@remnux/mcp-server 0.1.13 → 0.1.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -6
- package/dist/file-type-mappings.d.ts.map +1 -1
- package/dist/file-type-mappings.js +11 -0
- package/dist/file-type-mappings.js.map +1 -1
- package/dist/handlers/analyze-file.d.ts.map +1 -1
- package/dist/handlers/analyze-file.js +45 -1
- package/dist/handlers/analyze-file.js.map +1 -1
- package/dist/handlers/suggest-tools.d.ts.map +1 -1
- package/dist/handlers/suggest-tools.js +13 -7
- package/dist/handlers/suggest-tools.js.map +1 -1
- package/dist/tools/definitions.d.ts.map +1 -1
- package/dist/tools/definitions.js +232 -7
- package/dist/tools/definitions.js.map +1 -1
- package/dist/tools/preprocessors.d.ts +33 -0
- package/dist/tools/preprocessors.d.ts.map +1 -0
- package/dist/tools/preprocessors.js +48 -0
- package/dist/tools/preprocessors.js.map +1 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -432,13 +432,23 @@ claude mcp add remnux --transport http http://REMNUX_IP:3000/mcp \
|
|
|
432
432
|
|
|
433
433
|
| Tier | Behavior |
|
|
434
434
|
|------|----------|
|
|
435
|
-
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings, js-beautify, decode-vbe) |
|
|
436
|
-
| `standard` | Default — all category tools |
|
|
437
|
-
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, jstillery, spidermonkey, full decompilation) |
|
|
435
|
+
| `quick` | Fast triage tools only (peframe, pdfid, oleid, diec, readelf, strings, js-beautify, decode-vbe, tshark conversations, ssdeep) |
|
|
436
|
+
| `standard` | Default — all category tools (adds capa, olevba, oledump, cfr, jadx, tshark HTTP/DNS/protocol stats, etc.) |
|
|
437
|
+
| `deep` | Standard + expensive tools (pedump, brxor, peepdf-3, dotnetfile_dump, jstillery, spidermonkey, tshark full decode, full decompilation) |
|
|
438
438
|
|
|
439
439
|
**Output format:** Returns JSON with `detected_type`, `matched_category`, `depth`, `tools_run` (with output), `tools_failed`, and `tools_skipped`.
|
|
440
440
|
|
|
441
|
-
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, JavaScript (.js/.hta/.wsf/.html), shell scripts/VBS/PowerShell (.sh/.vbs/.ps1/.bat), Python bytecode (.pyc), JAR, email (EML), Android APK. Unknown types get fallback tools (strings, exiftool, base64dump, xorsearch).
|
|
441
|
+
**Supported file types:** PE/DLL, PDF, OLE2 Office (.doc/.xls/.ppt), OOXML (.docx/.xlsx/.pptx), RTF, ELF, JavaScript (.js/.hta/.wsf/.html), shell scripts/VBS/PowerShell (.sh/.vbs/.ps1/.bat), Python bytecode (.pyc), JAR, email (EML), Android APK, OneNote, PCAP/pcapng network captures. Unknown types get fallback tools (strings, exiftool, base64dump, xorsearch).
|
|
442
|
+
|
|
443
|
+
**Preprocessing:** Before running analysis tools, `analyze_file` checks for conditions that would prevent effective analysis and applies automatic fixes:
|
|
444
|
+
|
|
445
|
+
| Preprocessor | Condition | Action |
|
|
446
|
+
|--------------|-----------|--------|
|
|
447
|
+
| msoffcrypto-tool | Office doc is encrypted | Decrypt with empty/default password before running olevba/oledump |
|
|
448
|
+
| debloat | PE file is >50MB | Remove junk padding before running peframe/capa/etc |
|
|
449
|
+
| pyinstxtractor | PE is a PyInstaller bundle | Extract Python files before analysis |
|
|
450
|
+
|
|
451
|
+
Preprocessing results appear in the response under `preprocessing`. If a preprocessor fails (e.g., wrong password), analysis continues on the original file.
|
|
442
452
|
|
|
443
453
|
#### Example: Using extract_iocs
|
|
444
454
|
|
|
@@ -499,7 +509,7 @@ All three connection modes (docker, ssh, local) execute commands inside a dispos
|
|
|
499
509
|
| Command injection (prompt injection tricks AI into shell execution) | Analyst's workflow | Anti-injection patterns (`eval`, `$()`, backticks, etc.) |
|
|
500
510
|
| Dangerous pipes (attacker code piped to interpreters) | Analyst's workflow | Pipe-to-interpreter blocking (`\| bash`, `\| python`) |
|
|
501
511
|
| Catastrophic commands (`rm -rf /`, `mkfs`) | Analysis session | Narrow pattern guards for root wipes and filesystem formatting |
|
|
502
|
-
| Resource exhaustion (tools hang or consume excessive resources) | AI assistant / analysis session | Timeout enforcement (default 5 min), output budgets (
|
|
512
|
+
| Resource exhaustion (tools hang or consume excessive resources) | AI assistant / analysis session | Timeout enforcement (default 5 min), output budgets (40KB/tool default, 120KB total) |
|
|
503
513
|
| Archive zip-slip (path traversal in archives) | Analysis session | Post-extraction validation rejects path escape attempts |
|
|
504
514
|
| SSH injection | SSH connection | Proper shell escaping using single quotes |
|
|
505
515
|
|
|
@@ -547,7 +557,7 @@ These commands are intentionally allowed because REMnux is disposable and contai
|
|
|
547
557
|
3. **Pipe validation**: Pipes to code interpreters blocked
|
|
548
558
|
4. **Shell escaping**: Proper single-quote escaping for SSH commands
|
|
549
559
|
5. **Timeouts**: Long-running processes terminated (default 5 min)
|
|
550
|
-
6. **Output budgets**: Per-tool (
|
|
560
|
+
6. **Output budgets**: Per-tool (40KB default) and total (120KB) limits prevent AI context exhaustion
|
|
551
561
|
7. **Path sandboxing** (opt-in via `--sandbox`): Restricts file operations to samples/output dirs
|
|
552
562
|
|
|
553
563
|
### Prompt Injection from Malware
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,
|
|
1
|
+
{"version":3,"file":"file-type-mappings.d.ts","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yEAAyE;AACzE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,EAAE,SAAS,SAAS,EAA2C,CAAC;AAE7F,MAAM,WAAW,gBAAgB;IAC/B,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,EAAE,gBAAgB,EAyElD,CAAC;AAEF,yDAAyD;AACzD,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAmBnD,CAAC;AA0BF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAqDrF"}
|
|
@@ -79,6 +79,10 @@ export const FILE_TYPE_CATEGORIES = [
|
|
|
79
79
|
name: "APK",
|
|
80
80
|
patterns: [/\bAndroid\b/i],
|
|
81
81
|
},
|
|
82
|
+
{
|
|
83
|
+
name: "PCAP",
|
|
84
|
+
patterns: [/pcap capture/i, /tcpdump/i, /pcapng/i, /pcap-ng/i],
|
|
85
|
+
},
|
|
82
86
|
];
|
|
83
87
|
/** Maps category names to their primary registry tag. */
|
|
84
88
|
export const CATEGORY_TAG_MAP = {
|
|
@@ -96,6 +100,7 @@ export const CATEGORY_TAG_MAP = {
|
|
|
96
100
|
JAR: "jar",
|
|
97
101
|
Email: "email",
|
|
98
102
|
APK: "apk",
|
|
103
|
+
PCAP: "pcap",
|
|
99
104
|
Memory: "memory",
|
|
100
105
|
Shellcode: "shellcode",
|
|
101
106
|
Unknown: "fallback",
|
|
@@ -106,6 +111,8 @@ const JAVASCRIPT_EXTENSIONS = /\.(js|hta|wsf|html|htm)$/i;
|
|
|
106
111
|
const SCRIPT_EXTENSIONS = /\.(vbs|vbe|ps1|bat|cmd|sh|py|pl|rb)$/i;
|
|
107
112
|
/** Python bytecode extensions — used as fallback for data files. */
|
|
108
113
|
const PYTHON_EXTENSIONS = /\.(pyc|pyo)$/i;
|
|
114
|
+
/** PCAP file extensions — used as fallback for network captures. */
|
|
115
|
+
const PCAP_EXTENSIONS = /\.(pcap|pcapng|cap)$/i;
|
|
109
116
|
/** Memory image extensions — used as fallback when `file` reports "data". */
|
|
110
117
|
const MEMORY_EXTENSIONS = /\.(img|raw|mem|vmem|dmp|lime)$/i;
|
|
111
118
|
/** Shellcode extensions — used as fallback when `file` reports "data". */
|
|
@@ -151,6 +158,10 @@ export function matchFileType(fileOutput, filename) {
|
|
|
151
158
|
if (filename && OLE2_EXTENSIONS.test(filename) && /^data$|^CDF/i.test(typeOutput)) {
|
|
152
159
|
return FILE_TYPE_CATEGORIES.find((c) => c.name === "OLE2");
|
|
153
160
|
}
|
|
161
|
+
// Fallback: PCAP files — `file` may report "data" for some capture formats
|
|
162
|
+
if (filename && PCAP_EXTENSIONS.test(filename)) {
|
|
163
|
+
return FILE_TYPE_CATEGORIES.find((c) => c.name === "PCAP");
|
|
164
|
+
}
|
|
154
165
|
// Fallback: memory images — `file` reports "data" for raw memory dumps
|
|
155
166
|
if (filename && MEMORY_EXTENSIONS.test(filename) && /^data$/i.test(typeOutput)) {
|
|
156
167
|
