windows-exe-decompiler-mcp-server 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CODEX_INSTALLATION.md +69 -0
- package/COPILOT_INSTALLATION.md +77 -0
- package/LICENSE +21 -0
- package/README.md +314 -0
- package/bin/windows-exe-decompiler-mcp-server.js +3 -0
- package/dist/analysis-provenance.d.ts +184 -0
- package/dist/analysis-provenance.js +74 -0
- package/dist/analysis-task-runner.d.ts +31 -0
- package/dist/analysis-task-runner.js +160 -0
- package/dist/artifact-inventory.d.ts +23 -0
- package/dist/artifact-inventory.js +175 -0
- package/dist/cache-manager.d.ts +128 -0
- package/dist/cache-manager.js +454 -0
- package/dist/confidence-semantics.d.ts +66 -0
- package/dist/confidence-semantics.js +122 -0
- package/dist/config.d.ts +335 -0
- package/dist/config.js +193 -0
- package/dist/database.d.ts +227 -0
- package/dist/database.js +601 -0
- package/dist/decompiler-worker.d.ts +441 -0
- package/dist/decompiler-worker.js +1962 -0
- package/dist/dynamic-trace.d.ts +95 -0
- package/dist/dynamic-trace.js +629 -0
- package/dist/env-validator.d.ts +15 -0
- package/dist/env-validator.js +249 -0
- package/dist/error-handler.d.ts +28 -0
- package/dist/error-handler.example.d.ts +22 -0
- package/dist/error-handler.example.js +141 -0
- package/dist/error-handler.js +139 -0
- package/dist/ghidra-analysis-status.d.ts +49 -0
- package/dist/ghidra-analysis-status.js +178 -0
- package/dist/ghidra-config.d.ts +134 -0
- package/dist/ghidra-config.js +464 -0
- package/dist/index.d.ts +9 -0
- package/dist/index.js +200 -0
- package/dist/job-queue.d.ts +169 -0
- package/dist/job-queue.js +407 -0
- package/dist/logger.d.ts +106 -0
- package/dist/logger.js +176 -0
- package/dist/policy-guard.d.ts +115 -0
- package/dist/policy-guard.js +243 -0
- package/dist/process-output.d.ts +15 -0
- package/dist/process-output.js +90 -0
- package/dist/prompts/function-explanation-review.d.ts +5 -0
- package/dist/prompts/function-explanation-review.js +64 -0
- package/dist/prompts/semantic-name-review.d.ts +5 -0
- package/dist/prompts/semantic-name-review.js +63 -0
- package/dist/runtime-correlation.d.ts +34 -0
- package/dist/runtime-correlation.js +279 -0
- package/dist/runtime-paths.d.ts +3 -0
- package/dist/runtime-paths.js +11 -0
- package/dist/selection-diff.d.ts +667 -0
- package/dist/selection-diff.js +53 -0
- package/dist/semantic-name-suggestion-artifacts.d.ts +116 -0
- package/dist/semantic-name-suggestion-artifacts.js +314 -0
- package/dist/server.d.ts +129 -0
- package/dist/server.js +578 -0
- package/dist/tools/artifact-read.d.ts +235 -0
- package/dist/tools/artifact-read.js +317 -0
- package/dist/tools/artifacts-diff.d.ts +728 -0
- package/dist/tools/artifacts-diff.js +304 -0
- package/dist/tools/artifacts-list.d.ts +515 -0
- package/dist/tools/artifacts-list.js +389 -0
- package/dist/tools/attack-map.d.ts +290 -0
- package/dist/tools/attack-map.js +519 -0
- package/dist/tools/cache-observability.d.ts +4 -0
- package/dist/tools/cache-observability.js +36 -0
- package/dist/tools/code-function-cfg.d.ts +50 -0
- package/dist/tools/code-function-cfg.js +102 -0
- package/dist/tools/code-function-decompile.d.ts +55 -0
