@remnux/mcp-server 0.1.54 → 0.1.55

package/dist/parsers/capa.js

@@ -4,6 +4,137 @@
  * Extracts capabilities and their associated ATT&CK techniques.
  * Expects JSON output from `capa -j <file>`.
  */
+/**
+ * Map a capa feature-node type to the kind of evidence it represents.
+ *
+ * Deliberately conservative: only feature types whose evidence kind is
+ * unambiguous are mapped. A rule's namespace describes its INTENT
+ * (e.g. "collection/*"), not how it matched, so it is NOT used here to infer
+ * behavior — conflating the two is exactly the artifact-vs-behavior error this
+ * tagging exists to prevent.
+ */
+const FEATURE_EVIDENCE_TYPE = {
+    // artifact — data/content patterns present in the binary
+    string: "artifact",
+    substring: "artifact",
+    regex: "artifact",
+    bytes: "artifact",
+    // behavior — code-level semantics (these feature types occur only in code)
+    api: "behavior",
+    mnemonic: "behavior",
+    number: "behavior",
+    offset: "behavior",
+    "operand number": "behavior",
+    "operand offset": "behavior",
+    // structural — binary layout / metadata
+    section: "structural",
+    export: "structural",
+    // linking — imports / library presence
+    import: "linking",
+    // Intentionally NEUTRAL (no contribution): os, arch, format, match, class,
+    // property, namespace, function-name. These are environment guards or
+    // ambiguous signals that would dilute the artifact-vs-behavior distinction
+    // (e.g. `os: windows` appears in many behavioral rules as a guard).
+};
+/**
+ * capa's `characteristic` feature is overloaded: some values describe binary
+ * structure, others describe code execution. Map by value; unknown values
+ * contribute nothing (conservative — a mislabel is worse than no label).
+ */
+const CHARACTERISTIC_EVIDENCE_TYPE = {
+    // structural — file/layout characteristics
+    "embedded pe": "structural",
+    "mixed mode": "structural",
+    "forwarded export": "structural",
+    // artifact — string data (constructed in code, but still data)
+    "stack string": "artifact",
+    // behavior — code-execution characteristics
+    loop: "behavior",
+    "tight loop": "behavior",
+    "recursive call": "behavior",
+    nzxor: "behavior",
+    "peb access": "behavior",
+    "fs access": "behavior",
+    "gs access": "behavior",
+    "cross section flow": "behavior",
+    "indirect call": "behavior",
+    "unmanaged call": "behavior",
+};
+/** Stable ordering for the unordered evidence_types set (deterministic output). */
+const EVIDENCE_TYPE_ORDER = ["artifact", "behavior", "structural", "linking"];
+/**
+ * Walk a capa match-node tree and collect the feature types of nodes that
+ * ACTUALLY matched (success === true). capa includes non-matching branches
+ * (the untaken side of an `or`, the inner feature of a satisfied `not`) with
+ * success === false; excluding them ensures a rule that fired on a `string`
+ * branch is never credited with an unmatched `api` branch.
+ */
+function collectMatchedEvidenceTypes(node, out) {
+    if (!node || typeof node !== "object")
+        return;
+    const n = node;
+    const inner = n.node;
+    if (n.success === true && inner && typeof inner === "object") {
+        const i = inner;
+        if (i.type === "feature" && i.feature && typeof i.feature === "object") {
+            const f = i.feature;
+            const ft = f.type;
+            if (typeof ft === "string") {
+                if (ft === "characteristic") {
+                    const val = typeof f.characteristic === "string" ? f.characteristic : "";
+                    const et = CHARACTERISTIC_EVIDENCE_TYPE[val];
+                    if (et)
+                        out.add(et);
+                }
+                else {
+                    const et = FEATURE_EVIDENCE_TYPE[ft];
+                    if (et)
+                        out.add(et);
+                }
+            }
+        }
+    }
+    if (Array.isArray(n.children)) {
+        for (const c of n.children)
+            collectMatchedEvidenceTypes(c, out);
+    }
+}
+/**
+ * Derive the evidence_types set for a single capa rule from the feature nodes
+ * that actually matched, plus two unambiguous namespace signals. Returns
+ * undefined when nothing can be determined (the caller then omits the field).
+ * Never throws — a malformed rule yields undefined, never a lost finding.
+ */
+export function deriveEvidenceTypes(rule) {
+    try {
+        const types = new Set();
+        if (Array.isArray(rule.matches)) {
+            for (const m of rule.matches) {
+                // each match is [address, matchNode]
+                if (Array.isArray(m) && m.length >= 2) {
+                    collectMatchedEvidenceTypes(m[1], types);
+                }
+            }
+        }
+        // Namespace carries an unambiguous evidence-kind signal in two cases only.
+        const meta = rule.meta;
+        if (meta && typeof meta === "object" && !Array.isArray(meta)) {
+            const ns = meta.namespace;
+            if (typeof ns === "string") {
+                if (ns.startsWith("linking/"))
+                    types.add("linking");
+                else if (ns.startsWith("executable/"))
+                    types.add("structural");
+            }
+        }
+        if (types.size === 0)
+            return undefined;
+        return EVIDENCE_TYPE_ORDER.filter((t) => types.has(t));
+    }
+    catch {
+        return undefined;
+    }
+}
 export function parseCapaOutput(rawOutput) {
     const result = {
         tool: "capa",
@@ -38,6 +169,13 @@ export function parseCapaOutput(rawOutput) {
                             .join(", ");
                     }
                 }
+                // Tag the kind(s) of evidence the rule actually matched on (artifact vs
+                // behavior vs structural vs linking). Additive and fail-soft: if this
+                // cannot be determined the field is simply omitted — the finding's name
+                // and ATT&CK evidence are never affected.
+                const evidenceTypes = deriveEvidenceTypes(r);
+                if (evidenceTypes)
+                    finding.evidence_types = evidenceTypes;
                 result.findings.push(finding);
             }
         }

