windows-exe-decompiler-mcp-server 0.1.0 → 0.1.3

package/dist/tools/code-reconstruct-plan.d.ts

@@ -84,15 +84,15 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
             confidence: z.ZodNumber;
         }, "strip", z.ZodTypeAny, {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
         }, {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
@@ -117,8 +117,8 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
         recommendations: string[];
         phases: {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
@@ -143,8 +143,8 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
         recommendations: string[];
         phases: {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
@@ -182,16 +182,6 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     ok: boolean;
-    metrics?: {
-        elapsed_ms: number;
-        tool: string;
-        cached?: boolean | undefined;
-        cache_key?: string | undefined;
-        cache_tier?: string | undefined;
-        cache_created_at?: string | undefined;
-        cache_expires_at?: string | undefined;
-        cache_hit_at?: string | undefined;
-    } | undefined;
     data?: {
         confidence: number;
         feasibility: "high" | "low" | "medium";
@@ -212,17 +202,13 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
         recommendations: string[];
         phases: {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
         }[];
     } | undefined;
-    warnings?: string[] | undefined;
-    errors?: string[] | undefined;
-}, {
-    ok: boolean;
     metrics?: {
         elapsed_ms: number;
         tool: string;
@@ -233,6 +219,10 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
         cache_expires_at?: string | undefined;
         cache_hit_at?: string | undefined;
     } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+}, {
+    ok: boolean;
     data?: {
         confidence: number;
         feasibility: "high" | "low" | "medium";
@@ -253,13 +243,23 @@ export declare const CodeReconstructPlanOutputSchema: z.ZodObject<{
         recommendations: string[];
         phases: {
             confidence: number;
-            title: string;
             phase: string;
+            title: string;
             objective: string;
             actions: string[];
             estimated_effort: "high" | "low" | "medium";
         }[];
     } | undefined;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+        cached?: boolean | undefined;
+        cache_key?: string | undefined;
+        cache_tier?: string | undefined;
+        cache_created_at?: string | undefined;
+        cache_expires_at?: string | undefined;
+        cache_hit_at?: string | undefined;
+    } | undefined;
     warnings?: string[] | undefined;
     errors?: string[] | undefined;
 }>;

package/dist/tools/com-role-profile.d.ts

@@ -0,0 +1,353 @@
+import { z } from 'zod';
+import type { ToolArgs, ToolDefinition, WorkerResult } from '../types.js';
+import type { WorkspaceManager } from '../workspace-manager.js';
+import type { DatabaseManager } from '../database.js';
+import type { CacheManager } from '../cache-manager.js';
+export declare const ComRoleProfileInputSchema: z.ZodObject<{
+    sample_id: z.ZodString;
+    max_exports: z.ZodDefault<z.ZodNumber>;
+    max_strings: z.ZodDefault<z.ZodNumber>;
+    force_refresh: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    sample_id: string;
+    force_refresh: boolean;
+    max_strings: number;
+    max_exports: number;
+}, {
+    sample_id: string;
+    force_refresh?: boolean | undefined;
+    max_strings?: number | undefined;
+    max_exports?: number | undefined;
+}>;
+export declare const ComRoleProfileDataSchema: z.ZodObject<{
+    sample_id: z.ZodString;
+    original_filename: z.ZodNullable<z.ZodString>;
+    binary_role: z.ZodString;
+    likely_com_server: z.ZodBoolean;
+    com_confidence: z.ZodNumber;
+    class_factory_exports: z.ZodArray<z.ZodString, "many">;
+    registration_exports: z.ZodArray<z.ZodString, "many">;
+    clsid_strings: z.ZodArray<z.ZodString, "many">;
+    progid_strings: z.ZodArray<z.ZodString, "many">;
+    interface_hints: z.ZodArray<z.ZodString, "many">;
+    registration_strings: z.ZodArray<z.ZodString, "many">;
+    class_factory_surface: z.ZodObject<{
+        class_factory_exports: z.ZodArray<z.ZodString, "many">;
+        activation_markers: z.ZodArray<z.ZodString, "many">;
+        interface_hints: z.ZodArray<z.ZodString, "many">;
