executable");
+      }
+    }
+    // Static libraries (.a files)
+    else if (info.includes("ar archive") || info.includes("current ar archive")) {
+      fileType = "static-library";
+      hasDynamicSymbols = false;
+    }
+    // Object files
+    else if (info.includes("relocatable")) {
+      fileType = "object-file";
+      hasDynamicSymbols = false;
+    }
+
+    return {
+      hasDynamicSymbols,
+      fileType,
+      format: fileInfo.trim(),
+    };
+  } catch {
+    return {
+      hasDynamicSymbols: false,
+      fileType: "unknown",
+      format: "Unable to determine file type",
+    };
+  }
+}
+
 // ============================================================================
 // nm execution
 // ============================================================================
@@ -677,6 +758,46 @@ async function handleDefinedSymbols(args: { filePath: string; demangle?: boolean
 }
 
 async function handleDynamicSymbols(args: { filePath: string; demangle?: boolean; definedOnly?: boolean }) {
+  // Check if file supports dynamic symbols before running nm -D
+  const analysis = await analyzeFile(args.filePath);
+
+  if (!analysis.hasDynamicSymbols) {
+    const suggestions: string[] = [];
+
+    switch (analysis.fileType) {
+      case "static-library":
+        suggestions.push("Static libraries (.a) contain object files without dynamic symbols.");
+        suggestions.push("Use nm_list_symbols or nm_defined_symbols to see available symbols.");
+        break;
+      case "object-file":
+        suggestions.push("Object files (.o) are not linked and have no dynamic symbol table.");
+        suggestions.push("Use nm_list_symbols to see symbols in this object file.");
+        break;
+      case "elf-executable":
+        suggestions.push("This appears to be a statically linked executable.");
+        suggestions.push("Use nm_list_symbols or nm_defined_symbols instead.");
+        break;
+      default:
+        suggestions.push("This file type does not have a dynamic symbol table.");
+        suggestions.push("Try nm_list_symbols or nm_defined_symbols instead.");
+    }
+
+    return {
+      content: [{
+        type: "text",
+        text: [
+          `Error: File has no dynamic symbol table`,
+          "",
+          `File: ${args.filePath}`,
+          `Type: ${analysis.format}`,
+          "",
+          ...suggestions,
+        ].join("\n"),
+      }],
+      isError: true,
+    };
+  }
+
   const result = await runNm(args.filePath, {
     dynamicSymbols: true,
     demangle: args.demangle ?? true,
@@ -685,6 +806,7 @@ async function handleDynamicSymbols(args: { filePath: string; demangle?: boolean
 
   const summary = [
     `File: ${result.filePath}`,
+    `File type: ${analysis.format}`,
     `Dynamic symbols: ${result.totalCount}`,
     "",
     "Symbols:",
@@ -852,6 +974,705 @@ async function handleSummary(args: { filePath: string }) {
   return { content: [{ type: "text", text: summary }] };
 }
 
+// ============================================================================
+// Extended Binary Analysis Tools
+// ============================================================================
+
+// --- strings extraction ---
+async function handleStrings(args: {
+  filePath: string;
+  minLength?: number;
+  encoding?: "ascii" | "unicode" | "all";
+}) {
+  const minLen = args.minLength ?? 4;
+  const encFlags = {
+    ascii: "-a",
+    unicode: "-e l",
+    all: "-a -e l",
+  };
+  const encFlag = encFlags[args.encoding ?? "all"];
+
+  try {
+    const { stdout } = await execAsync(
+      `strings ${encFlag} -n ${minLen} "${args.filePath}"`,
+      { maxBuffer: 50 * 1024 * 1024 }
+    );
+
+    const strings = stdout.trim().split("\n").filter(Boolean);
+    const summary = [
+      `Strings in: ${args.filePath}`,
+      `Encoding: ${args.encoding ?? "all"}`,
+      `Minimum length: ${minLen}`,
+      `Total strings: ${strings.length}`,
+      "",
+      "Strings:",
+      ...strings.slice(0, 200).map((s) => `  ${s}`),
+      strings.length > 200 ? `  ... and ${strings.length - 200} more` : "",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`strings command failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- file type with MIME ---
