windows-exe-decompiler-mcp-server 0.1.0 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (134) hide show
  1. package/CLAUDE_INSTALLATION.md +129 -0
  2. package/CODEX_INSTALLATION.md +25 -1
  3. package/COPILOT_INSTALLATION.md +29 -1
  4. package/LICENSE +21 -21
  5. package/README.md +232 -110
  6. package/dist/analysis-provenance.d.ts +50 -2
  7. package/dist/analysis-provenance.js +1 -0
  8. package/dist/analysis-task-runner.js +92 -0
  9. package/dist/config.d.ts +35 -16
  10. package/dist/config.js +37 -3
  11. package/dist/database.js +115 -115
  12. package/dist/decompiler-worker.d.ts +10 -5
  13. package/dist/decompiler-worker.js +240 -58
  14. package/dist/dynamic-trace.d.ts +6 -0
  15. package/dist/dynamic-trace.js +52 -1
  16. package/dist/ghidra-config.js +17 -1
  17. package/dist/index.js +38 -8
  18. package/dist/pe-runtime-functions.d.ts +90 -0
  19. package/dist/pe-runtime-functions.js +452 -0
  20. package/dist/prompts/module-reconstruction-review.d.ts +5 -0
  21. package/dist/prompts/module-reconstruction-review.js +65 -0
  22. package/dist/runtime-correlation.d.ts +5 -0
  23. package/dist/runtime-correlation.js +179 -2
  24. package/dist/sample-workspace.d.ts +28 -0
  25. package/dist/sample-workspace.js +186 -0
  26. package/dist/semantic-name-suggestion-artifacts.d.ts +56 -0
  27. package/dist/semantic-name-suggestion-artifacts.js +87 -0
  28. package/dist/server.js +1 -1
  29. package/dist/setup-guidance.d.ts +73 -0
  30. package/dist/setup-guidance.js +211 -0
  31. package/dist/tools/artifact-read.d.ts +10 -10
  32. package/dist/tools/artifacts-diff.d.ts +8 -8
  33. package/dist/tools/artifacts-list.d.ts +16 -16
  34. package/dist/tools/attack-map.d.ts +8 -8
  35. package/dist/tools/binary-role-profile.d.ts +1197 -0
  36. package/dist/tools/binary-role-profile.js +575 -0
  37. package/dist/tools/code-function-explain-apply.d.ts +12 -12
  38. package/dist/tools/code-function-explain-prepare.d.ts +12 -12
  39. package/dist/tools/code-function-explain-review.d.ts +58 -58
  40. package/dist/tools/code-function-rename-apply.d.ts +12 -12
  41. package/dist/tools/code-function-rename-prepare.d.ts +14 -14
  42. package/dist/tools/code-function-rename-review.d.ts +66 -66
  43. package/dist/tools/code-functions-define.d.ts +337 -0
  44. package/dist/tools/code-functions-define.js +337 -0
  45. package/dist/tools/code-functions-list.js +1 -1
  46. package/dist/tools/code-functions-rank.js +1 -1
  47. package/dist/tools/code-functions-reconstruct.d.ts +368 -58
  48. package/dist/tools/code-functions-reconstruct.js +130 -10
  49. package/dist/tools/code-functions-smart-recover.d.ts +352 -0
  50. package/dist/tools/code-functions-smart-recover.js +190 -0
  51. package/dist/tools/code-module-review-apply.d.ts +233 -0
  52. package/dist/tools/code-module-review-apply.js +209 -0
  53. package/dist/tools/code-module-review-prepare.d.ts +756 -0
  54. package/dist/tools/code-module-review-prepare.js +343 -0
  55. package/dist/tools/code-module-review.d.ts +474 -0
  56. package/dist/tools/code-module-review.js +566 -0
  57. package/dist/tools/code-reconstruct-export.d.ts +193 -21
  58. package/dist/tools/code-reconstruct-export.js +578 -21
  59. package/dist/tools/code-reconstruct-plan.d.ts +20 -20
  60. package/dist/tools/com-role-profile.d.ts +353 -0
  61. package/dist/tools/com-role-profile.js +186 -0
  62. package/dist/tools/dll-export-profile.d.ts +625 -0
  63. package/dist/tools/dll-export-profile.js +230 -0
  64. package/dist/tools/dotnet-metadata-extract.d.ts +122 -122
  65. package/dist/tools/dotnet-reconstruct-export.d.ts +49 -49
  66. package/dist/tools/dotnet-types-list.d.ts +66 -66
  67. package/dist/tools/dynamic-dependencies.d.ts +144 -8
  68. package/dist/tools/dynamic-dependencies.js +20 -1
  69. package/dist/tools/dynamic-memory-import.js +105 -2
  70. package/dist/tools/ghidra-analyze.d.ts +20 -0
  71. package/dist/tools/ghidra-analyze.js +10 -2
  72. package/dist/tools/ghidra-health.d.ts +177 -0
  73. package/dist/tools/ghidra-health.js +28 -0
  74. package/dist/tools/ioc-export.d.ts +8 -8
  75. package/dist/tools/packer-detect.d.ts +14 -14
  76. package/dist/tools/packer-detect.js +6 -9
  77. package/dist/tools/pe-exports-extract.d.ts +8 -8
  78. package/dist/tools/pe-exports-extract.js +6 -9
  79. package/dist/tools/pe-fingerprint.d.ts +36 -36
  80. package/dist/tools/pe-imports-extract.d.ts +8 -8
  81. package/dist/tools/pe-imports-extract.js +6 -9
  82. package/dist/tools/pe-pdata-extract.d.ts +448 -0
  83. package/dist/tools/pe-pdata-extract.js +219 -0
  84. package/dist/tools/pe-symbols-recover.d.ts +227 -0
  85. package/dist/tools/pe-symbols-recover.js +316 -0
  86. package/dist/tools/report-generate.d.ts +15 -1
  87. package/dist/tools/report-generate.js +139 -16
  88. package/dist/tools/report-summarize.d.ts +2242 -8
  89. package/dist/tools/report-summarize.js +246 -10
  90. package/dist/tools/runtime-detect.d.ts +8 -8
  91. package/dist/tools/runtime-detect.js +2 -12
  92. package/dist/tools/rust-binary-analyze.d.ts +2047 -0
  93. package/dist/tools/rust-binary-analyze.js +443 -0
  94. package/dist/tools/sample-profile-get.d.ts +135 -16
  95. package/dist/tools/sample-profile-get.js +35 -32
  96. package/dist/tools/sandbox-execute.d.ts +10 -10
  97. package/dist/tools/strings-extract.d.ts +8 -8
  98. package/dist/tools/strings-extract.js +2 -12
  99. package/dist/tools/strings-floss-decode.d.ts +8 -8
  100. package/dist/tools/system-health.d.ts +172 -36
  101. package/dist/tools/system-health.js +14 -0
  102. package/dist/tools/system-setup-guide.d.ts +179 -0
  103. package/dist/tools/system-setup-guide.js +62 -0
  104. package/dist/tools/tool-help.d.ts +16 -16
  105. package/dist/tools/tool-help.js +172 -0
  106. package/dist/tools/yara-scan.d.ts +8 -8
  107. package/dist/types.d.ts +2 -0
  108. package/dist/workflows/function-explanation-review.d.ts +3034 -76
  109. package/dist/workflows/function-explanation-review.js +172 -42
  110. package/dist/workflows/function-index-recover.d.ts +333 -0
  111. package/dist/workflows/function-index-recover.js +291 -0
  112. package/dist/workflows/module-reconstruction-review.d.ts +3537 -0
  113. package/dist/workflows/module-reconstruction-review.js +354 -0
  114. package/dist/workflows/reconstruct.d.ts +2182 -223
  115. package/dist/workflows/reconstruct.js +575 -32
  116. package/dist/workflows/semantic-name-review.d.ts +1436 -85
  117. package/dist/workflows/semantic-name-review.js +150 -58
  118. package/dist/workflows/triage.d.ts +8 -8
  119. package/ghidra_scripts/DecompileFunction.java +487 -487
  120. package/ghidra_scripts/ExtractCFG.java +256 -256
  121. package/ghidra_scripts/ExtractFunctions.java +442 -442
  122. package/ghidra_scripts/README.md +112 -112
  123. package/ghidra_scripts/SearchFunctionReferences.java +380 -380
  124. package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -9
  125. package/helpers/DotNetMetadataProbe/Program.cs +566 -566
  126. package/install-to-claude.ps1 +432 -0
  127. package/install-to-codex.ps1 +256 -178
  128. package/install-to-copilot.ps1 +389 -303
  129. package/package.json +4 -2
  130. package/requirements.txt +9 -9
  131. package/workers/requirements-dynamic.txt +11 -11
  132. package/workers/requirements.txt +8 -8
  133. package/workers/speakeasy_compat.py +175 -175
  134. package/workers/static_worker.py +3474 -3474
@@ -0,0 +1,2047 @@
1
+ import { z } from 'zod';
2
+ import type { ToolArgs, ToolDefinition, WorkerResult } from '../types.js';
3
+ import type { WorkspaceManager } from '../workspace-manager.js';
4
+ import type { DatabaseManager } from '../database.js';
5
+ import type { CacheManager } from '../cache-manager.js';
6
+ export declare const rustBinaryAnalyzeInputSchema: z.ZodObject<{
7
+ sample_id: z.ZodString;
8
+ max_strings: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
9
+ max_symbol_preview: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
10
+ force_refresh: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
11
+ }, "strip", z.ZodTypeAny, {
12
+ sample_id: string;
13
+ force_refresh: boolean;
14
+ max_strings: number;
15
+ max_symbol_preview: number;
16
+ }, {
17
+ sample_id: string;
18
+ force_refresh?: boolean | undefined;
19
+ max_strings?: number | undefined;
20
+ max_symbol_preview?: number | undefined;
21
+ }>;
22
+ export declare const RustBinaryAnalyzeDataSchema: z.ZodObject<{
23
+ sample_id: z.ZodString;
24
+ suspected_rust: z.ZodBoolean;
25
+ confidence: z.ZodNumber;
26
