@remnux/mcp-server 0.1.12 → 0.1.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -6
- package/dist/file-type-mappings.d.ts.map +1 -1
- package/dist/file-type-mappings.js +40 -1
- package/dist/file-type-mappings.js.map +1 -1
- package/dist/handlers/analyze-file.d.ts.map +1 -1
- package/dist/handlers/analyze-file.js +45 -1
- package/dist/handlers/analyze-file.js.map +1 -1
- package/dist/handlers/suggest-tools.d.ts.map +1 -1
- package/dist/handlers/suggest-tools.js +36 -15
- package/dist/handlers/suggest-tools.js.map +1 -1
- package/dist/tools/definitions.d.ts.map +1 -1
- package/dist/tools/definitions.js +363 -74
- package/dist/tools/definitions.js.map +1 -1
- package/dist/tools/preprocessors.d.ts +33 -0
- package/dist/tools/preprocessors.d.ts.map +1 -0
- package/dist/tools/preprocessors.js +48 -0
- package/dist/tools/preprocessors.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -432,13 +432,23 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
|
|
|
432
432
|
|
|
433
433
|
| Tier | Behavior |
|
|
434
434
|
|------|----------|
|
|
435
|
-
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings) |
|
|
436
|
-
| `standard` | Default — all category tools |
|
|
437
|
-
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, full decompilation) |
|
|
435
|
+
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings, js-beautify, decode-vbe, tshark conversations, ssdeep) |
|
|
436
|
+
| `standard` | Default — all category tools (adds capa, olevba, oledump, cfr, jadx, tshark HTTP/DNS/protocol stats, etc.) |
|
|
437
|
+
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, jstillery, spidermonkey, tshark full decode, full decompilation) |
|
|
438
438
|
|
|
439
439
|
**Output format:** Returns JSON with `detected_type`, `matched_category`, `depth`, `tools_run` (with output), `tools_failed`, and `tools_skipped`.
|
|
440
440
|
|
|
441
|
-
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, shell scripts/
|
|
441
|
+
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, JavaScript (.js/.hta/.wsf/.html), shell scripts/VBS/PowerShell (.sh/.vbs/.ps1/.bat), Python bytecode (.pyc), JAR, email (EML), Android APK, OneNote, PCAP/pcapng network captures. Unknown types get fallback tools (strings, exiftool, base64dump, xorsearch).
|
|
442
|
+
|
|
443
|
+
**Preprocessing:** Before running analysis tools, `analyze_file` checks for conditions that would prevent effective analysis and applies automatic fixes:
|
|
444
|
+
|
|
445
|
+
| Preprocessor | Condition | Action |
|
|
446
|
+
|--------------|-----------|--------|
|
|
447
|
+
| msoffcrypto-tool | Office doc is encrypted | Decrypt with empty/default password before running olevba/oledump |
|
|
448
|
+
| debloat | PE file is >50MB | Remove junk padding before running peframe/capa/etc |
|
|
449
|
+
| pyinstxtractor | PE is a PyInstaller bundle | Extract Python files before analysis |
|
|
450
|
+
|
|
451
|
+
Preprocessing results appear in the response under `preprocessing`. If a preprocessor fails (e.g., wrong password), analysis continues on the original file.
|
|
442
452
|
|
|
443
453
|
#### Example: Using extract_iocs
|
|
444
454
|
|
|
@@ -499,7 +509,7 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
|
|
|
499
509
|
| Command injection (prompt injection tricks AI into shell execution) | Analyst's workflow | Anti-injection patterns (`eval`, `$()`, backticks, etc.) |
|
|
500
510
|
| Dangerous pipes (attacker code piped to interpreters) | Analyst's workflow | Pipe-to-interpreter blocking (`\| bash`, `\| python`) |
|
|
501
511
|
| Catastrophic commands (`rm -rf /`, `mkfs`) | Analysis session | Narrow pattern guards for root wipes and filesystem formatting |
|
|
502
|
-
| Resource exhaustion (tools hang or consume excessive resources) | AI assistant / analysis session | Timeout enforcement (default 5 min), output budgets (
|
|
512
|
+
| Resource exhaustion (tools hang or consume excessive resources) | AI assistant / analysis session | Timeout enforcement (default 5 min), output budgets (40KB/tool default, 120KB total) |
|
|
503
513
|
| Archive zip-slip (path traversal in archives) | Analysis session | Post-extraction validation rejects path escape attempts |
|
|
504
514
|
| SSH injection | SSH connection | Proper shell escaping using single quotes |
|
|
505
515
|
|
|
@@ -547,7 +557,7 @@ These commands are intentionally allowed because REMnux is disposable and contai
|
|
|
547
557
|
3. **Pipe validation**: Pipes to code interpreters blocked
|
|
548
558
|
4. **Shell escaping**: Proper single-quote escaping for SSH commands
|
|
549
559
|
5. **Timeouts**: Long-running processes terminated (default 5 min)
|
|
550
|
-
6. **Output budgets**: Per-tool (
|
|
560
|
+
6. **Output budgets**: Per-tool (40KB default) and total (120KB) limits prevent AI context exhaustion
|
|
551
561
|
7. **Path sandboxing** (opt-in via `--sandbox`): Restricts file operations to samples/output dirs
|
|
552
562
|
|
|
553
563
|
### Prompt Injection from Malware
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,
|
|
1
|
+
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,EAyElD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBnD,CAAC;AA0BF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAqDrF"}
|
|
@@ -55,9 +55,17 @@ export const FILE_TYPE_CATEGORIES = [
|
|
|
55
55
|
name: "OneNote",
|
|
56
56
|
patterns: [/OneNote/i],
|
|
57
57
|
},
|
|
58
|
+
{
|
|
59
|
+
name: "JavaScript",
|
|
60
|
+
patterns: [/HTML document/i],
|
|
61
|
+
},
|
|
58
62
|
{
|
|
59
63
|
name: "Script",
|
|
60
|
-
patterns: [/shell script/i, /script text/i, /
|
|
64
|
+
patterns: [/shell script/i, /script text/i, /Python script/i, /batch file/i],
|
|
65
|
+
},
|
|
66
|
+
{
|
|
67
|
+
name: "Python",
|
|
68
|
+
patterns: [/python.*byte-compiled/i],
|
|
61
69
|
},
|
|
62
70
|
{
|
|
63
71
|
name: "JAR",
|
|
@@ -71,6 +79,10 @@ export const FILE_TYPE_CATEGORIES = [
|
|
|
71
79
|
name: "APK",
|
|
72
80
|
patterns: [/\bAndroid\b/i],
|
|
73
81
|
},
|
|
82
|
+
{
|
|
83
|
+
name: "PCAP",
|
|
84
|
+
patterns: [/pcap capture/i, /tcpdump/i, /pcapng/i, /pcap-ng/i],
|
|
85
|
+
},
|
|
74
86
|
];
|
|
75
87
|
/** Maps category names to their primary registry tag. */
|
|
76
88
|
export const CATEGORY_TAG_MAP = {
|
|
@@ -82,14 +94,25 @@ export const CATEGORY_TAG_MAP = {
|
|
|
82
94
|
RTF: "rtf",
|
|
83
95
|
ELF: "elf",
|
|
84
96
|
OneNote: "onenote",
|
|
97
|
+
JavaScript: "javascript",
|
|
85
98
|
Script: "script",
|
|
99
|
+
Python: "python",
|
|
86
100
|
JAR: "jar",
|
|
87
101
|
Email: "email",
|
|
88
102
|
APK: "apk",
|
|
103
|
+
PCAP: "pcap",
|
|
89
104
|
Memory: "memory",
|
|
90
105
|
Shellcode: "shellcode",
|
|
91
106
|
Unknown: "fallback",
|
|
92
107
|
};
|
|
108
|
+
/** JavaScript file extensions — used as fallback for text files. */
|
|
109
|
+
const JAVASCRIPT_EXTENSIONS = /\.(js|hta|wsf|html|htm)$/i;
|
|
110
|
+
/** Script file extensions — used as fallback for text files. */
|
|
111
|
+
const SCRIPT_EXTENSIONS = /\.(vbs|vbe|ps1|bat|cmd|sh|py|pl|rb)$/i;
|
|
112
|
+
/** Python bytecode extensions — used as fallback for data files. */
|
|
113
|
+
const PYTHON_EXTENSIONS = /\.(pyc|pyo)$/i;
|
|
114
|
+
/** PCAP file extensions — used as fallback for network captures. */
|
|
115
|
+
const PCAP_EXTENSIONS = /\.(pcap|pcapng|cap)$/i;
|
|
93
116
|
/** Memory image extensions — used as fallback when `file` reports "data". */
|
|
94
117
|
const MEMORY_EXTENSIONS = /\.(img|raw|mem|vmem|dmp|lime)$/i;
|
|
95
118
|
/** Shellcode extensions — used as fallback when `file` reports "data". */
|
|
@@ -113,6 +136,18 @@ export function matchFileType(fileOutput, filename) {
|
|
|
113
136
|
}
|
|
114
137
|
}
|
|
115
138
|
}
|
|
139
|
+
// Fallback: extension-based classification for text files that didn't match specific patterns
|
|
140
|
+
if (filename) {
|
|
141
|
+
if (JAVASCRIPT_EXTENSIONS.test(filename)) {
|
|
142
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "JavaScript");
|
|
143
|
+
}
|
|
144
|
+
if (SCRIPT_EXTENSIONS.test(filename)) {
|
|
145
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "Script");
|
|
146
|
+
}
|
|
147
|
+
if (PYTHON_EXTENSIONS.test(filename)) {
|
|
148
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "Python");
|
|
149
|
+
}
|
|
150
|
+
}
|
|
116
151
|
// Fallback: if `file` says "Zip archive" and filename has OOXML extension, classify as OOXML
|
|
117
152
|
if (filename && /zip archive/i.test(typeOutput)) {
|
|
118
153
|
if (OOXML_EXTENSIONS.test(filename)) {
|
|
@@ -123,6 +158,10 @@ export function matchFileType(fileOutput, filename) {
|
|
|
123
158
|
if (filename && OLE2_EXTENSIONS.test(filename) && /^data$|^CDF/i.test(typeOutput)) {
|
|
124
159
|
return FILE_TYPE_CATEGORIES.find((c) => c.name === "OLE2");
|
|
125
160
|
}
|
|
161
|
+