return { name: "Memory", patterns: [] };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC;KAC7E;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,wBAAwB,CAAC;KACrC;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KACxC;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;KACjD;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,cAAc,CAAC;KAC3B;CACF,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,UAAU;CACpB,CAAC;AAEF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,iEAAiE;AACjE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,QAAiB;IACjE,iHAAiH;IACjH,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAElH,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;QACpE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,mFAAmF;IACnF,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC"}
|
|
1
|
+
{"version":3,"file":"file-type-mappings.js","sourceRoot":"","sources":["../src/file-type-mappings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAyB,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAU,CAAC;AAS7F,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,yEAAyE;IACzE,4EAA4E;IAC5E;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,cAAc,EAAE,iBAAiB,EAAE,cAAc,CAAC;KAC9D;IACD;QACE,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,CAAC,UAAU,EAAE,oBAAoB,CAAC;KAC7C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE;YACR,0BAA0B;YAC1B,QAAQ;YACR,0BAA0B;YAC1B,2BAA2B;YAC3B,gCAAgC;SACjC;KACF;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE;YACR,sBAAsB;YACtB,uBAAuB;YACvB,YAAY;SACb;KACF;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC;KAC3C;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD;QACE,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,CAAC,UAAU,CAAC;KACvB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,gBAAgB,CAAC;KAC7B;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,CAAC;KAC7E;IACD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,wBAAwB,CAAC;KACrC;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;KACxC;IACD;QACE,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC;KACjD;IACD;QACE,IAAI,EAAE,KAAK;QACX,QAAQ,EAAE,CAAC,cAAc,CAAC;KAC3B;IACD;QACE,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC;KAC/D;CACF,CAAC;AAEF,yDAAyD;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,YAAY;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,UAAU;CACpB,CAAC;AAEF,oEAAoE;AACpE,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AAE1D,gEAAgE;AAChE,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,oEAAoE;AACpE,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,iCAAiC,CAAC;AAE5D,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,gCAAgC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAE/D,iEAAiE;AACjE,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,QAAiB;IACjE,iHAAiH;IACjH,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAElH,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACxC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAE,CAAC;QACpE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;QACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAE,CAAC;QAChE,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,IAAI,QAAQ,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/C,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC;IAC9D,CAAC;IAED,uEAAuE;IACvE,IAAI,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,mFAAmF;IACnF,IAAI,QAAQ,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC3C,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"analyze-file.d.ts","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAsD3D,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,eAAe;;;;;;GAkPtB"}
|
|
@@ -8,6 +8,7 @@ import { REMnuxError } from "../errors/remnux-error.js";
|
|
|
8
8
|
import { toREMnuxError } from "../errors/error-mapper.js";
|
|
9
9
|
import { extractIOCs } from "../ioc/extractor.js";
|
|
10
10
|
import { filterStderrNoise } from "../utils/stderr-filter.js";
|
|
11
|
+
import { getPreprocessors } from "../tools/preprocessors.js";
|
|
11
12
|
const DEFAULT_OUTPUT_BUDGET = 40 * 1024; // 40KB default
|
|
12
13
|
const TOTAL_RESPONSE_BUDGET = 120 * 1024; // 120KB total across all tools
|
|
13
14
|
/** Per-tool output budgets — tools known to produce large output get tighter limits. */
|
|
@@ -26,6 +27,11 @@ const TOOL_OUTPUT_BUDGETS = {
|
|
|
26
27
|
base64dump: 15 * 1024,
|
|
27
28
|
"js-beautify": 15 * 1024,
|
|
28
29
|
"box-js": 20 * 1024,
|
|
30
|
+
cfr: 15 * 1024,
|
|
31
|
+
jadx: 15 * 1024,
|
|
32
|
+
manalyze: 15 * 1024,
|
|
33
|
+
"tshark-verbose": 30 * 1024,
|
|
34
|
+
"tshark-dns": 15 * 1024,
|
|
29
35
|
};
|
|
30
36
|
export async function handleAnalyzeFile(deps, args) {
|
|
31
37
|
const startTime = Date.now();
|
|
@@ -72,13 +78,50 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
72
78
|
const category = matchFileType(fileOutput, args.file);
|
|
73
79
|
const tag = CATEGORY_TAG_MAP[category.name] ?? "fallback";
|
|
74
80
|
const tools = toolRegistry.byTagAndTier(tag, depth);
|
|
81
|
+
// Step 2b: Run applicable preprocessors
|
|
82
|
+
let analysisPath = filePath;
|
|
83
|
+
const preprocessResults = [];
|
|
84
|
+
for (const pp of getPreprocessors(category.name)) {
|
|
85
|
+
try {
|
|
86
|
+
const detect = await connector.executeShell(pp.detectCommand(filePath), {
|
|
87
|
+
timeout: 10000,
|
|
88
|
+
cwd: config.samplesDir,
|
|
89
|
+
});
|
|
90
|
+
if (detect.exitCode !== 0)
|
|
91
|
+
continue; // Not applicable
|
|
92
|
+
const safeFile = args.file.replace(/[^a-zA-Z0-9._-]/g, "_");
|
|
93
|
+
const outPath = `${config.outputDir}/preprocessed-${pp.name}-${safeFile}`;
|
|
94
|
+
const result = await connector.executeShell(pp.processCommand(filePath, outPath), {
|
|
95
|
+
timeout: pp.timeout,
|
|
96
|
+
cwd: config.samplesDir,
|
|
97
|
+
});
|
|
98
|
+
if (result.exitCode === 0) {
|
|
99
|
+
analysisPath = outPath;
|
|
100
|
+
preprocessResults.push({ name: pp.name, description: pp.description, outputPath: outPath });
|
|
101
|
+
}
|
|
102
|
+
else {
|
|
103
|
+
preprocessResults.push({
|
|
104
|
+
name: pp.name,
|
|
105
|
+
description: pp.description,
|
|
106
|
+
error: result.stderr?.trim() || `Exit code ${result.exitCode}`,
|
|
107
|
+
});
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
catch (error) {
|
|
111
|
+
preprocessResults.push({
|
|
112
|
+
name: pp.name,
|
|
113
|
+
description: pp.description,
|
|
114
|
+
error: error instanceof Error ? error.message : "Unknown error",
|
|
115
|
+
});
|
|
116
|
+
}
|
|
117
|
+
}
|
|
75
118
|
const toolsRun = [];
|
|
76
119
|
const toolsFailed = [];
|
|
77
120
|
const toolsSkipped = [];
|
|
78
121
|
let totalOutputSize = 0;
|
|
79
122
|
// Step 3: Run each tool
|
|
80
123
|
for (const tool of tools) {
|
|
81
|
-
const cmd = buildCommandFromDefinition(tool,
|
|
124
|
+
const cmd = buildCommandFromDefinition(tool, analysisPath, config.outputDir);
|
|
82
125
|
// Ensure output directories exist for tools that write to --output-dir
|
|
83
126
|
if (tool.fixedArgs && config.outputDir) {
|
|
84
127
|
const dirIdx = tool.fixedArgs.indexOf("--output-dir");
|
|
@@ -177,6 +220,7 @@ export async function handleAnalyzeFile(deps, args) {
|
|
|
177
220
|
detected_type: fileOutput,
|
|
178
221
|
matched_category: category.name,
|
|
179
222
|
depth,
|
|
223
|
+
...(preprocessResults.length > 0 && { preprocessing: preprocessResults }),
|
|
180
224
|
analysis_guidance: "IMPORTANT: Many capabilities flagged by analysis tools (API imports like GetProcAddress/VirtualProtect, " +
|
|
181
225
|
"memory operations, TLS sections, anti-debug patterns) are common in BOTH malware and legitimate software. " +
|
|
182
226
|