+ primary_runtime: z.ZodNullable<z.ZodString>;
27
+ runtime_hints: z.ZodArray<z.ZodString, "many">;
28
+ cargo_paths: z.ZodArray<z.ZodString, "many">;
29
+ rust_markers: z.ZodArray<z.ZodString, "many">;
30
+ async_runtime_markers: z.ZodArray<z.ZodString, "many">;
31
+ panic_markers: z.ZodArray<z.ZodString, "many">;
32
+ crate_hints: z.ZodArray<z.ZodString, "many">;
33
+ library_profile: z.ZodOptional<z.ZodObject<{
34
+ ecosystems: z.ZodArray<z.ZodString, "many">;
35
+ top_crates: z.ZodArray<z.ZodString, "many">;
36
+ notable_libraries: z.ZodArray<z.ZodString, "many">;
37
+ evidence: z.ZodArray<z.ZodString, "many">;
38
+ }, "strip", z.ZodTypeAny, {
39
+ evidence: string[];
40
+ ecosystems: string[];
41
+ top_crates: string[];
42
+ notable_libraries: string[];
43
+ }, {
44
+ evidence: string[];
45
+ ecosystems: string[];
46
+ top_crates: string[];
47
+ notable_libraries: string[];
48
+ }>>;
49
+ binary_profile: z.ZodOptional<z.ZodObject<{
50
+ sample_id: z.ZodString;
51
+ original_filename: z.ZodNullable<z.ZodString>;
52
+ binary_role: z.ZodString;
53
+ role_confidence: z.ZodNumber;
54
+ runtime_hint: z.ZodObject<{
55
+ is_dotnet: z.ZodNullable<z.ZodBoolean>;
56
+ dotnet_version: z.ZodNullable<z.ZodString>;
57
+ target_framework: z.ZodNullable<z.ZodString>;
58
+ primary_runtime: z.ZodNullable<z.ZodString>;
59
+ }, "strip", z.ZodTypeAny, {
60
+ is_dotnet: boolean | null;
61
+ dotnet_version: string | null;
62
+ target_framework: string | null;
63
+ primary_runtime: string | null;
64
+ }, {
65
+ is_dotnet: boolean | null;
66
+ dotnet_version: string | null;
67
+ target_framework: string | null;
68
+ primary_runtime: string | null;
69
+ }>;
70
+ export_surface: z.ZodObject<{
71
+ total_exports: z.ZodNumber;
72
+ total_forwarders: z.ZodNumber;
73
+ notable_exports: z.ZodArray<z.ZodString, "many">;
74
+ com_related_exports: z.ZodArray<z.ZodString, "many">;
75
+ service_related_exports: z.ZodArray<z.ZodString, "many">;
76
+ plugin_related_exports: z.ZodArray<z.ZodString, "many">;
77
+ forwarded_exports: z.ZodArray<z.ZodString, "many">;
78
+ }, "strip", z.ZodTypeAny, {
79
+ total_exports: number;
80
+ total_forwarders: number;
81
+ notable_exports: string[];
82
+ com_related_exports: string[];
83
+ service_related_exports: string[];
84
+ plugin_related_exports: string[];
85
+ forwarded_exports: string[];
86
+ }, {
87
+ total_exports: number;
88
+ total_forwarders: number;
89
+ notable_exports: string[];
90
+ com_related_exports: string[];
91
+ service_related_exports: string[];
92
+ plugin_related_exports: string[];
93
+ forwarded_exports: string[];
94
+ }>;
95
+ import_surface: z.ZodObject<{
96
+ dll_count: z.ZodNumber;
97
+ notable_dlls: z.ZodArray<z.ZodString, "many">;
98
+ com_related_imports: z.ZodArray<z.ZodString, "many">;
99
+ service_related_imports: z.ZodArray<z.ZodString, "many">;
100
+ network_related_imports: z.ZodArray<z.ZodString, "many">;
101
+ process_related_imports: z.ZodArray<z.ZodString, "many">;
102
+ }, "strip", z.ZodTypeAny, {
103
+ dll_count: number;
104
+ notable_dlls: string[];
105
+ com_related_imports: string[];
106
+ service_related_imports: string[];
107
+ network_related_imports: string[];
108
+ process_related_imports: string[];
109
+ }, {
110
+ dll_count: number;
111
+ notable_dlls: string[];
112
+ com_related_imports: string[];
113
+ service_related_imports: string[];
114
+ network_related_imports: string[];
115
+ process_related_imports: string[];
116
+ }>;
117
+ packed: z.ZodBoolean;
118
+ packing_confidence: z.ZodNumber;
119
+ indicators: z.ZodObject<{
120
+ com_server: z.ZodObject<{
121
+ likely: z.ZodBoolean;
122
+ confidence: z.ZodNumber;
123
+ evidence: z.ZodArray<z.ZodString, "many">;
124
+ }, "strip", z.ZodTypeAny, {
125
+ confidence: number;
126
+ evidence: string[];
127
+ likely: boolean;
128
+ }, {
129
+ confidence: number;
130
+ evidence: string[];
131
+ likely: boolean;
132
+ }>;
133
+ service_binary: z.ZodObject<{
134
+ likely: z.ZodBoolean;
135
+ confidence: z.ZodNumber;
136
+ evidence: z.ZodArray<z.ZodString, "many">;
137
+ }, "strip", z.ZodTypeAny, {
138
+ confidence: number;
139
+ evidence: string[];
140
+ likely: boolean;
141
+ }, {
142
+ confidence: number;
143
+ evidence: string[];
144
+ likely: boolean;
145
+ }>;
146
+ plugin_binary: z.ZodObject<{
147
+ likely: z.ZodBoolean;
148
+ confidence: z.ZodNumber;
149
+ evidence: z.ZodArray<z.ZodString, "many">;
150
+ }, "strip", z.ZodTypeAny, {
151
+ confidence: number;
152
+ evidence: string[];
153
+ likely: boolean;
154
+ }, {
155
+ confidence: number;
156
+ evidence: string[];
157
+ likely: boolean;
158
+ }>;
159
+ driver_binary: z.ZodObject<{
160
+ likely: z.ZodBoolean;
161
+ confidence: z.ZodNumber;
162
+ evidence: z.ZodArray<z.ZodString, "many">;
163
+ }, "strip", z.ZodTypeAny, {
164
+ confidence: number;
165
+ evidence: string[];
166
+ likely: boolean;
167
+ }, {
168
+ confidence: number;
169
+ evidence: string[];
170
+ likely: boolean;
171
+ }>;
172
+ }, "strip", z.ZodTypeAny, {
173
+ com_server: {
174
+ confidence: number;
175
+ evidence: string[];
176
+ likely: boolean;
177
+ };
178
+ service_binary: {
179
+ confidence: number;
180
+ evidence: string[];
181
+ likely: boolean;
182
+ };
183
+ plugin_binary: {
184
+ confidence: number;
185
+ evidence: string[];
186
+ likely: boolean;
187
+ };
188
+ driver_binary: {
189
+ confidence: number;
190
+ evidence: string[];
191
+ likely: boolean;
192
+ };
193
+ }, {
194
+ com_server: {
195
+ confidence: number;
196
+ evidence: string[];
197
+ likely: boolean;
198
+ };
199
+ service_binary: {
200
+ confidence: number;
201
+ evidence: string[];
202
+ likely: boolean;
203
+ };
204
+ plugin_binary: {
205
+ confidence: number;
206
+ evidence: string[];
207
+ likely: boolean;
208
+ };
209
+ driver_binary: {
210
+ confidence: number;
211
+ evidence: string[];
212
+ likely: boolean;
213
+ };
214
+ }>;
215
+ export_dispatch_profile: z.ZodObject<{
216
+ command_like_exports: z.ZodArray<z.ZodString, "many">;
217
+ callback_like_exports: z.ZodArray<z.ZodString, "many">;
218
+ registration_exports: z.ZodArray<z.ZodString, "many">;
219
+ ordinal_only_exports: z.ZodNumber;
220
+ likely_dispatch_model: z.ZodString;
221
+ confidence: z.ZodNumber;
222
+ }, "strip", z.ZodTypeAny, {
223
+ confidence: number;
224
+ command_like_exports: string[];
225
+ callback_like_exports: string[];
226
+ registration_exports: string[];
227
+ ordinal_only_exports: number;
228
+ likely_dispatch_model: string;
229
+ }, {
230
+ confidence: number;
231
+ command_like_exports: string[];
232
+ callback_like_exports: string[];
233
+ registration_exports: string[];
234
+ ordinal_only_exports: number;
235
+ likely_dispatch_model: string;
236
+ }>;
237
+ lifecycle_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
238
+ com_profile: z.ZodObject<{
239
+ clsid_strings: z.ZodArray<z.ZodString, "many">;
240
+ progid_strings: z.ZodArray<z.ZodString, "many">;
241
+ interface_hints: z.ZodArray<z.ZodString, "many">;
242
+ registration_strings: z.ZodArray<z.ZodString, "many">;
243
+ class_factory_exports: z.ZodArray<z.ZodString, "many">;
244
+ class_factory_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
245
+ confidence: z.ZodNumber;
246
+ }, "strip", z.ZodTypeAny, {
247
+ confidence: number;
248
+ clsid_strings: string[];
249
+ progid_strings: string[];
250
+ interface_hints: string[];
251
+ registration_strings: string[];
252
+ class_factory_exports: string[];
253
+ class_factory_surface: string[];
254
+ }, {
255
+ confidence: number;
256
+ clsid_strings: string[];
257
+ progid_strings: string[];
258
+ interface_hints: string[];
259
+ registration_strings: string[];
260
+ class_factory_exports: string[];
261
+ class_factory_surface?: string[] | undefined;
262
+ }>;
263
+ host_interaction_profile: z.ZodObject<{
264
+ likely_hosted: z.ZodBoolean;
265
+ host_hints: z.ZodArray<z.ZodString, "many">;
266
+ callback_exports: z.ZodArray<z.ZodString, "many">;
267
+ callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
268
+ callback_strings: z.ZodArray<z.ZodString, "many">;
269
+ service_hooks: z.ZodArray<z.ZodString, "many">;
270
+ confidence: z.ZodNumber;
271
+ }, "strip", z.ZodTypeAny, {
272
+ confidence: number;
273
+ callback_surface: string[];
274
+ likely_hosted: boolean;
275
+ host_hints: string[];
276
+ callback_exports: string[];
277
+ callback_strings: string[];
278
+ service_hooks: string[];
279
+ }, {
280
+ confidence: number;
281
+ likely_hosted: boolean;
282
+ host_hints: string[];
283
+ callback_exports: string[];
284
+ callback_strings: string[];
