windows-exe-decompiler-mcp-server 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (190) hide show
  1. package/CODEX_INSTALLATION.md +69 -0
  2. package/COPILOT_INSTALLATION.md +77 -0
  3. package/LICENSE +21 -0
  4. package/README.md +314 -0
  5. package/bin/windows-exe-decompiler-mcp-server.js +3 -0
  6. package/dist/analysis-provenance.d.ts +184 -0
  7. package/dist/analysis-provenance.js +74 -0
  8. package/dist/analysis-task-runner.d.ts +31 -0
  9. package/dist/analysis-task-runner.js +160 -0
  10. package/dist/artifact-inventory.d.ts +23 -0
  11. package/dist/artifact-inventory.js +175 -0
  12. package/dist/cache-manager.d.ts +128 -0
  13. package/dist/cache-manager.js +454 -0
  14. package/dist/confidence-semantics.d.ts +66 -0
  15. package/dist/confidence-semantics.js +122 -0
  16. package/dist/config.d.ts +335 -0
  17. package/dist/config.js +193 -0
  18. package/dist/database.d.ts +227 -0
  19. package/dist/database.js +601 -0
  20. package/dist/decompiler-worker.d.ts +441 -0
  21. package/dist/decompiler-worker.js +1962 -0
  22. package/dist/dynamic-trace.d.ts +95 -0
  23. package/dist/dynamic-trace.js +629 -0
  24. package/dist/env-validator.d.ts +15 -0
  25. package/dist/env-validator.js +249 -0
  26. package/dist/error-handler.d.ts +28 -0
  27. package/dist/error-handler.example.d.ts +22 -0
  28. package/dist/error-handler.example.js +141 -0
  29. package/dist/error-handler.js +139 -0
  30. package/dist/ghidra-analysis-status.d.ts +49 -0
  31. package/dist/ghidra-analysis-status.js +178 -0
  32. package/dist/ghidra-config.d.ts +134 -0
  33. package/dist/ghidra-config.js +464 -0
  34. package/dist/index.d.ts +9 -0
  35. package/dist/index.js +200 -0
  36. package/dist/job-queue.d.ts +169 -0
  37. package/dist/job-queue.js +407 -0
  38. package/dist/logger.d.ts +106 -0
  39. package/dist/logger.js +176 -0
  40. package/dist/policy-guard.d.ts +115 -0
  41. package/dist/policy-guard.js +243 -0
  42. package/dist/process-output.d.ts +15 -0
  43. package/dist/process-output.js +90 -0
  44. package/dist/prompts/function-explanation-review.d.ts +5 -0
  45. package/dist/prompts/function-explanation-review.js +64 -0
  46. package/dist/prompts/semantic-name-review.d.ts +5 -0
  47. package/dist/prompts/semantic-name-review.js +63 -0
  48. package/dist/runtime-correlation.d.ts +34 -0
  49. package/dist/runtime-correlation.js +279 -0
  50. package/dist/runtime-paths.d.ts +3 -0
  51. package/dist/runtime-paths.js +11 -0
  52. package/dist/selection-diff.d.ts +667 -0
  53. package/dist/selection-diff.js +53 -0
  54. package/dist/semantic-name-suggestion-artifacts.d.ts +116 -0
  55. package/dist/semantic-name-suggestion-artifacts.js +314 -0
  56. package/dist/server.d.ts +129 -0
  57. package/dist/server.js +578 -0
  58. package/dist/tools/artifact-read.d.ts +235 -0
  59. package/dist/tools/artifact-read.js +317 -0
  60. package/dist/tools/artifacts-diff.d.ts +728 -0
  61. package/dist/tools/artifacts-diff.js +304 -0
  62. package/dist/tools/artifacts-list.d.ts +515 -0
  63. package/dist/tools/artifacts-list.js +389 -0
  64. package/dist/tools/attack-map.d.ts +290 -0