package/dist/parsers/capa.js.map

@@ -1 +1 @@
-{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"capa.js","sourceRoot":"","sources":["../../src/parsers/capa.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,qBAAqB,GAAiC;IAC1D,yDAAyD;IACzD,MAAM,EAAE,UAAU;IAClB,SAAS,EAAE,UAAU;IACrB,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,UAAU;IACjB,2EAA2E;IAC3E,GAAG,EAAE,UAAU;IACf,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,UAAU;IAClB,MAAM,EAAE,UAAU;IAClB,gBAAgB,EAAE,UAAU;IAC5B,gBAAgB,EAAE,UAAU;IAC5B,wCAAwC;IACxC,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,uCAAuC;IACvC,MAAM,EAAE,SAAS;IACjB,2EAA2E;IAC3E,sEAAsE;IACtE,2EAA2E;IAC3E,oEAAoE;CACrE,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAiC;IACjE,2CAA2C;IAC3C,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,YAAY;IAC1B,kBAAkB,EAAE,YAAY;IAChC,+DAA+D;IAC/D,cAAc,EAAE,UAAU;IAC1B,4CAA4C;IAC5C,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,UAAU;IACxB,gBAAgB,EAAE,UAAU;IAC5B,KAAK,EAAE,UAAU;IACjB,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE,UAAU;IACvB,WAAW,EAAE,UAAU;IACvB,oBAAoB,EAAE,UAAU;IAChC,eAAe,EAAE,UAAU;IAC3B,gBAAgB,EAAE,UAAU;CAC7B,CAAC;AAEF,mFAAmF;AACnF,MAAM,mBAAmB,GAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,SAAS,2BAA2B,CAAC,IAAa,EAAE,GAAsB;IACxE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC;IACrB,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAkC,CAAC;YAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;YAClB,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,KAAK,gBAAgB,EAAE,CAAC;oBAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;oBACzE,MAAM,EAAE,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;oBAC7C,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;qBAAM,CAAC;oBACN,MAAM,EAAE,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;oBACrC,IAAI,EAAE;wBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,2BAA2B,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA6B;IAC/D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;QAEtC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,qCAAqC;gBACrC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACtC,2BAA2B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,EAAE,GAAI,IAAgC,CAAC,SAAS,CAAC;YACvD,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;qBAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC;oBAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,MAAM,GAAqB;QAC/B,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;QACZ,GAAG,EAAE,SAAS;KACf,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC;QAErB,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBAChD,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACpB,MAAM,OAAO,GAAY;oBACvB,WAAW,EAAE,IAAI;oBACjB,QAAQ,EAAE,YAAY;oBACtB,QAAQ,EAAE,MAAM;iBACjB,CAAC;gBAEF,4DAA4D;gBAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7D,MAAM,CAAC,GAAG,IAA+B,CAAC;oBAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACnD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,MAAM;6BACxB,MAAM,CAAC,CAAC,CAAC,EAA+B,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;6BACtE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,GAAG,CAAC;6BACpD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,CAAC;gBACH,CAAC;gBAED,wEAAwE;gBACxE,sEAAsE;gBACtE,wEAAwE;gBACxE,0CAA0C;gBAC1C,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,aAAa;oBAAE,OAAO,CAAC,cAAc,GAAG,aAAa,CAAC;gBAE1D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAChD,CAAC;QAED,yDAAyD;QACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,QAAQ,CAAC,kBAAkB;gBAChC,mDAAmD;oBACnD,+EAA+E;oBAC/E,4DAA4D;oBAC5D,2DAA2D;oBAC3D,6CAA6C;oBAC7C,0DAA0D;oBAC1D,wEAAwE,CAAC;QAC7E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/imports.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Parser for a PE import table from `readpe -i -f json` (pev suite).
+ *
+ * Produces a structured, queryable view of which APIs a PE statically imports.
+ * This is the enabling primitive for check_behavior_prerequisites: knowing the
+ * import surface lets us ask "can this binary even call the APIs a behavior
+ * requires?" — without conflating "the API is imported" with "the behavior
+ * runs".
+ *
+ * Note on what imports prove: a statically imported API means the binary *can*
+ * call it; it is not evidence the call happens on a reachable path. Absence is
+ * weaker still — APIs can be resolved at runtime (GetProcAddress + LoadLibrary)
+ * or hidden by packing.
+ */
+export interface PeImports {
+    /** True when readpe produced valid JSON we could read (even if zero imports). */
+    parsed: boolean;
+    dlls: Array<{
+        dll: string;
+        functions: string[];
+    }>;
+    /** Lowercased imported function names, for case-insensitive lookup. */
+    functionSet: Set<string>;
+    /** Total number of imported functions across all DLLs. */
+    count: number;
+}
+export declare function parsePeImports(readpeJson: string): PeImports;
+/**
+ * Whether a required API (given as a base name without the ANSI/Unicode suffix)
+ * is present in the import set. Matches the base plus its `...A` / `...W`
+ * variants — e.g. required "InternetOpenUrl" is satisfied by "InternetOpenUrlW".
+ * We APPEND candidate suffixes rather than stripping, because many genuine API
+ * names already end in 'a'/'w' (e.g. "GetClipboardData", "ShowWindow").
+ */
+export declare function apiPresent(requiredBaseName: string, functionSet: Set<string>): boolean;
+//# sourceMappingURL=imports.d.ts.map

package/dist/parsers/imports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.d.ts","sourceRoot":"","sources":["../../src/parsers/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,SAAS;IACxB,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAClD,uEAAuE;IACvE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAoC5D;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,OAAO,CAGtF"}