285
+ service_hooks: string[];
286
+ callback_surface?: string[] | undefined;
287
+ }>;
288
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
289
+ strings_considered: z.ZodNumber;
290
+ }, "strip", z.ZodTypeAny, {
291
+ sample_id: string;
292
+ indicators: {
293
+ com_server: {
294
+ confidence: number;
295
+ evidence: string[];
296
+ likely: boolean;
297
+ };
298
+ service_binary: {
299
+ confidence: number;
300
+ evidence: string[];
301
+ likely: boolean;
302
+ };
303
+ plugin_binary: {
304
+ confidence: number;
305
+ evidence: string[];
306
+ likely: boolean;
307
+ };
308
+ driver_binary: {
309
+ confidence: number;
310
+ evidence: string[];
311
+ likely: boolean;
312
+ };
313
+ };
314
+ export_surface: {
315
+ total_exports: number;
316
+ total_forwarders: number;
317
+ notable_exports: string[];
318
+ com_related_exports: string[];
319
+ service_related_exports: string[];
320
+ plugin_related_exports: string[];
321
+ forwarded_exports: string[];
322
+ };
323
+ packed: boolean;
324
+ binary_role: string;
325
+ original_filename: string | null;
326
+ packing_confidence: number;
327
+ analysis_priorities: string[];
328
+ role_confidence: number;
329
+ runtime_hint: {
330
+ is_dotnet: boolean | null;
331
+ dotnet_version: string | null;
332
+ target_framework: string | null;
333
+ primary_runtime: string | null;
334
+ };
335
+ import_surface: {
336
+ dll_count: number;
337
+ notable_dlls: string[];
338
+ com_related_imports: string[];
339
+ service_related_imports: string[];
340
+ network_related_imports: string[];
341
+ process_related_imports: string[];
342
+ };
343
+ export_dispatch_profile: {
344
+ confidence: number;
345
+ command_like_exports: string[];
346
+ callback_like_exports: string[];
347
+ registration_exports: string[];
348
+ ordinal_only_exports: number;
349
+ likely_dispatch_model: string;
350
+ };
351
+ lifecycle_surface: string[];
352
+ com_profile: {
353
+ confidence: number;
354
+ clsid_strings: string[];
355
+ progid_strings: string[];
356
+ interface_hints: string[];
357
+ registration_strings: string[];
358
+ class_factory_exports: string[];
359
+ class_factory_surface: string[];
360
+ };
361
+ host_interaction_profile: {
362
+ confidence: number;
363
+ callback_surface: string[];
364
+ likely_hosted: boolean;
365
+ host_hints: string[];
366
+ callback_exports: string[];
367
+ callback_strings: string[];
368
+ service_hooks: string[];
369
+ };
370
+ strings_considered: number;
371
+ }, {
372
+ sample_id: string;
373
+ indicators: {
374
+ com_server: {
375
+ confidence: number;
376
+ evidence: string[];
377
+ likely: boolean;
378
+ };
379
+ service_binary: {
380
+ confidence: number;
381
+ evidence: string[];
382
+ likely: boolean;
383
+ };
384
+ plugin_binary: {
385
+ confidence: number;
386
+ evidence: string[];
387
+ likely: boolean;
388
+ };
389
+ driver_binary: {
390
+ confidence: number;
391
+ evidence: string[];
392
+ likely: boolean;
393
+ };
394
+ };
395
+ export_surface: {
396
+ total_exports: number;
397
+ total_forwarders: number;
398
+ notable_exports: string[];
399
+ com_related_exports: string[];
400
+ service_related_exports: string[];
401
+ plugin_related_exports: string[];
402
+ forwarded_exports: string[];
403
+ };
404
+ packed: boolean;
405
+ binary_role: string;
406
+ original_filename: string | null;
407
+ packing_confidence: number;
408
+ analysis_priorities: string[];
409
+ role_confidence: number;
410
+ runtime_hint: {
411
+ is_dotnet: boolean | null;
412
+ dotnet_version: string | null;
413
+ target_framework: string | null;
414
+ primary_runtime: string | null;
415
+ };
416
+ import_surface: {
417
+ dll_count: number;
418
+ notable_dlls: string[];
419
+ com_related_imports: string[];
420
+ service_related_imports: string[];
421
+ network_related_imports: string[];
422
+ process_related_imports: string[];
423
+ };
424
+ export_dispatch_profile: {
425
+ confidence: number;
426
+ command_like_exports: string[];
427
+ callback_like_exports: string[];
428
+ registration_exports: string[];
429
+ ordinal_only_exports: number;
430
+ likely_dispatch_model: string;
431
+ };
432
+ com_profile: {
433
+ confidence: number;
434
+ clsid_strings: string[];
435
+ progid_strings: string[];
436
+ interface_hints: string[];
437
+ registration_strings: string[];
438
+ class_factory_exports: string[];
439
+ class_factory_surface?: string[] | undefined;
440
+ };
441
+ host_interaction_profile: {
442
+ confidence: number;
443
+ likely_hosted: boolean;
444
+ host_hints: string[];
445
+ callback_exports: string[];
446
+ callback_strings: string[];
447
+ service_hooks: string[];
448
+ callback_surface?: string[] | undefined;
449
+ };
450
+ strings_considered: number;
451
+ lifecycle_surface?: string[] | undefined;
452
+ }>>;
453
+ recovered_function_count: z.ZodNumber;
454
+ recovered_function_strategy: z.ZodArray<z.ZodString, "many">;
455
+ recovered_symbol_count: z.ZodNumber;
456
+ recovered_symbol_preview: z.ZodArray<z.ZodObject<{
457
+ address: z.ZodString;
458
+ recovered_name: z.ZodString;
459
+ name_strategy: z.ZodString;
460
+ confidence: z.ZodNumber;
461
+ }, "strip", z.ZodTypeAny, {
462
+ address: string;
463
+ confidence: number;
464
+ recovered_name: string;
465
+ name_strategy: string;
466
+ }, {
467
+ address: string;
468
+ confidence: number;
469
+ recovered_name: string;
470
+ name_strategy: string;
471
+ }>, "many">;
472
+ components: z.ZodObject<{
473
+ runtime_detect: z.ZodObject<{
474
+ ok: z.ZodBoolean;
475
+ warning_count: z.ZodNumber;
476
+ error_count: z.ZodNumber;
477
+ }, "strip", z.ZodTypeAny, {
478
+ ok: boolean;
479
+ warning_count: number;
480
+ error_count: number;
481
+ }, {
482
+ ok: boolean;
483
+ warning_count: number;
484
+ error_count: number;
485
+ }>;
486
+ strings_extract: z.ZodObject<{
487
+ ok: z.ZodBoolean;
488
+ warning_count: z.ZodNumber;
489
+ error_count: z.ZodNumber;
490
+ }, "strip", z.ZodTypeAny, {
491
+ ok: boolean;
492
+ warning_count: number;
493
+ error_count: number;
494
+ }, {
495
+ ok: boolean;
496
+ warning_count: number;
497
+ error_count: number;
498
+ }>;
499
+ smart_recover: z.ZodObject<{
500
+ ok: z.ZodBoolean;
501
+ warning_count: z.ZodNumber;
502
+ error_count: z.ZodNumber;
503
+ }, "strip", z.ZodTypeAny, {
504
+ ok: boolean;
505
+ warning_count: number;
506
+ error_count: number;
507
+ }, {
508
+ ok: boolean;
509
+ warning_count: number;
510
+ error_count: number;
511
+ }>;
512
+ symbols_recover: z.ZodObject<{
513
+ ok: z.ZodBoolean;
514
+ warning_count: z.ZodNumber;
515
+ error_count: z.ZodNumber;
516
+ }, "strip", z.ZodTypeAny, {
517
+ ok: boolean;
518
+ warning_count: number;
519
+ error_count: number;
520
+ }, {
521
+ ok: boolean;
522
+ warning_count: number;
523
+ error_count: number;
524
+ }>;
525
+ binary_role_profile: z.ZodObject<{
526
+ ok: z.ZodBoolean;
527
+ warning_count: z.ZodNumber;
528
+ error_count: z.ZodNumber;
529
+ }, "strip", z.ZodTypeAny, {
530
+ ok: boolean;
531
+ warning_count: number;
532
+ error_count: number;
533
+ }, {
534
+ ok: boolean;
535
+ warning_count: number;
536
+ error_count: number;
537
+ }>;
538
+ }, "strip", z.ZodTypeAny, {
539
+ runtime_detect: {
540
+ ok: boolean;
541
+ warning_count: number;
542
+ error_count: number;
543
+ };
544
+ strings_extract: {
545
+ ok: boolean;
546
+ warning_count: number;
547
+ error_count: number;
548
+ };
549
+ smart_recover: {
550
+ ok: boolean;
551
+ warning_count: number;
552
+ error_count: number;
553
+ };
554
+ symbols_recover: {
555
+ ok: boolean;
556
+ warning_count: number;
557
+ error_count: number;
558
+ };
559
+ binary_role_profile: {
560
+ ok: boolean;
561
+ warning_count: number;
562
+ error_count: number;
563
+ };
564
+ }, {
565
+ runtime_detect: {
566
+ ok: boolean;
567
+ warning_count: number;
568
+ error_count: number;
569
+ };
570
+ strings_extract: {
571
+ ok: boolean;
572
+ warning_count: number;
573
+ error_count: number;
574
+ };
575
+ smart_recover: {
576
+ ok: boolean;
577
+ warning_count: number;
578
+ error_count: number;
579
+ };
580
+ symbols_recover: {
581
+ ok: boolean;
582
+ warning_count: number;
583
+ error_count: number;
584
+ };
585
+ binary_role_profile: {
586
+ ok: boolean;
587
+ warning_count: number;
588
+ error_count: number;
589
+ };
590
+ }>;
591
+ importable_with_code_functions_define: z.ZodBoolean;
592
+ evidence: z.ZodArray<z.ZodString, "many">;
593
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
594
+ next_steps: z.ZodArray<z.ZodString, "many">;
595
+ }, "strip", z.ZodTypeAny, {
596
+ sample_id: string;
597
+ confidence: number;