"Do not assume malicious intent from flagged items alone. For each finding, consider: " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAe9D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,eAAe;AACxD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAEzE,wFAAwF;AACxF,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,SAAS,EAAE,EAAE,GAAG,IAAI;IACpB,KAAK,EAAE,EAAE,GAAG,IAAI;IAChB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,MAAM,EAAE,EAAE,GAAG,IAAI;IACjB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,aAAa,EAAE,EAAE,GAAG,IAAI;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI;CACpB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1H,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CACxC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAC7J,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAExE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAEzE,uEAAuE;YACvE,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3E,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,gBAAgB;oBACzB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnC,gFAAgF;gBAChF,yFAAyF;gBACzF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG;oBAC5C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9G,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,wEAAwE;gBACxE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,eAAe,CAAC,CAAC;gBAClG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC/C,IAAI,eAAmC,CAAC;gBACxC,IAAI,eAAe,EAAE,CAAC;oBACpB,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oBAC5D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBACrD,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjE,eAAe,GAAG,WAAW,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC9B,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU;wBAC3F,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,eAAe,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAElD,0CAA0C;gBAC1C,MAAM,aAAa,GAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,aAAa,CAAC,YAAY,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,GAAG,CAAC,eAAe,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;oBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI;wBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,aAAa,EAAE;qBACnD,CAAC;oBACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5D,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EACf,0GAA0G;gBAC1G,4GAA4G;gBAC5G,uFAAuF;gBACvF,6DAA6D;gBAC7D,wFAAwF;gBACxF,+CAA+C;gBAC/C,uEAAuE;gBACvE,8GAA8G;YAChH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI;gBACxB,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
|
|
1
|
+
{"version":3,"file":"analyze-file.js","sourceRoot":"","sources":["../../src/handlers/analyze-file.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAe7D,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,eAAe;AACxD,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,+BAA+B;AAEzE,wFAAwF;AACxF,MAAM,mBAAmB,GAA2B;IAClD,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,SAAS,EAAE,EAAE,GAAG,IAAI;IACpB,KAAK,EAAE,EAAE,GAAG,IAAI;IAChB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,MAAM,EAAE,EAAE,GAAG,IAAI;IACjB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,OAAO,EAAE,EAAE,GAAG,IAAI;IAClB,UAAU,EAAE,EAAE,GAAG,IAAI;IACrB,aAAa,EAAE,EAAE,GAAG,IAAI;IACxB,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,GAAG,EAAE,EAAE,GAAG,IAAI;IACd,IAAI,EAAE,EAAE,GAAG,IAAI;IACf,QAAQ,EAAE,EAAE,GAAG,IAAI;IACnB,gBAAgB,EAAE,EAAE,GAAG,IAAI;IAC3B,YAAY,EAAE,EAAE,GAAG,IAAI;CACxB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAiB,EACjB,IAAqB;IAErB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1H,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QAE5D,2BAA2B;QAC3B,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,cAAc,EAAE,IAAI,WAAW,CAChD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CACxC,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAC7J,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,UAAU,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,IAAI,IAAI,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC/C,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACpC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,4DAA4D,CAAC,CAAC;QAExE,uEAAuE;QACvE,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QAC1D,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAEpD,wCAAwC;QACxC,IAAI,YAAY,GAAG,QAAQ,CAAC;QAC5B,MAAM,iBAAiB,GAAsF,EAAE,CAAC;QAEhH,KAAK,MAAM,EAAE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;oBACtE,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;oBAAE,SAAS,CAAC,iBAAiB;gBAEtD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;gBAC5D,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,iBAAiB,EAAE,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;oBAChF,OAAO,EAAE,EAAE,CAAC,OAAO;oBACnB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,YAAY,GAAG,OAAO,CAAC;oBACvB,iBAAiB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC9F,CAAC;qBAAM,CAAC;oBACN,iBAAiB,CAAC,IAAI,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;wBACb,WAAW,EAAE,EAAE,CAAC,WAAW;wBAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,MAAM,CAAC,QAAQ,EAAE;qBAC/D,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,iBAAiB,CAAC,IAAI,CAAC;oBACrB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,WAAW,EAAE,EAAE,CAAC,WAAW;oBAC3B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAChE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,YAAY,GAAkB,EAAE,CAAC;QACvC,IAAI,eAAe,GAAG,CAAC,CAAC;QAExB,wBAAwB;QACxB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAE7E,uEAAuE;YACvE,IAAI,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;gBACtD,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;oBAChD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;oBAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC;wBACjD,CAAC,CAAC,MAAM,CAAC;oBACX,IAAI,CAAC;wBACH,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC3E,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YAED,mEAAmE;YACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAE/E,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE;oBAC/C,OAAO,EAAE,gBAAgB;oBACzB,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBACjC,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACnC,gFAAgF;gBAChF,yFAAyF;gBACzF,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,KAAK,GAAG;oBAC5C,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC;oBACjC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC9G,IAAI,cAAc,EAAE,CAAC;oBACnB,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACnF,SAAS;gBACX,CAAC;gBAED,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,IAAI,aAAa,CAAC;gBACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC9B,wEAAwE;gBACxE,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,qBAAqB,GAAG,eAAe,CAAC,CAAC;gBACpF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,EAAE,eAAe,CAAC,CAAC;gBAClG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC/C,IAAI,eAAmC,CAAC;gBACxC,IAAI,eAAe,EAAE,CAAC;oBACpB,qDAAqD;oBACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;oBAC5D,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,QAAQ,MAAM,CAAC;oBACnD,IAAI,CAAC;wBACH,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,WAAW,EAAE,CAAC;wBACrD,MAAM,SAAS,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;wBACjE,eAAe,GAAG,WAAW,CAAC;oBAChC,CAAC;oBAAC,MAAM,CAAC;wBACP,0DAA0D;oBAC5D,CAAC;oBACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;wBAC9B,qBAAqB,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU;wBAC3F,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,eAAe,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC1G,CAAC;gBAED,eAAe,IAAI,MAAM,CAAC,MAAM,CAAC;gBAEjC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAElD,0CAA0C;gBAC1C,MAAM,aAAa,GAA4B,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,EAAE,CAAC;oBACT,aAAa,CAAC,YAAY,GAAG,IAAI,CAAC;gBACpC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,GAAG;oBACZ,MAAM;oBACN,SAAS,EAAE,MAAM,CAAC,QAAQ;oBAC1B,GAAG,CAAC,eAAe,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,CAAC;oBACxE,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI;wBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;wBACzB,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,aAAa,EAAE;qBACnD,CAAC;oBACF,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;iBAC5F,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;gBACrE,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;aAC5D,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;QAE9C,6DAA6D;QAC7D,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvB,SAAS,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC3F,CAAC;QAED,OAAO,cAAc,CAAC,cAAc,EAAE;YACpC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,GAAG,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;YACzE,iBAAiB,EACf,0GAA0G;gBAC1G,4GAA4G;gBAC5G,uFAAuF;gBACvF,6DAA6D;gBAC7D,wFAAwF;gBACxF,+CAA+C;gBAC/C,uEAAuE;gBACvE,8GAA8G;YAChH,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI;gBACxB,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,WAAW,EAAE,SAAS,CAAC,OAAO;YAC9B,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,YAAY;SAC5B,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,cAAc,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;