+async function handleFileInfo(args: { filePath: string }) {
+  try {
+    const { stdout: mimeInfo } = await execAsync(
+      `file --mime --brief "${args.filePath}"`
+    );
+    const { stdout: detailedInfo } = await execAsync(
+      `file "${args.filePath}"`
+    );
+
+    const summary = [
+      `File: ${args.filePath}`,
+      "",
+      "MIME Type:",
+      `  ${mimeInfo.trim()}`,
+      "",
+      "Detailed Type:",
+      `  ${detailedInfo.trim()}`,
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`file command failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- section sizes (size command) ---
+async function handleSectionSizes(args: { filePath: string }) {
+  try {
+    const { stdout } = await execAsync(`size -A -x "${args.filePath}"`);
+    const lines = stdout.trim().split("\n");
+
+    const summary = [
+      `Section Sizes: ${args.filePath}`,
+      "",
+      ...lines.map((l) => `  ${l}`),
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    // Try alternative format
+    try {
+      const { stdout } = await execAsync(`size -m "${args.filePath}"`);
+      return { content: [{ type: "text", text: `Section Sizes:\n${stdout}` }] };
+    } catch {
+      throw new Error(`size command failed: ${error instanceof Error ? error.message : error}`);
+    }
+  }
+}
+
+// --- objdump section headers ---
+async function handleObjdumpSections(args: { filePath: string }) {
+  try {
+    const { stdout } = await execAsync(`objdump -h "${args.filePath}"`, {
+      maxBuffer: 10 * 1024 * 1024,
+    });
+
+    const summary = [
+      `Section Headers: ${args.filePath}`,
+      "",
+      stdout,
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`objdump -h failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- objdump program headers / DLL imports ---
+async function handleObjdumpProgramHeaders(args: { filePath: string }) {
+  try {
+    const { stdout } = await execAsync(`objdump -p "${args.filePath}"`, {
+      maxBuffer: 10 * 1024 * 1024,
+    });
+
+    const summary = [
+      `Program Headers / Imports: ${args.filePath}`,
+      "",
+      stdout,
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`objdump -p failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- Mach-O dynamic libraries (otool -L) ---
+async function handleOtoolLibs(args: { filePath: string }) {
+  try {
+    const { stdout } = await execAsync(`otool -L "${args.filePath}"`);
+    const lines = stdout.trim().split("\n");
+
+    const summary = [
+      `Dynamic Library Dependencies: ${args.filePath}`,
+      "",
+      ...lines.map((l) => `  ${l}`),
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`otool -L failed (macOS only): ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- readelf full analysis ---
+async function handleReadelf(args: {
+  filePath: string;
+  sections?: ("headers" | "sections" | "segments" | "symbols" | "dynamic" | "all")[];
+}) {
+  const sections = args.sections ?? ["all"];
+  const flags: string[] = [];
+
+  if (sections.includes("all")) {
+    flags.push("-a");
+  } else {
+    if (sections.includes("headers")) flags.push("-h");
+    if (sections.includes("sections")) flags.push("-S");
+    if (sections.includes("segments")) flags.push("-l");
+    if (sections.includes("symbols")) flags.push("-s");
+    if (sections.includes("dynamic")) flags.push("-d");
+  }
+
+  try {
+    const { stdout } = await execAsync(`readelf ${flags.join(" ")} "${args.filePath}"`, {
+      maxBuffer: 20 * 1024 * 1024,
+    });
+
+    const summary = [
+      `ELF Analysis: ${args.filePath}`,
+      `Sections: ${sections.join(", ")}`,
+      "",
+      stdout.slice(0, 50000),
+      stdout.length > 50000 ? `\n... truncated (${stdout.length - 50000} more chars)` : "",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`readelf failed (Linux ELF only): ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- ldd shared library dependencies ---
+async function handleLdd(args: { filePath: string }) {
+  try {
+    const { stdout } = await execAsync(`ldd "${args.filePath}"`);
+    const lines = stdout.trim().split("\n").filter(Boolean);