  65. package/dist/tools/attack-map.js +519 -0
  66. package/dist/tools/cache-observability.d.ts +4 -0
  67. package/dist/tools/cache-observability.js +36 -0
  68. package/dist/tools/code-function-cfg.d.ts +50 -0
  69. package/dist/tools/code-function-cfg.js +102 -0
  70. package/dist/tools/code-function-decompile.d.ts +55 -0
  71. package/dist/tools/code-function-decompile.js +103 -0
  72. package/dist/tools/code-function-disassemble.d.ts +43 -0
  73. package/dist/tools/code-function-disassemble.js +185 -0
  74. package/dist/tools/code-function-explain-apply.d.ts +255 -0
  75. package/dist/tools/code-function-explain-apply.js +225 -0
  76. package/dist/tools/code-function-explain-prepare.d.ts +535 -0
  77. package/dist/tools/code-function-explain-prepare.js +276 -0
  78. package/dist/tools/code-function-explain-review.d.ts +397 -0
  79. package/dist/tools/code-function-explain-review.js +589 -0
  80. package/dist/tools/code-function-rename-apply.d.ts +248 -0
  81. package/dist/tools/code-function-rename-apply.js +220 -0
  82. package/dist/tools/code-function-rename-prepare.d.ts +506 -0
  83. package/dist/tools/code-function-rename-prepare.js +279 -0
  84. package/dist/tools/code-function-rename-review.d.ts +574 -0
  85. package/dist/tools/code-function-rename-review.js +761 -0
  86. package/dist/tools/code-functions-list.d.ts +37 -0
  87. package/dist/tools/code-functions-list.js +91 -0
  88. package/dist/tools/code-functions-rank.d.ts +34 -0
  89. package/dist/tools/code-functions-rank.js +90 -0
  90. package/dist/tools/code-functions-reconstruct.d.ts +2725 -0
  91. package/dist/tools/code-functions-reconstruct.js +2807 -0
  92. package/dist/tools/code-functions-search.d.ts +39 -0
  93. package/dist/tools/code-functions-search.js +90 -0
  94. package/dist/tools/code-reconstruct-export.d.ts +1212 -0
  95. package/dist/tools/code-reconstruct-export.js +4002 -0
  96. package/dist/tools/code-reconstruct-plan.d.ts +274 -0
  97. package/dist/tools/code-reconstruct-plan.js +342 -0
  98. package/dist/tools/dotnet-metadata-extract.d.ts +541 -0
  99. package/dist/tools/dotnet-metadata-extract.js +355 -0
  100. package/dist/tools/dotnet-reconstruct-export.d.ts +567 -0
  101. package/dist/tools/dotnet-reconstruct-export.js +1151 -0
  102. package/dist/tools/dotnet-types-list.d.ts +325 -0
  103. package/dist/tools/dotnet-types-list.js +201 -0
  104. package/dist/tools/dynamic-dependencies.d.ts +115 -0
  105. package/dist/tools/dynamic-dependencies.js +213 -0
  106. package/dist/tools/dynamic-memory-import.d.ts +10 -0
  107. package/dist/tools/dynamic-memory-import.js +567 -0
  108. package/dist/tools/dynamic-trace-import.d.ts +10 -0
  109. package/dist/tools/dynamic-trace-import.js +235 -0
  110. package/dist/tools/entrypoint-fallback-disasm.d.ts +30 -0
  111. package/dist/tools/entrypoint-fallback-disasm.js +89 -0
  112. package/dist/tools/ghidra-analyze.d.ts +88 -0
  113. package/dist/tools/ghidra-analyze.js +208 -0
  114. package/dist/tools/ghidra-health.d.ts +37 -0
  115. package/dist/tools/ghidra-health.js +212 -0
  116. package/dist/tools/ioc-export.d.ts +209 -0
  117. package/dist/tools/ioc-export.js +542 -0