|
|
1
|
+
{"version":3,"file":"suggest-tools.d.ts","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAwL5D,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,gBAAgB;;;;;;GA8FvB"}
|
|
@@ -17,21 +17,25 @@ const BASE_HINTS = {
|
|
|
17
17
|
"capa maps capabilities to MITRE ATT&CK. floss extracts obfuscated strings. " +
|
|
18
18
|
"portex provides comprehensive PE structure analysis including anomaly detection. " +
|
|
19
19
|
"yara-rules scans against community signatures for known malware families. " +
|
|
20
|
+
"1768.py analyzes Cobalt Strike beacons. disitool.py examines Authenticode signatures. " +
|
|
20
21
|
"For deep analysis, capa -vv shows matched rule details with addresses. " +
|
|
21
22
|
"pedump shows raw PE structure and brxor bruteforces XOR-encoded strings.",
|
|
22
23
|
PDF: "Start with pdfid to identify notable elements (/JS, /JavaScript, /OpenAction, /Launch). " +
|
|
23
24
|
"Use pdf-parser --stats for structural overview. If notable objects found, " +
|
|
24
25
|
"extract them with pdf-parser -o <obj_id> -d. " +
|
|
25
|
-
"
|
|
26
|
+
"pdftool.py analyzes incremental updates — shows what changed between PDF revisions. " +
|
|
27
|
+
"pdfresurrect extracts previous versions of content — recovers earlier document states. " +
|
|
26
28
|
"peepdf-3 provides interactive deep analysis. " +
|
|
27
29
|
"qpdf decrypts permission-locked PDFs. pdftk extracts metadata and document info.",
|
|
28
30
|
OLE2: "Start with oleid for risk indicators (macros, encryption, external links). " +
|
|
29
31
|
"olevba extracts and analyzes VBA macros — look for auto-execute triggers and notable keywords. " +
|
|
30
32
|
"oledump lists OLE streams; use -s <stream> -v to dump specific macro streams. " +
|
|
33
|
+
"msoffcrypto-crack.py attempts to recover passwords for encrypted documents. " +
|
|
31
34
|
"pcodedmp disassembles VBA p-code (useful when source is stomped). " +
|
|
32
35
|
"xlmdeobfuscator handles Excel 4.0 XLM macros.",
|
|
33
36
|
OOXML: "olevba handles both OLE2 and OOXML macro extraction. " +
|
|
34
37
|
"zipdump lists the ZIP structure — OOXML files are ZIP archives with XML inside. " +
|
|
38
|
+
"To examine XML: zipdump.py -s <stream_num> -d file.docx | xmldump.py pretty. " +
|
|
35
39
|
"Look for unusual entries or embedded OLE objects within the archive. " +
|
|
36
40
|
"pcodedmp disassembles VBA p-code. xlmdeobfuscator deobfuscates Excel 4.0 XLM macros.",
|
|
37
41
|
RTF: "rtfobj extracts embedded objects (OLE, packages) from RTF files. " +
|
|
@@ -50,7 +54,7 @@ const BASE_HINTS = {
|
|
|
50
54
|
"To extract scripts from HTML, use ExtractScripts via run_tool.",
|
|
51
55
|
Script: "base64dump finds and decodes Base64 and other encoded strings — " +
|
|
52
56
|
"common in PowerShell, bash, and VBScript malware. " +
|
|
53
|
-
"decode-vbe.py decodes VBE-encoded
|
|
57
|
+
"decode-vbe.py decodes VBE-encoded (.vbe) files only — look for VBScript.Encode marker. " +
|
|
54
58
|
"re-search extracts patterns using regular expressions. " +
|
|
55
59
|
"For PowerShell deobfuscation, consider running pwsh via run_tool. " +
|
|
56
60
|
"translate.py applies byte-level transforms. numbers-to-string.py decodes numeric payloads.",
|
|
@@ -67,11 +71,11 @@ const BASE_HINTS = {
|
|
|
67
71
|
APK: "apktool decompiles the APK to smali and extracts resources. " +
|
|
68
72
|
"droidlysis performs static analysis identifying permissions, API calls, and risk indicators. " +
|
|
69
73
|
"Look for excessive permissions, obfuscation, and notable network activity.",
|
|
70
|
-
OneNote: "OneNote file detected.
|
|
71
|
-
"Use strings and exiftool for
|
|
74
|
+
OneNote: "OneNote file detected. onedump.py analyzes OneNote documents and extracts embedded files. " +
|
|
75
|
+
"Use strings and exiftool for additional triage. " +
|
|
72
76
|
"OneNote files may contain embedded scripts, executables, or malicious attachments.",
|
|
73
|
-
Shellcode: "Raw shellcode detected.
|
|
74
|
-
"
|
|
77
|
+
Shellcode: "Raw shellcode detected. speakeasy emulates both x86 and x64 shellcode with Windows API emulation. " +
|
|
78
|
+
"scdbgc provides additional Win32 API call tracing for x86 shellcode. " +
|
|
75
79
|
"Look for resolved API names, network connections, file system access, and registry modifications in emulation output. " +
|
|
76
80
|
"For deep analysis, qltool (Qiling) provides multi-platform emulation and tracesc traces execution via Wine. " +
|
|
77
81
|
"Use strings and xorsearch for static indicators before emulation.",
|
|
@@ -83,9 +87,11 @@ const BASE_HINTS = {
|
|
|
83
87
|
"For deeper analysis, vol3-malfind detects injected code and vol3-handles lists open handles. " +
|
|
84
88
|
"For Linux memory images, use vol3-linux-pslist.",
|
|
85
89
|
Unknown: "File type not recognized. strings and exiftool provide basic triage. " +
|
|
86
|
-
"base64dump searches for encoded content. xorsearch
|
|
90
|
+
"base64dump searches for encoded content. xorsearch.py outputs JSON for structured analysis; xorsearch binary is faster for large files. " +
|
|
87
91
|
"translate.py applies byte-level transforms (XOR, shift). re-search.py extracts regex patterns. " +
|
|
88
92
|
"file-magic.py identifies embedded file types. numbers-to-string.py decodes numeric payloads. " +
|
|
93
|
+
"cut-bytes.py extracts byte ranges. format-bytes.py parses structured binary data. " +
|
|
94
|
+
"xor-kpa.py performs known-plaintext XOR attacks. " +
|
|
89
95
|
"Consider using 'file' or 'diec' via run_tool for deeper type identification.",
|
|
90
96
|
};
|
|
91
97
|
/** Extract observable properties from `file` command output. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,2EAA2E;QAC3E,oFAAoF;QACpF,yCAAyC;QACzC,wEAAwE;IAC1E,EAAE,EACA,+EAA+E;QAC/E,6EAA6E;QAC7E,mFAAmF;QACnF,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;IAC5E,GAAG,EACD,0FAA0F;QAC1F,4EAA4E;QAC5E,+CAA+C;QAC/C,
|
|
1
|
+
{"version":3,"file":"suggest-tools.js","sourceRoot":"","sources":["../../src/handlers/suggest-tools.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D;;GAEG;AACH,MAAM,UAAU,GAA2B;IACzC,MAAM,EACJ,2EAA2E;QAC3E,2EAA2E;QAC3E,oFAAoF;QACpF,yCAAyC;QACzC,wEAAwE;IAC1E,EAAE,EACA,+EAA+E;QAC/E,6EAA6E;QAC7E,mFAAmF;QACnF,4EAA4E;QAC5E,wFAAwF;QACxF,yEAAyE;QACzE,0EAA0E;IAC5E,GAAG,EACD,0FAA0F;QAC1F,4EAA4E;QAC5E,+CAA+C;QAC/C,sFAAsF;QACtF,yFAAyF;QACzF,+CAA+C;QAC/C,kFAAkF;IACpF,IAAI,EACF,6EAA6E;QAC7E,iGAAiG;QACjG,gFAAgF;QAChF,8EAA8E;QAC9E,oEAAoE;QACpE,+CAA+C;IACjD,KAAK,EACH,uDAAuD;QACvD,kFAAkF;QAClF,+EAA+E;QAC/E,uEAAuE;QACvE,sFAAsF;IACxF,GAAG,EACD,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;IACzE,GAAG,EACD,yDAAyD;QACzD,uEAAuE;QACvE,oEAAoE;QACpE,wEAAwE;IAC1E,UAAU,EACR,uEAAuE;QACvE,oEAAoE;QACpE,gFAAgF;QAChF,iEAAiE;QACjE,kFAAkF;QAClF,yFAAyF;QACzF,gEAAgE;IAClE,MAAM,EACJ,kEAAkE;QAClE,oDAAoD;QACpD,yFAAyF;QACzF,yDAAyD;QACzD,oEAAoE;QACpE,4FAA4F;IAC9F,MAAM,EACJ,mEAAmE;QACnE,oFAAoF;QACpF,wEAAwE;IAC1E,GAAG,EACD,qEAAqE;QACrE,yEAAyE;QACzE,8CAA8C;IAChD,KAAK,EACH,2DAA2D;QAC3D,iFAAiF;QACjF,qEAAqE;QACrE,kEAAkE;IACpE,GAAG,EACD,8DAA8D;QAC9D,+FAA+F;QAC/F,4EAA4E;IAC9E,OAAO,EACL,4FAA4F;QAC5F,kDAAkD;QAClD,oFAAoF;IACtF,SAAS,EACP,oGAAoG;QACpG,uEAAuE;QACvE,wHAAwH;QACxH,8GAA8G;QAC9G,mEAAmE;IACrE,MAAM,EACJ,iFAAiF;QACjF,wDAAwD;QACxD,uFAAuF;QACvF,2EAA2E;QAC3E,wEAAwE;QACxE,+FAA+F;QAC/F,iDAAiD;IACnD,OAAO,EACL,uEAAuE;QACvE,0IAA0I;QAC1I,iGAAiG;QACjG,+FAA+F;QAC/F,oFAAoF;QACpF,mDAAmD;QACnD,8EAA8E;CACjF,CAAC;AAWF,gEAAgE;AAChE,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IACvC,MAAM,KAAK,GAAmB,EAAE,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC;SAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;SACxD,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC;SAC9D,IAAI,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;IAE/D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,WAAW,CAAC;SAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC;SACtD,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;SAC1D,IAAI,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAE/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,QAAgB,EAAE,UAAkB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;IACxD,MAAM,KAAK,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CACT,oBAAoB,KAAK,CAAC,MAAM,IAAI;YACpC,2DAA2D;YAC3D,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK;gBACrB,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,yEAAyE,CAAC,CAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAChG,CAAC;IAED,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,QAAQ,6DAA6D,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,GAAG,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAiB,EACjB,IAAsB;IAEtB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,CAAC;QACL,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,UAAU,CAAc,CAAC;QAEtD,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,UAAU,CAAC,KAAK,IAAI,mBAAmB,EACvC,cAAc,EACd,YAAY,EACZ,kDAAkD,CACnD,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAE1H,mBAAmB;QACnB,IAAI,UAAkB,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/E,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,qDAAqD,EACrD,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,+BAA+B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;YACtG,OAAO,WAAW,CAAC,eAAe,EAAE,IAAI,WAAW,CACjD,GAAG,EACH,cAAc,EACd,cAAc,EACd,4CAA4C,CAC7C,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC;QACjE,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE3D,wEAAwE;QACxE,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC5C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,gDAAgD;gBAChD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,6BAA6B,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE;oBACjD,OAAO,EAAE,KAAK;oBACd,GAAG,EAAE,MAAM,CAAC,UAAU;iBACvB,CAAC,CAAC;gBACH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBACxB,IAAI,GAAG;wBAAE,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,KAAK,MAAM,CAAC,IAAI,cAAc;oBAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;YAClB,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAc,EAAE,CAAC;SAC3E,CAAC,CAAC,CAAC;QAEJ,OAAO,cAAc,CAAC,eAAe,EAAE;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,UAAU;YACzB,gBAAgB,EAAE,QAAQ,CAAC,IAAI;YAC/B,KAAK;YACL,iBAAiB,EAAE,WAAW;YAC9B,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI;gBAC9B,OAAO,EAAE,qCAAqC,QAAQ,CAAC,IAAI,eAAe,KAAK,+CAA+C;aAC/H,CAAC;YACF,cAAc,EAAE,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;SACzD,EAAE,SAAS,CAAC,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,WAAW,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;IACzF,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,gBAAgB,EAAE,cAAc,
|
|
1
|
+
{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAy/B5C,CAAC"}
|
|
@@ -91,6 +91,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
91
91
|
tags: ["pe", "dotnet"],
|
|
92
92
|
tier: "standard",
|
|
93
93
|
},
|
|
94
|
+
{
|
|
95
|
+
name: "disitool",
|
|
96
|
+
description: "Examine and manipulate embedded Authenticode digital signatures in PE files.",
|
|
97
|
+
command: "disitool.py",
|
|
98
|
+
inputStyle: "positional",
|
|
99
|
+
outputFormat: "text",
|
|
100
|
+
timeout: 60,
|
|
101
|
+
tags: ["pe"],
|
|
102
|
+
tier: "deep",
|
|
103
|
+
},
|
|
94
104
|
{
|
|
95
105
|
name: "pescan",
|
|
96
106
|
description: "Scan PE files for anomalies and notable indicators.",
|
|
@@ -100,6 +110,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
100
110
|
timeout: 60,
|
|
101
111
|
tags: ["pe", "dotnet"],
|
|
102
112
|
tier: "standard",
|
|
113
|
+
exitCodeHints: { 1: "pescan requires pev plugins — ensure /usr/local/lib/pev/plugins exists" },
|
|
103
114
|
},
|
|
104
115
|
{
|
|
105
116
|
name: "signsrch",
|
|
@@ -123,16 +134,46 @@ export const TOOL_DEFINITIONS = [
|
|
|
123
134
|
},
|
|
124
135
|
{
|
|
125
136
|
name: "upx-decompress",
|
|
126
|
-
description: "Decompress UPX-packed executables.",
|
|
137
|
+
description: "Decompress UPX-packed executables in-place (keeps backup as .exe~).",
|
|
127
138
|
command: "upx",
|
|
128
139
|
inputStyle: "positional",
|
|
129
|
-
fixedArgs: ["-d"],
|
|
130
|
-
suffixArgs: ["-o", "/tmp/unpacked"],
|
|
140
|
+
fixedArgs: ["-d", "-k"],
|
|
131
141
|
outputFormat: "text",
|
|
132
142
|
timeout: 60,
|
|
133
143
|
tags: ["pe", "unpacking"],
|
|
134
144
|
tier: "standard",
|
|
135
145
|
},
|
|
146
|
+
{
|
|
147
|
+
name: "manalyze",
|
|
148
|
+
description: "Statically analyze PE files for imports, resources, and anomalies.",
|
|
149
|
+
command: "manalyze",
|
|
150
|
+
inputStyle: "positional",
|
|
151
|
+
outputFormat: "text",
|
|
152
|
+
timeout: 60,
|
|
153
|
+
tags: ["pe"],
|
|
154
|
+
tier: "standard",
|
|
155
|
+
},
|
|
156
|
+
// ── Cobalt Strike ──────────────────────────────────────────────────────
|
|
157
|
+
{
|
|
158
|
+
name: "1768",
|
|
159
|
+
description: "Analyze Cobalt Strike beacons and extract configuration details.",
|
|
160
|
+
command: "1768.py",
|
|
161
|
+
inputStyle: "positional",
|
|
162
|
+
outputFormat: "text",
|
|
163
|
+
timeout: 60,
|
|
164
|
+
tags: ["pe", "cobalt-strike"],
|
|
165
|
+
tier: "standard",
|
|
166
|
+
},
|
|
167
|
+
{
|
|
168
|
+
name: "cs-decrypt-metadata",
|
|
169
|
+
description: "Decrypt and analyze Cobalt Strike beacon metadata.",
|
|
170
|
+
command: "cs-decrypt-metadata.py",
|
|
171
|
+
inputStyle: "positional",
|
|
172
|
+
outputFormat: "text",
|
|
173
|
+
timeout: 60,
|
|
174
|
+
tags: ["pe", "cobalt-strike"],
|
|
175
|
+
tier: "deep",
|
|
176
|
+
},
|
|
136
177
|
// ── PE extras from demos ────────────────────────────────────────────────
|
|
137
178
|
{
|
|
138
179
|
name: "pedump",
|
|
@@ -197,12 +238,22 @@ export const TOOL_DEFINITIONS = [
|
|
|
197
238
|
tags: ["pdf"],
|
|
198
239
|
tier: "standard",
|
|
199
240
|
},
|
|
241
|
+
{
|
|
242
|
+
name: "pdftool",
|
|
243
|
+
description: "Analyze incremental updates in PDF files to detect hidden payload swaps.",
|
|
244
|
+
command: "pdftool.py",
|
|
245
|
+
inputStyle: "positional",
|
|
246
|
+
fixedArgs: ["iu"],
|
|
247
|
+
outputFormat: "text",
|
|
248
|
+
timeout: 60,
|
|
249
|
+
tags: ["pdf"],
|
|
250
|
+
tier: "standard",
|
|
251
|
+
},
|
|
200
252
|
{
|
|
201
253
|
name: "pdfresurrect",
|
|
202
254
|
description: "Extract previous versions of content from PDF files.",
|
|
203
255
|
command: "pdfresurrect",
|
|
204
256
|
inputStyle: "positional",
|
|
205
|
-
fixedArgs: ["-w"],
|
|
206
257
|
outputFormat: "text",
|
|
207
258
|
timeout: 60,
|
|
208
259
|
tags: ["pdf"],
|
|
@@ -274,6 +325,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
274
325
|
tags: ["ole2"],
|
|
275
326
|
tier: "standard",
|
|
276
327
|
},
|
|
328
|
+
{
|
|
329
|
+
name: "msoffcrypto-crack",
|
|
330
|
+
description: "Attempt to recover the password of encrypted Microsoft Office documents.",
|
|
331
|
+
command: "msoffcrypto-crack.py",
|
|
332
|
+
inputStyle: "positional",
|
|
333
|
+
outputFormat: "text",
|
|
334
|
+
timeout: 120,
|
|
335
|
+
tags: ["ole2", "ooxml"],
|
|
336
|
+
tier: "standard",
|
|
337
|
+
},
|
|
277
338
|
{
|
|
278
339
|
name: "pcodedmp",
|
|
279
340
|
description: "Disassemble VBA p-code from Office documents.",
|
|
@@ -306,6 +367,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
306
367
|
tags: ["ooxml", "jar"],
|
|
307
368
|
tier: "standard",
|
|
308
369
|
},
|
|
370
|
+
{
|
|
371
|
+
name: "xmldump",
|
|
372
|
+