+        confidence: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        confidence: number;
+        interface_hints: string[];
+        class_factory_exports: string[];
+        activation_markers: string[];
+    }, {
+        confidence: number;
+        interface_hints: string[];
+        class_factory_exports: string[];
+        activation_markers: string[];
+    }>;
+    activation_steps: z.ZodArray<z.ZodString, "many">;
+    host_interaction_profile: z.ZodObject<{
+        likely_hosted: z.ZodBoolean;
+        host_hints: z.ZodArray<z.ZodString, "many">;
+        callback_exports: z.ZodArray<z.ZodString, "many">;
+        callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+        callback_strings: z.ZodArray<z.ZodString, "many">;
+        service_hooks: z.ZodArray<z.ZodString, "many">;
+        confidence: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        confidence: number;
+        callback_surface: string[];
+        likely_hosted: boolean;
+        host_hints: string[];
+        callback_exports: string[];
+        callback_strings: string[];
+        service_hooks: string[];
+    }, {
+        confidence: number;
+        likely_hosted: boolean;
+        host_hints: string[];
+        callback_exports: string[];
+        callback_strings: string[];
+        service_hooks: string[];
+        callback_surface?: string[] | undefined;
+    }>;
+    activation_model: z.ZodString;
+    analysis_priorities: z.ZodArray<z.ZodString, "many">;
+}, "strip", z.ZodTypeAny, {
+    sample_id: string;
+    binary_role: string;
+    original_filename: string | null;
+    analysis_priorities: string[];
+    registration_exports: string[];
+    clsid_strings: string[];
+    progid_strings: string[];
+    interface_hints: string[];
+    registration_strings: string[];
+    class_factory_exports: string[];
+    class_factory_surface: {
+        confidence: number;
+        interface_hints: string[];
+        class_factory_exports: string[];
+        activation_markers: string[];
+    };
+    host_interaction_profile: {
+        confidence: number;
+        callback_surface: string[];
+        likely_hosted: boolean;
+        host_hints: string[];
+        callback_exports: string[];
+        callback_strings: string[];
+        service_hooks: string[];
+    };
+    likely_com_server: boolean;
+    com_confidence: number;
+    activation_steps: string[];
+    activation_model: string;
+}, {
+    sample_id: string;
+    binary_role: string;
+    original_filename: string | null;
+    analysis_priorities: string[];
+    registration_exports: string[];
+    clsid_strings: string[];
+    progid_strings: string[];
+    interface_hints: string[];
+    registration_strings: string[];
+    class_factory_exports: string[];
+    class_factory_surface: {
+        confidence: number;
+        interface_hints: string[];
+        class_factory_exports: string[];
+        activation_markers: string[];
+    };
+    host_interaction_profile: {
+        confidence: number;
+        likely_hosted: boolean;
+        host_hints: string[];
+        callback_exports: string[];
+        callback_strings: string[];
+        service_hooks: string[];
+        callback_surface?: string[] | undefined;
+    };
+    likely_com_server: boolean;
+    com_confidence: number;
+    activation_steps: string[];
+    activation_model: string;
+}>;
+export declare const ComRoleProfileOutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodObject<{
+        sample_id: z.ZodString;
+        original_filename: z.ZodNullable<z.ZodString>;
+        binary_role: z.ZodString;
+        likely_com_server: z.ZodBoolean;
+        com_confidence: z.ZodNumber;
+        class_factory_exports: z.ZodArray<z.ZodString, "many">;
+        registration_exports: z.ZodArray<z.ZodString, "many">;
+        clsid_strings: z.ZodArray<z.ZodString, "many">;
+        progid_strings: z.ZodArray<z.ZodString, "many">;
+        interface_hints: z.ZodArray<z.ZodString, "many">;
+        registration_strings: z.ZodArray<z.ZodString, "many">;
+        class_factory_surface: z.ZodObject<{
+            class_factory_exports: z.ZodArray<z.ZodString, "many">;
+            activation_markers: z.ZodArray<z.ZodString, "many">;
+            interface_hints: z.ZodArray<z.ZodString, "many">;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        }, {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        }>;
+        activation_steps: z.ZodArray<z.ZodString, "many">;
+        host_interaction_profile: z.ZodObject<{