package/dist/parsers/imports.js

@@ -0,0 +1,67 @@
+/**
+ * Parser for a PE import table from `readpe -i -f json` (pev suite).
+ *
+ * Produces a structured, queryable view of which APIs a PE statically imports.
+ * This is the enabling primitive for check_behavior_prerequisites: knowing the
+ * import surface lets us ask "can this binary even call the APIs a behavior
+ * requires?" — without conflating "the API is imported" with "the behavior
+ * runs".
+ *
+ * Note on what imports prove: a statically imported API means the binary *can*
+ * call it; it is not evidence the call happens on a reachable path. Absence is
+ * weaker still — APIs can be resolved at runtime (GetProcAddress + LoadLibrary)
+ * or hidden by packing.
+ */
+function emptyImports(parsed) {
+    return { parsed, dlls: [], functionSet: new Set(), count: 0 };
+}
+export function parsePeImports(readpeJson) {
+    let data;
+    try {
+        data = JSON.parse(readpeJson);
+    }
+    catch {
+        return emptyImports(false);
+    }
+    if (!data || typeof data !== "object")
+        return emptyImports(false);
+    const imported = data["Imported functions"];
+    // Valid JSON but no import table (e.g. a PE with no imports) → parsed, empty.
+    if (!Array.isArray(imported))
+        return emptyImports(true);
+    const dlls = [];
+    const functionSet = new Set();
+    let count = 0;
+    for (const lib of imported) {
+        if (!lib || typeof lib !== "object")
+            continue;
+        const l = lib;
+        const dll = typeof l.Name === "string" ? l.Name : "";
+        const fns = Array.isArray(l.Functions) ? l.Functions : [];
+        const names = [];
+        for (const fn of fns) {
+            if (!fn || typeof fn !== "object")
+                continue;
+            const name = fn.Name;
+            if (typeof name === "string" && name.length > 0) {
+                names.push(name);
+                functionSet.add(name.toLowerCase());
+                count++;
+            }
+        }
+        dlls.push({ dll, functions: names });
+    }
+    return { parsed: true, dlls, functionSet, count };
+}
+/**
+ * Whether a required API (given as a base name without the ANSI/Unicode suffix)
+ * is present in the import set. Matches the base plus its `...A` / `...W`
+ * variants — e.g. required "InternetOpenUrl" is satisfied by "InternetOpenUrlW".
+ * We APPEND candidate suffixes rather than stripping, because many genuine API
+ * names already end in 'a'/'w' (e.g. "GetClipboardData", "ShowWindow").
+ */
+export function apiPresent(requiredBaseName, functionSet) {
+    const base = requiredBaseName.toLowerCase();
+    return functionSet.has(base) || functionSet.has(base + "a") || functionSet.has(base + "w");
+}
+//# sourceMappingURL=imports.js.map

package/dist/parsers/imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"imports.js","sourceRoot":"","sources":["../../src/parsers/imports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAYH,SAAS,YAAY,CAAC,MAAe;IACnC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAElE,MAAM,QAAQ,GAAI,IAAgC,CAAC,oBAAoB,CAAC,CAAC;IACzE,8EAA8E;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,IAAI,GAAgD,EAAE,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,IAAI,GAAI,EAA8B,CAAC,IAAI,CAAC;YAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpC,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,gBAAwB,EAAE,WAAwB;IAC3E,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,EAAE,CAAC;IAC5C,OAAO,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAC7F,CAAC"}