598
+ evidence: string[];
599
+ cargo_paths: string[];
600
+ rust_markers: string[];
601
+ primary_runtime: string | null;
602
+ analysis_priorities: string[];
603
+ crate_hints: string[];
604
+ runtime_hints: string[];
605
+ suspected_rust: boolean;
606
+ async_runtime_markers: string[];
607
+ panic_markers: string[];
608
+ recovered_function_count: number;
609
+ recovered_function_strategy: string[];
610
+ recovered_symbol_count: number;
611
+ recovered_symbol_preview: {
612
+ address: string;
613
+ confidence: number;
614
+ recovered_name: string;
615
+ name_strategy: string;
616
+ }[];
617
+ components: {
618
+ runtime_detect: {
619
+ ok: boolean;
620
+ warning_count: number;
621
+ error_count: number;
622
+ };
623
+ strings_extract: {
624
+ ok: boolean;
625
+ warning_count: number;
626
+ error_count: number;
627
+ };
628
+ smart_recover: {
629
+ ok: boolean;
630
+ warning_count: number;
631
+ error_count: number;
632
+ };
633
+ symbols_recover: {
634
+ ok: boolean;
635
+ warning_count: number;
636
+ error_count: number;
637
+ };
638
+ binary_role_profile: {
639
+ ok: boolean;
640
+ warning_count: number;
641
+ error_count: number;
642
+ };
643
+ };
644
+ importable_with_code_functions_define: boolean;
645
+ next_steps: string[];
646
+ library_profile?: {
647
+ evidence: string[];
648
+ ecosystems: string[];
649
+ top_crates: string[];
650
+ notable_libraries: string[];
651
+ } | undefined;
652
+ binary_profile?: {
653
+ sample_id: string;
654
+ indicators: {
655
+ com_server: {
656
+ confidence: number;
657
+ evidence: string[];
658
+ likely: boolean;
659
+ };
660
+ service_binary: {
661
+ confidence: number;
662
+ evidence: string[];
663
+ likely: boolean;
664
+ };
665
+ plugin_binary: {
666
+ confidence: number;
667
+ evidence: string[];
668
+ likely: boolean;
669
+ };
670
+ driver_binary: {
671
+ confidence: number;
672
+ evidence: string[];
673
+ likely: boolean;
674
+ };
675
+ };
676
+ export_surface: {
677
+ total_exports: number;
678
+ total_forwarders: number;
679
+ notable_exports: string[];
680
+ com_related_exports: string[];
681
+ service_related_exports: string[];
682
+ plugin_related_exports: string[];
683
+ forwarded_exports: string[];
684
+ };
685
+ packed: boolean;
686
+ binary_role: string;
687
+ original_filename: string | null;
688
+ packing_confidence: number;
689
+ analysis_priorities: string[];
690
+ role_confidence: number;
691
+ runtime_hint: {
692
+ is_dotnet: boolean | null;
693
+ dotnet_version: string | null;
694
+ target_framework: string | null;
695
+ primary_runtime: string | null;
696
+ };
697
+ import_surface: {
698
+ dll_count: number;
699
+ notable_dlls: string[];
700
+ com_related_imports: string[];
701
+ service_related_imports: string[];
702
+ network_related_imports: string[];
703
+ process_related_imports: string[];
704
+ };
705
+ export_dispatch_profile: {
706
+ confidence: number;
707
+ command_like_exports: string[];
708
+ callback_like_exports: string[];
709
+ registration_exports: string[];
710
+ ordinal_only_exports: number;
711
+ likely_dispatch_model: string;
712
+ };
713
+ lifecycle_surface: string[];
714
+ com_profile: {
715
+ confidence: number;
716
+ clsid_strings: string[];
717
+ progid_strings: string[];
718
+ interface_hints: string[];
719
+ registration_strings: string[];
720
+ class_factory_exports: string[];
721
+ class_factory_surface: string[];
722
+ };
723
+ host_interaction_profile: {
724
+ confidence: number;
725
+ callback_surface: string[];
726
+ likely_hosted: boolean;
727
+ host_hints: string[];
728
+ callback_exports: string[];
729
+ callback_strings: string[];
730
+ service_hooks: string[];
731
+ };
732
+ strings_considered: number;
733
+ } | undefined;
734
+ }, {
735
+ sample_id: string;
736
+ confidence: number;
737
+ evidence: string[];
738
+ cargo_paths: string[];
739
+ rust_markers: string[];
740
+ primary_runtime: string | null;
741
+ analysis_priorities: string[];
742
+ crate_hints: string[];
743
+ runtime_hints: string[];
744
+ suspected_rust: boolean;
745
+ async_runtime_markers: string[];
746
+ panic_markers: string[];
747
+ recovered_function_count: number;
748
+ recovered_function_strategy: string[];
749
+ recovered_symbol_count: number;
750
+ recovered_symbol_preview: {
751
+ address: string;
752
+ confidence: number;
753
+ recovered_name: string;
754
+ name_strategy: string;
755
+ }[];
756
+ components: {
757
+ runtime_detect: {
758
+ ok: boolean;
759
+ warning_count: number;
760
+ error_count: number;
761
+ };
762
+ strings_extract: {
763
+ ok: boolean;
764
+ warning_count: number;
765
+ error_count: number;
766
+ };
767
+ smart_recover: {
768
+ ok: boolean;
769
+ warning_count: number;
770
+ error_count: number;
771
+ };
772
+ symbols_recover: {
773
+ ok: boolean;
774
+ warning_count: number;
775
+ error_count: number;
776
+ };
777
+ binary_role_profile: {
778
+ ok: boolean;
779
+ warning_count: number;
780
+ error_count: number;
781
+ };
782
+ };
783
+ importable_with_code_functions_define: boolean;
784
+ next_steps: string[];
785
+ library_profile?: {
786
+ evidence: string[];
787
+ ecosystems: string[];
788
+ top_crates: string[];
789
+ notable_libraries: string[];
790
+ } | undefined;
791
+ binary_profile?: {
792
+ sample_id: string;
793
+ indicators: {
794
+ com_server: {
795
+ confidence: number;
796
+ evidence: string[];
797
+ likely: boolean;
798
+ };
799
+ service_binary: {
800
+ confidence: number;
801
+ evidence: string[];
802
+ likely: boolean;
803
+ };
804
+ plugin_binary: {
805
+ confidence: number;
806
+ evidence: string[];
807
+ likely: boolean;
808
+ };
809
+ driver_binary: {
810
+ confidence: number;
811
+ evidence: string[];
812
+ likely: boolean;
813
+ };
814
+ };
815
+ export_surface: {
816
+ total_exports: number;
817
+ total_forwarders: number;
818
+ notable_exports: string[];
819
+ com_related_exports: string[];
820
+ service_related_exports: string[];
821
+ plugin_related_exports: string[];
822
+ forwarded_exports: string[];
823
+ };
824
+ packed: boolean;
825
+ binary_role: string;
826
+ original_filename: string | null;
827
+ packing_confidence: number;
828
+ analysis_priorities: string[];
829
+ role_confidence: number;
830
+ runtime_hint: {
831
+ is_dotnet: boolean | null;
832
+ dotnet_version: string | null;
833
+ target_framework: string | null;
834
+ primary_runtime: string | null;
835
+ };
836
+ import_surface: {
837
+ dll_count: number;
838
+ notable_dlls: string[];
839
+ com_related_imports: string[];
840
+ service_related_imports: string[];
841
+ network_related_imports: string[];
842
+ process_related_imports: string[];
843
+ };
844
+ export_dispatch_profile: {
845
+ confidence: number;
846
+ command_like_exports: string[];
847
+ callback_like_exports: string[];
848
+ registration_exports: string[];
849
+ ordinal_only_exports: number;
850
+ likely_dispatch_model: string;
851
+ };
852
+ com_profile: {
853
+ confidence: number;
854
+ clsid_strings: string[];
855
+ progid_strings: string[];
856
+ interface_hints: string[];
857
+ registration_strings: string[];
858
+ class_factory_exports: string[];
859
+ class_factory_surface?: string[] | undefined;
860
+ };
861
+ host_interaction_profile: {
862
+ confidence: number;
863
+ likely_hosted: boolean;
864
+ host_hints: string[];
865
+ callback_exports: string[];
866
+ callback_strings: string[];
867
+ service_hooks: string[];
868
+ callback_surface?: string[] | undefined;
869
+ };
870
+ strings_considered: number;
871
+ lifecycle_surface?: string[] | undefined;
872
+ } | undefined;
873
+ }>;
874
+ export declare const rustBinaryAnalyzeOutputSchema: z.ZodObject<{
875
+ ok: z.ZodBoolean;
876
+ data: z.ZodOptional<z.ZodObject<{
877
+ sample_id: z.ZodString;
878
+ suspected_rust: z.ZodBoolean;
879
+ confidence: z.ZodNumber;
880
+ primary_runtime: z.ZodNullable<z.ZodString>;
881
+ runtime_hints: z.ZodArray<z.ZodString, "many">;
882
+ cargo_paths: z.ZodArray<z.ZodString, "many">;
883
+ rust_markers: z.ZodArray<z.ZodString, "many">;
884
+ async_runtime_markers: z.ZodArray<z.ZodString, "many">;
885
+ panic_markers: z.ZodArray<z.ZodString, "many">;
886
+ crate_hints: z.ZodArray<z.ZodString, "many">;
887
+ library_profile: z.ZodOptional<z.ZodObject<{
888
+ ecosystems: z.ZodArray<z.ZodString, "many">;
889
+ top_crates: z.ZodArray<z.ZodString, "many">;
890
+ notable_libraries: z.ZodArray<z.ZodString, "many">;
891
+ evidence: z.ZodArray<z.ZodString, "many">;
892
+ }, "strip", z.ZodTypeAny, {
893
+ evidence: string[];
894
+ ecosystems: string[];
895
+ top_crates: string[];
896