+            likely_hosted: z.ZodBoolean;
+            host_hints: z.ZodArray<z.ZodString, "many">;
+            callback_exports: z.ZodArray<z.ZodString, "many">;
+            callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            callback_strings: z.ZodArray<z.ZodString, "many">;
+            service_hooks: z.ZodArray<z.ZodString, "many">;
+            confidence: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            confidence: number;
+            callback_surface: string[];
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+        }, {
+            confidence: number;
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+            callback_surface?: string[] | undefined;
+        }>;
+        activation_model: z.ZodString;
+        analysis_priorities: z.ZodArray<z.ZodString, "many">;
+    }, "strip", z.ZodTypeAny, {
+        sample_id: string;
+        binary_role: string;
+        original_filename: string | null;
+        analysis_priorities: string[];
+        registration_exports: string[];
+        clsid_strings: string[];
+        progid_strings: string[];
+        interface_hints: string[];
+        registration_strings: string[];
+        class_factory_exports: string[];
+        class_factory_surface: {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        };
+        host_interaction_profile: {
+            confidence: number;
+            callback_surface: string[];
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+        };
+        likely_com_server: boolean;
+        com_confidence: number;
+        activation_steps: string[];
+        activation_model: string;
+    }, {
+        sample_id: string;
+        binary_role: string;
+        original_filename: string | null;
+        analysis_priorities: string[];
+        registration_exports: string[];
+        clsid_strings: string[];
+        progid_strings: string[];
+        interface_hints: string[];
+        registration_strings: string[];
+        class_factory_exports: string[];
+        class_factory_surface: {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        };
+        host_interaction_profile: {
+            confidence: number;
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+            callback_surface?: string[] | undefined;
+        };
+        likely_com_server: boolean;
+        com_confidence: number;
+        activation_steps: string[];
+        activation_model: string;
+    }>>;
+    warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        elapsed_ms: z.ZodNumber;
+        tool: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        elapsed_ms: number;
+        tool: string;
+    }, {
+        elapsed_ms: number;
+        tool: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    ok: boolean;
+    data?: {
+        sample_id: string;
+        binary_role: string;
+        original_filename: string | null;
+        analysis_priorities: string[];
+        registration_exports: string[];
+        clsid_strings: string[];
+        progid_strings: string[];
+        interface_hints: string[];
+        registration_strings: string[];
+        class_factory_exports: string[];
+        class_factory_surface: {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        };
+        host_interaction_profile: {
+            confidence: number;
+            callback_surface: string[];
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+        };
+        likely_com_server: boolean;
+        com_confidence: number;
+        activation_steps: string[];
+        activation_model: string;
+    } | undefined;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+}, {
+    ok: boolean;
+    data?: {
+        sample_id: string;
+        binary_role: string;
+        original_filename: string | null;
+        analysis_priorities: string[];
+        registration_exports: string[];
+        clsid_strings: string[];
+        progid_strings: string[];
+        interface_hints: string[];
+        registration_strings: string[];
+        class_factory_exports: string[];
+        class_factory_surface: {
+            confidence: number;
+            interface_hints: string[];
+            class_factory_exports: string[];
+            activation_markers: string[];
+        };
+        host_interaction_profile: {
+            confidence: number;
+            likely_hosted: boolean;
+            host_hints: string[];
+            callback_exports: string[];