+
+    const summary = [
+      `Shared Library Dependencies: ${args.filePath}`,
+      "",
+      ...lines.map((l) => `  ${l}`),
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`ldd failed (Linux only): ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- Disassembly (objdump -d) ---
+async function handleDisassembly(args: {
+  filePath: string;
+  symbol?: string;
+  startOffset?: number;
+  length?: number;
+}) {
+  let cmd = "objdump -d";
+
+  if (args.symbol) {
+    cmd += ` --disassemble="${args.symbol}"`;
+  }
+
+  cmd += ` "${args.filePath}"`;
+
+  try {
+    const { stdout } = await execAsync(cmd, {
+      maxBuffer: 50 * 1024 * 1024,
+    });
+
+    let output = stdout;
+    if (args.startOffset !== undefined || args.length !== undefined) {
+      const lines = stdout.split("\n");
+      const start = args.startOffset ?? 0;
+      const len = args.length ?? 500;
+      output = lines.slice(start, start + len).join("\n");
+    }
+
+    const summary = [
+      `Disassembly: ${args.filePath}`,
+      args.symbol ? `Symbol: ${args.symbol}` : "",
+      "",
+      output.slice(0, 100000),
+      output.length > 100000 ? `\n... truncated (${output.length - 100000} more chars)` : "",
+    ].filter(Boolean).join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`objdump -d failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- Security audit ---
+async function handleSecurityAudit(args: { filePath: string }) {
+  const results: { check: string; status: string; details: string }[] = [];
+
+  try {
+    const { stdout: fileInfo } = await execAsync(`file "${args.filePath}"`);
+    const info = fileInfo.toLowerCase();
+
+    // PIE (Position Independent Executable)
+    if (info.includes("pie") || info.includes("position independent")) {
+      results.push({ check: "PIE", status: "ENABLED", details: "Position Independent Executable" });
+    } else if (info.includes("executable")) {
+      results.push({ check: "PIE", status: "DISABLED", details: "Not a PIE binary" });
+    }
+
+    // Check with readelf for RELRO (Linux)
+    try {
+      const { stdout: relro } = await execAsync(`readelf -l "${args.filePath}" 2>/dev/null | grep -i gnu_relro`);
+      if (relro.trim()) {
+        results.push({ check: "RELRO", status: "ENABLED", details: "Read-Only relocations" });
+      }
+    } catch {
+      // Not Linux or no RELRO
+    }
+
+    // Check for stack canary
+    try {
+      const { stdout: canary } = await execAsync(
+        `nm "${args.filePath}" 2>/dev/null | grep -i "__stack_chk_fail"`
+      );
+      if (canary.trim()) {
+        results.push({ check: "Stack Canary", status: "ENABLED", details: "Stack smashing detected symbol found" });
+      } else {
+        results.push({ check: "Stack Canary", status: "UNKNOWN", details: "No stack canary symbol found" });
+      }
+    } catch {
+      results.push({ check: "Stack Canary", status: "UNKNOWN", details: "Could not check" });
+    }
+
+    // NX bit (non-executable stack)
+    try {
+      const { stdout: nx } = await execAsync(
+        `readelf -l "${args.filePath}" 2>/dev/null | grep -i "gnu_stack"`
+      );
+      if (nx.toLowerCase().includes("rwe")) {
+        results.push({ check: "NX", status: "DISABLED", details: "Stack is executable (RWE)" });
+      } else if (nx.trim()) {
+        results.push({ check: "NX", status: "ENABLED", details: "Non-executable stack" });
+      }
+    } catch {
+      // Not Linux
+    }
+
+    // FORTIFY_SOURCE
+    try {
+      const { stdout: fortify } = await execAsync(
+        `nm "${args.filePath}" 2>/dev/null | grep -i "_chk@"`
+      );
+      if (fortify.trim()) {
+        results.push({ check: "FORTIFY", status: "ENABLED", details: "Fortified functions detected" });
+      }
+    } catch {
+      // Not applicable
+    }
+
+    // macOS specific: check with otool
+    if (info.includes("mach-o")) {
+      try {
+        const { stdout: loadCmds } = await execAsync(`otool -l "${args.filePath}"`);
+        if (loadCmds.toLowerCase().includes("lc_main")) {
+          results.push({ check: "PIE", status: "ENABLED", details: "Mach-O with LC_MAIN (likely PIE)" });
