@zhuixin/engine 0.2.4 → 0.2.5

package/README.md

@@ -5,6 +5,16 @@ Private source repository for the AppTrace analysis engine.
 The published npm package contains only the compiled bundle (`dist/engine-main.js`).
 Source, tests, and build configuration stay in this repository.
 
+## Status
+
+- macOS arm64: bundle inspection and Electron/JavaScript analysis are verified.
+  Reports include the code-signature authority chain, team identifier and entitlement
+  keys. Ghidra headless import and automatic analysis work with a thin Mach-O, but
+  macOS native analysis is not implemented. `.dmg` acquisition is unsupported.
+- Windows x64: local application inspection, PE metadata and Authenticode signature
+  inspection are implemented. Native Windows analysis and MSIX/MSI packages are not
+  supported.
+
 ## Release
 
 ```bash

package/dist/engine-main.js

@@ -19950,6 +19950,12 @@ function archName2(cpu, subtype) {
   if (cpu === 16777228) return (subtype & 16777215) === 2 ? "arm64e" : "arm64";
   return `cpu-${cpu.toString(16)}`;
 }
+function readEntitlements(stdout) {
+  const trimmed = stdout.trim();
+  if (!trimmed) return void 0;
+  const xmlStart = trimmed.search(/<\?xml|<plist/i);
+  return (xmlStart === -1 ? trimmed : trimmed.slice(xmlStart)).trim() || void 0;
+}
 function machOArchitectures(filePath) {
   const fd = import_node_fs4.default.openSync(filePath, "r");
   try {
@@ -19989,7 +19995,9 @@ async function readSignature(bundlePath, warnings) {
   try {
     const { stdout, stderr } = await execFileAsync(
       "codesign",
-      ["-dv", "--entitlements", ":-", bundlePath],
+      // Single `-v` omits the Authority chain on macOS 14.x; the certificate
+      // chain is only printed at triple verbosity.
+      ["-dvvv", "--entitlements", ":-", bundlePath],
       { timeout: 3e4, maxBuffer: 4 * 1024 * 1024 }
     );
     const details = `${stderr}`;
@@ -19998,11 +20006,14 @@ async function readSignature(bundlePath, warnings) {
     );
     const team = /^TeamIdentifier=(.+)$/m.exec(details)?.[1]?.trim();
     const signed = /^CodeDirectory|^Signature=/m.test(details) || authority.length > 0;
+    if (/invalid entitlements blob/i.test(details)) {
+      warnings.push("Code signature reports an invalid entitlements blob; the OS ignores these entitlements.");
+    }
     return {
       signed,
       authority: authority.length ? authority : void 0,
       teamIdentifier: team,
-      entitlements: stdout.trim() || void 0
+      entitlements: readEntitlements(stdout)
     };
   } catch (error) {
     const stderr = error.stderr ?? "";
@@ -20950,6 +20961,11 @@ function inspectionValue(inspection, key) {
 function record(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
+function entitlementKeys(value) {
+  if (typeof value !== "string" || !value.includes("<key>")) return void 0;
+  const keys = [...value.matchAll(/<key>([^<]+)<\/key>/g)].map((match) => match[1]);
+  return keys.length ? keys : void 0;
+}
 function collectEvidencePaths(jobs) {
   const paths = /* @__PURE__ */ new Set();
   for (const job of jobs) {
@@ -20986,6 +21002,13 @@ function renderMacAppInspection(lines, inspection, warnings) {
     `| Authority | ${cell(
       Array.isArray(signature?.authority) ? signature?.authority.join(", ") : void 0
     )} |`,
+    `| Team identifier | ${cell(signature?.teamIdentifier)} |`,
+    `| Entitlements | ${cell(
+      (() => {
+        const keys = entitlementKeys(signature?.entitlements);
+        return keys ? keys.join(", ") : void 0;
+      })()
+    )} |`,
     ""
   );
   if (warnings.length > 0) {
@@ -21063,6 +21086,210 @@ function renderIpaInspection(lines, inspection, warnings) {
     lines.push("");
   }
 }
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+var IRREGULAR_PLURALS = {
+  "storage entry": "storage entries",
+  slice: "slices"
+};
+function countLabel(count, noun) {