  118. package/dist/tools/packer-detect.d.ts +165 -0
  119. package/dist/tools/packer-detect.js +284 -0
  120. package/dist/tools/pe-exports-extract.d.ts +175 -0
  121. package/dist/tools/pe-exports-extract.js +253 -0
  122. package/dist/tools/pe-fingerprint.d.ts +234 -0
  123. package/dist/tools/pe-fingerprint.js +269 -0
  124. package/dist/tools/pe-imports-extract.d.ts +105 -0
  125. package/dist/tools/pe-imports-extract.js +245 -0
  126. package/dist/tools/report-generate.d.ts +157 -0
  127. package/dist/tools/report-generate.js +457 -0
  128. package/dist/tools/report-summarize.d.ts +2131 -0
  129. package/dist/tools/report-summarize.js +596 -0
  130. package/dist/tools/runtime-detect.d.ts +135 -0
  131. package/dist/tools/runtime-detect.js +247 -0
  132. package/dist/tools/sample-ingest.d.ts +94 -0
  133. package/dist/tools/sample-ingest.js +327 -0
  134. package/dist/tools/sample-profile-get.d.ts +183 -0
  135. package/dist/tools/sample-profile-get.js +121 -0
  136. package/dist/tools/sandbox-execute.d.ts +441 -0
  137. package/dist/tools/sandbox-execute.js +392 -0
  138. package/dist/tools/strings-extract.d.ts +375 -0
  139. package/dist/tools/strings-extract.js +314 -0
  140. package/dist/tools/strings-floss-decode.d.ts +143 -0
  141. package/dist/tools/strings-floss-decode.js +259 -0
  142. package/dist/tools/system-health.d.ts +434 -0
  143. package/dist/tools/system-health.js +446 -0
  144. package/dist/tools/task-cancel.d.ts +21 -0
  145. package/dist/tools/task-cancel.js +70 -0
  146. package/dist/tools/task-status.d.ts +27 -0
  147. package/dist/tools/task-status.js +106 -0
  148. package/dist/tools/task-sweep.d.ts +22 -0
  149. package/dist/tools/task-sweep.js +77 -0
  150. package/dist/tools/tool-help.d.ts +340 -0
  151. package/dist/tools/tool-help.js +261 -0
  152. package/dist/tools/yara-scan.d.ts +554 -0
  153. package/dist/tools/yara-scan.js +313 -0
  154. package/dist/types.d.ts +266 -0
  155. package/dist/types.js +41 -0
  156. package/dist/worker-pool.d.ts +204 -0
  157. package/dist/worker-pool.js +650 -0
  158. package/dist/workflows/deep-static.d.ts +104 -0
  159. package/dist/workflows/deep-static.js +276 -0
  160. package/dist/workflows/function-explanation-review.d.ts +655 -0
  161. package/dist/workflows/function-explanation-review.js +440 -0
  162. package/dist/workflows/reconstruct.d.ts +2053 -0
  163. package/dist/workflows/reconstruct.js +666 -0
  164. package/dist/workflows/semantic-name-review.d.ts +2418 -0
  165. package/dist/workflows/semantic-name-review.js +521 -0
  166. package/dist/workflows/triage.d.ts +659 -0
  167. package/dist/workflows/triage.js +1374 -0
  168. package/dist/workspace-manager.d.ts +150 -0
  169. package/dist/workspace-manager.js +411 -0
  170. package/ghidra_scripts/DecompileFunction.java +487 -0
  171. package/ghidra_scripts/DecompileFunction.py +150 -0
  172. package/ghidra_scripts/ExtractCFG.java +256 -0
  173. package/ghidra_scripts/ExtractCFG.py +233 -0
  174. package/ghidra_scripts/ExtractFunctions.java +442 -0
  175. package/ghidra_scripts/ExtractFunctions.py +101 -0
  176. package/ghidra_scripts/README.md +125 -0