// Fallback: PCAP files — `file` may report "data" for some capture formats
|
|
162
|
+
if (filename && PCAP_EXTENSIONS.test(filename)) {
|
|
163
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "PCAP");
|
|
164
|
+
}
|
|
126
165
|
// Fallback: memory images — `file` reports "data" for raw memory dumps
|
|
127
166
|
if (filename && MEMORY_EXTENSIONS.test(filename) && /^data$/i.test(typeOutput)) {
|
|
128
167
|
return { name: "Memory", patterns: [] };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,
|
|
1
|
+
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC;KAC7E;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,wBAAwB,CAAC;KACrC;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KACxC;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;KACjD;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,cAAc,CAAC;KAC3B;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;KAC/D;CACF,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,UAAU;CACpB,CAAC;AAEF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,oEAAoE;AACpE,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,iEAAiE;AACjE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,QAAiB;IACjE,iHAAiH;IACjH,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAElH,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;QACpE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,mFAAmF;IACnF,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAsD3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAkPtB"}
|
|
@@ -8,6 +8,7 @@ import { REMnuxError } from "../errors/remnux-error.js";
|
|
|
8
8
|
import { toREMnuxError } from "../errors/error-mapper.js";
|
|
9
9
|
import { extractIOCs } from "../ioc/extractor.js";
|
|
10
10
|
import { filterStderrNoise } from "../utils/stderr-filter.js";
|
|
11
|
+
import { getPreprocessors } from "../tools/preprocessors.js";
|
|
11
12
|
const DEFAULT_OUTPUT_BUDGET = 40 * 1024; // 40KB default
|
|
12
13
|
const TOTAL_RESPONSE_BUDGET = 120 * 1024; // 120KB total across all tools
|
|
13
14
|
/** Per-tool output budgets — tools known to produce large output get tighter limits. */
|
|
@@ -26,6 +27,11 @@ const TOOL_OUTPUT_BUDGETS = {
|
|
|
26
27
|
base64dump: 15 * 1024,
|
|
27
28
|
"js-beautify": 15 * 1024,
|
|
28
29
|
"box-js": 20 * 1024,
|
|
30
|
+
cfr: 15 * 1024,
|
|
31
|
+
jadx: 15 * 1024,
|
|
32
|
+
manalyze: 15 * 1024,
|
|
33
|
+
"tshark-verbose": 30 * 1024,
|
|
34
|
+
"tshark-dns": 15 * 1024,
|
|
29
35
|
};
|
|
30
36
|
export async function handleAnalyzeFile(deps, args) {
|
|
31
37
|
const startTime = Date.now();
|
|
@@ -72,13 +78,50 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
72
78
|
const category = matchFileType(fileOutput, args.file);
|
|
73
79
|
const tag = CATEGORY_TAG_MAP[category.name] ?? "fallback";
|
|
74
80
|
const tools = toolRegistry.byTagAndTier(tag, depth);
|
|
81
|
+
// Step 2b: Run applicable preprocessors
|
|
82
|
+
let analysisPath = filePath;
|
|
83
|
+
const preprocessResults = [];
|
|
84
|
+
for (const pp of getPreprocessors(category.name)) {
|
|
85
|
+
try {
|
|
86
|
+
const detect = await connector.executeShell(pp.detectCommand(filePath), {
|
|
87
|
+
timeout: 10000,
|
|
88
|
+
cwd: config.samplesDir,
|
|
89
|
+
});
|
|
90
|
+
if (detect.exitCode !== 0)
|
|
91
|
+
continue; // Not applicable
|
|
92
|
+
const safeFile = args.file.replace(/[^a-zA-Z0-9._-]/g, "_");
|
|
93
|
+
const outPath = `${config.outputDir}/preprocessed-${pp.name}-${safeFile}`;
|
|
94
|
+
const result = await connector.executeShell(pp.processCommand(filePath, outPath), {
|
|
95
|
+
timeout: pp.timeout,
|
|
96
|
+
cwd: config.samplesDir,
|
|
97
|
+
});
|
|
98
|
+
if (result.exitCode === 0) {
|
|
99
|
+
analysisPath = outPath;
|
|
100
|
+
preprocessResults.push({ name: pp.name, description: pp.description, outputPath: outPath });
|
|
101
|
+
}
|
|
102
|
+
else {
|
|
103
|
+
preprocessResults.push({
|
|
104
|
+
name: pp.name,
|
|
105
|
+
description: pp.description,
|
|
106
|
+
error: result.stderr?.trim() || `Exit code ${result.exitCode}`,
|
|
107
|
+
});
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
catch (error) {
|
|
111
|
+
preprocessResults.push({
|
|
112
|
+
name: pp.name,
|
|
113
|
+
description: pp.description,
|
|
114
|
+
error: error instanceof Error ? error.message : "Unknown error",
|
|
115
|
+
});
|
|
116
|
+
}
|
|
117
|
+
}
|
|
75
118
|
const toolsRun = [];
|
|
76
119
|
const toolsFailed = [];
|
|
77
120
|
const toolsSkipped = [];
|
|
78
121
|
let totalOutputSize = 0;
|
|
79
122
|
// Step 3: Run each tool
|
|
80
123
|
for (const tool of tools) {
|
|
81
|
-
const cmd = buildCommandFromDefinition(tool,
|
|
124
|
+
const cmd = buildCommandFromDefinition(tool, analysisPath, config.outputDir);
|
|
82
125
|
// Ensure output directories exist for tools that write to --output-dir
|
|
83
126
|
if (tool.fixedArgs && config.outputDir) {
|
|
84
127
|
const dirIdx = tool.fixedArgs.indexOf("--output-dir");
|
|
@@ -177,6 +220,7 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
177
220
|
detected_type: fileOutput,
|
|
178
221
|
matched_category: category.name,
|
|
179
222
|
depth,
|
|
223
|
+
...(preprocessResults.length > 0 && { preprocessing: preprocessResults }),
|
|
180
224
|
analysis_guidance: "IMPORTANT: Many capabilities flagged by analysis tools (API imports like GetProcAddress/VirtualProtect, " +
|
|
181
225
|
"memory operations, TLS sections, anti-debug patterns) are common in BOTH malware and legitimate software. " +
|
|
182
226
|
"Do not assume malicious intent from flagged items alone. For each finding, consider: " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,eAAe;AACxD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAEzE,wFAAwF;AACxF,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,SAAS,EAAE,EAAE,GAAG,IAAI;IACpB,KAAK,EAAE,EAAE,GAAG,IAAI;IAChB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,MAAM,EAAE,EAAE,GAAG,IAAI;IACjB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,aAAa,EAAE,EAAE,GAAG,IAAI;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI;CACpB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1H,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CACxC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAC7J,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAExE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAEzE,uEAAuE;YACvE,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3E,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,gBAAgB;oBACzB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnC,gFAAgF;gBAChF,yFAAyF;gBACzF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG;oBAC5C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9G,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,wEAAwE;gBACxE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,eAAe,CAAC,CAAC;gBAClG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC/C,IAAI,eAAmC,CAAC;gBACxC,IAAI,eAAe,EAAE,CAAC;oBACpB,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oBAC5D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBACrD,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjE,eAAe,GAAG,WAAW,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC9B,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU;wBAC3F,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,eAAe,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAElD,0CAA0C;gBAC1C,MAAM,aAAa,GAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,aAAa,CAAC,YAAY,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,GAAG,CAAC,eAAe,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;oBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI;wBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,aAAa,EAAE;qBACnD,CAAC;oBACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5D,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EACf,0GAA0G;gBAC1G,4GAA4G;gBAC5G,uFAAuF;gBACvF,6DAA6D;gBAC7D,wFAAwF;gBACxF,+CAA+C;gBAC/C,uEAAuE;gBACvE,8GAA8G;YAChH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI;gBACxB,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAe7D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,eAAe;AACxD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAEzE,wFAAwF;AACxF,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,SAAS,EAAE,EAAE,GAAG,IAAI;IACpB,KAAK,EAAE,EAAE,GAAG,IAAI;IAChB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,MAAM,EAAE,EAAE,GAAG,IAAI;IACjB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,aAAa,EAAE,EAAE,GAAG,IAAI;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,GAAG,EAAE,EAAE,GAAG,IAAI;IACd,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,gBAAgB,EAAE,EAAE,GAAG,IAAI;IAC3B,YAAY,EAAE,EAAE,GAAG,IAAI;CACxB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1H,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CACxC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAC7J,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAExE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,wCAAwC;QACxC,IAAI,YAAY,GAAG,QAAQ,CAAC;QAC5B,MAAM,iBAAiB,GAAsF,EAAE,CAAC;QAEhH,KAAK,MAAM,EAAE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;oBACtE,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,SAAS,CAAC,iBAAiB;gBAEtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;gBAC5D,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,iBAAiB,EAAE,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;oBAChF,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,YAAY,GAAG,OAAO,CAAC;oBACvB,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,CAAC;qBAAM,CAAC;oBACN,iBAAiB,CAAC,IAAI,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;wBACb,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,QAAQ,EAAE;qBAC/D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,IAAI,CAAC;oBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAE7E,uEAAuE;YACvE,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3E,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,gBAAgB;oBACzB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnC,gFAAgF;gBAChF,yFAAyF;gBACzF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG;oBAC5C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9G,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,wEAAwE;gBACxE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,eAAe,CAAC,CAAC;gBAClG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC/C,IAAI,eAAmC,CAAC;gBACxC,IAAI,eAAe,EAAE,CAAC;oBACpB,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oBAC5D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBACrD,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjE,eAAe,GAAG,WAAW,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC9B,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU;wBAC3F,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,eAAe,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAElD,0CAA0C;gBAC1C,MAAM,aAAa,GAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,aAAa,CAAC,YAAY,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,GAAG,CAAC,eAAe,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;oBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI;wBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,aAAa,EAAE;qBACnD,CAAC;oBACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5D,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;YACzE,iBAAiB,EACf,0GAA0G;gBAC1G,4GAA4G;gBAC5G,uFAAuF;gBACvF,6DAA6D;gBAC7D,wFAAwF;gBACxF,+CAA+C;gBAC/C,uEAAuE;gBACvE,8GAA8G;YAChH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI;gBACxB,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAwL5D,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,gBAAgB;;;;;;GA8FvB"}
|
|
@@ -9,24 +9,33 @@ import { toREMnuxError } from "../errors/error-mapper.js";
|
|
|
9
9
|
*/
|
|
10
10
|
const BASE_HINTS = {
|
|
11
11
|
DOTNET: "Start with peframe and diec for triage. diec detects packers/protectors. " +
|
|
12
|
-
"ilspycmd decompiles .NET to C# source. " +
|
|
13
12
|
"capa identifies capabilities like C2, persistence, or file manipulation. " +
|
|
13
|
+
"floss extracts obfuscated strings. yara-rules scans against community signatures. " +
|
|
14
|
+
"ilspycmd decompiles .NET to C# source. " +
|
|
14
15
|
"For deep analysis, capa -vv shows matched rule details with addresses.",
|
|
15
16
|
PE: "Start with peframe and diec for triage — diec detects packers and compilers. " +
|
|
16
17
|
"capa maps capabilities to MITRE ATT&CK. floss extracts obfuscated strings. " +
|
|
18
|
+
"portex provides comprehensive PE structure analysis including anomaly detection. " +
|
|
19
|
+
"yara-rules scans against community signatures for known malware families. " +
|
|
20
|
+
"1768.py analyzes Cobalt Strike beacons. disitool.py examines Authenticode signatures. " +
|
|
17
21
|
"For deep analysis, capa -vv shows matched rule details with addresses. " +
|
|
18
22
|
"pedump shows raw PE structure and brxor bruteforces XOR-encoded strings.",
|
|
19
23
|
PDF: "Start with pdfid to identify notable elements (/JS, /JavaScript, /OpenAction, /Launch). " +
|
|
20
24
|
"Use pdf-parser --stats for structural overview. If notable objects found, " +
|
|
21
|
-
"extract them with pdf-parser -o <obj_id> -d.
|
|
25
|
+
"extract them with pdf-parser -o <obj_id> -d. " +
|
|
26
|
+
"pdftool.py analyzes incremental updates — shows what changed between PDF revisions. " +
|
|
27
|
+
"pdfresurrect extracts previous versions of content — recovers earlier document states. " +
|
|
28
|
+
"peepdf-3 provides interactive deep analysis. " +
|
|
22
29
|
"qpdf decrypts permission-locked PDFs. pdftk extracts metadata and document info.",
|
|
23
30
|
OLE2: "Start with oleid for risk indicators (macros, encryption, external links). " +
|
|
24
31
|
"olevba extracts and analyzes VBA macros — look for auto-execute triggers and notable keywords. " +
|
|
25
32
|
"oledump lists OLE streams; use -s <stream> -v to dump specific macro streams. " +
|
|
33
|
+
"msoffcrypto-crack.py attempts to recover passwords for encrypted documents. " +
|
|
26
34
|
"pcodedmp disassembles VBA p-code (useful when source is stomped). " +
|
|
27
35
|
"xlmdeobfuscator handles Excel 4.0 XLM macros.",
|
|
28
36
|
OOXML: "olevba handles both OLE2 and OOXML macro extraction. " +
|
|
29
37
|
"zipdump lists the ZIP structure — OOXML files are ZIP archives with XML inside. " +
|
|
38
|
+
"xmldump.py extracts and examines XML content within the OOXML archive. " +
|
|
30
39
|
"Look for unusual entries or embedded OLE objects within the archive. " +
|
|
31
40
|
"pcodedmp disassembles VBA p-code. xlmdeobfuscator deobfuscates Excel 4.0 XLM macros.",
|
|
32
41
|
RTF: "rtfobj extracts embedded objects (OLE, packages) from RTF files. " +
|
|
@@ -36,13 +45,22 @@ const BASE_HINTS = {
|
|
|
36
45
|
"readelf -S lists sections — look for unusual section names or sizes. " +
|
|
37
46
|
"capa detects capabilities in ELF binaries similar to PE analysis. " +
|
|
38
47
|
"For deep analysis, capa -vv shows matched rule details with addresses.",
|
|
39
|
-
|
|
40
|
-
"js-beautify reformats and deobfuscates JavaScript — look for eval(), " +
|
|
48
|
+
JavaScript: "js-beautify reformats and deobfuscates JavaScript — look for eval(), " +
|
|
41
49
|
"document.write(), String.fromCharCode(), and unescape() patterns. " +
|
|
42
|
-
"base64dump finds and decodes Base64 and other encoded strings — " +
|
|
43
|
-
"common in PowerShell, bash, and JavaScript malware. " +
|
|
44
50
|
"box-js analyzes and deobfuscates JavaScript malware in a sandbox environment. " +
|
|
45
|
-
"
|
|
51
|
+
"base64dump finds and decodes Base64 and other encoded strings. " +
|
|
52
|
+
"For deep analysis, JStillery uses AST partial evaluation for deobfuscation, and " +
|
|
53
|
+
"SpiderMonkey with -f /usr/share/remnux/objects.js emulates browser/PDF viewer objects. " +
|
|
54
|
+
"To extract scripts from HTML, use ExtractScripts via run_tool.",
|
|
55
|
+
Script: "base64dump finds and decodes Base64 and other encoded strings — " +
|
|
56
|
+
"common in PowerShell, bash, and VBScript malware. " +
|
|
57
|
+
"decode-vbe.py decodes VBE-encoded VBScript files to readable source. " +
|
|
58
|
+
"re-search extracts patterns using regular expressions. " +
|
|
59
|
+
"For PowerShell deobfuscation, consider running pwsh via run_tool. " +
|
|
60
|
+
"translate.py applies byte-level transforms. numbers-to-string.py decodes numeric payloads.",
|
|
61
|
+
Python: "pycdc decompiles Python bytecode (.pyc) to readable source code. " +
|
|
62
|
+
"For PyInstaller bundles (which produce PE files), use pyinstxtractor via run_tool " +
|
|
63
|
+
"to extract contents, then analyze the resulting .pyc files with pycdc.",
|
|
46
64
|
JAR: "zipdump lists the JAR archive contents (JAR files are ZIP format). " +
|
|
47
65
|
"Look for unusual class files, embedded resources, or manifest entries. " +
|
|
48
66
|
"exiftool reveals metadata about the archive.",
|
|
@@ -53,24 +71,27 @@ const BASE_HINTS = {
|
|
|
53
71
|
APK: "apktool decompiles the APK to smali and extracts resources. " +
|
|
54
72
|
"droidlysis performs static analysis identifying permissions, API calls, and risk indicators. " +
|
|
55
73
|
"Look for excessive permissions, obfuscation, and notable network activity.",
|
|
56
|
-
OneNote: "OneNote file detected.
|
|
57
|
-
"Use strings and exiftool for
|
|
74
|
+
OneNote: "OneNote file detected. onedump.py analyzes OneNote documents and extracts embedded files. " +
|
|
75
|
+
"Use strings and exiftool for additional triage. " +
|
|
58
76
|
"OneNote files may contain embedded scripts, executables, or malicious attachments.",
|
|
59
|
-
Shellcode: "Raw shellcode detected.