+  const many = IRREGULAR_PLURALS[noun] ?? `${noun}s`;
+  return `${count.toLocaleString("en-US")} ${count === 1 ? noun : many}`;
+}
+var PLATFORM_LABEL = {
+  ios: "iOS",
+  macos: "macOS",
+  windows: "Windows",
+  linux: "Linux"
+};
+var FORMAT_LABEL = {
+  ipa: "IPA",
+  app: "macOS app bundle",
+  exe: "Windows executable"
+};
+function formatBytes(bytes) {
+  if (typeof bytes !== "number" || bytes <= 0) return "unknown size";
+  const units = ["B", "KB", "MB", "GB"];
+  let size = bytes;
+  let unit = 0;
+  while (size >= 1024 && unit < units.length - 1) {
+    size /= 1024;
+    unit += 1;
+  }
+  return `${size.toFixed(unit === 0 ? 0 : 1)} ${units[unit]}`;
+}
+function routeSegments(value) {
+  return value.replace(/^(?:\.{1,2}\/)+/, "").replace(/^\/+/, "").split(/[/?#]/).filter((segment) => segment.length > 0);
+}
+function routeGroup(value, depth = 1) {
+  const segments = routeSegments(value).slice(0, depth);
+  return segments.length > 0 ? segments.join("/") : "(root)";
+}
+function groupRoutes(values2) {
+  if (values2.length === 0) return [];
+  const buckets = /* @__PURE__ */ new Map();
+  for (const value of values2) {
+    const key = routeGroup(value, 1);
+    const bucket = buckets.get(key);
+    if (bucket) bucket.values.push(value);
+    else buckets.set(key, { depth: 1, values: [value] });
+  }
+  for (let guard = 0; guard < 8; guard += 1) {
+    const [key, bucket] = [...buckets.entries()].sort(
+      (a, b) => b[1].values.length - a[1].values.length
+    )[0];
+    if (bucket.depth >= 3 || bucket.values.length <= values2.length / 2) break;
+    const split = /* @__PURE__ */ new Map();
+    for (const value of bucket.values) {
+      const next = routeGroup(value, bucket.depth + 1);
+      const list = split.get(next);
+      if (list) list.push(value);
+      else split.set(next, [value]);
+    }
+    if (split.size * 2 > bucket.values.length) break;
+    if (split.size === 1 && split.has(key)) break;
+    buckets.delete(key);
+    for (const [next, list] of split) {
+      buckets.set(next, { depth: bucket.depth + 1, values: list });
+    }
+  }
+  return [...buckets.entries()].map(([group, bucket]) => ({
+    group,
+    count: bucket.values.length,
+    example: bucket.values[0]
+  })).sort((a, b) => b.count - a.count || a.group.localeCompare(b.group));
+}
+function selectReportJobs(jobs, limit = 20) {
+  const window = jobs.slice(0, limit);
+  const present = new Set(window.map((job) => job.id));
+  const carried = [];
+  for (const capability of ["native:inspect"]) {
+    const latest = jobs.find(
+      (job) => job.capabilityId === capability && String(job.status) === "analyzed"
+    );
+    if (latest && !present.has(latest.id)) carried.push(latest);
+  }
+  return [...window, ...carried];
+}
+function nativeFacts(jobs) {
+  const job = [...jobs].reverse().find(
+    (item) => item.capabilityId === "native:inspect" && String(item.status) === "analyzed"
+  );
+  if (!job?.result) return { inspected: false };
+  const counts = record(job.result.counts) ?? {};
+  const encryption = record(job.result.encryption) ?? {};
+  return {
+    inspected: true,
+    procedureCount: numberValue(
+      counts.procedure_count ?? counts.procedureCount
+    ),
+    stringCount: numberValue(counts.string_count ?? counts.stringCount),
+    declaredSlices: numberValue(encryption.declaredSlices),
+    encryptedSlices: numberValue(encryption.encryptedSlices),
+    allDeclaredEncrypted: typeof encryption.allDeclaredEncrypted === "boolean" ? encryption.allDeclaredEncrypted : void 0
+  };
+}
+function encryptionStatement(native, packageFormat) {
+  if (packageFormat !== "ipa") {
+    return "Not applicable: declared encryption only applies to iOS Mach-O slices.";
+  }
+  if (!native.inspected) {
+    return "Not determined \u2014 native inspection has not run for this artifact, so the encryption state is unknown.";