package/dist/parsers/r2.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Pure parsers for radare2 JSON output (izj/izzj strings, iSj sections, aflj
+ * functions, axtj cross-references) plus the marker-split for the batched
+ * "Pass 2" command used by verify_string_usage.
+ *
+ * Every parser is defensive and NEVER throws — malformed/partial r2 output
+ * returns an empty result so the classifier can degrade to `unknown` rather
+ * than mistaking a parse failure for a real "no xref" answer. Field shapes were
+ * captured from radare2 6.1.6; alternative key names seen across versions are
+ * tolerated (e.g. function address as `addr` or `offset`).
+ */
+/** Self-generated markers (emitted via `?e`) that delimit the Pass-2 sections. */
+export declare const R2_MARKERS: {
+    readonly sections: "__R2MCP_SEC__";
+    readonly functions: "__R2MCP_FNS__";
+    readonly xref: "__R2MCP_XR__";
+};
+export interface R2String {
+    value: string;
+    vaddr: number;
+    section: string;
+}
+export interface R2Section {
+    name: string;
+    vaddr: number;
+    vaddrEnd: number;
+    /** True when the section is executable (perm contains 'x'). */
+    exec: boolean;
+}
+export interface R2Function {
+    addr: number;
+    name: string;
+    size: number;
+}
+export interface R2Xref {
+    /** Source address of the reference. */
+    from: number;
+    /** r2 reference type: STRN / DATA / CODE / CALL … */
+    type: string;
+    /** Containing function address, when r2 attributed one. */
+    fcnAddr?: number;
+    /** Containing function name, when present. */
+    fcnName?: string;
+    opcode?: string;
+}
+/** Parse `izj` / `izzj` string output. */
+export declare function parseR2Strings(json: string): R2String[];
+/** Parse `iSj` section output into ranges with an exec flag. */
+export declare function parseR2Sections(json: string): R2Section[];
+/** Parse `aflj` function list (address key is `addr` or `offset` across versions). */
+export declare function parseR2Functions(json: string): R2Function[];
+/** Parse `axtj` cross-reference output for one address. */
+export declare function parseR2Xrefs(json: string): R2Xref[];
+/** Extract the radare2 version string from `?V` output (first matching line). */
+export declare function parseR2Version(text: string): string | undefined;
+export interface SplitR2Output {
+    /** True if the connector truncated the output (→ treat as incomplete). */
+    truncated: boolean;
+    version?: string;
+    sectionsJson: string;
+    functionsJson: string;
+    /** Raw axtj JSON keyed by the queried address marker (hex string as emitted). */
+    xrefsByVaddr: Map<string, string>;
+}
+/**
+ * Split the batched Pass-2 stdout on the self-generated markers. The preamble
+ * (before the sections marker) carries the `?V` version line; sections sit
+ * between the sections and functions markers; functions between the functions
+ * marker and the first xref marker; each `__R2MCP_XR__ <addr>` block holds that
+ * address's axtj JSON up to the next marker or EOF.
+ */
+export declare function splitMarkedR2Output(stdout: string): SplitR2Output;
+//# sourceMappingURL=r2.d.ts.map