- package/dist/tools/code-function-decompile.js +103 -0
- package/dist/tools/code-function-disassemble.d.ts +43 -0
- package/dist/tools/code-function-disassemble.js +185 -0
- package/dist/tools/code-function-explain-apply.d.ts +255 -0
- package/dist/tools/code-function-explain-apply.js +225 -0
- package/dist/tools/code-function-explain-prepare.d.ts +535 -0
- package/dist/tools/code-function-explain-prepare.js +276 -0
- package/dist/tools/code-function-explain-review.d.ts +397 -0
- package/dist/tools/code-function-explain-review.js +589 -0
- package/dist/tools/code-function-rename-apply.d.ts +248 -0
- package/dist/tools/code-function-rename-apply.js +220 -0
- package/dist/tools/code-function-rename-prepare.d.ts +506 -0
- package/dist/tools/code-function-rename-prepare.js +279 -0
- package/dist/tools/code-function-rename-review.d.ts +574 -0
- package/dist/tools/code-function-rename-review.js +761 -0
- package/dist/tools/code-functions-list.d.ts +37 -0
- package/dist/tools/code-functions-list.js +91 -0
- package/dist/tools/code-functions-rank.d.ts +34 -0
- package/dist/tools/code-functions-rank.js +90 -0
- package/dist/tools/code-functions-reconstruct.d.ts +2725 -0
- package/dist/tools/code-functions-reconstruct.js +2807 -0
- package/dist/tools/code-functions-search.d.ts +39 -0
- package/dist/tools/code-functions-search.js +90 -0
- package/dist/tools/code-reconstruct-export.d.ts +1212 -0
- package/dist/tools/code-reconstruct-export.js +4002 -0
- package/dist/tools/code-reconstruct-plan.d.ts +274 -0
- package/dist/tools/code-reconstruct-plan.js +342 -0
- package/dist/tools/dotnet-metadata-extract.d.ts +541 -0
- package/dist/tools/dotnet-metadata-extract.js +355 -0
- package/dist/tools/dotnet-reconstruct-export.d.ts +567 -0
- package/dist/tools/dotnet-reconstruct-export.js +1151 -0
- package/dist/tools/dotnet-types-list.d.ts +325 -0
- package/dist/tools/dotnet-types-list.js +201 -0
- package/dist/tools/dynamic-dependencies.d.ts +115 -0
- package/dist/tools/dynamic-dependencies.js +213 -0
- package/dist/tools/dynamic-memory-import.d.ts +10 -0
- package/dist/tools/dynamic-memory-import.js +567 -0
- package/dist/tools/dynamic-trace-import.d.ts +10 -0
- package/dist/tools/dynamic-trace-import.js +235 -0
- package/dist/tools/entrypoint-fallback-disasm.d.ts +30 -0
- package/dist/tools/entrypoint-fallback-disasm.js +89 -0
- package/dist/tools/ghidra-analyze.d.ts +88 -0
- package/dist/tools/ghidra-analyze.js +208 -0
- package/dist/tools/ghidra-health.d.ts +37 -0
- package/dist/tools/ghidra-health.js +212 -0
- package/dist/tools/ioc-export.d.ts +209 -0
- package/dist/tools/ioc-export.js +542 -0
- package/dist/tools/packer-detect.d.ts +165 -0
- package/dist/tools/packer-detect.js +284 -0
- package/dist/tools/pe-exports-extract.d.ts +175 -0
- package/dist/tools/pe-exports-extract.js +253 -0
- package/dist/tools/pe-fingerprint.d.ts +234 -0
- package/dist/tools/pe-fingerprint.js +269 -0
- package/dist/tools/pe-imports-extract.d.ts +105 -0
- package/dist/tools/pe-imports-extract.js +245 -0
- package/dist/tools/report-generate.d.ts +157 -0
- package/dist/tools/report-generate.js +457 -0