|
|
60
|
-
"
|
|
77
|
+
Shellcode: "Raw shellcode detected. speakeasy emulates both x86 and x64 shellcode with Windows API emulation. " +
|
|
78
|
+
"scdbgc provides additional Win32 API call tracing for x86 shellcode. " +
|
|
61
79
|
"Look for resolved API names, network connections, file system access, and registry modifications in emulation output. " +
|
|
62
80
|
"For deep analysis, qltool (Qiling) provides multi-platform emulation and tracesc traces execution via Wine. " +
|
|
63
81
|
"Use strings and xorsearch for static indicators before emulation.",
|
|
64
82
|
Memory: "Memory image detected. Start with vol3-info to identify OS and kernel version. " +
|
|
65
|
-
"vol3-pslist and vol3-pstree reveal running processes
|
|
66
|
-
"vol3-netscan shows network connections. vol3-
|
|
67
|
-
"vol3-
|
|
83
|
+
"vol3-pslist and vol3-pstree reveal running processes. " +
|
|
84
|
+
"vol3-netscan shows network connections. vol3-psscan finds hidden/unlinked processes. " +
|
|
85
|
+
"vol3-cmdline extracts process arguments. vol3-dlllist shows loaded DLLs. " +
|
|
86
|
+
"vol3-filescan finds file objects. vol3-hivelist lists registry hives. " +
|
|
68
87
|
"For deeper analysis, vol3-malfind detects injected code and vol3-handles lists open handles. " +
|
|
69
88
|
"For Linux memory images, use vol3-linux-pslist.",
|
|
70
89
|
Unknown: "File type not recognized. strings and exiftool provide basic triage. " +
|
|
71
|
-
"base64dump searches for encoded content. xorsearch
|
|
90
|
+
"base64dump searches for encoded content. xorsearch.py outputs JSON for structured analysis; xorsearch binary is faster for large files. " +
|
|
72
91
|
"translate.py applies byte-level transforms (XOR, shift). re-search.py extracts regex patterns. " +
|
|
73
92
|
"file-magic.py identifies embedded file types. numbers-to-string.py decodes numeric payloads. " +
|
|
93
|
+
"cut-bytes.py extracts byte ranges. format-bytes.py parses structured binary data. " +
|
|
94
|
+
"xor-kpa.py performs known-plaintext XOR attacks. " +
|
|
74
95
|
"Consider using 'file' or 'diec' via run_tool for deeper type identification.",
|
|
75
96
|
};
|
|
76
97
|
/** Extract observable properties from `file` command output. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,yCAAyC;QACzC,
|
|
1
|
+
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,2EAA2E;QAC3E,oFAAoF;QACpF,yCAAyC;QACzC,wEAAwE;IAC1E,EAAE,EACA,+EAA+E;QAC/E,6EAA6E;QAC7E,mFAAmF;QACnF,4EAA4E;QAC5E,wFAAwF;QACxF,yEAAyE;QACzE,0EAA0E;IAC5E,GAAG,EACD,0FAA0F;QAC1F,4EAA4E;QAC5E,+CAA+C;QAC/C,sFAAsF;QACtF,yFAAyF;QACzF,+CAA+C;QAC/C,kFAAkF;IACpF,IAAI,EACF,6EAA6E;QAC7E,iGAAiG;QACjG,gFAAgF;QAChF,8EAA8E;QAC9E,oEAAoE;QACpE,+CAA+C;IACjD,KAAK,EACH,uDAAuD;QACvD,kFAAkF;QAClF,yEAAyE;QACzE,uEAAuE;QACvE,sFAAsF;IACxF,GAAG,EACD,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;IACzE,GAAG,EACD,yDAAyD;QACzD,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;IAC1E,UAAU,EACR,uEAAuE;QACvE,oEAAoE;QACpE,gFAAgF;QAChF,iEAAiE;QACjE,kFAAkF;QAClF,yFAAyF;QACzF,gEAAgE;IAClE,MAAM,EACJ,kEAAkE;QAClE,oDAAoD;QACpD,uEAAuE;QACvE,yDAAyD;QACzD,oEAAoE;QACpE,4FAA4F;IAC9F,MAAM,EACJ,mEAAmE;QACnE,oFAAoF;QACpF,wEAAwE;IAC1E,GAAG,EACD,qEAAqE;QACrE,yEAAyE;QACzE,8CAA8C;IAChD,KAAK,EACH,2DAA2D;QAC3D,iFAAiF;QACjF,qEAAqE;QACrE,kEAAkE;IACpE,GAAG,EACD,8DAA8D;QAC9D,+FAA+F;QAC/F,4EAA4E;IAC9E,OAAO,EACL,4FAA4F;QAC5F,kDAAkD;QAClD,oFAAoF;IACtF,SAAS,EACP,oGAAoG;QACpG,uEAAuE;QACvE,wHAAwH;QACxH,8GAA8G;QAC9G,mEAAmE;IACrE,MAAM,EACJ,iFAAiF;QACjF,wDAAwD;QACxD,uFAAuF;QACvF,2EAA2E;QAC3E,wEAAwE;QACxE,+FAA+F;QAC/F,iDAAiD;IACnD,OAAO,EACL,uEAAuE;QACvE,0IAA0I;QAC1I,iGAAiG;QACjG,+FAA+F;QAC/F,oFAAoF;QACpF,mDAAmD;QACnD,8EAA8E;CACjF,CAAC;AAWF,gEAAgE;AAChE,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;SAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;SACxD,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;SAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAE/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC;SAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC;SACtD,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;SAC1D,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAE/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;IACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,CAAC,MAAM,IAAI;YACpC,2DAA2D;YAC3D,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;gBACrB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,yEAAyE,CAAC,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,QAAQ,6DAA6D,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAiB,EACjB,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1H,mBAAmB;QACnB,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QACjE,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3D,wEAAwE;QACxE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gDAAgD;gBAChD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE;oBACjD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,GAAG;wBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,KAAK,MAAM,CAAC,IAAI,cAAc;oBAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAc,EAAE,CAAC;SAC3E,CAAC,CAAC,CAAC;QAEJ,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EAAE,WAAW;YAC9B,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI;gBAC9B,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;SACzD,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,gBAAgB,EAAE,cAAc,
|
|
1
|
+
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAy/B5C,CAAC"}
|
|
@@ -16,26 +16,6 @@ export const TOOL_DEFINITIONS = [
|
|
|
16
16
|
tags: ["pe", "dotnet", "triage"],
|
|
17
17
|
tier: "quick",
|
|
18
18
|
},
|
|
19
|
-
{
|
|
20
|
-
name: "pecheck",
|
|
21
|
-
description: "Analyze static properties of PE files.",
|
|
22
|
-
command: "pecheck",
|
|
23
|
-
inputStyle: "positional",
|
|
24
|
-
outputFormat: "text",
|
|
25
|
-
timeout: 60,
|
|
26
|
-
tags: ["pe", "dotnet"],
|
|
27
|
-
tier: "standard",
|
|
28
|
-
},
|
|
29
|
-
{
|
|
30
|
-
name: "pescan",
|
|
31
|
-
description: "Scan PE files for anomalies and notable indicators.",
|
|
32
|
-
command: "pescan",
|
|
33
|
-
inputStyle: "positional",
|
|
34
|
-
outputFormat: "text",
|
|
35
|
-
timeout: 60,
|
|
36
|
-
tags: ["pe", "dotnet"],
|
|
37
|
-
tier: "standard",
|
|
38
|
-
},
|
|
39
19
|
{
|
|
40
20
|
name: "diec",
|
|
41
21
|
description: "Determine types of files and examine file properties.",
|
|
@@ -82,13 +62,13 @@ export const TOOL_DEFINITIONS = [
|
|
|
82
62
|
tier: "standard",
|
|
83
63
|
},
|
|
84
64
|
{
|
|
85
|
-
name: "
|
|
86
|
-
description: "
|
|
87
|
-
command: "
|
|
65
|
+
name: "portex",
|
|
66
|
+
description: "Statically analyze PE files for anomalies, structure, and metadata.",
|
|
67
|
+
command: "portex",
|
|
88
68
|
inputStyle: "positional",
|
|
89
69
|
outputFormat: "text",
|
|
90
|
-
timeout:
|
|
91
|
-
tags: ["pe"
