@remnux/mcp-server 0.1.0

package/dist/tools/definitions.js

@@ -0,0 +1,708 @@
+/**
+ * Static tool definitions for all REMnux analysis tools.
+ *
+ * Each entry normalizes how a tool is invoked so the invoker doesn't need
+ * to know CLI quirks. Descriptions sourced from REMnux docs.
+ */
+export const TOOL_DEFINITIONS = [
+    // ── PE / .NET analysis ──────────────────────────────────────────────────
+    {
+        name: "peframe",
+        description: "Statically analyze PE and Microsoft Office files.",
+        command: "peframe",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "pecheck",
+        description: "Analyze static properties of PE files.",
+        command: "pecheck",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet"],
+        tier: "standard",
+    },
+    {
+        name: "pescan",
+        description: "Scan PE files for anomalies and suspicious indicators.",
+        command: "pescan",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet"],
+        tier: "standard",
+    },
+    {
+        name: "diec",
+        description: "Determine types of files and examine file properties.",
+        command: "diec",
+        inputStyle: "positional",
+        fixedArgs: ["--json"],
+        outputFormat: "json",
+        timeout: 60,
+        tags: ["pe", "dotnet", "packer-detection"],
+        tier: "quick",
+    },
+    {
+        name: "capa",
+        description: "Detect suspicious capabilities in executable files using CAPA rules.",
+        command: "capa",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 300,
+        tags: ["pe", "dotnet", "elf", "capabilities"],
+        tier: "standard",
+    },
+    {
+        name: "capa-json",
+        description: "Detect suspicious capabilities in executable files (JSON output).",
+        command: "capa",
+        inputStyle: "positional",
+        fixedArgs: ["-j"],
+        outputFormat: "json",
+        timeout: 300,
+        tags: ["pe", "dotnet", "elf", "capabilities"],
+        tier: "deep",
+    },
+    {
+        name: "floss",
+        description: "Extract and deobfuscate strings from PE executables.",
+        command: "floss",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 300,
+        tags: ["pe", "dotnet", "strings"],
+        tier: "standard",
+    },
+    {
+        name: "signsrch",
+        description: "Find patterns of common encryption, compression, or encoding algorithms.",
+        command: "signsrch",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet", "crypto"],
+        tier: "standard",
+    },
+    {
+        name: "yara-rules",
+        description: "Scan a file with YARA rules to identify common malicious capabilities.",
+        command: "yara-rules",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet", "yara"],
+        tier: "standard",
+    },
+    {
+        name: "ilspycmd",
+        description: "Decompile .NET assemblies to C# source code.",
+        command: "ilspycmd",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["dotnet", "decompilation"],
+        tier: "standard",
+    },
+    {
+        name: "upx-decompress",
+        description: "Decompress UPX-packed executables.",
+        command: "upx",
+        inputStyle: "positional",
+        fixedArgs: ["-d"],
+        suffixArgs: ["-o", "/tmp/unpacked"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "unpacking"],
+        tier: "standard",
+    },
+    // ── PE extras from demos ────────────────────────────────────────────────
+    {
+        name: "pedump",
+        description: "Statically analyze PE files and extract their components.",
+        command: "pedump",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe"],
+        tier: "deep",
+    },
+    {
+        name: "dotnetfile_dump",
+        description: "Analyze static properties of .NET files.",
+        command: "dotnetfile_dump.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["dotnet"],
+        tier: "deep",
+    },
+    {
+        name: "brxor",
+        description: "Bruteforce XOR-encoded strings to find English words.",
+        command: "brxor.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "decryption"],
+        tier: "deep",
+    },
+    // ── PDF analysis ────────────────────────────────────────────────────────
+    {
+        name: "pdfid",
+        description: "Identify suspicious elements of a PDF file.",
+        command: "pdfid.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pdf", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "pdfid-detailed",
+        description: "Identify suspicious elements of a PDF file (detailed names output).",
+        command: "pdfid.py",
+        inputStyle: "positional",
+        fixedArgs: ["-n"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pdf"],
+        tier: "standard",
+    },
+    {
+        name: "pdf-parser",
+        description: "Examine elements and structure of a PDF file.",
+        command: "pdf-parser.py",
+        inputStyle: "positional",
+        fixedArgs: ["--stats"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pdf"],
+        tier: "standard",
+    },
+    {
+        name: "peepdf-3",
+        description: "Examine elements of a PDF file for malicious content.",
+        command: "peepdf-3",
+        inputStyle: "positional",
+        fixedArgs: ["-f", "-l"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["pdf"],
+        tier: "deep",
+    },
+    {
+        name: "qpdf",
+        description: "Decrypt password-protected or permission-locked PDF files.",
+        command: "qpdf",
+        inputStyle: "positional",
+        fixedArgs: ["--decrypt"],
+        suffixArgs: ["/tmp/decrypted.pdf"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pdf"],
+        tier: "standard",
+    },
+    {
+        name: "pdftk",
+        description: "Manipulate PDF files: merge, split, decrypt, repair, and extract metadata.",
+        command: "pdftk",
+        inputStyle: "positional",
+        suffixArgs: ["dump_data"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pdf"],
+        tier: "standard",
+    },
+    // ── OLE2 / Office analysis ──────────────────────────────────────────────
+    {
+        name: "oleid",
+        description: "Analyze OLE2 files for risk indicators (macros, encryption, etc.).",