- package/dist/tools/report-summarize.d.ts +2131 -0
- package/dist/tools/report-summarize.js +596 -0
- package/dist/tools/runtime-detect.d.ts +135 -0
- package/dist/tools/runtime-detect.js +247 -0
- package/dist/tools/sample-ingest.d.ts +94 -0
- package/dist/tools/sample-ingest.js +327 -0
- package/dist/tools/sample-profile-get.d.ts +183 -0
- package/dist/tools/sample-profile-get.js +121 -0
- package/dist/tools/sandbox-execute.d.ts +441 -0
- package/dist/tools/sandbox-execute.js +392 -0
- package/dist/tools/strings-extract.d.ts +375 -0
- package/dist/tools/strings-extract.js +314 -0
- package/dist/tools/strings-floss-decode.d.ts +143 -0
- package/dist/tools/strings-floss-decode.js +259 -0
- package/dist/tools/system-health.d.ts +434 -0
- package/dist/tools/system-health.js +446 -0
- package/dist/tools/task-cancel.d.ts +21 -0
- package/dist/tools/task-cancel.js +70 -0
- package/dist/tools/task-status.d.ts +27 -0
- package/dist/tools/task-status.js +106 -0
- package/dist/tools/task-sweep.d.ts +22 -0
- package/dist/tools/task-sweep.js +77 -0
- package/dist/tools/tool-help.d.ts +340 -0
- package/dist/tools/tool-help.js +261 -0
- package/dist/tools/yara-scan.d.ts +554 -0
- package/dist/tools/yara-scan.js +313 -0
- package/dist/types.d.ts +266 -0
- package/dist/types.js +41 -0
- package/dist/worker-pool.d.ts +204 -0
- package/dist/worker-pool.js +650 -0
- package/dist/workflows/deep-static.d.ts +104 -0
- package/dist/workflows/deep-static.js +276 -0
- package/dist/workflows/function-explanation-review.d.ts +655 -0
- package/dist/workflows/function-explanation-review.js +440 -0
- package/dist/workflows/reconstruct.d.ts +2053 -0
- package/dist/workflows/reconstruct.js +666 -0
- package/dist/workflows/semantic-name-review.d.ts +2418 -0
- package/dist/workflows/semantic-name-review.js +521 -0
- package/dist/workflows/triage.d.ts +659 -0
- package/dist/workflows/triage.js +1374 -0
- package/dist/workspace-manager.d.ts +150 -0
- package/dist/workspace-manager.js +411 -0
- package/ghidra_scripts/DecompileFunction.java +487 -0
- package/ghidra_scripts/DecompileFunction.py +150 -0
- package/ghidra_scripts/ExtractCFG.java +256 -0
- package/ghidra_scripts/ExtractCFG.py +233 -0
- package/ghidra_scripts/ExtractFunctions.java +442 -0
- package/ghidra_scripts/ExtractFunctions.py +101 -0
- package/ghidra_scripts/README.md +125 -0
- package/ghidra_scripts/SearchFunctionReferences.java +380 -0
- package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -0
- package/helpers/DotNetMetadataProbe/Program.cs +566 -0
- package/install-to-codex.ps1 +178 -0
- package/install-to-copilot.ps1 +303 -0
- package/package.json +101 -0
- package/requirements.txt +9 -0
- package/workers/requirements-dynamic.txt +11 -0
- package/workers/requirements.txt +8 -0
- package/workers/speakeasy_compat.py +175 -0
- package/workers/static_worker.py +5183 -0
- package/workers/yara_rules/default.yar +33 -0
- package/workers/yara_rules/malware_families.yar +93 -0
- package/workers/yara_rules/packers.yar +80 -0
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* code.functions.list MCP Tool
|
|
3
|
+
*
|
|
4
|
+
* Requirements: 9.1
|
|