description: "Format and analyze XML. For OOXML: zipdump.py -s <n> -d file | xmldump.py pretty",
|
|
373
|
+
command: "xmldump.py",
|
|
374
|
+
inputStyle: "positional",
|
|
375
|
+
outputFormat: "text",
|
|
376
|
+
timeout: 60,
|
|
377
|
+
tags: ["ooxml"],
|
|
378
|
+
tier: "standard",
|
|
379
|
+
},
|
|
309
380
|
// ── RTF ─────────────────────────────────────────────────────────────────
|
|
310
381
|
{
|
|
311
382
|
name: "rtfdump",
|
|
@@ -438,6 +509,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
438
509
|
},
|
|
439
510
|
// ── JAR ─────────────────────────────────────────────────────────────────
|
|
440
511
|
// zipdump already covers JAR (tagged "jar")
|
|
512
|
+
{
|
|
513
|
+
name: "cfr",
|
|
514
|
+
description: "Decompile Java class files and JARs to readable Java source code.",
|
|
515
|
+
command: "cfr",
|
|
516
|
+
inputStyle: "positional",
|
|
517
|
+
outputFormat: "text",
|
|
518
|
+
timeout: 120,
|
|
519
|
+
tags: ["jar"],
|
|
520
|
+
tier: "standard",
|
|
521
|
+
},
|
|
441
522
|
// ── Email ───────────────────────────────────────────────────────────────
|
|
442
523
|
{
|
|
443
524
|
name: "emldump",
|
|
@@ -459,6 +540,17 @@ export const TOOL_DEFINITIONS = [
|
|
|
459
540
|
tags: ["email"],
|
|
460
541
|
tier: "quick",
|
|
461
542
|
},
|
|
543
|
+
// ── OneNote ─────────────────────────────────────────────────────────────
|
|
544
|
+
{
|
|
545
|
+
name: "onedump",
|
|
546
|
+
description: "Analyze OneNote documents and extract embedded files.",
|
|
547
|
+
command: "onedump.py",
|
|
548
|
+
inputStyle: "positional",
|
|
549
|
+
outputFormat: "text",
|
|
550
|
+
timeout: 60,
|
|
551
|
+
tags: ["onenote"],
|
|
552
|
+
tier: "standard",
|
|
553
|
+
},
|
|
462
554
|
// ── APK ─────────────────────────────────────────────────────────────────
|
|
463
555
|
{
|
|
464
556
|
name: "apktool",
|
|
@@ -481,6 +573,17 @@ export const TOOL_DEFINITIONS = [
|
|
|
481
573
|
tags: ["apk"],
|
|
482
574
|
tier: "standard",
|
|
483
575
|
},
|
|
576
|
+
{
|
|
577
|
+
name: "jadx",
|
|
578
|
+
description: "Decompile Android APK/DEX files to Java source code.",
|
|
579
|
+
command: "jadx",
|
|
580
|
+
inputStyle: "positional",
|
|
581
|
+
fixedArgs: ["-d", "/tmp/jadx-out", "--no-debug-info"],
|
|
582
|
+
outputFormat: "text",
|
|
583
|
+
timeout: 120,
|
|
584
|
+
tags: ["apk"],
|
|
585
|
+
tier: "standard",
|
|
586
|
+
},
|
|
484
587
|
// ── Memory forensics (Volatility 3) ─────────────────────────────────────
|
|
485
588
|
{
|
|
486
589
|
name: "vol3-info",
|
|
@@ -667,6 +770,46 @@ export const TOOL_DEFINITIONS = [
|
|
|
667
770
|
tags: ["fallback"],
|
|
668
771
|
tier: "standard",
|
|
669
772
|
},
|
|
773
|
+
{
|
|
774
|
+
name: "cut-bytes",
|
|
775
|
+
description: "Cut out portions of data streams by position or pattern.",
|
|
776
|
+
command: "cut-bytes.py",
|
|
777
|
+
inputStyle: "positional",
|
|
778
|
+
outputFormat: "text",
|
|
779
|
+
timeout: 60,
|
|
780
|
+
tags: ["fallback"],
|
|
781
|
+
tier: "standard",
|
|
782
|
+
},
|
|
783
|
+
{
|
|
784
|
+
name: "format-bytes",
|
|
785
|
+
description: "Decompose and display structured binary data in readable format.",
|
|
786
|
+
command: "format-bytes.py",
|
|
787
|
+
inputStyle: "positional",
|
|
788
|
+
outputFormat: "text",
|
|
789
|
+
timeout: 60,
|
|
790
|
+
tags: ["fallback"],
|
|
791
|
+
tier: "standard",
|
|
792
|
+
},
|
|
793
|
+
{
|
|
794
|
+
name: "xor-kpa",
|
|
795
|
+
description: "Perform XOR decryption using known-plaintext attack.",
|
|
796
|
+
command: "xor-kpa.py",
|
|
797
|
+
inputStyle: "positional",
|
|
798
|
+
outputFormat: "text",
|
|
799
|
+
timeout: 60,
|
|
800
|
+
tags: ["fallback", "decryption"],
|
|
801
|
+
tier: "deep",
|
|
802
|
+
},
|
|
803
|
+
{
|
|
804
|
+
name: "sets",
|
|
805
|
+
description: "Perform set operations (union, intersection, difference) on text file lines or bytes.",
|
|
806
|
+
command: "sets.py",
|
|
807
|
+
inputStyle: "positional",
|
|
808
|
+
outputFormat: "text",
|
|
809
|
+
timeout: 60,
|
|
810
|
+
tags: ["fallback"],
|
|
811
|
+
tier: "deep",
|
|
812
|
+
},
|
|
670
813
|
// ── Shellcode analysis ─────────────────────────────────────────────────
|
|
671
814
|
{
|
|
672
815
|
name: "scdbgc",
|
|
@@ -678,7 +821,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
678
821
|
outputFormat: "text",
|
|
679
822
|
timeout: 60,
|
|
680
823
|
tags: ["shellcode"],
|
|
681
|
-
tier: "
|
|
824
|
+
tier: "standard",
|
|
682
825
|
},
|
|
683
826
|
{
|
|
684
827
|
name: "speakeasy-sc-x86",
|
|
@@ -690,7 +833,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
690
833
|
outputFormat: "text",
|
|
691
834
|
timeout: 120,
|
|
692
835
|
tags: ["shellcode"],
|
|
693
|
-
tier: "
|
|
836
|
+
tier: "quick",
|
|
694
837
|
},
|
|
695
838
|
{
|
|
696
839
|
name: "speakeasy-sc-x64",
|
|
@@ -702,7 +845,7 @@ export const TOOL_DEFINITIONS = [
|
|
|
702
845
|
outputFormat: "text",
|
|
703
846
|
timeout: 120,
|
|
704
847
|
tags: ["shellcode"],
|
|
705
|
-
tier: "
|
|
848
|
+
tier: "quick",
|
|
706
849
|
},
|
|
707
850
|
{
|
|
708
851
|
name: "speakeasy",
|
|
@@ -750,7 +893,78 @@ export const TOOL_DEFINITIONS = [
|
|
|
750
893
|
tags: ["shellcode"],
|
|
751
894
|
tier: "deep",
|
|
752
895
|
},
|
|
896
|
+
// ── PCAP / network analysis ─────────────────────────────────────────────
|
|
897
|
+
{
|
|
898
|
+
name: "tshark-conversations",
|
|
899
|
+
description: "Summarize TCP/UDP conversations from a PCAP file.",
|
|
900
|
+
command: "tshark",
|
|
901
|
+
inputStyle: "flag",
|
|
902
|
+
inputFlag: "-r",
|
|
903
|
+
fixedArgs: ["-q", "-z", "conv,tcp"],
|
|
904
|
+
outputFormat: "text",
|
|
905
|
+
timeout: 60,
|
|
906
|
+
tags: ["pcap", "triage"],
|
|
907
|
+
tier: "quick",
|
|
908
|
+
},
|
|
909
|
+
{
|
|
910
|
+
name: "tshark-http",
|
|
911
|
+
description: "Show HTTP request/response statistics from a PCAP file.",
|
|
912
|
+
command: "tshark",
|
|
913
|
+
inputStyle: "flag",
|
|
914
|
+
inputFlag: "-r",
|
|
915
|
+
fixedArgs: ["-q", "-z", "http,tree"],
|
|
916
|
+
outputFormat: "text",
|
|
917
|
+
timeout: 60,
|
|
918
|
+
tags: ["pcap"],
|
|
919
|
+
tier: "standard",
|
|
920
|
+
},
|
|
921
|
+
{
|
|
922
|
+
name: "tshark-hierarchy",
|
|
923
|
+
description: "Show protocol hierarchy statistics from a PCAP file.",
|
|
924
|
+
command: "tshark",
|
|
925
|
+
inputStyle: "flag",
|
|
926
|
+
inputFlag: "-r",
|
|
927
|
+
fixedArgs: ["-q", "-z", "io,phs"],
|
|
928
|
+
outputFormat: "text",
|
|
929
|
+
timeout: 60,
|
|
930
|
+
tags: ["pcap"],
|
|
931
|
+
tier: "standard",
|
|
932
|
+
},
|
|
933
|
+
{
|
|
934
|
+
name: "tshark-dns",
|
|
935
|
+
description: "Extract DNS queries and responses from a PCAP file.",
|
|
936
|
+
command: "tshark",
|
|
937
|
+
inputStyle: "flag",
|
|
938
|
+
inputFlag: "-r",
|
|
939
|
+
fixedArgs: ["-Y", "dns", "-T", "fields", "-e", "dns.qry.name", "-e", "dns.a", "-e", "dns.resp.type"],
|
|
940
|
+
outputFormat: "text",
|
|
941
|
+
timeout: 60,
|
|
942
|
+
tags: ["pcap"],
|
|
943
|
+
tier: "standard",
|
|
944
|
+
},
|
|
945
|
+
{
|
|
946
|
+
name: "tshark-verbose",
|
|
947
|
+
description: "Full packet decode of first 50 packets from a PCAP file.",
|
|
948
|
+
command: "tshark",
|
|
949
|
+
inputStyle: "flag",
|
|
950
|
+
inputFlag: "-r",
|
|
951
|
+
fixedArgs: ["-V", "-c", "50"],
|
|
952
|
+
outputFormat: "text",
|
|
953
|
+
timeout: 120,
|
|
954
|
+
tags: ["pcap"],
|
|
955
|
+
tier: "deep",
|
|
956
|
+
},
|
|
753
957
|
// ── Cross-type / general ────────────────────────────────────────────────
|
|
958
|
+
{
|
|
959
|
+
name: "ssdeep",
|
|
960
|
+
description: "Compute fuzzy hash (ssdeep) for file similarity comparison.",
|
|
961
|
+
command: "ssdeep",
|
|
962
|
+
inputStyle: "positional",
|
|
963
|
+
outputFormat: "text",
|
|
964
|
+
timeout: 30,
|
|
965
|
+
tags: ["pe", "dotnet", "elf", "pdf", "ole2", "ooxml", "rtf", "jar", "apk", "pcap", "fallback"],
|
|
966
|
+
tier: "quick",
|
|
967
|
+
},
|
|
754
968
|
{
|
|
755
969
|
name: "exiftool",
|
|
756
970
|
description: "Read and analyze EXIF metadata from various file types.",
|
|
@@ -772,5 +986,16 @@ export const TOOL_DEFINITIONS = [
|
|
|
772
986
|