+        command: "oleid",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["ole2", "ooxml", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "olevba",
+        description: "Extract and analyze VBA macros from Microsoft Office documents.",
+        command: "olevba",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["ole2", "ooxml", "macros"],
+        tier: "standard",
+    },
+    {
+        name: "oledump",
+        description: "Analyze OLE2 Structured Storage files.",
+        command: "oledump.py",
+        inputStyle: "positional",
+        fixedArgs: ["-i"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["ole2"],
+        tier: "standard",
+    },
+    {
+        name: "pcodedmp",
+        description: "Disassemble VBA p-code from Office documents.",
+        command: "pcodedmp",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["ole2", "ooxml", "macros"],
+        tier: "standard",
+    },
+    {
+        name: "xlmdeobfuscator",
+        description: "Deobfuscate Excel 4.0 (XLM) macros.",
+        command: "xlmdeobfuscator",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["ole2", "ooxml", "macros"],
+        tier: "standard",
+    },
+    // ── OOXML ───────────────────────────────────────────────────────────────
+    {
+        name: "zipdump",
+        description: "Analyze zip-compressed files including OOXML and JAR.",
+        command: "zipdump.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["ooxml", "jar"],
+        tier: "standard",
+    },
+    // ── RTF ─────────────────────────────────────────────────────────────────
+    {
+        name: "rtfobj",
+        description: "Extract embedded objects from RTF files.",
+        command: "rtfobj.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["rtf"],
+        tier: "standard",
+    },
+    {
+        name: "rtfdump",
+        description: "Analyze suspicious RTF files for embedded content.",
+        command: "rtfdump.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["rtf"],
+        tier: "quick",
+    },
+    // ── ELF analysis ────────────────────────────────────────────────────────
+    {
+        name: "readelf-header",
+        description: "Display ELF file header information.",
+        command: "readelf",
+        inputStyle: "positional",
+        fixedArgs: ["-h"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["elf", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "readelf-sections",
+        description: "Display ELF section headers.",
+        command: "readelf",
+        inputStyle: "positional",
+        fixedArgs: ["-S"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["elf"],
+        tier: "standard",
+    },
+    // ── Script / text analysis ──────────────────────────────────────────────
+    {
+        name: "js-beautify",
+        description: "Beautify and deobfuscate JavaScript, CSS, and HTML files.",
+        command: "js-beautify",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script"],
+        tier: "quick",
+    },
+    {
+        name: "strings",
+        description: "Extract printable strings from binary files.",
+        command: "strings",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script", "fallback", "strings"],
+        tier: "quick",
+    },
+    {
+        name: "box-js",
+        description: "Analyze and deobfuscate JavaScript malware in a sandbox.",
+        command: "box-js",
+        inputStyle: "positional",
+        fixedArgs: ["--output-dir", "/tmp/box-js-out"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["script"],
+        tier: "standard",
+    },
+    {
+        name: "base64dump",
+        description: "Locate and decode Base64 and other encoded strings.",
+        command: "base64dump.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script", "fallback"],
+        tier: "standard",
+    },
+    // ── JAR ─────────────────────────────────────────────────────────────────
+    // zipdump already covers JAR (tagged "jar")
+    // ── Email ───────────────────────────────────────────────────────────────
+    {
+        name: "emldump",
+        description: "Analyze and extract content from email (EML) files.",
+        command: "emldump.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["email"],
+        tier: "standard",
+    },
+    {
+        name: "msgconvert",
+        description: "Convert Outlook MSG files to standard EML format.",
+        command: "msgconvert",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["email"],
+        tier: "quick",
+    },
+    // ── APK ─────────────────────────────────────────────────────────────────
+    {
+        name: "apktool",
+        description: "Reverse-engineer Android APK files.",
+        command: "apktool",
+        inputStyle: "positional",
+        fixedArgs: ["d"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["apk"],
+        tier: "standard",
+    },
+    {
+        name: "droidlysis",
+        description: "Perform static analysis of Android applications.",
+        command: "droidlysis",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["apk"],
+        tier: "standard",
+    },
+    // ── Memory forensics (Volatility 3) ─────────────────────────────────────
+    {
+        name: "vol3-info",
+        description: "Display OS and kernel details from a memory image.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.info"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "vol3-pslist",
+        description: "List running processes from a memory image.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.pslist"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory", "triage"],
+        tier: "quick",
+    },
+    {
+        name: "vol3-pstree",
+        description: "Display process tree from a memory image.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.pstree"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-netscan",
+        description: "Scan for network connections and sockets in a memory image.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.netscan"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-cmdline",
+        description: "Extract command-line arguments for each process.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.cmdline"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-malfind",