5
|
+
*
|
|
6
|
+
* Lists all functions extracted from a binary sample
|
|
7
|
+
*/
|
|
8
|
+
import { z } from 'zod';
|
|
9
|
+
import type { ToolDefinition, ToolHandler } from '../types.js';
|
|
10
|
+
import type { DatabaseManager } from '../database.js';
|
|
11
|
+
import type { WorkspaceManager } from '../workspace-manager.js';
|
|
12
|
+
/**
|
|
13
|
+
* Input schema for code.functions.list tool
|
|
14
|
+
*/
|
|
15
|
+
export declare const codeFunctionsListInputSchema: z.ZodObject<{
|
|
16
|
+
sample_id: z.ZodString;
|
|
17
|
+
backend: z.ZodOptional<z.ZodEnum<["ghidra", "auto"]>>;
|
|
18
|
+
limit: z.ZodOptional<z.ZodNumber>;
|
|
19
|
+
}, "strip", z.ZodTypeAny, {
|
|
20
|
+
sample_id: string;
|
|
21
|
+
backend?: "ghidra" | "auto" | undefined;
|
|
22
|
+
limit?: number | undefined;
|
|
23
|
+
}, {
|
|
24
|
+
sample_id: string;
|
|
25
|
+
backend?: "ghidra" | "auto" | undefined;
|
|
26
|
+
limit?: number | undefined;
|
|
27
|
+
}>;
|
|
28
|
+
export type CodeFunctionsListInput = z.infer<typeof codeFunctionsListInputSchema>;
|
|
29
|
+
/**
|
|
30
|
+
* Tool definition for code.functions.list
|
|
31
|
+
*/
|
|
32
|
+
export declare const codeFunctionsListToolDefinition: ToolDefinition;
|
|
33
|
+
/**
|
|
34
|
+
* Create handler for code.functions.list tool
|
|
35
|
+
*/
|
|
36
|
+
export declare function createCodeFunctionsListHandler(workspaceManager: WorkspaceManager, database: DatabaseManager): ToolHandler;
|
|
37
|
+
//# sourceMappingURL=code-functions-list.d.ts.map
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* code.functions.list MCP Tool
|
|
3
|
+
*
|
|
4
|
+
* Requirements: 9.1
|
|
5
|
+
*
|
|
6
|
+
* Lists all functions extracted from a binary sample
|
|
7
|
+
*/
|
|
8
|
+
import { z } from 'zod';
|
|
9
|
+
import { DecompilerWorker } from '../decompiler-worker.js';
|
|
10
|
+
import { logger } from '../logger.js';
|
|
11
|
+
/**
|
|
12
|
+
* Input schema for code.functions.list tool
|
|
13
|
+
*/
|
|
14
|
+
export const codeFunctionsListInputSchema = z.object({
|
|
15
|
+
sample_id: z.string().describe('Sample identifier (sha256:<hex>)'),
|
|
16
|
+
backend: z.enum(['ghidra', 'auto']).optional().describe('Decompiler backend (default: auto)'),
|
|
17
|
+
limit: z.number().optional().describe('Maximum number of functions to return')
|
|
18
|
+
});
|
|
19
|
+
/**
|
|
20
|
+
* Tool definition for code.functions.list
|
|
21
|
+
*/
|
|
22
|
+
export const codeFunctionsListToolDefinition = {
|
|
23
|
+
name: 'code.functions.list',
|
|
24
|
+
description: 'List all functions extracted from a binary sample. Requires prior Ghidra analysis.',
|
|
25
|
+
inputSchema: codeFunctionsListInputSchema
|
|
26
|
+
};
|
|
27
|
+
/**
|
|
28
|
+
* Create handler for code.functions.list tool
|
|
29
|
+
*/
|
|
30
|
+
export function createCodeFunctionsListHandler(workspaceManager, database) {
|
|
31
|
+
return async (args) => {
|
|
32
|
+
try {
|
|
33
|
+
const input = codeFunctionsListInputSchema.parse(args);
|
|
34
|
+
logger.info({
|
|
35
|
+
sample_id: input.sample_id,
|
|
36
|
+
limit: input.limit
|
|
37
|
+
}, 'code.functions.list tool called');
|
|
38
|
+
// Check if sample exists