+        }
+      } catch {
+        // Ignore
+      }
+    }
+
+  } catch (error) {
+    results.push({ check: "Error", status: "FAILED", details: error instanceof Error ? error.message : String(error) });
+  }
+
+  const summary = [
+    `Security Audit: ${args.filePath}`,
+    "",
+    "Security Features:",
+    ...results.map((r) => `  ${r.check}: ${r.status} - ${r.details}`),
+    "",
+    "Recommendations:",
+    ...results
+      .filter((r) => r.status === "DISABLED" || r.status === "UNKNOWN")
+      .map((r) => `  - Consider enabling ${r.check}`),
+  ].join("\n");
+
+  return { content: [{ type: "text", text: summary }] };
+}
+
+// --- Section entropy (detect packed/encrypted) ---
+async function handleEntropyAnalysis(args: { filePath: string; blockSize?: number }) {
+  const blockSize = args.blockSize ?? 1024;
+
+  try {
+    // Read file and calculate entropy
+    const { stdout: hexData } = await execAsync(`xxd -p "${args.filePath}" | tr -d '\\n'`);
+    const bytes = hexData.match(/.{2}/g)?.map((h) => parseInt(h, 16)) ?? [];
+
+    const results: { section: string; offset: number; entropy: number; status: string }[] = [];
+
+    for (let i = 0; i < bytes.length; i += blockSize) {
+      const block = bytes.slice(i, i + blockSize);
+      if (block.length === 0) continue;
+
+      // Calculate Shannon entropy
+      const freq: Record<number, number> = {};
+      for (const byte of block) {
+        freq[byte] = (freq[byte] ?? 0) + 1;
+      }
+
+      let entropy = 0;
+      for (const count of Object.values(freq)) {
+        const p = count / block.length;
+        entropy -= p * Math.log2(p);
+      }
+
+      // Max entropy for byte is 8
+      const normalizedEntropy = entropy / 8;
+      let status = "normal";
+      if (normalizedEntropy > 0.95) status = "high (possibly encrypted/compressed)";
+      else if (normalizedEntropy < 0.3) status = "low (possibly padding/zeros)";
+
+      results.push({
+        section: `Block ${Math.floor(i / blockSize)}`,
+        offset: i,
+        entropy: Math.round(entropy * 100) / 100,
+        status,
+      });
+    }
+
+    const avgEntropy = results.reduce((a, b) => a + b.entropy, 0) / results.length;
+
+    const summary = [
+      `Entropy Analysis: ${args.filePath}`,
+      `Block size: ${blockSize} bytes`,
+      `Total blocks: ${results.length}`,
+      `Average entropy: ${(avgEntropy / 8 * 100).toFixed(1)}% of max`,
+      "",
+      "Blocks with unusual entropy:",
+      ...results
+        .filter((r) => r.status !== "normal")
+        .slice(0, 50)
+        .map((r) => `  ${r.section} (offset ${r.offset}): ${r.entropy}/8 bits - ${r.status}`),
+      results.filter((r) => r.status !== "normal").length > 50
+        ? `  ... and ${results.filter((r) => r.status !== "normal").length - 50} more`
+        : "",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`Entropy analysis failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- Import/Export tables ---
+async function handleImportExport(args: { filePath: string }) {
+  const analysis = await analyzeFile(args.filePath);
+  const imports: string[] = [];
+  const exports: string[] = [];
+
+  try {
+    if (analysis.format.toLowerCase().includes("mach-o")) {
+      // macOS: use nm and otool
+      const { stdout: importSyms } = await execAsync(
+        `nm -u "${args.filePath}" 2>/dev/null | awk '{print $2}'`
+      );
+      imports.push(...importSyms.trim().split("\n").filter(Boolean));
+
+      const { stdout: exportSyms } = await execAsync(
+        `nm -g "${args.filePath}" 2>/dev/null | grep -v "U " | awk '{print $3}'`
+      );
+      exports.push(...exportSyms.trim().split("\n").filter(Boolean));
+    } else {
+      // Linux ELF: use nm and objdump
+      const { stdout: importSyms } = await execAsync(
+        `nm -D -u "${args.filePath}" 2>/dev/null | awk '{print $2}'`
+      );
+      imports.push(...importSyms.trim().split("\n").filter(Boolean));
+
+      const { stdout: exportSyms } = await execAsync(
+        `nm -D --defined-only "${args.filePath}" 2>/dev/null | awk '{print $3}'`
+      );
+      exports.push(...exportSyms.trim().split("\n").filter(Boolean));