tags: ["fallback"],
|
|
773
987
|
tier: "standard",
|
|
774
988
|
},
|
|
989
|
+
{
|
|
990
|
+
name: "xorsearch.py",
|
|
991
|
+
description: "Search for XOR/ROL/ROT/SHIFT encoded strings with JSON output and YARA support.",
|
|
992
|
+
command: "xorsearch.py",
|
|
993
|
+
inputStyle: "positional",
|
|
994
|
+
fixedArgs: ["-J"],
|
|
995
|
+
outputFormat: "json",
|
|
996
|
+
timeout: 60,
|
|
997
|
+
tags: ["fallback"],
|
|
998
|
+
tier: "standard",
|
|
999
|
+
},
|
|
775
1000
|
];
|
|
776
1001
|
//# sourceMappingURL=definitions.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QAC1C,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,KAAK,CAAC;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,UAAU,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QACnC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACzB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,MAAM;KACb;IAED;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,WAAW,CAAC;QACxB,UAAU,EAAE,CAAC,oBAAoB,CAAC;QAClC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC9C,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,CAAC,EAAE,yGAAyG,EAAE;KAChI;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC;QACjD,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QACrD,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IAED,yEAAyE;IACzE;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E,4CAA4C;IAE5C,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,OAAO;KACd;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,yBAAyB,CAAC;QACvC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAC1E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;QAC5E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QACjF,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;CACF,CAAC"}
|
|
1
|
+
{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAqB;IAChD,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,kBAAkB,CAAC;QAC1C,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,KAAK,CAAC;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC;QAC7C,IAAI,EAAE,MAAM;QACZ,aAAa,EAAE,EAAE,EAAE,EAAE,2FAA2F,EAAE;KACnH;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+DAA+D;QAC5E,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC;QAC9B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,CAAC,EAAE,wEAAwE,EAAE;KAC/F;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAChC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;QACzB,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QAC7B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC;QAC7B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,oBAAoB;QAC7B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC;QAC1B,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,SAAS,CAAC;QACtB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,MAAM;KACb;IAED;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,WAAW,CAAC;QACxB,UAAU,EAAE,CAAC,oBAAoB,CAAC;QAClC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,CAAC,WAAW,CAAC;QACzB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,oEAAoE;QACjF,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,0EAA0E;QACvF,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACvB,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,+CAA+C;QAC5D,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QACjC,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QACtB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,kFAAkF;QAC/F,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,0CAA0C;QACvD,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;QACvB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8BAA8B;QAC3C,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;QAC9C,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,UAAU;QAChB,aAAa,EAAE,EAAE,CAAC,EAAE,yGAAyG,EAAE;KAChI;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,4DAA4D;QACzE,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC;QACjD,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,8CAA8C;QAC3D,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC;QACrD,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IAED,yEAAyE;IACzE;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,2DAA2D;QACxE,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E,4CAA4C;IAC5C;QACE,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,mEAAmE;QAChF,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,UAAU;KACjB;IAED;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,OAAO,CAAC;QACf,IAAI,EAAE,OAAO;KACd;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,uDAAuD;QACpE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,SAAS,CAAC;QACjB,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,GAAG,CAAC;QAChB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC;QACrD,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,KAAK,CAAC;QACb,IAAI,EAAE,UAAU;KACjB;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,2CAA2C;QACxD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,kBAAkB,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,sCAAsC;QACnD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,2BAA2B,CAAC;QACzC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,cAAc,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kDAAkD;QAC/D,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,yBAAyB,CAAC;QACvC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,QAAQ,CAAC;QAChB,IAAI,EAAE,MAAM;KACb;IAED,6EAA6E;IAC7E;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC;QAC1C,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,sBAAsB;QAC/B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC5B,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,gEAAgE;QAC7E,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,kEAAkE;QAC/E,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;QAChC,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,uFAAuF;QACpG,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,MAAM;KACb;IAED,0EAA0E;IAC1E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACvB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;QAC9B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,iEAAiE;QAC9E,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC;QAChC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC;QAC1E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,4EAA4E;QACzF,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC;QAC5E,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,SAAS;QAClB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,WAAW,CAAC;QACnB,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,mDAAmD;QAChE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC;QACnC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxB,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC;QACpC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACjC,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,qDAAqD;QAClE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC;QACpG,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,MAAM;QAClB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAC7B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,GAAG;QACZ,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,MAAM;KACb;IAED,2EAA2E;IAC3E;QACE,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,QAAQ;QACjB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;QAC9F,IAAI,EAAE,OAAO;KACd;IACD;QACE,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,yDAAyD;QACtE,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC;QACjF,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,sEAAsE;QACnF,OAAO,EAAE,WAAW;QACpB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC;QAC5B,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iFAAiF;QAC9F,OAAO,EAAE,cAAc;QACvB,UAAU,EAAE,YAAY;QACxB,SAAS,EAAE,CAAC,IAAI,CAAC;QACjB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,EAAE;QACX,IAAI,EAAE,CAAC,UAAU,CAAC;QAClB,IAAI,EAAE,UAAU;KACjB;CACF,CAAC"}
|
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Preprocessors — transforms applied before analysis tools run.