|
|
39
|
+
const sample = database.findSample(input.sample_id);
|
|
40
|
+
if (!sample) {
|
|
41
|
+
return {
|
|
42
|
+
content: [{
|
|
43
|
+
type: 'text',
|
|
44
|
+
text: JSON.stringify({
|
|
45
|
+
ok: false,
|
|
46
|
+
errors: [`Sample not found: ${input.sample_id}`]
|
|
47
|
+
}, null, 2)
|
|
48
|
+
}],
|
|
49
|
+
isError: true
|
|
50
|
+
};
|
|
51
|
+
}
|
|
52
|
+
// Create decompiler worker
|
|
53
|
+
const decompilerWorker = new DecompilerWorker(database, workspaceManager);
|
|
54
|
+
// List functions
|
|
55
|
+
const functions = await decompilerWorker.listFunctions(input.sample_id, input.limit);
|
|
56
|
+
logger.info({
|
|
57
|
+
sample_id: input.sample_id,
|
|
58
|
+
function_count: functions.length
|
|
59
|
+
}, 'Functions listed successfully');
|
|
60
|
+
return {
|
|
61
|
+
content: [{
|
|
62
|
+
type: 'text',
|
|
63
|
+
text: JSON.stringify({
|
|
64
|
+
ok: true,
|
|
65
|
+
data: {
|
|
66
|
+
functions,
|
|
67
|
+
count: functions.length
|
|
68
|
+
}
|
|
69
|
+
}, null, 2)
|
|
70
|
+
}]
|
|
71
|
+
};
|
|
72
|
+
}
|
|
73
|
+
catch (error) {
|
|
74
|
+
const errorMessage = error instanceof Error ? error.message : String(error);
|
|
75
|
+
logger.error({
|
|
76
|
+
error: errorMessage
|
|
77
|
+
}, 'code.functions.list tool failed');
|
|
78
|
+
return {
|
|
79
|
+
content: [{
|
|
80
|
+
type: 'text',
|
|
81
|
+
text: JSON.stringify({
|
|
82
|
+
ok: false,
|
|
83
|
+
errors: [errorMessage]
|
|
84
|
+
}, null, 2)
|
|
85
|
+
}],
|
|
86
|
+
isError: true
|
|
87
|
+
};
|
|
88
|
+
}
|
|
89
|
+
};
|
|
90
|
+
}
|
|
91
|
+
//# sourceMappingURL=code-functions-list.js.map
|
|
@@ -0,0 +1,34 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* code.functions.rank MCP Tool
|
|
3
|
+
*
|
|
4
|
+
* Requirements: 9.2, 9.8
|
|
5
|
+
*
|
|
6
|
+
* Ranks functions by interest score
|
|
7
|
+
*/
|
|
8
|
+
import { z } from 'zod';
|
|
9
|
+
import type { ToolDefinition, ToolHandler } from '../types.js';
|
|
10
|
+
import type { DatabaseManager } from '../database.js';
|
|
11
|
+
import type { WorkspaceManager } from '../workspace-manager.js';
|
|
12
|
+
/**
|
|
13
|
+
* Input schema for code.functions.rank tool
|
|
14
|
+
*/
|
|
15
|
+
export declare const codeFunctionsRankInputSchema: z.ZodObject<{
|
|
16
|
+
sample_id: z.ZodString;
|
|
17
|
+
topk: z.ZodOptional<z.ZodNumber>;
|
|
18
|
+
}, "strip", z.ZodTypeAny, {
|
|
19
|
+
sample_id: string;
|
|
20
|
+
topk?: number | undefined;
|
|
21
|
+
}, {
|
|
22
|
+
sample_id: string;
|
|
23
|
+
topk?: number | undefined;
|
|
24
|
+
}>;
|
|
25
|
+
export type CodeFunctionsRankInput = z.infer<typeof codeFunctionsRankInputSchema>;
|
|
26
|
+
/**
|
|
27
|
+
* Tool definition for code.functions.rank
|
|
28
|
+
*/
|
|
29
|
+
export declare const codeFunctionsRankToolDefinition: ToolDefinition;
|
|
30
|
+
/**
|
|
31
|
+
* Create handler for code.functions.rank tool
|
|
32
|
+
*/
|
|
33
|
+
export declare function createCodeFunctionsRankHandler(workspaceManager: WorkspaceManager, database: DatabaseManager): ToolHandler;
|
|
34
|
+
//# sourceMappingURL=code-functions-rank.d.ts.map
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* code.functions.rank MCP Tool