+    }
+  } catch {
+    // Fallback to regular nm
+    try {
+      const { stdout: allSyms } = await execAsync(`nm "${args.filePath}" 2>/dev/null`);
+      for (const line of allSyms.split("\n")) {
+        const match = line.match(/^\s*([0-9a-fA-F]+)?\s+([UTDDBRC])\s+(.+)/);
+        if (match) {
+          if (match[2] === "U") imports.push(match[3]);
+          else if (match[1] && match[2] === match[2].toUpperCase()) exports.push(match[3]);
+        }
+      }
+    } catch {
+      // Ignore
+    }
+  }
+
+  const summary = [
+    `Import/Export Analysis: ${args.filePath}`,
+    `File type: ${analysis.format}`,
+    "",
+    `Imports (${imports.length}):`,
+    ...imports.slice(0, 100).map((s) => `  - ${s}`),
+    imports.length > 100 ? `  ... and ${imports.length - 100} more` : "",
+    "",
+    `Exports (${exports.length}):`,
+    ...exports.slice(0, 100).map((s) => `  + ${s}`),
+    exports.length > 100 ? `  ... and ${exports.length - 100} more` : "",
+  ].join("\n");
+
+  return { content: [{ type: "text", text: summary }] };
+}
+
+// --- Binary diff ---
+async function handleBinaryDiff(args: {
+  file1: string;
+  file2: string;
+  contextBytes?: number;
+}) {
+  const contextBytes = args.contextBytes ?? 32;
+
+  try {
+    const { stdout: hex1 } = await execAsync(`xxd -p "${args.file1}" | tr -d '\\n'`);
+    const { stdout: hex2 } = await execAsync(`xxd -p "${args.file2}" | tr -d '\\n'`);
+
+    const bytes1 = hex1.match(/.{2}/g) ?? [];
+    const bytes2 = hex2.match(/.{2}/g) ?? [];
+
+    const maxLen = Math.max(bytes1.length, bytes2.length);
+    const diffs: { offset: number; file1: string; file2: string }[] = [];
+
+    for (let i = 0; i < maxLen; i++) {
+      const b1 = bytes1[i] ?? "??";
+      const b2 = bytes2[i] ?? "??";
+      if (b1 !== b2) {
+        diffs.push({ offset: i, file1: b1, file2: b2 });
+      }
+    }
+
+    const diffPercent = ((diffs.length / maxLen) * 100).toFixed(2);
+
+    const summary = [
+      `Binary Diff: ${args.file1} vs ${args.file2}`,
+      "",
+      `File 1 size: ${bytes1.length} bytes`,
+      `File 2 size: ${bytes2.length} bytes`,
+      `Differences: ${diffs.length} bytes (${diffPercent}%)`,
+      "",
+      "Differences (first 200):",
+      ...diffs.slice(0, 200).map((d) => {
+        const ctx1 = bytes1.slice(Math.max(0, d.offset - 4), d.offset + 5).join(" ");
+        const ctx2 = bytes2.slice(Math.max(0, d.offset - 4), d.offset + 5).join(" ");
+        return `  Offset 0x${d.offset.toString(16).padStart(8, "0")}: ${d.file1} -> ${d.file2}\n    Context: [${ctx1}] -> [${ctx2}]`;
+      }),
+      diffs.length > 200 ? `  ... and ${diffs.length - 200} more differences` : "",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`Binary diff failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- Archive extraction ---
+async function handleArchiveExtract(args: {
+  filePath: string;
+  outputDir?: string;
+  listOnly?: boolean;
+}) {
+  const outputDir = args.outputDir ?? `/tmp/archive_${Date.now()}`;
+
+  try {
+    // Check if it's an archive
+    const { stdout: fileInfo } = await execAsync(`file "${args.filePath}"`);
+    if (!fileInfo.toLowerCase().includes("ar archive") && !fileInfo.toLowerCase().includes("archive")) {
+      return {
+        content: [{ type: "text", text: `Error: ${args.filePath} is not an archive file.\n${fileInfo}` }],
+        isError: true,
+      };
+    }
+
+    // List contents
+    const { stdout: contents } = await execAsync(`ar -t "${args.filePath}"`);
+    const files = contents.trim().split("\n").filter(Boolean);
+
+    if (args.listOnly) {
+      return {
+        content: [{
+          type: "text",
+          text: [
+            `Archive Contents: ${args.filePath}`,
+            `Total files: ${files.length}`,
+            "",
+            "Files:",
+            ...files.map((f) => `  - ${f}`),
+          ].join("\n"),
+        }],
+      };
+    }
+
+    // Extract
+    await execAsync(`mkdir -p "${outputDir}"`);
+    await execAsync(`cd "${outputDir}" && ar -x "${args.filePath}"`);
+
+    const summary = [
+      `Archive Extracted: ${args.filePath}`,