|
|
3
|
+
*
|
|
4
|
+
* Preprocessors detect conditions (encrypted Office docs, bloated PEs,
|
|
5
|
+
* PyInstaller bundles) and produce a cleaned/extracted version of the file
|
|
6
|
+
* for subsequent analysis tools to operate on.
|
|
7
|
+
*/
|
|
8
|
+
export interface Preprocessor {
|
|
9
|
+
/** Unique name for logging */
|
|
10
|
+
name: string;
|
|
11
|
+
/** Human-readable description shown in analysis output */
|
|
12
|
+
description: string;
|
|
13
|
+
/** File type categories this preprocessor applies to */
|
|
14
|
+
categories: string[];
|
|
15
|
+
/**
|
|
16
|
+
* Shell command to detect whether preprocessing is needed.
|
|
17
|
+
* Exit code 0 = preprocessing needed, non-zero = skip.
|
|
18
|
+
*/
|
|
19
|
+
detectCommand: (filePath: string) => string;
|
|
20
|
+
/**
|
|
21
|
+
* Shell command to run the preprocessor.
|
|
22
|
+
* Should write output to `outputPath`.
|
|
23
|
+
*/
|
|
24
|
+
processCommand: (filePath: string, outputPath: string) => string;
|
|
25
|
+
/** Timeout in milliseconds */
|
|
26
|
+
timeout: number;
|
|
27
|
+
}
|
|
28
|
+
export declare const PREPROCESSORS: Preprocessor[];
|
|
29
|
+
/**
|
|
30
|
+
* Get preprocessors applicable to a given file type category.
|
|
31
|
+
*/
|
|
32
|
+
export declare function getPreprocessors(categoryName: string): Preprocessor[];
|
|
33
|
+
//# sourceMappingURL=preprocessors.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"preprocessors.d.ts","sourceRoot":"","sources":["../../src/tools/preprocessors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,YAAY;IAC3B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;OAGG;IACH,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC;IAC5C;;;OAGG;IACH,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,MAAM,CAAC;IACjE,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,aAAa,EAAE,YAAY,EAkCvC,CAAC;AAEF;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,YAAY,EAAE,CAErE"}
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Preprocessors — transforms applied before analysis tools run.
|
|
3
|
+
*
|
|
4
|
+
* Preprocessors detect conditions (encrypted Office docs, bloated PEs,
|
|
5
|
+
* PyInstaller bundles) and produce a cleaned/extracted version of the file
|
|
6
|
+
* for subsequent analysis tools to operate on.
|
|
7
|
+
*/
|
|
8
|
+
/** Escape a value for safe inclusion in a single-quoted shell string. */
|
|
9
|
+
function shellEscape(value) {
|
|
10
|
+
return `'${value.replace(/'/g, "'\\''")}'`;
|
|
11
|
+
}
|
|
12
|
+
export const PREPROCESSORS = [
|
|
13
|
+
{
|
|
14
|
+
name: "msoffcrypto-tool",
|
|
15
|
+
description: "Decrypt password-protected Office documents",
|
|
16
|
+
categories: ["OLE2", "OOXML"],
|
|
17
|
+
// msoffcrypto-tool -t tests if file is encrypted (exit 0 = encrypted)
|
|
18
|
+
detectCommand: (fp) => `msoffcrypto-tool -t ${shellEscape(fp)}`,
|
|
19
|
+
// -p "" tries empty password and the default VelvetSweatshop password
|
|
20
|
+
processCommand: (fp, out) => `msoffcrypto-tool -p "" ${shellEscape(fp)} ${shellEscape(out)}`,
|
|
21
|
+
timeout: 30000,
|
|
22
|
+
},
|
|
23
|
+
{
|
|
24
|
+
name: "debloat",
|
|
25
|
+
description: "Remove junk from artificially bloated PE files",
|
|
26
|
+
categories: ["PE", "DOTNET"],
|
|
27
|
+
// Only debloat if file is >50MB
|
|
28
|
+
detectCommand: (fp) => `test $(stat -c%s ${shellEscape(fp)} 2>/dev/null || stat -f%z ${shellEscape(fp)}) -gt 52428800`,
|
|
29
|
+
processCommand: (fp, out) => `debloat -o ${shellEscape(out)} ${shellEscape(fp)}`,
|
|
30
|
+
timeout: 60000,
|
|
31
|
+
},
|
|
32
|
+
{
|
|
33
|
+
name: "pyinstxtractor",
|
|
34
|
+
description: "Extract files from PyInstaller bundles",
|
|
35
|
+
categories: ["PE"],
|
|
36
|
+
// Check for PyInstaller magic bytes at end of file
|
|
37
|
+
detectCommand: (fp) => `python3 -c "import sys; f=open(sys.argv[1],'rb'); f.seek(-24,2); exit(0 if f.read(13)==b'MEI\\x0c\\x0b\\x0a\\x0b\\x0e' else 1)" ${shellEscape(fp)}`,
|
|
38
|
+
processCommand: (fp, out) => `pyinstxtractor ${shellEscape(fp)} -d ${shellEscape(out)}`,
|
|
39
|
+
timeout: 60000,
|
|
40
|
+
},
|
|
41
|
+
];
|
|
42
|
+
/**
|
|
43
|
+
* Get preprocessors applicable to a given file type category.
|
|
44
|
+
*/
|
|
45
|
+
export function getPreprocessors(categoryName) {
|
|
46
|
+
return PREPROCESSORS.filter((pp) => pp.categories.includes(categoryName));
|
|
47
|
+
}
|
|
48
|
+
//# sourceMappingURL=preprocessors.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"preprocessors.js","sourceRoot":"","sources":["../../src/tools/preprocessors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAuBH,yEAAyE;AACzE,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAmB;IAC3C;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,6CAA6C;QAC1D,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,sEAAsE;QACtE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,uBAAuB,WAAW,CAAC,EAAE,CAAC,EAAE;QAC/D,sEAAsE;QACtE,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,0BAA0B,WAAW,CAAC,EAAE,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE;QACjE,OAAO,EAAE,KAAK;KACf;IACD;QACE,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,gDAAgD;QAC7D,UAAU,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC;QAC5B,gCAAgC;QAChC,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CACpB,oBAAoB,WAAW,CAAC,EAAE,CAAC,6BAA6B,WAAW,CAAC,EAAE,CAAC,gBAAgB;QACjG,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,cAAc,WAAW,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE;QACrD,OAAO,EAAE,KAAK;KACf;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,wCAAwC;QACrD,UAAU,EAAE,CAAC,IAAI,CAAC;QAClB,mDAAmD;QACnD,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CACpB,mIAAmI,WAAW,CAAC,EAAE,CAAC,EAAE;QACtJ,cAAc,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAC1B,kBAAkB,WAAW,CAAC,EAAE,CAAC,OAAO,WAAW,CAAC,GAAG,CAAC,EAAE;QAC5D,OAAO,EAAE,KAAK;KACf;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AAC5E,CAAC"}
|