+  }
+  const declared = native.declaredSlices ?? 0;
+  const encrypted = native.encryptedSlices ?? 0;
+  if (declared === 0) {
+    return "The main executable declares no slices, so encryption state is unknown.";
+  }
+  if (encrypted === 0) {
+    return `No slice declares encryption (0 of ${declared}). Native code is readable, subject to normal static-analysis limits.`;
+  }
+  const subject = native.allDeclaredEncrypted ? "Every main-executable slice declares" : `${encrypted} of ${countLabel(declared, "slice")} declare`;
+  return `${subject} encryption (\`cryptid != 0\`, FairPlay). Symbol and string tables remain readable; decompiling those regions does not yield trustworthy original code.`;
+}
+function renderSummary(input2) {
+  const { target, artifact, counts, routeGroups, native, technology } = input2;
+  const countOf = (type) => counts.get(type) ?? 0;
+  const lines = ["## Summary", ""];
+  const format = artifact ? FORMAT_LABEL[artifact.packageFormat] ?? artifact.packageFormat.toUpperCase() : void 0;
+  const platform = PLATFORM_LABEL[target.targetRef.platform] ?? target.targetRef.platform;
+  const identity = [
+    `**${target.name}**`,
+    `${platform} application`,
+    target.version ? `version ${target.version}` : void 0,
+    target.publisher ? `published by ${target.publisher}` : void 0
+  ].filter(Boolean).join(", ");
+  const article = format && /^[AEIOU]/i.test(format) ? "an" : "a";
+  lines.push(
+    `${identity}${/[.!?]$/.test(identity) ? "" : "."}${artifact ? ` The artifact is ${article} ${format} of ${formatBytes(artifact.sizeBytes)}, SHA-256 \`${artifact.sha256.slice(0, 12)}\u2026\`.` : " No artifact has been registered yet."}`,
+    ""
+  );
+  const hasScriptSurface = countOf("route") > 0 || countOf("module") > 0 || countOf("asset") > 0;
+  if (hasScriptSurface) {
+    const surface = [
+      countOf("route") > 0 ? `${countLabel(countOf("route"), "route")} in ${countLabel(routeGroups.length, "path group")}` : void 0,
+      countOf("module") > 0 ? countLabel(countOf("module"), "JavaScript module") : void 0,
+      countOf("asset") > 0 ? countLabel(countOf("asset"), "asset") : void 0,
+      countLabel(countOf("network_endpoint"), "network endpoint candidate"),
+      countOf("storage") > 0 ? countLabel(countOf("storage"), "storage entry") : void 0
+    ].filter(Boolean);
+    lines.push(`**Static surface.** ${surface.join(", ")}.`, "");
+    if (countOf("network_endpoint") === 0) {
+      lines.push(
+        "No endpoint was classified. The analyzer reports absolute URLs found in inert JavaScript; a base URL assembled at runtime is not visible this way, so this is **not** evidence that the app makes no network calls.",
+        ""
+      );
+    }
+  } else {
+    lines.push(
+      "**Static surface.** No bundle script, route or module findings were recorded; the bundle inspection above is the complete recorded surface.",
+      ""
+    );
+  }
+  lines.push(
+    `**Technology signals.** ${technology.length > 0 ? technology.join(" / ") : "none detected"} (static hints, not a build-tool claim).`,
+    "",
+    `**Encryption.** ${encryptionStatement(native, artifact?.packageFormat)}`,
+    ""
+  );
+  if (native.inspected) {
+    const indexed = [
+      native.procedureCount !== void 0 ? countLabel(native.procedureCount, "procedure") : void 0,
+      native.stringCount !== void 0 ? countLabel(native.stringCount, "string") : void 0
+    ].filter(Boolean);
+    if (indexed.length > 0) {
+      lines.push(
+        `**Native surface.** ${indexed.join(" and ")} indexed; \`search_native\` and \`decompile_function\` answer from this index.`,
+        ""
+      );
+    }
+  }
+  const questions = [];
+  if (countOf("route") > 0 || countOf("module") > 0) {
+    questions.push(
+      "Which routes and modules make up a feature, and where each one is defined in the bundle."