+      `Output directory: ${outputDir}`,
+      `Files extracted: ${files.length}`,
+      "",
+      "Extracted files:",
+      ...files.map((f) => `  - ${f}`),
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`Archive extraction failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// ============================================================================
+// Binary Patching Tools (DESTRUCTIVE - use with caution)
+// ============================================================================
+
+// --- Patch bytes ---
+async function handlePatchBytes(args: {
+  filePath: string;
+  offset: number;
+  hexData: string;
+  createBackup?: boolean;
+}) {
+  const backup = args.createBackup ?? true;
+
+  try {
+    // Validate hex data
+    const hex = args.hexData.replace(/\s/g, "");
+    if (!/^[0-9a-fA-F]*$/.test(hex) || hex.length % 2 !== 0) {
+      throw new Error("Invalid hex data. Must be even number of hex characters.");
+    }
+
+    // Create backup if requested
+    if (backup) {
+      await execAsync(`cp "${args.filePath}" "${args.filePath}.bak"`);
+    }
+
+    // Convert hex to bytes and patch
+    const bytes = hex.match(/.{2}/g)?.map((h) => parseInt(h, 16)) ?? [];
+
+    // Use printf and dd to patch
+    const hexBytes = bytes.map((b) => `\\x${b.toString(16).padStart(2, "0")}`).join("");
+    await execAsync(
+      `printf '${hexBytes}' | dd of="${args.filePath}" bs=1 seek=${args.offset} conv=notrunc 2>/dev/null`
+    );
+
+    const summary = [
+      `Bytes Patched: ${args.filePath}`,
+      `Offset: 0x${args.offset.toString(16)} (${args.offset})`,
+      `Bytes written: ${bytes.length}`,
+      `Hex data: ${hex}`,
+      backup ? `Backup created: ${args.filePath}.bak` : "WARNING: No backup created",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`Patch failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
+// --- NOP sled ---
+async function handleNopSled(args: {
+  filePath: string;
+  offset: number;
+  count: number;
+  createBackup?: boolean;
+}) {
+  const backup = args.createBackup ?? true;
+  const nopHex = "90".repeat(args.count); // x86 NOP
+
+  return handlePatchBytes({
+    filePath: args.filePath,
+    offset: args.offset,
+    hexData: nopHex,
+    createBackup: backup,
+  });
+}
+
+// --- Hex editor mode (read/modify at offset) ---
+async function handleHexEditor(args: {
+  filePath: string;
+  offset: number;
+  length: number;
+  newHex?: string;
+}) {
+  try {
+    // Read current bytes
+    const { stdout: currentHex } = await execAsync(
+      `xxd -s ${args.offset} -l ${args.length} -p "${args.filePath}" | tr -d '\\n'`
+    );
+
+    if (args.newHex) {
+      // Modify
+      const hex = args.newHex.replace(/\s/g, "");
+      if (!/^[0-9a-fA-F]*$/.test(hex)) {
+        throw new Error("Invalid hex data.");
+      }
+
+      await execAsync(`cp "${args.filePath}" "${args.filePath}.bak"`);
+      const bytes = hex.match(/.{2}/g)?.map((h) => parseInt(h, 16)) ?? [];
+      const hexBytes = bytes.map((b) => `\\x${b.toString(16).padStart(2, "0")}`).join("");
+      await execAsync(
+        `printf '${hexBytes}' | dd of="${args.filePath}" bs=1 seek=${args.offset} conv=notrunc 2>/dev/null`
+      );
+
+      return {
+        content: [{
+          type: "text",
+          text: [
+            `Hex Editor: ${args.filePath}`,
+            `Offset: 0x${args.offset.toString(16)}`,
+            "",
+            `Previous: ${currentHex}`,
+            `New:      ${hex}`,
+            `Backup:   ${args.filePath}.bak`,
+          ].join("\n"),
+        }],
+      };
+    }
+
+    // Read only
+    const summary = [
+      `Hex Editor (read mode): ${args.filePath}`,
+      `Offset: 0x${args.offset.toString(16)} (${args.offset})`,
+      `Length: ${args.length} bytes`,
+      "",
+      `Hex: ${currentHex}`,
+      "",
+      "To modify, provide newHex parameter",
+    ].join("\n");
+
+    return { content: [{ type: "text", text: summary }] };
+  } catch (error) {
+    throw new Error(`Hex editor failed: ${error instanceof Error ? error.message : error}`);
+  }
+}
+
 // ============================================================================