+ notable_libraries: string[];
897
+ }, {
898
+ evidence: string[];
899
+ ecosystems: string[];
900
+ top_crates: string[];
901
+ notable_libraries: string[];
902
+ }>>;
903
+ binary_profile: z.ZodOptional<z.ZodObject<{
904
+ sample_id: z.ZodString;
905
+ original_filename: z.ZodNullable<z.ZodString>;
906
+ binary_role: z.ZodString;
907
+ role_confidence: z.ZodNumber;
908
+ runtime_hint: z.ZodObject<{
909
+ is_dotnet: z.ZodNullable<z.ZodBoolean>;
910
+ dotnet_version: z.ZodNullable<z.ZodString>;
911
+ target_framework: z.ZodNullable<z.ZodString>;
912
+ primary_runtime: z.ZodNullable<z.ZodString>;
913
+ }, "strip", z.ZodTypeAny, {
914
+ is_dotnet: boolean | null;
915
+ dotnet_version: string | null;
916
+ target_framework: string | null;
917
+ primary_runtime: string | null;
918
+ }, {
919
+ is_dotnet: boolean | null;
920
+ dotnet_version: string | null;
921
+ target_framework: string | null;
922
+ primary_runtime: string | null;
923
+ }>;
924
+ export_surface: z.ZodObject<{
925
+ total_exports: z.ZodNumber;
926
+ total_forwarders: z.ZodNumber;
927
+ notable_exports: z.ZodArray<z.ZodString, "many">;
928
+ com_related_exports: z.ZodArray<z.ZodString, "many">;
929
+ service_related_exports: z.ZodArray<z.ZodString, "many">;
930
+ plugin_related_exports: z.ZodArray<z.ZodString, "many">;
931
+ forwarded_exports: z.ZodArray<z.ZodString, "many">;
932
+ }, "strip", z.ZodTypeAny, {
933
+ total_exports: number;
934
+ total_forwarders: number;
935
+ notable_exports: string[];
936
+ com_related_exports: string[];
937
+ service_related_exports: string[];
938
+ plugin_related_exports: string[];
939
+ forwarded_exports: string[];
940
+ }, {
941
+ total_exports: number;
942
+ total_forwarders: number;
943
+ notable_exports: string[];
944
+ com_related_exports: string[];
945
+ service_related_exports: string[];
946
+ plugin_related_exports: string[];
947
+ forwarded_exports: string[];
948
+ }>;
949
+ import_surface: z.ZodObject<{
950
+ dll_count: z.ZodNumber;
951
+ notable_dlls: z.ZodArray<z.ZodString, "many">;
952
+ com_related_imports: z.ZodArray<z.ZodString, "many">;
953
+ service_related_imports: z.ZodArray<z.ZodString, "many">;
954
+ network_related_imports: z.ZodArray<z.ZodString, "many">;
955
+ process_related_imports: z.ZodArray<z.ZodString, "many">;
956
+ }, "strip", z.ZodTypeAny, {
957
+ dll_count: number;
958
+ notable_dlls: string[];
959
+ com_related_imports: string[];
960
+ service_related_imports: string[];
961
+ network_related_imports: string[];
962
+ process_related_imports: string[];
963
+ }, {
964
+ dll_count: number;
965
+ notable_dlls: string[];
966
+ com_related_imports: string[];
967
+ service_related_imports: string[];
968
+ network_related_imports: string[];
969
+ process_related_imports: string[];
970
+ }>;
971
+ packed: z.ZodBoolean;
972
+ packing_confidence: z.ZodNumber;
973
+ indicators: z.ZodObject<{
974
+ com_server: z.ZodObject<{
975
+ likely: z.ZodBoolean;
976
+ confidence: z.ZodNumber;
977
+ evidence: z.ZodArray<z.ZodString, "many">;
978
+ }, "strip", z.ZodTypeAny, {
979
+ confidence: number;
980
+ evidence: string[];
981
+ likely: boolean;
982
+ }, {
983
+ confidence: number;
984
+ evidence: string[];
985
+ likely: boolean;
986
+ }>;
987
+ service_binary: z.ZodObject<{
988
+ likely: z.ZodBoolean;
989
+ confidence: z.ZodNumber;
990
+ evidence: z.ZodArray<z.ZodString, "many">;
991
+ }, "strip", z.ZodTypeAny, {
992
+ confidence: number;
993
+ evidence: string[];
994
+ likely: boolean;
995
+ }, {
996
+ confidence: number;
997
+ evidence: string[];
998
+ likely: boolean;
999
+ }>;
1000
+ plugin_binary: z.ZodObject<{
1001
+ likely: z.ZodBoolean;
1002
+ confidence: z.ZodNumber;
1003
+ evidence: z.ZodArray<z.ZodString, "many">;
1004
+ }, "strip", z.ZodTypeAny, {
1005
+ confidence: number;
1006
+ evidence: string[];
1007
+ likely: boolean;
1008
+ }, {
1009
+ confidence: number;
1010
+ evidence: string[];
1011
+ likely: boolean;
1012
+ }>;
1013
+ driver_binary: z.ZodObject<{
1014
+ likely: z.ZodBoolean;
1015
+ confidence: z.ZodNumber;
1016
+ evidence: z.ZodArray<z.ZodString, "many">;
1017
+ }, "strip", z.ZodTypeAny, {
1018
+ confidence: number;
1019
+ evidence: string[];
1020
+ likely: boolean;
1021
+ }, {
1022
+ confidence: number;
1023
+ evidence: string[];
1024
+ likely: boolean;
1025
+ }>;
1026
+ }, "strip", z.ZodTypeAny, {
1027
+ com_server: {
1028
+ confidence: number;
1029
+ evidence: string[];
1030
+ likely: boolean;
1031
+ };
1032
+ service_binary: {
1033
+ confidence: number;
1034
+ evidence: string[];
1035
+ likely: boolean;
1036
+ };
1037
+ plugin_binary: {
1038
+ confidence: number;
1039
+ evidence: string[];
1040
+ likely: boolean;
1041
+ };
1042
+ driver_binary: {
1043
+ confidence: number;
1044
+ evidence: string[];
1045
+ likely: boolean;
1046
+ };
1047
+ }, {
1048
+ com_server: {
1049
+ confidence: number;
1050
+ evidence: string[];
1051
+ likely: boolean;
1052
+ };
1053
+ service_binary: {
1054
+ confidence: number;
1055
+ evidence: string[];
1056
+ likely: boolean;
1057
+ };
1058
+ plugin_binary: {
1059
+ confidence: number;
1060
+ evidence: string[];
1061
+ likely: boolean;
1062
+ };
1063
+ driver_binary: {
1064
+ confidence: number;
1065
+ evidence: string[];
1066
+ likely: boolean;
1067
+ };
1068
+ }>;
1069
+ export_dispatch_profile: z.ZodObject<{
1070
+ command_like_exports: z.ZodArray<z.ZodString, "many">;
1071
+ callback_like_exports: z.ZodArray<z.ZodString, "many">;
1072
+ registration_exports: z.ZodArray<z.ZodString, "many">;
1073
+ ordinal_only_exports: z.ZodNumber;
1074
+ likely_dispatch_model: z.ZodString;
1075
+ confidence: z.ZodNumber;
1076
+ }, "strip", z.ZodTypeAny, {
1077
+ confidence: number;
1078
+ command_like_exports: string[];
1079
+ callback_like_exports: string[];
1080
+ registration_exports: string[];
1081
+ ordinal_only_exports: number;
1082
+ likely_dispatch_model: string;
1083
+ }, {
1084
+ confidence: number;
1085
+ command_like_exports: string[];
1086
+ callback_like_exports: string[];
1087
+ registration_exports: string[];
1088
+ ordinal_only_exports: number;
1089
+ likely_dispatch_model: string;
1090
+ }>;
1091
+ lifecycle_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1092
+ com_profile: z.ZodObject<{
1093
+ clsid_strings: z.ZodArray<z.ZodString, "many">;
1094
+ progid_strings: z.ZodArray<z.ZodString, "many">;
1095
+ interface_hints: z.ZodArray<z.ZodString, "many">;
1096
+ registration_strings: z.ZodArray<z.ZodString, "many">;
1097
+ class_factory_exports: z.ZodArray<z.ZodString, "many">;
1098
+ class_factory_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1099
+ confidence: z.ZodNumber;
1100
+ }, "strip", z.ZodTypeAny, {
1101
+ confidence: number;
1102
+ clsid_strings: string[];
1103
+ progid_strings: string[];
1104
+ interface_hints: string[];
1105
+ registration_strings: string[];
1106
+ class_factory_exports: string[];
1107
+ class_factory_surface: string[];
1108
+ }, {
1109
+ confidence: number;
1110
+ clsid_strings: string[];
1111
+ progid_strings: string[];
1112
+ interface_hints: string[];
1113
+ registration_strings: string[];
1114
+ class_factory_exports: string[];
1115
+ class_factory_surface?: string[] | undefined;
1116
+ }>;
1117
+ host_interaction_profile: z.ZodObject<{
1118
+ likely_hosted: z.ZodBoolean;
1119
+ host_hints: z.ZodArray<z.ZodString, "many">;
1120
+ callback_exports: z.ZodArray<z.ZodString, "many">;
1121
+ callback_surface: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
1122
+ callback_strings: z.ZodArray<z.ZodString, "many">;
1123
+ service_hooks: z.ZodArray<z.ZodString, "many">;
1124
+ confidence: z.ZodNumber;
1125
+ }, "strip", z.ZodTypeAny, {
1126
+ confidence: number;
1127
+ callback_surface: string[];
1128
+ likely_hosted: boolean;
1129
+ host_hints: string[];
1130
+ callback_exports: string[];
1131
+ callback_strings: string[];
1132
+ service_hooks: string[];
1133
+ }, {
1134
+ confidence: number;
1135
+ likely_hosted: boolean;
1136
+ host_hints: string[];
1137
+ callback_exports: string[];
1138
+ callback_strings: string[];
1139
+ service_hooks: string[];
1140
+ callback_surface?: string[] | undefined;
1141
+ }>;
1142
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
1143
+ strings_considered: z.ZodNumber;
1144
+ }, "strip", z.ZodTypeAny, {
1145
+ sample_id: string;
1146
+ indicators: {
1147
+ com_server: {
1148
+ confidence: number;
1149
+ evidence: string[];
1150
+ likely: boolean;
1151
+ };
1152
+ service_binary: {
1153
+ confidence: number;
1154
+ evidence: string[];
1155
+ likely: boolean;
1156
+ };
1157
+ plugin_binary: {
1158
+ confidence: number;