+    );
+  }
+  if (native.inspected) {
+    questions.push(
+      "Which native symbols and strings match a name, and what one exact symbol decompiles to."
+    );
+  }
+  if (technology.length > 0) {
+    questions.push("Which framework produced the package and how it is laid out.");
+  }
+  if (questions.length > 0) {
+    lines.push("**Questions this evidence can answer.**", "");
+    for (const question of questions) lines.push(`- ${question}`);
+    lines.push("");
+  }
+  lines.push(
+    "**What it cannot establish.** Runtime behaviour, server-side logic, and code paths outside the recorded evidence; the app was not executed and no backend was contacted.",
+    ""
+  );
+  return lines;
+}
 function renderReportMarkdown(input2) {
   const {
     target,
@@ -21076,6 +21303,20 @@ function renderReportMarkdown(input2) {
   const inspection = artifact?.inspection;
   const warnings = Array.isArray(inspection?.warnings) ? inspection.warnings.map(String) : [];
   const evidencePaths = collectEvidencePaths(jobs);
+  const counts = /* @__PURE__ */ new Map();
+  for (const [type, total] of Object.entries(input2.typeTotals ?? {})) {
+    counts.set(type, total);
+  }
+  if (counts.size === 0) {
+    for (const finding of findings) {
+      counts.set(finding.type, (counts.get(finding.type) ?? 0) + 1);
+    }
+  }
+  const technology = findings.filter((finding) => finding.type === "technology").map((finding) => finding.value);
+  const routeGroups = groupRoutes(
+    findings.filter((finding) => finding.type === "route").map((finding) => finding.value)
+  );
+  const native = nativeFacts(jobs);
   const lines = [
     `# ${target.name} \xB7 Analysis report`,
     "",
@@ -21085,6 +21326,14 @@ function renderReportMarkdown(input2) {
     `- Source: ${target.targetRef.sourceId} / ${target.targetRef.sourceRef}`,
     "- Scope: this report summarizes the local artifact, static inspection and job records. It does not describe runtime behavior.",
     "",
+    ...renderSummary({
+      target,
+      artifact,
+      counts,
+      routeGroups,
+      native,
+      technology
+    }),
     "## Target",
     "",
     "| Field | Value |",
@@ -21135,34 +21384,71 @@ function renderReportMarkdown(input2) {
     "| Type | Count |",
     "| --- | --- |"
   );
-  const byType = /* @__PURE__ */ new Map();
-  for (const finding of findings) {
-    byType.set(finding.type, (byType.get(finding.type) ?? 0) + 1);
-  }
-  if (byType.size === 0) {
+  if (counts.size === 0) {
     lines.push("| \u2014 | 0 |");
   } else {
-    for (const [type, count] of [...byType.entries()].sort(
+    for (const [type, count] of [...counts.entries()].sort(
       (a, b) => a[0].localeCompare(b[0])
     )) {
       lines.push(`| ${cell(type)} | ${count} |`);
     }
   }
   lines.push("");
+  const itemLine = (item) => {
+    const location = item.sourcePath ? ` \u2014 \`${item.sourcePath}\`${item.start ? `:${item.start.line}:${item.start.column}` : ""}` : "";
+    return `- ${item.value}${location} (Evidence: \`${item.evidenceId}\`)`;
+  };
+  const routeItems = findings.filter((finding) => finding.type === "route");
+  const routeTotal = counts.get("route") ?? routeItems.length;
+  if (routeItems.length > 0) {
+    lines.push(
+      `### Routes (${routeTotal}, ${routeGroups.length} path groups)`,
+      "",
+      "Grouped by path prefix. A group holding more than half of the routes is split further, so one row cannot hide the rest.",
+      "",
+      "| Group | Routes | Example |",
+      "| --- | --- | --- |"
+    );
+    const shown = routeGroups.slice(0, 25);
+    for (const group of shown) {
+      lines.push(
+        `| ${cell(group.group)} | ${group.count} | \`${cell(group.example)}\` |`
+      );
+    }
+    if (routeGroups.length > shown.length) {
+      const rest = routeGroups.slice(shown.length).reduce((total, group) => total + group.count, 0);
+      lines.push(
+        `| (other ${routeGroups.length - shown.length} groups) | ${rest} | \u2014 |`
+      );
+    }
+    lines.push(
+      "",