|
|
70
|
+
timeout: 90,
|
|
71
|
+
tags: ["pe"],
|
|
92
72
|
tier: "standard",
|
|
93
73
|
},
|
|
94
74
|
{
|
|
@@ -101,6 +81,46 @@ export const TOOL_DEFINITIONS = [
|
|
|
101
81
|
tags: ["pe", "dotnet", "yara"],
|
|
102
82
|
tier: "standard",
|
|
103
83
|
},
|
|
84
|
+
{
|
|
85
|
+
name: "pecheck",
|
|
86
|
+
description: "Analyze static properties of PE files.",
|
|
87
|
+
command: "pecheck",
|
|
88
|
+
inputStyle: "positional",
|
|
89
|
+
outputFormat: "text",
|
|
90
|
+
timeout: 60,
|
|
91
|
+
tags: ["pe", "dotnet"],
|
|
92
|
+
tier: "standard",
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
name: "disitool",
|
|
96
|
+
description: "Examine and manipulate embedded Authenticode digital signatures in PE files.",
|
|
97
|
+
command: "disitool.py",
|
|
98
|
+
inputStyle: "positional",
|
|
99
|
+
outputFormat: "text",
|
|
100
|
+
timeout: 60,
|
|
101
|
+
tags: ["pe"],
|
|
102
|
+
tier: "deep",
|
|
103
|
+
},
|
|
104
|
+
{
|
|
105
|
+
name: "pescan",
|
|
106
|
+
description: "Scan PE files for anomalies and notable indicators.",
|
|
107
|
+
command: "pescan",
|
|
108
|
+
inputStyle: "positional",
|
|
109
|
+
outputFormat: "text",
|
|
110
|
+
timeout: 60,
|
|
111
|
+
tags: ["pe", "dotnet"],
|
|
112
|
+
tier: "standard",
|
|
113
|
+
},
|
|
114
|
+
{
|
|
115
|
+
name: "signsrch",
|
|
116
|
+
description: "Find patterns of common encryption, compression, or encoding algorithms.",
|
|
117
|
+
command: "signsrch",
|
|
118
|
+
inputStyle: "positional",
|
|
119
|
+
outputFormat: "text",
|
|
120
|
+
timeout: 60,
|
|
121
|
+
tags: ["pe", "dotnet", "crypto"],
|
|
122
|
+
tier: "standard",
|
|
123
|
+
},
|
|
104
124
|
{
|
|
105
125
|
name: "ilspycmd",
|
|
106
126
|
description: "Decompile .NET assemblies to C# source code.",
|
|
@@ -123,6 +143,37 @@ export const TOOL_DEFINITIONS = [
|
|
|
123
143
|
tags: ["pe", "unpacking"],
|
|
124
144
|
tier: "standard",
|
|
125
145
|
},
|
|
146
|
+
{
|
|
147
|
+
name: "manalyze",
|
|
148
|
+
description: "Statically analyze PE files for imports, resources, and anomalies.",
|
|
149
|
+
command: "manalyze",
|
|
150
|
+
inputStyle: "positional",
|
|
151
|
+
outputFormat: "text",
|
|
152
|
+
timeout: 60,
|
|
153
|
+
tags: ["pe"],
|
|
154
|
+
tier: "standard",
|
|
155
|
+
},
|
|
156
|
+
// ── Cobalt Strike ──────────────────────────────────────────────────────
|
|
157
|
+
{
|
|
158
|
+
name: "1768",
|
|
159
|
+
description: "Analyze Cobalt Strike beacons and extract configuration details.",
|
|
160
|
+
command: "1768.py",
|
|
161
|
+
inputStyle: "positional",
|
|
162
|
+
outputFormat: "text",
|
|
163
|
+
timeout: 60,
|
|
164
|
+
tags: ["pe", "cobalt-strike"],
|
|
165
|
+
tier: "standard",
|
|
166
|
+
},
|
|
167
|
+
{
|
|
168
|
+
name: "cs-decrypt-metadata",
|
|
169
|
+
description: "Decrypt and analyze Cobalt Strike beacon metadata.",
|
|
170
|
+
command: "cs-decrypt-metadata.py",
|
|
171
|
+
inputStyle: "positional",
|
|
172
|
+
outputFormat: "text",
|
|
173
|
+
timeout: 60,
|
|
174
|
+
tags: ["pe", "cobalt-strike"],
|
|
175
|
+
tier: "deep",
|
|
176
|
+
},
|
|
126
177
|
// ── PE extras from demos ────────────────────────────────────────────────
|
|
127
178
|
{
|
|
128
179
|
name: "pedump",
|
|
@@ -187,6 +238,27 @@ export const TOOL_DEFINITIONS = [
|
|
|
187
238
|
tags: ["pdf"],
|
|
188
239
|
tier: "standard",
|
|
189
240
|
},
|
|
241
|
+
{
|
|
242
|
+
name: "pdftool",
|
|
243
|
+
description: "Analyze incremental updates in PDF files to detect hidden payload swaps.",
|
|
244
|
+
command: "pdftool.py",
|
|
245
|
+
inputStyle: "positional",
|
|
246
|
+
outputFormat: "text",
|
|
247
|
+
timeout: 60,
|
|
248
|
+
tags: ["pdf"],
|
|
249
|
+
tier: "standard",
|
|
250
|
+
},
|
|
251
|
+
{
|
|
252
|
+
name: "pdfresurrect",
|
|
253
|
+
description: "Extract previous versions of content from PDF files.",
|
|
254
|
+
command: "pdfresurrect",
|
|
255
|
+
inputStyle: "positional",
|
|
256
|
+
fixedArgs: ["-w"],
|
|
257
|
+
outputFormat: "text",
|
|
258
|
+
timeout: 60,
|
|
259
|
+
tags: ["pdf"],
|
|
260
|
+
tier: "standard",
|
|
261
|
+
},
|
|
190
262
|
{
|
|
191
263
|
name: "peepdf-3",
|
|
192
264
|
description: "Examine elements of a PDF file for notable content.",
|
|
@@ -253,6 +325,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
253
325
|
tags: ["ole2"],
|
|
254
326
|
tier: "standard",
|
|
255
327
|
},
|
|
328
|
+
{
|
|
329
|
+
name: "msoffcrypto-crack",
|
|
330
|
+
description: "Attempt to recover the password of encrypted Microsoft Office documents.",
|
|
331
|
+
command: "msoffcrypto-crack.py",
|
|
332
|
+
inputStyle: "positional",
|
|
333
|
+
outputFormat: "text",
|
|
334
|
+
timeout: 120,
|
|
335
|
+
tags: ["ole2", "ooxml"],
|
|
336
|
+
tier: "standard",
|
|
337
|
+
},
|
|
256
338
|
{
|
|
257
339
|
name: "pcodedmp",
|
|
258
340
|
description: "Disassemble VBA p-code from Office documents.",
|
|
@@ -285,17 +367,17 @@ export const TOOL_DEFINITIONS = [
|
|
|
285
367
|
tags: ["ooxml", "jar"],
|
|
286
368
|
tier: "standard",
|
|
287
369
|
},
|
|
288
|
-
// ── RTF ─────────────────────────────────────────────────────────────────
|
|
289
370
|
{
|
|
290
|
-
name: "
|
|
291
|
-
description: "Extract
|
|
292
|
-
command: "
|
|
371
|
+
name: "xmldump",
|
|
372
|
+
description: "Extract and examine XML contents from OOXML documents.",
|
|
373
|
+
command: "xmldump.py",
|
|
293
374
|
inputStyle: "positional",
|
|
294
375
|
outputFormat: "text",
|
|
295
376
|
timeout: 60,
|
|
296
|
-
tags: ["
|
|
377
|
+
tags: ["ooxml"],
|
|
297
378
|
tier: "standard",
|
|
298
379
|
},
|
|
380
|
+
// ── RTF ─────────────────────────────────────────────────────────────────
|
|
299
381
|
{
|
|
300
382
|
name: "rtfdump",
|
|
301
383
|
description: "Analyze RTF files for embedded content.",
|
|
@@ -306,6 +388,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
306
388
|
tags: ["rtf"],
|
|
307
389
|
tier: "quick",
|
|
308
390
|
},
|
|
391
|
+
{
|
|
392
|
+
name: "rtfobj",
|
|
393
|
+
description: "Extract embedded objects from RTF files.",
|
|
394
|
+
command: "rtfobj.py",
|
|
395
|
+
inputStyle: "positional",
|
|
396
|
+
outputFormat: "text",
|
|
397
|
+
timeout: 60,
|
|
398
|
+
tags: ["rtf"],
|
|
399
|
+
tier: "standard",
|
|
400
|
+
},
|
|
309
401
|
// ── ELF analysis ────────────────────────────────────────────────────────
|
|
310
402
|
{
|
|
311
403
|
name: "readelf-header",
|
|
@@ -329,7 +421,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
329
421
|
tags: ["elf"],
|
|
330
422
|
tier: "standard",
|
|
331
423
|
},
|
|
332
|
-
// ──
|
|
424
|
+
// ── JavaScript analysis ────────────────────────────────────────────────
|
|
333
425
|
{
|
|
334
426
|
name: "js-beautify",
|
|
335
427
|
description: "Beautify and deobfuscate JavaScript, CSS, and HTML files.",
|
|
@@ -337,9 +429,43 @@ export const TOOL_DEFINITIONS = [
|
|
|
337
429
|