1159
+ evidence: string[];
1160
+ likely: boolean;
1161
+ };
1162
+ driver_binary: {
1163
+ confidence: number;
1164
+ evidence: string[];
1165
+ likely: boolean;
1166
+ };
1167
+ };
1168
+ export_surface: {
1169
+ total_exports: number;
1170
+ total_forwarders: number;
1171
+ notable_exports: string[];
1172
+ com_related_exports: string[];
1173
+ service_related_exports: string[];
1174
+ plugin_related_exports: string[];
1175
+ forwarded_exports: string[];
1176
+ };
1177
+ packed: boolean;
1178
+ binary_role: string;
1179
+ original_filename: string | null;
1180
+ packing_confidence: number;
1181
+ analysis_priorities: string[];
1182
+ role_confidence: number;
1183
+ runtime_hint: {
1184
+ is_dotnet: boolean | null;
1185
+ dotnet_version: string | null;
1186
+ target_framework: string | null;
1187
+ primary_runtime: string | null;
1188
+ };
1189
+ import_surface: {
1190
+ dll_count: number;
1191
+ notable_dlls: string[];
1192
+ com_related_imports: string[];
1193
+ service_related_imports: string[];
1194
+ network_related_imports: string[];
1195
+ process_related_imports: string[];
1196
+ };
1197
+ export_dispatch_profile: {
1198
+ confidence: number;
1199
+ command_like_exports: string[];
1200
+ callback_like_exports: string[];
1201
+ registration_exports: string[];
1202
+ ordinal_only_exports: number;
1203
+ likely_dispatch_model: string;
1204
+ };
1205
+ lifecycle_surface: string[];
1206
+ com_profile: {
1207
+ confidence: number;
1208
+ clsid_strings: string[];
1209
+ progid_strings: string[];
1210
+ interface_hints: string[];
1211
+ registration_strings: string[];
1212
+ class_factory_exports: string[];
1213
+ class_factory_surface: string[];
1214
+ };
1215
+ host_interaction_profile: {
1216
+ confidence: number;
1217
+ callback_surface: string[];
1218
+ likely_hosted: boolean;
1219
+ host_hints: string[];
1220
+ callback_exports: string[];
1221
+ callback_strings: string[];
1222
+ service_hooks: string[];
1223
+ };
1224
+ strings_considered: number;
1225
+ }, {
1226
+ sample_id: string;
1227
+ indicators: {
1228
+ com_server: {
1229
+ confidence: number;
1230
+ evidence: string[];
1231
+ likely: boolean;
1232
+ };
1233
+ service_binary: {
1234
+ confidence: number;
1235
+ evidence: string[];
1236
+ likely: boolean;
1237
+ };
1238
+ plugin_binary: {
1239
+ confidence: number;
1240
+ evidence: string[];
1241
+ likely: boolean;
1242
+ };
1243
+ driver_binary: {
1244
+ confidence: number;
1245
+ evidence: string[];
1246
+ likely: boolean;
1247
+ };
1248
+ };
1249
+ export_surface: {
1250
+ total_exports: number;
1251
+ total_forwarders: number;
1252
+ notable_exports: string[];
1253
+ com_related_exports: string[];
1254
+ service_related_exports: string[];
1255
+ plugin_related_exports: string[];
1256
+ forwarded_exports: string[];
1257
+ };
1258
+ packed: boolean;
1259
+ binary_role: string;
1260
+ original_filename: string | null;
1261
+ packing_confidence: number;
1262
+ analysis_priorities: string[];
1263
+ role_confidence: number;
1264
+ runtime_hint: {
1265
+ is_dotnet: boolean | null;
1266
+ dotnet_version: string | null;
1267
+ target_framework: string | null;
1268
+ primary_runtime: string | null;
1269
+ };
1270
+ import_surface: {
1271
+ dll_count: number;
1272
+ notable_dlls: string[];
1273
+ com_related_imports: string[];
1274
+ service_related_imports: string[];
1275
+ network_related_imports: string[];
1276
+ process_related_imports: string[];
1277
+ };
1278
+ export_dispatch_profile: {
1279
+ confidence: number;
1280
+ command_like_exports: string[];
1281
+ callback_like_exports: string[];
1282
+ registration_exports: string[];
1283
+ ordinal_only_exports: number;
1284
+ likely_dispatch_model: string;
1285
+ };
1286
+ com_profile: {
1287
+ confidence: number;
1288
+ clsid_strings: string[];
1289
+ progid_strings: string[];
1290
+ interface_hints: string[];
1291
+ registration_strings: string[];
1292
+ class_factory_exports: string[];
1293
+ class_factory_surface?: string[] | undefined;
1294
+ };
1295
+ host_interaction_profile: {
1296
+ confidence: number;
1297
+ likely_hosted: boolean;
1298
+ host_hints: string[];
1299
+ callback_exports: string[];
1300
+ callback_strings: string[];
1301
+ service_hooks: string[];
1302
+ callback_surface?: string[] | undefined;
1303
+ };
1304
+ strings_considered: number;
1305
+ lifecycle_surface?: string[] | undefined;
1306
+ }>>;
1307
+ recovered_function_count: z.ZodNumber;
1308
+ recovered_function_strategy: z.ZodArray<z.ZodString, "many">;
1309
+ recovered_symbol_count: z.ZodNumber;
1310
+ recovered_symbol_preview: z.ZodArray<z.ZodObject<{
1311
+ address: z.ZodString;
1312
+ recovered_name: z.ZodString;
1313
+ name_strategy: z.ZodString;
1314
+ confidence: z.ZodNumber;
1315
+ }, "strip", z.ZodTypeAny, {
1316
+ address: string;
1317
+ confidence: number;
1318
+ recovered_name: string;
1319
+ name_strategy: string;
1320
+ }, {
1321
+ address: string;
1322
+ confidence: number;
1323
+ recovered_name: string;
1324
+ name_strategy: string;
1325
+ }>, "many">;
1326
+ components: z.ZodObject<{
1327
+ runtime_detect: z.ZodObject<{
1328
+ ok: z.ZodBoolean;
1329
+ warning_count: z.ZodNumber;
1330
+ error_count: z.ZodNumber;
1331
+ }, "strip", z.ZodTypeAny, {
1332
+ ok: boolean;
1333
+ warning_count: number;
1334
+ error_count: number;
1335
+ }, {
1336
+ ok: boolean;
1337
+ warning_count: number;
1338
+ error_count: number;
1339
+ }>;
1340
+ strings_extract: z.ZodObject<{
1341
+ ok: z.ZodBoolean;
1342
+ warning_count: z.ZodNumber;
1343
+ error_count: z.ZodNumber;
1344
+ }, "strip", z.ZodTypeAny, {
1345
+ ok: boolean;
1346
+ warning_count: number;
1347
+ error_count: number;
1348
+ }, {
1349
+ ok: boolean;
1350
+ warning_count: number;
1351
+ error_count: number;
1352
+ }>;
1353
+ smart_recover: z.ZodObject<{
1354
+ ok: z.ZodBoolean;
1355
+ warning_count: z.ZodNumber;
1356
+ error_count: z.ZodNumber;
1357
+ }, "strip", z.ZodTypeAny, {
1358
+ ok: boolean;
1359
+ warning_count: number;
1360
+ error_count: number;
1361
+ }, {
1362
+ ok: boolean;
1363
+ warning_count: number;
1364
+ error_count: number;
1365
+ }>;
1366
+ symbols_recover: z.ZodObject<{
1367
+ ok: z.ZodBoolean;
1368
+ warning_count: z.ZodNumber;
1369
+ error_count: z.ZodNumber;
1370
+ }, "strip", z.ZodTypeAny, {
1371
+ ok: boolean;
1372
+ warning_count: number;
1373
+ error_count: number;
1374
+ }, {
1375
+ ok: boolean;
1376
+ warning_count: number;
1377
+ error_count: number;
1378
+ }>;
1379
+ binary_role_profile: z.ZodObject<{
1380
+ ok: z.ZodBoolean;
1381
+ warning_count: z.ZodNumber;
1382
+ error_count: z.ZodNumber;
1383
+ }, "strip", z.ZodTypeAny, {
1384
+ ok: boolean;
1385
+ warning_count: number;
1386
+ error_count: number;
1387
+ }, {
1388
+ ok: boolean;
1389
+ warning_count: number;
1390
+ error_count: number;
1391
+ }>;
1392
+ }, "strip", z.ZodTypeAny, {
1393
+ runtime_detect: {
1394
+ ok: boolean;
1395
+ warning_count: number;
1396
+ error_count: number;
1397
+ };
1398
+ strings_extract: {
1399
+ ok: boolean;
1400
+ warning_count: number;
1401
+ error_count: number;
1402
+ };
1403
+ smart_recover: {
1404
+ ok: boolean;
1405
+ warning_count: number;
1406
+ error_count: number;
1407
+ };
1408
+ symbols_recover: {
1409
+ ok: boolean;
1410
+ warning_count: number;
1411
+ error_count: number;
1412
+ };
1413
+ binary_role_profile: {
1414
+ ok: boolean;
1415
+ warning_count: number;
1416
+ error_count: number;
1417
+ };
1418
+ }, {
1419
+ runtime_detect: {
1420
+ ok: boolean;
1421
+ warning_count: number;
1422
+ error_count: number;
1423
+ };
1424
+ strings_extract: {
1425
+ ok: boolean;
1426
+ warning_count: number;
1427
+ error_count: number;
1428
+ };
1429
+ smart_recover: {
1430
+ ok: boolean;
1431
+ warning_count: number;
1432
+ error_count: number;
1433
+ };
1434
+ symbols_recover: {
1435
+ ok: boolean;
1436
+ warning_count: number;
1437
+ error_count: number;
1438
+ };
1439
+ binary_role_profile: {
1440
+ ok: boolean;
1441
+ warning_count: number;
1442
+ error_count: number;
1443
+ };
1444
+ }>;
1445
+ importable_with_code_functions_define: z.ZodBoolean;
1446
+ evidence: z.ZodArray<z.ZodString, "many">;
1447
+ analysis_priorities: z.ZodArray<z.ZodString, "many">;
1448
+ next_steps: z.ZodArray<z.ZodString, "many">;
1449
+ }, "strip", z.ZodTypeAny, {
1450
+ sample_id: string;
1451
+ confidence: number;
1452
+ evidence: string[];
1453
+ cargo_paths: string[];
1454
+ rust_markers: string[];
1455
+ primary_runtime: string | null;
1456
+ analysis_priorities: string[];
1457
+ crate_hints: string[];
1458
+ runtime_hints: string[];