+            callback_strings: string[];
+            service_hooks: string[];
+            callback_surface?: string[] | undefined;
+        };
+        likely_com_server: boolean;
+        com_confidence: number;
+        activation_steps: string[];
+        activation_model: string;
+    } | undefined;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+}>;
+export declare const comRoleProfileToolDefinition: ToolDefinition;
+export declare function createComRoleProfileHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager, dependencies?: {
+    binaryRoleProfileHandler?: (args: ToolArgs) => Promise<WorkerResult>;
+}): (args: ToolArgs) => Promise<WorkerResult>;
+//# sourceMappingURL=com-role-profile.d.ts.map

package/dist/tools/com-role-profile.js

@@ -0,0 +1,186 @@
+import { z } from 'zod';
+import { BinaryRoleProfileDataSchema, createBinaryRoleProfileHandler, } from './binary-role-profile.js';
+const TOOL_NAME = 'com.role.profile';
+export const ComRoleProfileInputSchema = z.object({
+    sample_id: z.string().describe('Sample ID (format: sha256:<hex>)'),
+    max_exports: z
+        .number()
+        .int()
+        .min(1)
+        .max(24)
+        .default(12)
+        .describe('Maximum class-factory and registration exports surfaced in the COM role profile'),
+    max_strings: z
+        .number()
+        .int()
+        .min(20)
+        .max(400)
+        .default(140)
+        .describe('Maximum strings inspected for CLSID, ProgID, interface, and registration hints'),
+    force_refresh: z
+        .boolean()
+        .default(false)
+        .describe('Bypass cache lookup and recompute the COM role profile from source evidence'),
+});
+export const ComRoleProfileDataSchema = z.object({
+    sample_id: z.string(),
+    original_filename: z.string().nullable(),
+    binary_role: z.string(),
+    likely_com_server: z.boolean(),
+    com_confidence: z.number().min(0).max(1),
+    class_factory_exports: z.array(z.string()),
+    registration_exports: z.array(z.string()),
+    clsid_strings: z.array(z.string()),
+    progid_strings: z.array(z.string()),
+    interface_hints: z.array(z.string()),
+    registration_strings: z.array(z.string()),
+    class_factory_surface: z.object({
+        class_factory_exports: z.array(z.string()),
+        activation_markers: z.array(z.string()),
+        interface_hints: z.array(z.string()),
+        confidence: z.number().min(0).max(1),
+    }),
+    activation_steps: z.array(z.string()),
+    host_interaction_profile: BinaryRoleProfileDataSchema.shape.host_interaction_profile,
+    activation_model: z.string(),
+    analysis_priorities: z.array(z.string()),
+});
+export const ComRoleProfileOutputSchema = z.object({
+    ok: z.boolean(),
+    data: ComRoleProfileDataSchema.optional(),
+    warnings: z.array(z.string()).optional(),
+    errors: z.array(z.string()).optional(),
+    metrics: z
+        .object({
+        elapsed_ms: z.number(),
+        tool: z.string(),
+    })
+        .optional(),
+});
+export const comRoleProfileToolDefinition = {
+    name: TOOL_NAME,
+    description: 'Profile COM-oriented PE samples, including class factory exports, CLSID/ProgID strings, registration hints, and likely activation flow.',
+    inputSchema: ComRoleProfileInputSchema,
+    outputSchema: ComRoleProfileOutputSchema,
+};
+function dedupe(values) {
+    return Array.from(new Set(values.map((item) => item.trim()).filter((item) => item.length > 0)));
+}
+function inferActivationModel(profile) {
+    if (profile.com_profile.class_factory_exports.length > 0) {
+        return 'inproc_class_factory';
+    }
+    if (profile.com_profile.registration_strings.some((item) => /localserver32/i.test(item))) {
+        return 'local_server_registration';
+    }
+    if (profile.com_profile.clsid_strings.length > 0 || profile.com_profile.progid_strings.length > 0) {
+        return 'registration_strings_only';
+    }
+    return 'not_com_like';
+}
+function buildActivationSteps(profile) {
+    const steps = [];
+    if (profile.export_dispatch_profile.registration_exports.length > 0) {
+        steps.push('Review COM registration exports and registry-facing installation routines.');
+    }
+    if (profile.com_profile.registration_strings.some((item) => /inprocserver32/i.test(item))) {
+        steps.push('Resolve the InprocServer32 registration path and associated CLSID/ProgID bindings.');
+    }
+    if (profile.com_profile.registration_strings.some((item) => /localserver32/i.test(item))) {