 // Tool definitions
 // ============================================================================
@@ -1078,6 +1899,223 @@ const TOOLS = [
       required: ["filePath", "pattern"],
     },
   },
+  // Extended Binary Analysis Tools
+  {
+    name: "bin_strings",
+    description: "Extract readable strings (ASCII, Unicode) from a binary file",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+        minLength: { type: "number", description: "Minimum string length (default: 4)" },
+        encoding: {
+          type: "string",
+          enum: ["ascii", "unicode", "all"],
+          description: "String encoding to search (default: all)",
+        },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_file_info",
+    description: "Get detailed file type information with MIME type",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_section_sizes",
+    description: "Get section sizes (text, data, bss) of a binary",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_objdump_sections",
+    description: "Get section headers with flags using objdump -h",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_objdump_program_headers",
+    description: "Get program headers and DLL imports using objdump -p",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_otool_libs",
+    description: "Get dynamic library dependencies for Mach-O files (macOS only)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the Mach-O file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_readelf",
+    description: "Comprehensive ELF structure analysis using readelf",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the ELF file" },
+        sections: {
+          type: "array",
+          items: { type: "string", enum: ["headers", "sections", "segments", "symbols", "dynamic", "all"] },
+          description: "Sections to analyze (default: all)",
+        },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_ldd",
+    description: "Get shared library dependencies using ldd (Linux only)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_disassembly",
+    description: "Disassemble binary code using objdump -d",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+        symbol: { type: "string", description: "Specific symbol to disassemble (optional)" },
+        startOffset: { type: "number", description: "Line offset for output pagination" },
+        length: { type: "number", description: "Number of lines to output" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_security_audit",
+    description: "Check binary security features (ASLR, PIE, RELRO, stack canary, NX bit)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_entropy",
+    description: "Analyze section entropy to detect packed/encrypted sections",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+        blockSize: { type: "number", description: "Block size for entropy calculation (default: 1024)" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_import_export",
+    description: "Get detailed import/export table analysis",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+      },
+      required: ["filePath"],
+    },
+  },
+  {
+    name: "bin_diff",
+    description: "Byte-level comparison between two binary files",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        file1: { type: "string", description: "First binary file" },
+        file2: { type: "string", description: "Second binary file" },
+        contextBytes: { type: "number", description: "Bytes of context to show around differences (default: 32)" },
+      },
+      required: ["file1", "file2"],
+    },
+  },
+  {
+    name: "bin_archive_extract",
+    description: "Extract or list contents of static library (.a) archives",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the archive file" },
+        outputDir: { type: "string", description: "Output directory for extraction (optional)" },
+        listOnly: { type: "boolean", description: "Only list contents without extracting (default: false)" },
+      },
+      required: ["filePath"],
+    },
+  },
+  // Binary Patching Tools (DESTRUCTIVE)
+  {
+    name: "bin_patch_bytes",