1459
+ suspected_rust: boolean;
1460
+ async_runtime_markers: string[];
1461
+ panic_markers: string[];
1462
+ recovered_function_count: number;
1463
+ recovered_function_strategy: string[];
1464
+ recovered_symbol_count: number;
1465
+ recovered_symbol_preview: {
1466
+ address: string;
1467
+ confidence: number;
1468
+ recovered_name: string;
1469
+ name_strategy: string;
1470
+ }[];
1471
+ components: {
1472
+ runtime_detect: {
1473
+ ok: boolean;
1474
+ warning_count: number;
1475
+ error_count: number;
1476
+ };
1477
+ strings_extract: {
1478
+ ok: boolean;
1479
+ warning_count: number;
1480
+ error_count: number;
1481
+ };
1482
+ smart_recover: {
1483
+ ok: boolean;
1484
+ warning_count: number;
1485
+ error_count: number;
1486
+ };
1487
+ symbols_recover: {
1488
+ ok: boolean;
1489
+ warning_count: number;
1490
+ error_count: number;
1491
+ };
1492
+ binary_role_profile: {
1493
+ ok: boolean;
1494
+ warning_count: number;
1495
+ error_count: number;
1496
+ };
1497
+ };
1498
+ importable_with_code_functions_define: boolean;
1499
+ next_steps: string[];
1500
+ library_profile?: {
1501
+ evidence: string[];
1502
+ ecosystems: string[];
1503
+ top_crates: string[];
1504
+ notable_libraries: string[];
1505
+ } | undefined;
1506
+ binary_profile?: {
1507
+ sample_id: string;
1508
+ indicators: {
1509
+ com_server: {
1510
+ confidence: number;
1511
+ evidence: string[];
1512
+ likely: boolean;
1513
+ };
1514
+ service_binary: {
1515
+ confidence: number;
1516
+ evidence: string[];
1517
+ likely: boolean;
1518
+ };
1519
+ plugin_binary: {
1520
+ confidence: number;
1521
+ evidence: string[];
1522
+ likely: boolean;
1523
+ };
1524
+ driver_binary: {
1525
+ confidence: number;
1526
+ evidence: string[];
1527
+ likely: boolean;
1528
+ };
1529
+ };
1530
+ export_surface: {
1531
+ total_exports: number;
1532
+ total_forwarders: number;
1533
+ notable_exports: string[];
1534
+ com_related_exports: string[];
1535
+ service_related_exports: string[];
1536
+ plugin_related_exports: string[];
1537
+ forwarded_exports: string[];
1538
+ };
1539
+ packed: boolean;
1540
+ binary_role: string;
1541
+ original_filename: string | null;
1542
+ packing_confidence: number;
1543
+ analysis_priorities: string[];
1544
+ role_confidence: number;
1545
+ runtime_hint: {
1546
+ is_dotnet: boolean | null;
1547
+ dotnet_version: string | null;
1548
+ target_framework: string | null;
1549
+ primary_runtime: string | null;
1550
+ };
1551
+ import_surface: {
1552
+ dll_count: number;
1553
+ notable_dlls: string[];
1554
+ com_related_imports: string[];
1555
+ service_related_imports: string[];
1556
+ network_related_imports: string[];
1557
+ process_related_imports: string[];
1558
+ };
1559
+ export_dispatch_profile: {
1560
+ confidence: number;
1561
+ command_like_exports: string[];
1562
+ callback_like_exports: string[];
1563
+ registration_exports: string[];
1564
+ ordinal_only_exports: number;
1565
+ likely_dispatch_model: string;
1566
+ };
1567
+ lifecycle_surface: string[];
1568
+ com_profile: {
1569
+ confidence: number;
1570
+ clsid_strings: string[];
1571
+ progid_strings: string[];
1572
+ interface_hints: string[];
1573
+ registration_strings: string[];
1574
+ class_factory_exports: string[];
1575
+ class_factory_surface: string[];
1576
+ };
1577
+ host_interaction_profile: {
1578
+ confidence: number;
1579
+ callback_surface: string[];
1580
+ likely_hosted: boolean;
1581
+ host_hints: string[];
1582
+ callback_exports: string[];
1583
+ callback_strings: string[];
1584
+ service_hooks: string[];
1585
+ };
1586
+ strings_considered: number;
1587
+ } | undefined;
1588
+ }, {
1589
+ sample_id: string;
1590
+ confidence: number;
1591
+ evidence: string[];
1592
+ cargo_paths: string[];
1593
+ rust_markers: string[];
1594
+ primary_runtime: string | null;
1595
+ analysis_priorities: string[];
1596
+ crate_hints: string[];
1597
+ runtime_hints: string[];
1598
+ suspected_rust: boolean;
1599
+ async_runtime_markers: string[];
1600
+ panic_markers: string[];
1601
+ recovered_function_count: number;
1602
+ recovered_function_strategy: string[];
1603
+ recovered_symbol_count: number;
1604
+ recovered_symbol_preview: {
1605
+ address: string;
1606
+ confidence: number;
1607
+ recovered_name: string;
1608
+ name_strategy: string;
1609
+ }[];
1610
+ components: {
1611
+ runtime_detect: {
1612
+ ok: boolean;
1613
+ warning_count: number;
1614
+ error_count: number;
1615
+ };
1616
+ strings_extract: {
1617
+ ok: boolean;
1618
+ warning_count: number;
1619
+ error_count: number;
1620
+ };
1621
+ smart_recover: {
1622
+ ok: boolean;
1623
+ warning_count: number;
1624
+ error_count: number;
1625
+ };
1626
+ symbols_recover: {
1627
+ ok: boolean;
1628
+ warning_count: number;
1629
+ error_count: number;
1630
+ };
1631
+ binary_role_profile: {
1632
+ ok: boolean;
1633
+ warning_count: number;
1634
+ error_count: number;
1635
+ };
1636
+ };
1637
+ importable_with_code_functions_define: boolean;
1638
+ next_steps: string[];
1639
+ library_profile?: {
1640
+ evidence: string[];
1641
+ ecosystems: string[];
1642
+ top_crates: string[];
1643
+ notable_libraries: string[];
1644
+ } | undefined;
1645
+ binary_profile?: {
1646
+ sample_id: string;
1647
+ indicators: {
1648
+ com_server: {
1649
+ confidence: number;
1650
+ evidence: string[];
1651
+ likely: boolean;
1652
+ };
1653
+ service_binary: {
1654
+ confidence: number;
1655
+ evidence: string[];
1656
+ likely: boolean;
1657
+ };
1658
+ plugin_binary: {
1659
+ confidence: number;
1660
+ evidence: string[];
1661
+ likely: boolean;
1662
+ };
1663
+ driver_binary: {
1664
+ confidence: number;
1665
+ evidence: string[];
1666
+ likely: boolean;
1667
+ };
1668
+ };
1669
+ export_surface: {
1670
+ total_exports: number;
1671
+ total_forwarders: number;
1672
+ notable_exports: string[];
1673
+ com_related_exports: string[];
1674
+ service_related_exports: string[];
1675
+ plugin_related_exports: string[];
1676
+ forwarded_exports: string[];
1677
+ };
1678
+ packed: boolean;
1679
+ binary_role: string;
1680
+ original_filename: string | null;
1681
+ packing_confidence: number;
1682
+ analysis_priorities: string[];
1683
+ role_confidence: number;
1684
+ runtime_hint: {
1685
+ is_dotnet: boolean | null;
1686
+ dotnet_version: string | null;
1687
+ target_framework: string | null;
1688
+ primary_runtime: string | null;
1689
+ };
1690
+ import_surface: {
1691
+ dll_count: number;
1692
+ notable_dlls: string[];
1693
+ com_related_imports: string[];
1694
+ service_related_imports: string[];
1695
+ network_related_imports: string[];
1696
+ process_related_imports: string[];
1697
+ };
1698
+ export_dispatch_profile: {
1699
+ confidence: number;
1700
+ command_like_exports: string[];
1701
+ callback_like_exports: string[];
1702
+ registration_exports: string[];
1703
+ ordinal_only_exports: number;
1704
+ likely_dispatch_model: string;
1705
+ };
1706
+ com_profile: {
1707
+ confidence: number;
1708
+ clsid_strings: string[];
1709
+ progid_strings: string[];
1710
+ interface_hints: string[];
1711
+ registration_strings: string[];
1712
+ class_factory_exports: string[];
1713
+ class_factory_surface?: string[] | undefined;
1714
+ };
1715
+ host_interaction_profile: {
1716
+ confidence: number;
1717
+ likely_hosted: boolean;
1718
+ host_hints: string[];
1719
+ callback_exports: string[];
1720
+ callback_strings: string[];
1721
+ service_hooks: string[];
1722
+ callback_surface?: string[] | undefined;
1723
+ };
1724
+ strings_considered: number;
1725
+ lifecycle_surface?: string[] | undefined;
1726
+ } | undefined;
1727
+ }>>;
1728
+ warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1729
+ errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
1730
+ metrics: z.ZodOptional<z.ZodObject<{
1731
+ elapsed_ms: z.ZodNumber;
1732
+ tool: z.ZodString;
1733
+ }, "strip", z.ZodTypeAny, {
1734
+ elapsed_ms: number;
1735
+ tool: string;
1736
+ }, {
1737
+ elapsed_ms: number;
1738
+ tool: string;
1739
+ }>>;
1740
+ }, "strip", z.ZodTypeAny, {
1741
+ ok: boolean;
1742
+ data?: {
1743
+ sample_id: string;
1744
+ confidence: number;
1745
+ evidence: string[];
1746
+ cargo_paths: string[];
1747
+ rust_markers: string[];
1748
+ primary_runtime: string | null;
1749
+ analysis_priorities: string[];
1750
+ crate_hints: string[];
1751
+ runtime_hints: string[];
1752
+ suspected_rust: boolean;
1753
+ async_runtime_markers: string[];
1754
+ panic_markers: string[];
1755
+ recovered_function_count: number;
1756
+ recovered_function_strategy: string[];
1757
+ recovered_symbol_count: number;