inputStyle: "positional",
|
|
338
430
|
outputFormat: "text",
|
|
339
431
|
timeout: 60,
|
|
340
|
-
tags: ["
|
|
432
|
+
tags: ["javascript"],
|
|
341
433
|
tier: "quick",
|
|
342
434
|
},
|
|
435
|
+
{
|
|
436
|
+
name: "box-js",
|
|
437
|
+
description: "Analyze and deobfuscate JavaScript in a sandbox.",
|
|
438
|
+
command: "box-js",
|
|
439
|
+
inputStyle: "positional",
|
|
440
|
+
fixedArgs: ["--output-dir", "/tmp/box-js-out"],
|
|
441
|
+
outputFormat: "text",
|
|
442
|
+
timeout: 120,
|
|
443
|
+
tags: ["javascript"],
|
|
444
|
+
tier: "standard",
|
|
445
|
+
exitCodeHints: { 1: "Script execution failed — may require specific JS runtime features or have syntax box-js cannot handle." },
|
|
446
|
+
},
|
|
447
|
+
{
|
|
448
|
+
name: "jstillery",
|
|
449
|
+
description: "Deobfuscate JavaScript using AST-based partial evaluation.",
|
|
450
|
+
command: "jstillery",
|
|
451
|
+
inputStyle: "positional",
|
|
452
|
+
outputFormat: "text",
|
|
453
|
+
timeout: 120,
|
|
454
|
+
tags: ["javascript"],
|
|
455
|
+
tier: "deep",
|
|
456
|
+
},
|
|
457
|
+
{
|
|
458
|
+
name: "spidermonkey",
|
|
459
|
+
description: "Execute JavaScript with SpiderMonkey engine using browser/PDF object emulation.",
|
|
460
|
+
command: "js",
|
|
461
|
+
inputStyle: "positional",
|
|
462
|
+
fixedArgs: ["-f", "/usr/share/remnux/objects.js"],
|
|
463
|
+
outputFormat: "text",
|
|
464
|
+
timeout: 120,
|
|
465
|
+
tags: ["javascript"],
|
|
466
|
+
tier: "deep",
|
|
467
|
+
},
|
|
468
|
+
// ── Script / text analysis ──────────────────────────────────────────────
|
|
343
469
|
{
|
|
344
470
|
name: "strings",
|
|
345
471
|
description: "Extract printable strings from binary files.",
|
|
@@ -347,20 +473,18 @@ export const TOOL_DEFINITIONS = [
|
|
|
347
473
|
inputStyle: "positional",
|
|
348
474
|
outputFormat: "text",
|
|
349
475
|
timeout: 60,
|
|
350
|
-
tags: ["script", "fallback", "strings"],
|
|
476
|
+
tags: ["javascript", "script", "fallback", "strings"],
|
|
351
477
|
tier: "quick",
|
|
352
478
|
},
|
|
353
479
|
{
|
|
354
|
-
name: "
|
|
355
|
-
description: "
|
|
356
|
-
command: "
|
|
480
|
+
name: "decode-vbe",
|
|
481
|
+
description: "Decode VBE-encoded VBScript files to readable source.",
|
|
482
|
+
command: "decode-vbe.py",
|
|
357
483
|
inputStyle: "positional",
|
|
358
|
-
fixedArgs: ["--output-dir", "/tmp/box-js-out"],
|
|
359
484
|
outputFormat: "text",
|
|
360
|
-
timeout:
|
|
485
|
+
timeout: 60,
|
|
361
486
|
tags: ["script"],
|
|
362
|
-
tier: "
|
|
363
|
-
exitCodeHints: { 1: "Script execution failed — may require specific JS runtime features or have syntax box-js cannot handle." },
|
|
487
|
+
tier: "quick",
|
|
364
488
|
},
|
|
365
489
|
{
|
|
366
490
|
name: "base64dump",
|
|
@@ -369,11 +493,32 @@ export const TOOL_DEFINITIONS = [
|
|
|
369
493
|
inputStyle: "positional",
|
|
370
494
|
outputFormat: "text",
|
|
371
495
|
timeout: 60,
|
|
372
|
-
tags: ["script", "fallback"],
|
|
496
|
+
tags: ["javascript", "script", "fallback"],
|
|
497
|
+
tier: "standard",
|
|
498
|
+
},
|
|
499
|
+
// ── Python bytecode analysis ──────────────────────────────────────────
|
|
500
|
+
{
|
|
501
|
+
name: "pycdc",
|
|
502
|
+
description: "Decompile Python bytecode (.pyc) to readable source code.",
|
|
503
|
+
command: "pycdc",
|
|
504
|
+
inputStyle: "positional",
|
|
505
|
+
outputFormat: "text",
|
|
506
|
+
timeout: 120,
|
|
507
|
+
tags: ["python"],
|
|
373
508
|
tier: "standard",
|
|
374
509
|
},
|
|
375
510
|
// ── JAR ─────────────────────────────────────────────────────────────────
|
|
376
511
|
// zipdump already covers JAR (tagged "jar")
|
|
512
|
+
{
|
|
513
|
+
name: "cfr",
|
|
514
|
+
description: "Decompile Java class files and JARs to readable Java source code.",
|
|
515
|
+
command: "cfr",
|
|
516
|
+
inputStyle: "positional",
|
|
517
|
+
outputFormat: "text",
|
|
518
|
+
timeout: 120,
|
|
519
|
+
tags: ["jar"],
|
|
520
|
+
tier: "standard",
|
|
521
|
+
},
|
|
377
522
|
// ── Email ───────────────────────────────────────────────────────────────
|
|
378
523
|
{
|
|
379
524
|
name: "emldump",
|
|
@@ -395,6 +540,17 @@ export const TOOL_DEFINITIONS = [
|
|
|
395
540
|
tags: ["email"],
|
|
396
541
|
tier: "quick",
|
|
397
542
|
},
|
|
543
|
+
// ── OneNote ─────────────────────────────────────────────────────────────
|
|
544
|
+
{
|
|
545
|
+
name: "onedump",
|
|
546
|
+
description: "Analyze OneNote documents and extract embedded files.",
|
|
547
|
+
command: "onedump.py",
|
|
548
|
+
inputStyle: "positional",
|
|
549
|
+
outputFormat: "text",
|
|
550
|
+
timeout: 60,
|
|
551
|
+
tags: ["onenote"],
|
|
552
|
+
tier: "standard",
|
|
553
|
+
},
|
|
398
554
|
// ── APK ─────────────────────────────────────────────────────────────────
|
|
399
555
|
{
|
|
400
556
|
name: "apktool",
|
|
@@ -417,6 +573,17 @@ export const TOOL_DEFINITIONS = [
|
|
|
417
573
|
tags: ["apk"],
|
|
418
574
|
tier: "standard",
|
|
419
575
|
},
|
|
576
|
+
{
|
|
577
|
+
name: "jadx",
|
|
578
|
+
description: "Decompile Android APK/DEX files to Java source code.",
|
|
579
|
+
command: "jadx",
|
|
580
|
+
inputStyle: "positional",
|
|
581
|
+
fixedArgs: ["-d", "/tmp/jadx-out", "--no-debug-info"],
|
|
582
|
+
outputFormat: "text",
|
|
583
|
+
timeout: 120,
|
|
584
|
+
tags: ["apk"],
|
|
585
|
+
tier: "standard",
|
|
586
|
+
},
|
|
420
587
|
// ── Memory forensics (Volatility 3) ─────────────────────────────────────
|
|
421
588
|
{
|
|
422
589
|
name: "vol3-info",
|
|
@@ -467,36 +634,24 @@ export const TOOL_DEFINITIONS = [
|
|
|
467
634
|
tier: "standard",
|
|
468
635
|
},
|
|
469
636
|
{
|
|
470
|
-
name: "vol3-
|
|
471
|
-
description: "
|
|
637
|
+
name: "vol3-psscan",
|
|
638
|
+
description: "Find hidden or unlinked processes via pool tag scanning.",
|
|
472
639
|
command: "vol3",
|
|
473
640
|
inputStyle: "flag",
|
|
474
641
|
inputFlag: "-f",
|
|
475
|
-
suffixArgs: ["windows.
|
|
642
|
+
suffixArgs: ["windows.psscan"],
|
|
476
643
|
outputFormat: "text",
|
|
477
644
|
timeout: 120,
|
|
478
645
|
tags: ["memory"],
|
|
479
646
|
tier: "standard",
|
|
480
647
|
},
|
|
481
648
|
{
|
|
482
|
-
name: "vol3-
|
|
483
|
-
description: "
|
|
484
|
-
command: "vol3",
|
|
485
|
-
inputStyle: "flag",
|
|
486
|
-
inputFlag: "-f",
|
|
487
|
-
suffixArgs: ["windows.malware.malfind"],
|
|
488
|
-
outputFormat: "text",
|
|
489
|
-
timeout: 300,
|
|
490
|
-
tags: ["memory"],
|
|
491
|
-
tier: "deep",
|
|
492
|
-
},
|
|
493
|
-
{
|
|
494
|
-
name: "vol3-psscan",
|
|
495
|
-
description: "Find hidden or unlinked processes via pool tag scanning.",
|
|
649
|
+
name: "vol3-cmdline",
|
|
650
|
+
description: "Extract command-line arguments for each process.",
|
|
496
651
|
command: "vol3",
|
|
497
652
|
inputStyle: "flag",
|
|
498
653
|
inputFlag: "-f",
|
|
499
|
-
suffixArgs: ["windows.