+        steps.push('Check whether activation can fall back to a LocalServer32-style out-of-process server.');
+    }
+    if (profile.com_profile.class_factory_exports.length > 0) {
+        steps.push('Trace DllGetClassObject or equivalent class-factory export into object instantiation logic.');
+    }
+    if (profile.com_profile.interface_hints.length > 0) {
+        steps.push('Follow interface negotiation paths for IClassFactory/IUnknown/IDispatch-style flows.');
+    }
+    return dedupe(steps);
+}
+function buildClassFactorySurface(profile) {
+    const activationMarkers = dedupe([
+        ...profile.com_profile.clsid_strings,
+        ...profile.com_profile.progid_strings,
+        ...profile.com_profile.registration_strings.filter((item) => /inprocserver32|localserver32|appid|clsid/i.test(item)),
+    ].slice(0, 8));
+    let confidence = profile.com_profile.class_factory_exports.length > 0 ? 0.64 : 0.28;
+    if (activationMarkers.length > 0)
+        confidence += 0.16;
+    if (profile.com_profile.interface_hints.length > 0)
+        confidence += 0.08;
+    return {
+        class_factory_exports: profile.com_profile.class_factory_exports,
+        activation_markers: activationMarkers,
+        interface_hints: profile.com_profile.interface_hints,
+        confidence: Math.min(1, confidence),
+    };
+}
+export function createComRoleProfileHandler(workspaceManager, database, cacheManager, dependencies) {
+    const binaryRoleProfileHandler = dependencies?.binaryRoleProfileHandler ||
+        createBinaryRoleProfileHandler(workspaceManager, database, cacheManager);
+    return async (args) => {
+        const startTime = Date.now();
+        try {
+            const input = ComRoleProfileInputSchema.parse(args);
+            const profileResult = await binaryRoleProfileHandler({
+                sample_id: input.sample_id,
+                max_exports: input.max_exports,
+                max_strings: input.max_strings,
+                force_refresh: input.force_refresh,
+            });
+            if (!profileResult.ok || !profileResult.data) {
+                return {
+                    ok: false,
+                    errors: profileResult.errors || ['Failed to compute binary role profile'],
+                    warnings: profileResult.warnings,
+                    metrics: {
+                        elapsed_ms: Date.now() - startTime,
+                        tool: TOOL_NAME,
+                    },
+                };
+            }
+            const profile = BinaryRoleProfileDataSchema.parse(profileResult.data);
+            const payload = {
+                sample_id: profile.sample_id,
+                original_filename: profile.original_filename,
+                binary_role: profile.binary_role,
+                likely_com_server: profile.indicators.com_server.likely,
+                com_confidence: profile.com_profile.confidence,
+                class_factory_exports: profile.com_profile.class_factory_exports,
+                registration_exports: profile.export_dispatch_profile.registration_exports,
+                clsid_strings: profile.com_profile.clsid_strings,
+                progid_strings: profile.com_profile.progid_strings,
+                interface_hints: profile.com_profile.interface_hints,
+                registration_strings: profile.com_profile.registration_strings,
+                class_factory_surface: buildClassFactorySurface(profile),
+                activation_steps: buildActivationSteps(profile),
+                host_interaction_profile: profile.host_interaction_profile,
+                activation_model: inferActivationModel(profile),
+                analysis_priorities: dedupe([
+                    ...profile.analysis_priorities,
+                    'trace_com_activation_and_class_factory_flow',
+                ]),
+            };
+            return {
+                ok: true,
+                data: payload,
+                warnings: profileResult.warnings,
+                metrics: {
+                    elapsed_ms: Date.now() - startTime,
+                    tool: TOOL_NAME,
+                },
+            };
+        }
+        catch (error) {
+            return {
+                ok: false,
+                errors: [error.message],
+                metrics: {
+                    elapsed_ms: Date.now() - startTime,
+                    tool: TOOL_NAME,
+                },
+            };
+        }
+    };
+}
+//# sourceMappingURL=com-role-profile.js.map