package/dist/parsers/r2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.d.ts","sourceRoot":"","sources":["../../src/parsers/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAKX,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,MAAM;IACrB,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,0CAA0C;AAC1C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CAYvD;AAED,gEAAgE;AAChE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,CAiBzD;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAU3D;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBnD;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CA4CjE"}

package/dist/parsers/r2.js

@@ -0,0 +1,161 @@
+/**
+ * Pure parsers for radare2 JSON output (izj/izzj strings, iSj sections, aflj
+ * functions, axtj cross-references) plus the marker-split for the batched
+ * "Pass 2" command used by verify_string_usage.
+ *
+ * Every parser is defensive and NEVER throws — malformed/partial r2 output
+ * returns an empty result so the classifier can degrade to `unknown` rather
+ * than mistaking a parse failure for a real "no xref" answer. Field shapes were
+ * captured from radare2 6.1.6; alternative key names seen across versions are
+ * tolerated (e.g. function address as `addr` or `offset`).
+ */
+/** Self-generated markers (emitted via `?e`) that delimit the Pass-2 sections. */
+export const R2_MARKERS = {
+    sections: "__R2MCP_SEC__",
+    functions: "__R2MCP_FNS__",
+    xref: "__R2MCP_XR__",
+};
+/** The connector caps stdout at 10MB and appends this sentinel when it does. */
+const TRUNCATION_SENTINEL = "[OUTPUT TRUNCATED";
+function asArray(json) {
+    try {
+        const data = JSON.parse(json);
+        return Array.isArray(data) ? data : [];
+    }
+    catch {
+        return [];
+    }
+}
+function num(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+/** Parse `izj` / `izzj` string output. */
+export function parseR2Strings(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const value = r.string;
+        const vaddr = num(r.vaddr);
+        if (typeof value === "string" && vaddr !== undefined) {
+            out.push({ value, vaddr, section: typeof r.section === "string" ? r.section : "" });
+        }
+    }
+    return out;
+}
+/** Parse `iSj` section output into ranges with an exec flag. */
+export function parseR2Sections(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const vaddr = num(r.vaddr);
+        const vsize = num(r.vsize) ?? 0;
+        if (vaddr === undefined)
+            continue;
+        const perm = typeof r.perm === "string" ? r.perm : "";
+        out.push({
+            name: typeof r.name === "string" ? r.name : "",
+            vaddr,
+            vaddrEnd: vaddr + vsize,
+            exec: perm.includes("x"),
+        });
+    }
+    return out;
+}
+/** Parse `aflj` function list (address key is `addr` or `offset` across versions). */
+export function parseR2Functions(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const addr = num(r.addr) ?? num(r.offset);
+        if (addr === undefined)
+            continue;
+        out.push({ addr, name: typeof r.name === "string" ? r.name : "", size: num(r.size) ?? 0 });
+    }
+    return out;
+}
+/** Parse `axtj` cross-reference output for one address. */
+export function parseR2Xrefs(json) {
+    const out = [];
+    for (const e of asArray(json)) {
+        if (!e || typeof e !== "object")
+            continue;
+        const r = e;
+        const from = num(r.from);
+        if (from === undefined)
+            continue;
+        out.push({
+            from,
+            type: typeof r.type === "string" ? r.type : "",
+            fcnAddr: num(r.fcn_addr),
+            fcnName: typeof r.fcn_name === "string" ? r.fcn_name : undefined,
+            opcode: typeof r.opcode === "string" ? r.opcode : undefined,
+        });
+    }
+    return out;
+}
+/** Extract the radare2 version string from `?V` output (first matching line). */
+export function parseR2Version(text) {
+    const m = text.match(/radare2\s+(\S+)/i);
+    return m ? m[1] : undefined;
+}
+/**
+ * Split the batched Pass-2 stdout on the self-generated markers. The preamble
+ * (before the sections marker) carries the `?V` version line; sections sit
+ * between the sections and functions markers; functions between the functions
+ * marker and the first xref marker; each `__R2MCP_XR__ <addr>` block holds that
+ * address's axtj JSON up to the next marker or EOF.
+ */
+export function splitMarkedR2Output(stdout) {
+    const result = {
+        truncated: stdout.includes(TRUNCATION_SENTINEL),
+        sectionsJson: "",
+        functionsJson: "",
+        xrefsByVaddr: new Map(),
+    };
+    const lines = stdout.split("\n");
+    let bucket = { kind: "pre" };
+    let buf = [];
+    const flush = () => {
+        const text = buf.join("\n").trim();
+        if (bucket.kind === "pre") {
+            result.version = parseR2Version(text);
+        }
+        else if (bucket.kind === "sec") {
+            result.sectionsJson = text;
+        }
+        else if (bucket.kind === "fns") {
+            result.functionsJson = text;
+        }
+        else if (bucket.kind === "xref" && bucket.key) {
+            result.xrefsByVaddr.set(bucket.key, text);
+        }
+        buf = [];
+    };
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed === R2_MARKERS.sections) {
+            flush();
+            bucket = { kind: "sec" };
+        }
+        else if (trimmed === R2_MARKERS.functions) {
+            flush();
+            bucket = { kind: "fns" };
+        }
+        else if (trimmed.startsWith(R2_MARKERS.xref + " ")) {
+            flush();
+            bucket = { kind: "xref", key: trimmed.slice(R2_MARKERS.xref.length + 1).trim() };
+        }
+        else {
+            buf.push(line);
+        }
+    }
+    flush();
+    return result;
+}
+//# sourceMappingURL=r2.js.map