|
|
654
|
+
suffixArgs: ["windows.cmdline"],
|
|
500
655
|
outputFormat: "text",
|
|
501
656
|
timeout: 120,
|
|
502
657
|
tags: ["memory"],
|
|
@@ -526,18 +681,6 @@ export const TOOL_DEFINITIONS = [
|
|
|
526
681
|
tags: ["memory"],
|
|
527
682
|
tier: "standard",
|
|
528
683
|
},
|
|
529
|
-
{
|
|
530
|
-
name: "vol3-handles",
|
|
531
|
-
description: "List open handles for each process.",
|
|
532
|
-
command: "vol3",
|
|
533
|
-
inputStyle: "flag",
|
|
534
|
-
inputFlag: "-f",
|
|
535
|
-
suffixArgs: ["windows.handles"],
|
|
536
|
-
outputFormat: "text",
|
|
537
|
-
timeout: 300,
|
|
538
|
-
tags: ["memory"],
|
|
539
|
-
tier: "deep",
|
|
540
|
-
},
|
|
541
684
|
{
|
|
542
685
|
name: "vol3-hivelist",
|
|
543
686
|
description: "List registry hives found in memory.",
|
|
@@ -562,6 +705,30 @@ export const TOOL_DEFINITIONS = [
|
|
|
562
705
|
tags: ["memory"],
|
|
563
706
|
tier: "standard",
|
|
564
707
|
},
|
|
708
|
+
{
|
|
709
|
+
name: "vol3-malfind",
|
|
710
|
+
description: "Detect injected code and notable memory regions.",
|
|
711
|
+
command: "vol3",
|
|
712
|
+
inputStyle: "flag",
|
|
713
|
+
inputFlag: "-f",
|
|
714
|
+
suffixArgs: ["windows.malware.malfind"],
|
|
715
|
+
outputFormat: "text",
|
|
716
|
+
timeout: 300,
|
|
717
|
+
tags: ["memory"],
|
|
718
|
+
tier: "deep",
|
|
719
|
+
},
|
|
720
|
+
{
|
|
721
|
+
name: "vol3-handles",
|
|
722
|
+
description: "List open handles for each process.",
|
|
723
|
+
command: "vol3",
|
|
724
|
+
inputStyle: "flag",
|
|
725
|
+
inputFlag: "-f",
|
|
726
|
+
suffixArgs: ["windows.handles"],
|
|
727
|
+
outputFormat: "text",
|
|
728
|
+
timeout: 300,
|
|
729
|
+
tags: ["memory"],
|
|
730
|
+
tier: "deep",
|
|
731
|
+
},
|
|
565
732
|
// ── Didier Stevens utilities ──────────────────────────────────────────────
|
|
566
733
|
{
|
|
567
734
|
name: "translate",
|
|
@@ -603,6 +770,46 @@ export const TOOL_DEFINITIONS = [
|
|
|
603
770
|
tags: ["fallback"],
|
|
604
771
|
tier: "standard",
|
|
605
772
|
},
|
|
773
|
+
{
|
|
774
|
+
name: "cut-bytes",
|
|
775
|
+
description: "Cut out portions of data streams by position or pattern.",
|
|
776
|
+
command: "cut-bytes.py",
|
|
777
|
+
inputStyle: "positional",
|
|
778
|
+
outputFormat: "text",
|
|
779
|
+
timeout: 60,
|
|
780
|
+
tags: ["fallback"],
|
|
781
|
+
tier: "standard",
|
|
782
|
+
},
|
|
783
|
+
{
|
|
784
|
+
name: "format-bytes",
|
|
785
|
+
description: "Decompose and display structured binary data in readable format.",
|
|
786
|
+
command: "format-bytes.py",
|
|
787
|
+
inputStyle: "positional",
|
|
788
|
+
outputFormat: "text",
|
|
789
|
+
timeout: 60,
|
|
790
|
+
tags: ["fallback"],
|
|
791
|
+
tier: "standard",
|
|
792
|
+
},
|
|
793
|
+
{
|
|
794
|
+
name: "xor-kpa",
|
|
795
|
+
description: "Perform XOR decryption using known-plaintext attack.",
|
|
796
|
+
command: "xor-kpa.py",
|
|
797
|
+
inputStyle: "positional",
|
|
798
|
+
outputFormat: "text",
|
|
799
|
+
timeout: 60,
|
|
800
|
+
tags: ["fallback", "decryption"],
|
|
801
|
+
tier: "deep",
|
|
802
|
+
},
|
|
803
|
+
{
|
|
804
|
+
name: "sets",
|
|
805
|
+
description: "Perform set operations (union, intersection, difference) on text file lines or bytes.",
|
|
806
|
+
command: "sets.py",
|
|
807
|
+
inputStyle: "positional",
|
|
808
|
+
outputFormat: "text",
|
|
809
|
+
timeout: 60,
|
|
810
|
+
tags: ["fallback"],
|
|
811
|
+
tier: "deep",
|
|
812
|
+
},
|
|
606
813
|
// ── Shellcode analysis ─────────────────────────────────────────────────
|
|
607
814
|
{
|
|
608
815
|
name: "scdbgc",
|
|
@@ -614,7 +821,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
614
821
|
outputFormat: "text",
|
|
615
822
|
timeout: 60,
|
|
616
823
|
tags: ["shellcode"],
|
|
617
|
-
tier: "
|
|
824
|
+
tier: "standard",
|
|
618
825
|
},
|
|
619
826
|
{
|
|
620
827
|
name: "speakeasy-sc-x86",
|
|
@@ -626,7 +833,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
626
833
|
outputFormat: "text",
|
|
627
834
|
timeout: 120,
|
|
628
835
|
tags: ["shellcode"],
|
|
629
|
-
tier: "
|
|
836
|
+
tier: "quick",
|
|
630
837
|
},
|
|
631
838
|
{
|
|
632
839
|
name: "speakeasy-sc-x64",
|
|
@@ -638,7 +845,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
638
845
|
outputFormat: "text",
|
|
639
846
|
timeout: 120,
|
|
640
847
|
tags: ["shellcode"],
|
|
641
|
-
tier: "
|
|
848
|
+
tier: "quick",
|
|
642
849
|
},
|
|
643
850
|
{
|
|
644
851
|
name: "speakeasy",
|
|
@@ -686,7 +893,78 @@ export const TOOL_DEFINITIONS = [
|
|
|
686
893
|
tags: ["shellcode"],
|
|
687
894
|
tier: "deep",
|
|
688
895
|
},
|
|
896
|
+
// ── PCAP / network analysis ─────────────────────────────────────────────
|
|
897
|
+
{
|
|
898
|
+
name: "tshark-conversations",
|
|
899
|
+
description: "Summarize TCP/UDP conversations from a PCAP file.",
|
|
900
|
+
command: "tshark",
|
|
901
|
+
inputStyle: "flag",
|
|
902
|
+
inputFlag: "-r",
|
|
903
|
+
fixedArgs: ["-q", "-z", "conv,tcp"],
|
|
904
|
+
outputFormat: "text",
|
|
905
|
+
timeout: 60,
|
|
906
|
+
tags: ["pcap", "triage"],
|
|
907
|
+
tier: "quick",
|
|
908
|
+
},
|
|
909
|
+
{
|
|
910
|
+
name: "tshark-http",
|
|
911
|
+
description: "Show HTTP request/response statistics from a PCAP file.",
|
|
912
|
+
command: "tshark",
|
|
913
|
+
inputStyle: "flag",
|
|
914
|
+
inputFlag: "-r",
|
|
915
|
+
fixedArgs: ["-q", "-z", "http,tree"],
|
|
916
|
+
outputFormat: "text",
|
|
917
|
+
timeout: 60,
|
|
918
|
+
tags: ["pcap"],
|
|
919
|
+
tier: "standard",
|
|
920
|
+
},
|
|
921
|
+
{
|
|
922
|
+
name: "tshark-hierarchy",
|
|
923
|
+
description: "Show protocol hierarchy statistics from a PCAP file.",
|
|
924
|
+
command: "tshark",
|
|
925
|
+
inputStyle: "flag",
|
|
926
|
+
inputFlag: "-r",
|
|
927
|
+
fixedArgs: ["-q", "-z", "io,phs"],
|
|
928
|
+
outputFormat: "text",
|
|
929
|
+
timeout: 60,
|
|
930
|
+
tags: ["pcap"],
|
|
931
|
+
tier: "standard",
|
|
932
|
+
},
|
|
933
|
+
{
|
|
934
|
+
name: "tshark-dns",
|
|
935
|
+
description: "Extract DNS queries and responses from a PCAP file.",
|
|
936
|
+
command: "tshark",
|
|
937
|
+
inputStyle: "flag",
|
|
938
|
+
inputFlag: "-r",
|
|
939
|
+
fixedArgs: ["-Y", "dns", "-T", "fields", "-e", "dns.qry.name", "-e", "dns.a", "-e", "dns.resp.type"],
|
|
940
|
+
outputFormat: "text",
|
|
941
|
+
timeout: 60,
|
|
942
|
+
tags: ["pcap"],
|
|
943
|
+
tier: "standard",
|
|
944
|
+
},
|
|
945
|
+
{
|
|
946
|
+
name: "tshark-verbose",
|
|
947
|
+
description: "Full packet decode of first 50 packets from a PCAP file.",
|
|
948
|
+
command: "tshark",
|
|
949
|
+
inputStyle: "flag",
|
|
950
|
+
inputFlag: "-r",
|
|
951
|
+
fixedArgs: ["-V", "-c", "50"],
|
|
952
|
+
outputFormat: "text",
|
|
953
|
+
timeout: 120,
|
|
954
|
+
tags: ["pcap"],
|
|
955
|
+
tier: "deep",
|
|
956
|
+
},
|
|
689
957
|
// ── Cross-type / general ────────────────────────────────────────────────
|
|
958
|
+
{
|
|
959
|
+
name: "ssdeep",
|
|
960
|
+
description: "Compute fuzzy hash (ssdeep) for file similarity comparison.",
|
|
961
|
+
command: "ssdeep",
|
|
962
|
+
inputStyle: "positional",
|
|
963
|
+
outputFormat: "text",
|
|
964
|
+
timeout: 30,
|
|
965
|
+
tags: ["pe", "dotnet", "elf", "pdf", "ole2", "ooxml", "rtf", "jar", "apk", "pcap", "fallback"],
|
|
966
|
+
tier: "quick",
|
|
967
|
+
},
|
|
690
968
|
{
|
|
691
969
|
name: "exiftool",
|
|
692
970
|
description: "Read and analyze EXIF metadata from various file types.",
|
|
@@ -708,5 +986,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
708
986
|
tags: ["fallback"],
|
|
709
987
|
tier: "standard",
|
|
710
988
|
},
|
|
989
|
+
{
|
|
990
|
+
name: "xorsearch.py",
|
|
991
|
+
description: "Search for XOR/ROL/ROT/SHIFT encoded strings with JSON output and YARA support.",
|
|
992
|
+
command: "xorsearch.py",
|
|
993
|
+
inputStyle: "positional",
|
|
994
|
+
fixedArgs: ["-J"],
|
|
995
|
+
outputFormat: "json",
|
|
996
|
+
timeout: 60,
|
|
997
|
+
tags: ["fallback"],
|
|
998
|
+
tier: "standard",
|
|
999
|
+
},
|
|
711
1000
|
];
|
|
712
1001
|