+      routeItems.length < routeTotal ? `The inventory below covers the ${routeItems.length} routed findings included in this report; the full set stays queryable with \`search_findings --types route\`.` : "The inventory below is complete for this artifact.",
+      "",
+      `<details><summary>All ${routeItems.length} routed findings</summary>`,
+      ""
+    );
+    for (const item of routeItems) lines.push(itemLine(item));
+    lines.push("", "</details>", "");
+  }
+  const endpointItems = findings.filter(
+    (finding) => finding.type === "network_endpoint"
+  );
+  if (endpointItems.length > 0) {
+    lines.push("### Network endpoint candidates", "");
+    for (const item of endpointItems) lines.push(itemLine(item));
+    lines.push("");
+  }
   for (const [type, title] of [
-    ["route", "Routes"],
-    ["network_endpoint", "Network endpoint candidates"],
     ["module", "JavaScript modules"],
+    ["storage", "Storage entries"],
     ["native_procedure", "Native symbols"],
     ["risk", "Risks and limitations"]
   ]) {
-    const items = findings.filter((finding) => finding.type === type).slice(0, 20);
+    const items = findings.filter((finding) => finding.type === type).slice(0, 40);
     if (items.length === 0) continue;
     lines.push(`### ${title}`, "");
-    for (const item of items) {
-      const location = item.sourcePath ? ` \u2014 \`${item.sourcePath}\`${item.start ? `:${item.start.line}:${item.start.column}` : ""}` : "";
-      lines.push(`- ${item.value}${location} (Evidence: \`${item.evidenceId}\`)`);
-    }
+    for (const item of items) lines.push(itemLine(item));
     lines.push("");
   }
   const analysisGaps = findings.filter((finding) => finding.type === "limitation").slice(0, 20);
@@ -22199,13 +22485,22 @@ var CapabilityJobRunner = class {
       "risk",
       "limitation"
     ];
+    const limits = { route: 200, module: 200 };
     const findings = findingTypes.flatMap(
       (type) => this.store.searchFindings({
         targetId: target.id,
         types: [type],
-        limit: 20
+        limit: limits[type] ?? 40
       }).items
     );
+    const typeTotals = {};
+    for (const type of findingTypes) {
+      typeTotals[type] = this.store.searchFindings({
+        targetId: target.id,
+        types: [type],
+        limit: 1
+      }).total;
+    }
     const findingTotal = this.store.searchFindings({
       targetId: target.id,
       limit: 1
@@ -22213,9 +22508,13 @@ var CapabilityJobRunner = class {
     const markdown = renderReportMarkdown({
       target,
       artifact,
-      jobs: this.store.listJobs(target.id).filter((item) => item.id !== job.id).slice(0, 20),
+      jobs: selectReportJobs(
+        this.store.listJobs(target.id).filter((item) => item.id !== job.id),
+        20
+      ),
       findings,
       findingTotal,
+      typeTotals,
       hostPlatform: this.config.hostPlatform,
       generatedAt
     });
@@ -22437,7 +22736,9 @@ var FREE_FEATURES = /* @__PURE__ */ new Set([
   "inspect:pe",
   "extract:app",
   "javascript:analyze",
-  "generate:report"
+  "generate:report",
+  "native",
+  "compare"
 ]);
 function decode(value) {
   return Buffer.from(value, "base64url");
@@ -22723,11 +23024,11 @@ function evidenceFromRow(row) {
   };
 }
 function findingFromRow(row) {
-  const numberValue = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
-  const startLine = numberValue(row.start_line);
-  const startColumn = numberValue(row.start_column);
-  const endLine = numberValue(row.end_line);
-  const endColumn = numberValue(row.end_column);
+  const numberValue2 = (value) => typeof value === "number" && Number.isFinite(value) ? value : void 0;
+  const startLine = numberValue2(row.start_line);
+  const startColumn = numberValue2(row.start_column);
+  const endLine = numberValue2(row.end_line);
+  const endColumn = numberValue2(row.end_column);
   return {
     id: String(row.id),
     targetId: String(row.target_id),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zhuixin/engine",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "private": false,
   "license": "UNLICENSED",
   "description": "AppTrace analysis engine (compiled)",