|
|
3
|
+
*
|
|
4
|
+
* Requirements: 9.2, 9.8
|
|
5
|
+
*
|
|
6
|
+
* Ranks functions by interest score
|
|
7
|
+
*/
|
|
8
|
+
import { z } from 'zod';
|
|
9
|
+
import { DecompilerWorker } from '../decompiler-worker.js';
|
|
10
|
+
import { logger } from '../logger.js';
|
|
11
|
+
/**
|
|
12
|
+
* Input schema for code.functions.rank tool
|
|
13
|
+
*/
|
|
14
|
+
export const codeFunctionsRankInputSchema = z.object({
|
|
15
|
+
sample_id: z.string().describe('Sample identifier (sha256:<hex>)'),
|
|
16
|
+
topk: z.number().optional().describe('Number of top functions to return (default: 20)')
|
|
17
|
+
});
|
|
18
|
+
/**
|
|
19
|
+
* Tool definition for code.functions.rank
|
|
20
|
+
*/
|
|
21
|
+
export const codeFunctionsRankToolDefinition = {
|
|
22
|
+
name: 'code.functions.rank',
|
|
23
|
+
description: 'Rank functions by interest score based on size, callers, sensitive API calls, and entry points. Returns top K functions.',
|
|
24
|
+
inputSchema: codeFunctionsRankInputSchema
|
|
25
|
+
};
|
|
26
|
+
/**
|
|
27
|
+
* Create handler for code.functions.rank tool
|
|
28
|
+
*/
|
|
29
|
+
export function createCodeFunctionsRankHandler(workspaceManager, database) {
|
|
30
|
+
return async (args) => {
|
|
31
|
+
try {
|
|
32
|
+
const input = codeFunctionsRankInputSchema.parse(args);
|
|
33
|
+
logger.info({
|
|
34
|
+
sample_id: input.sample_id,
|
|
35
|
+
topk: input.topk
|
|
36
|
+
}, 'code.functions.rank tool called');
|
|
37
|
+
// Check if sample exists
|
|
38
|
+
const sample = database.findSample(input.sample_id);
|
|
39
|
+
if (!sample) {
|
|
40
|
+
return {
|
|
41
|
+
content: [{
|
|
42
|
+
type: 'text',
|
|
43
|
+
text: JSON.stringify({
|
|
44
|
+
ok: false,
|
|
45
|
+
errors: [`Sample not found: ${input.sample_id}`]
|
|
46
|
+
}, null, 2)
|
|
47
|
+
}],
|
|
48
|
+
isError: true
|
|
49
|
+
};
|
|
50
|
+
}
|
|
51
|
+
// Create decompiler worker
|
|
52
|
+
const decompilerWorker = new DecompilerWorker(database, workspaceManager);
|
|
53
|
+
// Rank functions
|
|
54
|
+
const rankedFunctions = await decompilerWorker.rankFunctions(input.sample_id, input.topk || 20);
|
|
55
|
+
logger.info({
|
|
56
|
+
sample_id: input.sample_id,
|
|
57
|
+
function_count: rankedFunctions.length
|
|
58
|
+
}, 'Functions ranked successfully');
|
|
59
|
+
return {
|
|
60
|
+
content: [{
|
|
61
|
+
type: 'text',
|
|
62
|
+
text: JSON.stringify({
|
|
63
|
+
ok: true,
|
|
64
|
+
data: {
|
|
65
|
+
functions: rankedFunctions,
|
|
66
|
+
count: rankedFunctions.length
|
|
67
|
+
}
|
|
68
|
+
}, null, 2)
|
|
69
|
+
}]
|
|
70
|
+
};
|
|
71
|
+
}
|
|
72
|
+
catch (error) {
|
|
73
|
+
const errorMessage = error instanceof Error ? error.message : String(error);
|
|
74
|
+
logger.error({
|
|
75
|
+
error: errorMessage
|
|
76
|
+
}, 'code.functions.rank tool failed');
|
|
77
|
+
return {
|
|
78
|
+
content: [{
|
|
79
|
+
type: 'text',
|
|
80
|
+
text: JSON.stringify({
|
|
81
|
+
ok: false,
|
|
82
|
+
errors: [errorMessage]
|
|
83
|
+
}, null, 2)
|
|
84
|
+
}],
|
|
85
|
+
isError: true
|
|
86
|
+
};
|
|
87
|
+
}
|
|
88
|
+
};
|
|
89
|
+
}
|
|
90
|
+
//# sourceMappingURL=code-functions-rank.js.map
|