  177. package/ghidra_scripts/SearchFunctionReferences.java +380 -0
  178. package/helpers/DotNetMetadataProbe/DotNetMetadataProbe.csproj +9 -0
  179. package/helpers/DotNetMetadataProbe/Program.cs +566 -0
  180. package/install-to-codex.ps1 +178 -0
  181. package/install-to-copilot.ps1 +303 -0
  182. package/package.json +101 -0
  183. package/requirements.txt +9 -0
  184. package/workers/requirements-dynamic.txt +11 -0
  185. package/workers/requirements.txt +8 -0
  186. package/workers/speakeasy_compat.py +175 -0
  187. package/workers/static_worker.py +5183 -0
  188. package/workers/yara_rules/default.yar +33 -0
  189. package/workers/yara_rules/malware_families.yar +93 -0
  190. package/workers/yara_rules/packers.yar +80 -0
@@ -0,0 +1,37 @@
1
+ /**
2
+ * code.functions.list MCP Tool
3
+ *
4
+ * Requirements: 9.1
5
+ *
6
+ * Lists all functions extracted from a binary sample
7
+ */
8
+ import { z } from 'zod';
9
+ import type { ToolDefinition, ToolHandler } from '../types.js';
10
+ import type { DatabaseManager } from '../database.js';
11
+ import type { WorkspaceManager } from '../workspace-manager.js';
12
+ /**
13
+ * Input schema for code.functions.list tool
14
+ */
15
+ export declare const codeFunctionsListInputSchema: z.ZodObject<{
16
+ sample_id: z.ZodString;
17
+ backend: z.ZodOptional<z.ZodEnum<["ghidra", "auto"]>>;
18
+ limit: z.ZodOptional<z.ZodNumber>;
19
+ }, "strip", z.ZodTypeAny, {
20
+ sample_id: string;
21
+ backend?: "ghidra" | "auto" | undefined;
22
+ limit?: number | undefined;
23
+ }, {
24
+ sample_id: string;
25
+ backend?: "ghidra" | "auto" | undefined;
26
+ limit?: number | undefined;
27
+ }>;
28
+ export type CodeFunctionsListInput = z.infer<typeof codeFunctionsListInputSchema>;
29
+ /**
30
+ * Tool definition for code.functions.list
31
+ */
32
+ export declare const codeFunctionsListToolDefinition: ToolDefinition;
33
+ /**
34
+ * Create handler for code.functions.list tool
35
+ */
36
+ export declare function createCodeFunctionsListHandler(workspaceManager: WorkspaceManager, database: DatabaseManager): ToolHandler;
37
+ //# sourceMappingURL=code-functions-list.d.ts.map
@@ -0,0 +1,91 @@
1
+ /**
2
+ * code.functions.list MCP Tool
3
+ *
4
+ * Requirements: 9.1
5
+ *
6
+ * Lists all functions extracted from a binary sample
7
+ */
8
+ import { z } from 'zod';
9
+ import { DecompilerWorker } from '../decompiler-worker.js';
10
+ import { logger } from '../logger.js';
11
+ /**
12
+ * Input schema for code.functions.list tool
13
+ */
14
+ export const codeFunctionsListInputSchema = z.object({
15
+ sample_id: z.string().describe('Sample identifier (sha256:<hex>)'),
16
+ backend: z.enum(['ghidra', 'auto']).optional().describe('Decompiler backend (default: auto)'),
17
+ limit: z.number().optional().describe('Maximum number of functions to return')
18
+ });
19
+ /**
20
+ * Tool definition for code.functions.list
21
+ */
22
+ export const codeFunctionsListToolDefinition = {
23
+ name: 'code.functions.list',
24
+ description: 'List all functions extracted from a binary sample. Requires prior Ghidra analysis.',
25
+ inputSchema: codeFunctionsListInputSchema
26
+ };