+    description: "Patch bytes at a specific offset in a binary file (DESTRUCTIVE)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+        offset: { type: "number", description: "Byte offset to patch" },
+        hexData: { type: "string", description: "Hex bytes to write (e.g., '90 90 90')" },
+        createBackup: { type: "boolean", description: "Create .bak backup before patching (default: true)" },
+      },
+      required: ["filePath", "offset", "hexData"],
+    },
+  },
+  {
+    name: "bin_nop_sled",
+    description: "Insert NOP instructions at a specific offset (DESTRUCTIVE)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the binary file" },
+        offset: { type: "number", description: "Byte offset for NOP sled" },
+        count: { type: "number", description: "Number of NOP instructions to insert" },
+        createBackup: { type: "boolean", description: "Create .bak backup (default: true)" },
+      },
+      required: ["filePath", "offset", "count"],
+    },
+  },
+  {
+    name: "bin_hex_editor",
+    description: "Read or modify bytes at a specific offset (hex editor mode)",
+    inputSchema: {
+      type: "object" as const,
+      properties: {
+        filePath: { type: "string", description: "Path to the file" },
+        offset: { type: "number", description: "Byte offset" },
+        length: { type: "number", description: "Number of bytes to read/modify" },
+        newHex: { type: "string", description: "New hex bytes to write (optional - read mode if omitted)" },
+      },
+      required: ["filePath", "offset", "length"],
+    },
+  },
 ];
 
 // ============================================================================
@@ -1161,6 +2199,42 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
           patternFormat?: "hex" | "text";
           maxLength?: number;
         });
+      // Extended Binary Analysis handlers
+      case "bin_strings":
+        return await handleStrings(args as { filePath: string; minLength?: number; encoding?: "ascii" | "unicode" | "all" });
+      case "bin_file_info":
+        return await handleFileInfo(args as { filePath: string });
+      case "bin_section_sizes":
+        return await handleSectionSizes(args as { filePath: string });
+      case "bin_objdump_sections":
+        return await handleObjdumpSections(args as { filePath: string });
+      case "bin_objdump_program_headers":
+        return await handleObjdumpProgramHeaders(args as { filePath: string });
+      case "bin_otool_libs":
+        return await handleOtoolLibs(args as { filePath: string });
+      case "bin_readelf":
+        return await handleReadelf(args as { filePath: string; sections?: ("headers" | "sections" | "segments" | "symbols" | "dynamic" | "all")[] });
+      case "bin_ldd":
+        return await handleLdd(args as { filePath: string });
+      case "bin_disassembly":
+        return await handleDisassembly(args as { filePath: string; symbol?: string; startOffset?: number; length?: number });
+      case "bin_security_audit":
+        return await handleSecurityAudit(args as { filePath: string });
+      case "bin_entropy":
+        return await handleEntropyAnalysis(args as { filePath: string; blockSize?: number });
+      case "bin_import_export":
+        return await handleImportExport(args as { filePath: string });
+      case "bin_diff":
+        return await handleBinaryDiff(args as { file1: string; file2: string; contextBytes?: number });
+      case "bin_archive_extract":
+        return await handleArchiveExtract(args as { filePath: string; outputDir?: string; listOnly?: boolean });
+      // Binary Patching handlers
+      case "bin_patch_bytes":
+        return await handlePatchBytes(args as { filePath: string; offset: number; hexData: string; createBackup?: boolean });
+      case "bin_nop_sled":
+        return await handleNopSled(args as { filePath: string; offset: number; count: number; createBackup?: boolean });
+      case "bin_hex_editor":
+        return await handleHexEditor(args as { filePath: string; offset: number; length: number; newHex?: string });
       default:
         throw new Error(`Unknown tool: ${name}`);
     }