//# sourceMappingURL=definitions.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QAC1C,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,KAAK,CAAC;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,UAAU,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QACnC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACzB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,MAAM;KACb;IAED;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,WAAW,CAAC;QACxB,UAAU,EAAE,CAAC,oBAAoB,CAAC;QAClC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,OAAO;KACd;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QACvC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC9C,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,CAAC,EAAE,yGAAyG,EAAE;KAChI;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E,4CAA4C;IAE5C,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,OAAO;KACd;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,yBAAyB,CAAC;QACvC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IAED;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAC1E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;QAC5E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QACjF,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;CACF,CAAC"}
|
|
1
|
+
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QAC1C,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,KAAK,CAAC;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,UAAU,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QACnC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACzB,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QAC7B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,MAAM;KACb;IAED;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,WAAW,CAAC;QACxB,UAAU,EAAE,CAAC,oBAAoB,CAAC;QAClC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wDAAwD;QACrE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC9C,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,CAAC,EAAE,yGAAyG,EAAE;KAChI;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC;QACjD,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QACrD,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IAED,yEAAyE;IACzE;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E,4CAA4C;IAC5C;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,OAAO;KACd;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,SAAS,CAAC;QACjB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC;QACrD,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,yBAAyB,CAAC;QACvC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;QAChC,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uFAAuF;QACpG,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM;KACb;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAC1E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;QAC5E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;QACpC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACjC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC;QACpG,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC7B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;QAC9F,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QACjF,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;CACF,CAAC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Preprocessors — transforms applied before analysis tools run.
|
|
3
|
+
*
|
|
4
|
+
* Preprocessors detect conditions (encrypted Office docs, bloated PEs,
|
|
5
|
+
* PyInstaller bundles) and produce a cleaned/extracted version of the file
|
|
6
|
+
* for subsequent analysis tools to operate on.
|
|
7
|
+
*/
|
|
8
|
+
export interface Preprocessor {
|
|
9
|
+
/** Unique name for logging */
|
|
10
|
+
name: string;
|
|
11
|
+
/** Human-readable description shown in analysis output */
|
|
12
|
+
description: string;
|
|
13
|
+
/** File type categories this preprocessor applies to */
|
|
14
|
+
categories: string[];
|
|
15
|
+
/**
|
|
16
|
+
* Shell command to detect whether preprocessing is needed.
|
|
17
|
+
* Exit code 0 = preprocessing needed, non-zero = skip.
|
|
18
|
+
*/
|
|
19
|
+
detectCommand: (filePath: string) => string;
|
|
20
|
+
/**
|
|
21
|
+
* Shell command to run the preprocessor.
|
|
22
|
+
* Should write output to `outputPath`.
|
|
23
|
+
*/
|
|
24
|
+
processCommand: (filePath: string, outputPath: string) => string;
|
|
25
|
+
/** Timeout in milliseconds */
|
|
26
|
+
timeout: number;
|
|
27
|
+
}
|
|
28
|
+
export declare const PREPROCESSORS: Preprocessor[];
|
|
29
|
+
/**
|
|
30
|
+
* Get preprocessors applicable to a given file type category.
|
|
31
|
+
*/
|
|
32
|
+
export declare function getPreprocessors(categoryName: string): Preprocessor[];
|
|
33
|
+
//# sourceMappingURL=preprocessors.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"preprocessors.d.ts","sourceRoot":"","sources":["../../src/tools/preprocessors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C;;;OAGG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,YAAY,EAkCvC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,EAAE,CAErE"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Preprocessors — transforms applied before analysis tools run.
|
|
3
|
+
*
|
|
4
|
+
* Preprocessors detect conditions (encrypted Office docs, bloated PEs,
|
|
5
|
+
* PyInstaller bundles) and produce a cleaned/extracted version of the file
|
|
6
|
+
* for subsequent analysis tools to operate on.
|
|
7
|
+
*/
|
|
8
|
+
/** Escape a value for safe inclusion in a single-quoted shell string. */
|
|
9
|
+
function shellEscape(value) {
|
|
10
|
+
return `'${value.replace(/'/g, "'\\''")}'`;
|
|
11
|
+
}
|
|
12
|
+
export const PREPROCESSORS = [
|
|
13
|
+
{
|
|
14
|
+
name: "msoffcrypto-tool",
|
|
15
|
+
description: "Decrypt password-protected Office documents",
|
|
16
|
+
categories: ["OLE2", "OOXML"],
|
|
17
|
+
// msoffcrypto-tool -t tests if file is encrypted (exit 0 = encrypted)
|
|
18
|
+
detectCommand: (fp) => `msoffcrypto-tool -t ${shellEscape(fp)}`,
|
|
19
|
+
// -p "" tries empty password and the default VelvetSweatshop password
|
|
20
|
+
processCommand: (fp, out) => `msoffcrypto-tool -p "" ${shellEscape(fp)} ${shellEscape(out)}`,
|
|
21
|
+
timeout: 30000,
|
|
22
|
+
},
|
|
23
|
+
{
|
|
24
|
+
name: "debloat",
|
|
25
|
+
description: "Remove junk from artificially bloated PE files",
|
|
26
|
+
categories: ["PE", "DOTNET"],
|
|
27
|
+
// Only debloat if file is >50MB
|
|
28
|
+
detectCommand: (fp) => `test $(stat -c%s ${shellEscape(fp)} 2>/dev/null || stat -f%z ${shellEscape(fp)}) -gt 52428800`,
|
|
29
|
+
processCommand: (fp, out) => `debloat -o ${shellEscape(out)} ${shellEscape(fp)}`,
|
|
30
|
+
timeout: 60000,
|
|
31
|
+
},
|
|
32
|
+
{
|
|
33
|
+
name: "pyinstxtractor",
|
|
34
|
+
description: "Extract files from PyInstaller bundles",
|
|
35
|
+
categories: ["PE"],
|
|
36
|
+
// Check for PyInstaller magic bytes at end of file
|
|
37
|
+
detectCommand: (fp) => `python3 -c "import sys; f=open(sys.argv[1],'rb'); f.seek(-24,2); exit(0 if f.read(13)==b'MEI\\x0c\\x0b\\x0a\\x0b\\x0e' else 1)" ${shellEscape(fp)}`,
|
|
38
|
+
processCommand: (fp, out) => `pyinstxtractor ${shellEscape(fp)} -d ${shellEscape(out)}`,
|
|
39
|
+
timeout: 60000,
|
|
40
|
+
},
|
|
41
|
+
];
|
|
42
|
+
/**
|
|
43
|
+
* Get preprocessors applicable to a given file type category.
|
|
44
|
+
*/
|
|
45
|
+
export function getPreprocessors(categoryName) {
|
|
46
|
+
return PREPROCESSORS.filter((pp) => pp.categories.includes(categoryName));
|
|
47
|
+
}
|
|
48
|
+
//# sourceMappingURL=preprocessors.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"preprocessors.js","sourceRoot":"","sources":["../../src/tools/preprocessors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH,yEAAyE;AACzE,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,sEAAsE;QACtE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,WAAW,CAAC,EAAE,CAAC,EAAE;QAC/D,sEAAsE;QACtE,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,0BAA0B,WAAW,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;QACjE,OAAO,EAAE,KAAK;KACf;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,gDAAgD;QAC7D,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5B,gCAAgC;QAChC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CACpB,oBAAoB,WAAW,CAAC,EAAE,CAAC,6BAA6B,WAAW,CAAC,EAAE,CAAC,gBAAgB;QACjG,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,cAAc,WAAW,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE;QACrD,OAAO,EAAE,KAAK;KACf;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,wCAAwC;QACrD,UAAU,EAAE,CAAC,IAAI,CAAC;QAClB,mDAAmD;QACnD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CACpB,mIAAmI,WAAW,CAAC,EAAE,CAAC,EAAE;QACtJ,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,kBAAkB,WAAW,CAAC,EAAE,CAAC,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE;QAC5D,OAAO,EAAE,KAAK;KACf;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5E,CAAC"}
|