package/dist/parsers/r2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"r2.js","sourceRoot":"","sources":["../../src/parsers/r2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,QAAQ,EAAE,eAAe;IACzB,SAAS,EAAE,eAAe;IAC1B,IAAI,EAAE,cAAc;CACZ,CAAC;AAEX,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAkChD,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,KAAK;YACL,QAAQ,EAAE,KAAK,GAAG,KAAK;YACvB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC9C,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACxB,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;YAChE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9B,CAAC;AAYD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,MAAM,MAAM,GAAkB;QAC5B,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAC/C,YAAY,EAAE,EAAE;QAChB,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAM,GAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrC,IAAI,GAAG,GAAa,EAAE,CAAC;IAEvB,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC;QAC7B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QACD,GAAG,GAAG,EAAE,CAAC;IACX,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,UAAU,CAAC,QAAQ,EAAE,CAAC;YACpC,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACrD,KAAK,EAAE,CAAC;YACR,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,KAAK,EAAE,CAAC;IACR,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/parsers/types.d.ts

@@ -11,7 +11,26 @@ export interface Finding {
     category?: string;
     /** Raw evidence from tool output */
     evidence?: string;
+    /**
+     * For capability findings (e.g. capa): the kind(s) of evidence the match
+     * actually relied on, derived from the feature nodes that matched. An
+     * unordered, deduplicated set describing HOW the rule matched — not a verdict
+     * on what the sample does. Absent when it cannot be determined (treat absence
+     * as "unknown", not "none").
+     *   - artifact   — matched on strings/regex/bytes (data present, not necessarily executed)
+     *   - behavior   — matched on API calls, mnemonics, or other code semantics
+     *   - structural — matched on sections, file characteristics, format/arch
+     *   - linking    — matched on imports / runtime-linking
+     */
+    evidence_types?: EvidenceType[];
 }
+/**
+ * The kind of evidence a capability match relied on (see Finding.evidence_types).
+ * A `string` artifact match proves the data is present; it does NOT prove the
+ * binary executes the corresponding behavior. Only a `behavior` match (API
+ * calls, mnemonics) is code-level evidence.
+ */
+export type EvidenceType = "artifact" | "behavior" | "structural" | "linking";
 /** Structured metadata extracted from tool output. */
 export interface ParsedToolOutput {
     /** Tool that produced this output */