+        description: "Detect injected code and suspicious memory regions.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.malware.malfind"],
+        outputFormat: "text",
+        timeout: 300,
+        tags: ["memory"],
+        tier: "deep",
+    },
+    {
+        name: "vol3-psscan",
+        description: "Find hidden or unlinked processes via pool tag scanning.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.psscan"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-dlllist",
+        description: "List loaded DLLs for each process.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.dlllist"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-filescan",
+        description: "Scan for file objects in memory.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.filescan"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-handles",
+        description: "List open handles for each process.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.handles"],
+        outputFormat: "text",
+        timeout: 300,
+        tags: ["memory"],
+        tier: "deep",
+    },
+    {
+        name: "vol3-hivelist",
+        description: "List registry hives found in memory.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["windows.registry.hivelist"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    {
+        name: "vol3-linux-pslist",
+        description: "List running processes from a Linux memory image.",
+        command: "vol3",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        suffixArgs: ["linux.pslist"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["memory"],
+        tier: "standard",
+    },
+    // ── Didier Stevens utilities ──────────────────────────────────────────────
+    {
+        name: "translate",
+        description: "Apply byte-level transforms to files (XOR, reverse, shift, custom expressions).",
+        command: "translate.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script", "fallback", "decryption"],
+        tier: "standard",
+    },
+    {
+        name: "numbers-to-string",
+        description: "Convert numeric representations to strings for deobfuscating encoded payloads.",
+        command: "numbers-to-string.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script", "fallback"],
+        tier: "standard",
+    },
+    {
+        name: "re-search",
+        description: "Search files using regular expressions to extract patterns and data.",
+        command: "re-search.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["script", "fallback"],
+        tier: "standard",
+    },
+    {
+        name: "file-magic",
+        description: "Identify file types of data streams using libmagic signatures.",
+        command: "file-magic.py",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["fallback"],
+        tier: "standard",
+    },
+    // ── Shellcode analysis ─────────────────────────────────────────────────
+    {
+        name: "scdbgc",
+        description: "Trace Win32 API calls made by 32-bit shellcode using emulation.",
+        command: "scdbgc",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        fixedArgs: ["-s", "-1"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["shellcode"],
+        tier: "quick",
+    },
+    {
+        name: "speakeasy-sc-x86",
+        description: "Emulate 32-bit shellcode using Speakeasy Windows API emulation.",
+        command: "speakeasy",
+        inputStyle: "flag",
+        inputFlag: "-t",
+        fixedArgs: ["-r", "-a", "x86"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["shellcode"],
+        tier: "standard",
+    },
+    {
+        name: "speakeasy-sc-x64",
+        description: "Emulate 64-bit shellcode using Speakeasy Windows API emulation.",
+        command: "speakeasy",
+        inputStyle: "flag",
+        inputFlag: "-t",
+        fixedArgs: ["-r", "-a", "amd64"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["shellcode"],
+        tier: "standard",
+    },
+    {
+        name: "speakeasy",
+        description: "Emulate Windows PE, DLL, and driver execution using Speakeasy API emulation.",
+        command: "speakeasy",
+        inputStyle: "flag",
+        inputFlag: "-t",
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["pe", "dotnet"],
+        tier: "deep",
+    },
+    {
+        name: "qltool-sc-x86",
+        description: "Emulate 32-bit Windows shellcode using Qiling framework (requires rootfs).",
+        command: "qltool",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        fixedArgs: ["code", "--os", "windows", "--arch", "x86", "--format", "bin"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["shellcode"],
+        tier: "deep",
+    },
+    {
+        name: "qltool-sc-x64",
+        description: "Emulate 64-bit Windows shellcode using Qiling framework (requires rootfs).",
+        command: "qltool",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        fixedArgs: ["code", "--os", "windows", "--arch", "x8664", "--format", "bin"],
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["shellcode"],
+        tier: "deep",
+    },
+    {
+        name: "tracesc",
+        description: "Execute and trace shellcode via Wine to log API calls and behavior.",
+        command: "tracesc",
+        inputStyle: "flag",
+        inputFlag: "-f",
+        outputFormat: "text",
+        timeout: 120,
+        tags: ["shellcode"],
+        tier: "deep",
+    },
+    // ── Cross-type / general ────────────────────────────────────────────────
+    {
+        name: "exiftool",
+        description: "Read and analyze EXIF metadata from various file types.",
+        command: "exiftool",
+        inputStyle: "positional",
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["pe", "dotnet", "pdf", "ole2", "ooxml", "elf", "jar", "email", "metadata"],
+        tier: "standard",
+    },
+    {
+        name: "xorsearch",
+        description: "Locate and decode strings obfuscated using XOR and other techniques.",
+        command: "xorsearch",
+        inputStyle: "positional",
+        fixedArgs: ["-W", "-d", "3"],
+        outputFormat: "text",
+        timeout: 60,
+        tags: ["fallback"],
+        tier: "standard",
+    },
+];
+//# sourceMappingURL=definitions.js.map