1758
+ recovered_symbol_preview: {
1759
+ address: string;
1760
+ confidence: number;
1761
+ recovered_name: string;
1762
+ name_strategy: string;
1763
+ }[];
1764
+ components: {
1765
+ runtime_detect: {
1766
+ ok: boolean;
1767
+ warning_count: number;
1768
+ error_count: number;
1769
+ };
1770
+ strings_extract: {
1771
+ ok: boolean;
1772
+ warning_count: number;
1773
+ error_count: number;
1774
+ };
1775
+ smart_recover: {
1776
+ ok: boolean;
1777
+ warning_count: number;
1778
+ error_count: number;
1779
+ };
1780
+ symbols_recover: {
1781
+ ok: boolean;
1782
+ warning_count: number;
1783
+ error_count: number;
1784
+ };
1785
+ binary_role_profile: {
1786
+ ok: boolean;
1787
+ warning_count: number;
1788
+ error_count: number;
1789
+ };
1790
+ };
1791
+ importable_with_code_functions_define: boolean;
1792
+ next_steps: string[];
1793
+ library_profile?: {
1794
+ evidence: string[];
1795
+ ecosystems: string[];
1796
+ top_crates: string[];
1797
+ notable_libraries: string[];
1798
+ } | undefined;
1799
+ binary_profile?: {
1800
+ sample_id: string;
1801
+ indicators: {
1802
+ com_server: {
1803
+ confidence: number;
1804
+ evidence: string[];
1805
+ likely: boolean;
1806
+ };
1807
+ service_binary: {
1808
+ confidence: number;
1809
+ evidence: string[];
1810
+ likely: boolean;
1811
+ };
1812
+ plugin_binary: {
1813
+ confidence: number;
1814
+ evidence: string[];
1815
+ likely: boolean;
1816
+ };
1817
+ driver_binary: {
1818
+ confidence: number;
1819
+ evidence: string[];
1820
+ likely: boolean;
1821
+ };
1822
+ };
1823
+ export_surface: {
1824
+ total_exports: number;
1825
+ total_forwarders: number;
1826
+ notable_exports: string[];
1827
+ com_related_exports: string[];
1828
+ service_related_exports: string[];
1829
+ plugin_related_exports: string[];
1830
+ forwarded_exports: string[];
1831
+ };
1832
+ packed: boolean;
1833
+ binary_role: string;
1834
+ original_filename: string | null;
1835
+ packing_confidence: number;
1836
+ analysis_priorities: string[];
1837
+ role_confidence: number;
1838
+ runtime_hint: {
1839
+ is_dotnet: boolean | null;
1840
+ dotnet_version: string | null;
1841
+ target_framework: string | null;
1842
+ primary_runtime: string | null;
1843
+ };
1844
+ import_surface: {
1845
+ dll_count: number;
1846
+ notable_dlls: string[];
1847
+ com_related_imports: string[];
1848
+ service_related_imports: string[];
1849
+ network_related_imports: string[];
1850
+ process_related_imports: string[];
1851
+ };
1852
+ export_dispatch_profile: {
1853
+ confidence: number;
1854
+ command_like_exports: string[];
1855
+ callback_like_exports: string[];
1856
+ registration_exports: string[];
1857
+ ordinal_only_exports: number;
1858
+ likely_dispatch_model: string;
1859
+ };
1860
+ lifecycle_surface: string[];
1861
+ com_profile: {
1862
+ confidence: number;
1863
+ clsid_strings: string[];
1864
+ progid_strings: string[];
1865
+ interface_hints: string[];
1866
+ registration_strings: string[];
1867
+ class_factory_exports: string[];
1868
+ class_factory_surface: string[];
1869
+ };
1870
+ host_interaction_profile: {
1871
+ confidence: number;
1872
+ callback_surface: string[];
1873
+ likely_hosted: boolean;
1874
+ host_hints: string[];
1875
+ callback_exports: string[];
1876
+ callback_strings: string[];
1877
+ service_hooks: string[];
1878
+ };
1879
+ strings_considered: number;
1880
+ } | undefined;
1881
+ } | undefined;
1882
+ metrics?: {
1883
+ elapsed_ms: number;
1884
+ tool: string;
1885
+ } | undefined;
1886
+ warnings?: string[] | undefined;
1887
+ errors?: string[] | undefined;
1888
+ }, {
1889
+ ok: boolean;
1890
+ data?: {
1891
+ sample_id: string;
1892
+ confidence: number;
1893
+ evidence: string[];
1894
+ cargo_paths: string[];
1895
+ rust_markers: string[];
1896
+ primary_runtime: string | null;
1897
+ analysis_priorities: string[];
1898
+ crate_hints: string[];
1899
+ runtime_hints: string[];
1900
+ suspected_rust: boolean;
1901
+ async_runtime_markers: string[];
1902
+ panic_markers: string[];
1903
+ recovered_function_count: number;
1904
+ recovered_function_strategy: string[];
1905
+ recovered_symbol_count: number;
1906
+ recovered_symbol_preview: {
1907
+ address: string;
1908
+ confidence: number;
1909
+ recovered_name: string;
1910
+ name_strategy: string;
1911
+ }[];
1912
+ components: {
1913
+ runtime_detect: {
1914
+ ok: boolean;
1915
+ warning_count: number;
1916
+ error_count: number;
1917
+ };
1918
+ strings_extract: {
1919
+ ok: boolean;
1920
+ warning_count: number;
1921
+ error_count: number;
1922
+ };
1923
+ smart_recover: {
1924
+ ok: boolean;
1925
+ warning_count: number;
1926
+ error_count: number;
1927
+ };
1928
+ symbols_recover: {
1929
+ ok: boolean;
1930
+ warning_count: number;
1931
+ error_count: number;
1932
+ };
1933
+ binary_role_profile: {
1934
+ ok: boolean;
1935
+ warning_count: number;
1936
+ error_count: number;
1937
+ };
1938
+ };
1939
+ importable_with_code_functions_define: boolean;
1940
+ next_steps: string[];
1941
+ library_profile?: {
1942
+ evidence: string[];
1943
+ ecosystems: string[];
1944
+ top_crates: string[];
1945
+ notable_libraries: string[];
1946
+ } | undefined;
1947
+ binary_profile?: {
1948
+ sample_id: string;
1949
+ indicators: {
1950
+ com_server: {
1951
+ confidence: number;
1952
+ evidence: string[];
1953
+ likely: boolean;
1954
+ };
1955
+ service_binary: {
1956
+ confidence: number;
1957
+ evidence: string[];
1958
+ likely: boolean;
1959
+ };
1960
+ plugin_binary: {
1961
+ confidence: number;
1962
+ evidence: string[];
1963
+ likely: boolean;
1964
+ };
1965
+ driver_binary: {
1966
+ confidence: number;
1967
+ evidence: string[];
1968
+ likely: boolean;
1969
+ };
1970
+ };
1971
+ export_surface: {
1972
+ total_exports: number;
1973
+ total_forwarders: number;
1974
+ notable_exports: string[];
1975
+ com_related_exports: string[];
1976
+ service_related_exports: string[];
1977
+ plugin_related_exports: string[];
1978
+ forwarded_exports: string[];
1979
+ };
1980
+ packed: boolean;
1981
+ binary_role: string;
1982
+ original_filename: string | null;
1983
+ packing_confidence: number;
1984
+ analysis_priorities: string[];
1985
+ role_confidence: number;
1986
+ runtime_hint: {
1987
+ is_dotnet: boolean | null;
1988
+ dotnet_version: string | null;
1989
+ target_framework: string | null;
1990
+ primary_runtime: string | null;
1991
+ };
1992
+ import_surface: {
1993
+ dll_count: number;
1994
+ notable_dlls: string[];
1995
+ com_related_imports: string[];
1996
+ service_related_imports: string[];
1997
+ network_related_imports: string[];
1998
+ process_related_imports: string[];
1999
+ };
2000
+ export_dispatch_profile: {
2001
+ confidence: number;
2002
+ command_like_exports: string[];
2003
+ callback_like_exports: string[];
2004
+ registration_exports: string[];
2005
+ ordinal_only_exports: number;
2006
+ likely_dispatch_model: string;
2007
+ };
2008
+ com_profile: {
2009
+ confidence: number;
2010
+ clsid_strings: string[];
2011
+ progid_strings: string[];
2012
+ interface_hints: string[];
2013
+ registration_strings: string[];
2014
+ class_factory_exports: string[];
2015
+ class_factory_surface?: string[] | undefined;
2016
+ };
2017
+ host_interaction_profile: {
2018
+ confidence: number;
2019
+ likely_hosted: boolean;
2020
+ host_hints: string[];
2021
+ callback_exports: string[];
2022
+ callback_strings: string[];
2023
+ service_hooks: string[];
2024
+ callback_surface?: string[] | undefined;
2025
+ };
2026
+ strings_considered: number;
2027
+ lifecycle_surface?: string[] | undefined;
2028
+ } | undefined;
2029
+ } | undefined;
2030
+ metrics?: {
2031
+ elapsed_ms: number;
2032
+ tool: string;
2033
+ } | undefined;
2034
+ warnings?: string[] | undefined;
2035
+ errors?: string[] | undefined;
2036
+ }>;
2037
+ export declare const rustBinaryAnalyzeToolDefinition: ToolDefinition;
2038
+ interface RustBinaryAnalyzeDependencies {
2039
+ runtimeHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2040
+ stringsHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2041
+ smartRecoverHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2042
+ symbolsRecoverHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2043
+ binaryRoleHandler?: (args: ToolArgs) => Promise<WorkerResult>;
2044
+ }
2045
+ export declare function createRustBinaryAnalyzeHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager, dependencies?: RustBinaryAnalyzeDependencies): (args: ToolArgs) => Promise<WorkerResult>;
2046
+ export {};
2047
+ //# sourceMappingURL=rust-binary-analyze.d.ts.map