package/dist/parsers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/parsers/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,wEAAwE;IACxE,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAC3D,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,SAAS,CAAC;AAE9E,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,MAAM,EAAE,OAAO,CAAC;IAChB,kCAAkC;IAClC,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,oEAAoE;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,gBAAgB,CAAC"}

package/dist/report/triage-discipline.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Pre-claim triage discipline checklist — server-authored, bundled, offline.
+ *
+ * This is operational guidance on USING the analysis tools and reasoning about
+ * evidence (the gates to pass before asserting a behavioral claim). It is
+ * deliberately distinct from the report-WRITING guidelines in
+ * content.generated.ts, which are synced from zeltser.com; this content is the
+ * same category as the server's other locally-authored guidance (the
+ * analyze_file analysis_guidance, the advisories, the suggest_tools hints) and
+ * is therefore authored and versioned here.
+ *
+ * Upgrade path: if this should later be published and reused on zeltser.com, it
+ * can graduate to the synced report-guidance pipeline without changing the
+ * `triage_checklist` topic's interface. Until then it is bundled and offline —
+ * no live network fetch (the server's works-offline guarantee is load-bearing
+ * for air-gapped REMnux deployments).
+ */
+export declare const TRIAGE_DISCIPLINE: {
+    readonly version: "1.0.0";
+    readonly title: "Malware triage discipline — gates to pass before making a claim";
+    readonly provenance: "Server-authored operational guidance, bundled and offline (not synced from zeltser.com).";
+    readonly core_principle: string;
+    readonly before_claiming_a_behavior: readonly ["Are the required APIs imported, or resolvable at runtime (GetProcAddress + LoadLibrary*)? If neither, the behavior is not statically supported.", "If the required APIs are absent but the binary is packed / encrypted / high-entropy, the honest answer is 'indeterminate — unpack first', not 'incapable'. Static absence on an obscured binary proves nothing.", "Are the relevant data artifacts (strings, wallet addresses, regexes) cross-referenced from executable code? Data sitting in .rdata with no code xref is an artifact, not an operational indicator.", "Is the relevant code reachable from the entry point, or only from unused / initializer-only code?", "Did dynamic analysis (emulation, sandbox) actually exercise the suspected path? Static analysis alone cannot confirm a runtime behavior.", "Distinguish 'the code to do X is present' (a capability) from 'the sample does X' (a confirmed behavior). Until confirmed, write 'capable of' or 'consistent with', not 'performs'."];
+    readonly for_each_ioc: readonly ["Operationally used (referenced by reachable code, or observed in traffic) vs. vestigial (present in the file but unreferenced)?", "Pyramid-of-Pain tier — trivially changed by the adversary (hash, IP) or costly (tooling, TTP)?", "Pivotable to other samples / campaigns, or unique to this sample?"];
+    readonly for_confidence: readonly ["Direct evidence vs. inferential leap — how many assumptions sit between the observation and the claim?", "Single-source vs. corroborated across independent tools or methods.", "Use ICD-203 estimative language; state attribution confidence separately from detection confidence."];
+    readonly using_this_server: readonly ["capa findings carry evidence_types (artifact / behavior / structural / linking), and analyze_file returns a capability_evidence field separating behavior_capable from artifact_only — read those before asserting a behavior.", "A YARA family match is resemblance, not identity. A family name in the filename is a lead to test, never a finding.", "When you need behavioral confirmation, plan for emulation (speakeasy) or sandbox detonation rather than inferring it from static artifacts."];
+};
+//# sourceMappingURL=triage-discipline.d.ts.map

package/dist/report/triage-discipline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-discipline.d.ts","sourceRoot":"","sources":["../../src/report/triage-discipline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;CA+BpB,CAAC"}