27
+ /**
28
+ * Create handler for code.functions.list tool
29
+ */
30
+ export function createCodeFunctionsListHandler(workspaceManager, database) {
31
+ return async (args) => {
32
+ try {
33
+ const input = codeFunctionsListInputSchema.parse(args);
34
+ logger.info({
35
+ sample_id: input.sample_id,
36
+ limit: input.limit
37
+ }, 'code.functions.list tool called');
38
+ // Check if sample exists
39
+ const sample = database.findSample(input.sample_id);
40
+ if (!sample) {
41
+ return {
42
+ content: [{
43
+ type: 'text',
44
+ text: JSON.stringify({
45
+ ok: false,
46
+ errors: [`Sample not found: ${input.sample_id}`]
47
+ }, null, 2)
48
+ }],
49
+ isError: true
50
+ };
51
+ }
52
+ // Create decompiler worker
53
+ const decompilerWorker = new DecompilerWorker(database, workspaceManager);
54
+ // List functions
55
+ const functions = await decompilerWorker.listFunctions(input.sample_id, input.limit);
56
+ logger.info({
57
+ sample_id: input.sample_id,
58
+ function_count: functions.length
59
+ }, 'Functions listed successfully');
60
+ return {
61
+ content: [{
62
+ type: 'text',
63
+ text: JSON.stringify({
64
+ ok: true,
65
+ data: {
66
+ functions,
67
+ count: functions.length
68
+ }
69
+ }, null, 2)
70
+ }]
71
+ };
72
+ }
73
+ catch (error) {
74
+ const errorMessage = error instanceof Error ? error.message : String(error);
75
+ logger.error({
76
+ error: errorMessage
77
+ }, 'code.functions.list tool failed');
78
+ return {
79
+ content: [{
80
+ type: 'text',
81
+ text: JSON.stringify({
82
+ ok: false,
83
+ errors: [errorMessage]
84
+ }, null, 2)
85
+ }],
86
+ isError: true
87
+ };
88
+ }
89
+ };
90
+ }
91
+ //# sourceMappingURL=code-functions-list.js.map
@@ -0,0 +1,34 @@
1
+ /**
2
+ * code.functions.rank MCP Tool
3
+ *
4
+ * Requirements: 9.2, 9.8
5
+ *
6
+ * Ranks functions by interest score
7
+ */
8
+ import { z } from 'zod';
9
+ import type { ToolDefinition, ToolHandler } from '../types.js';
10
+ import type { DatabaseManager } from '../database.js';
11
+ import type { WorkspaceManager } from '../workspace-manager.js';
12
+ /**
13
+ * Input schema for code.functions.rank tool
14
+ */
15
+ export declare const codeFunctionsRankInputSchema: z.ZodObject<{
16
+ sample_id: z.ZodString;
17
+ topk: z.ZodOptional<z.ZodNumber>;
18
+ }, "strip", z.ZodTypeAny, {
19
+ sample_id: string;
20
+ topk?: number | undefined;
21
+ }, {
22
+ sample_id: string;
23
+ topk?: number | undefined;
24
+ }>;
25
+ export type CodeFunctionsRankInput = z.infer<typeof codeFunctionsRankInputSchema>;
26
+ /**
27
+ * Tool definition for code.functions.rank
28
+ */
29
+ export declare const codeFunctionsRankToolDefinition: ToolDefinition;
30
+ /**
31
+ * Create handler for code.functions.rank tool
32
+ */
33
+ export declare function createCodeFunctionsRankHandler(workspaceManager: WorkspaceManager, database: DatabaseManager): ToolHandler;
34
+ //# sourceMappingURL=code-functions-rank.d.ts.map
@@ -0,0 +1,90 @@
1
+ /**
2
+ * code.functions.rank MCP Tool
3
+ *
4
+ * Requirements: 9.2, 9.8
5
+ *
6
+ * Ranks functions by interest score
7
+ */
8
+ import { z } from 'zod';
9
+ import { DecompilerWorker } from '../decompiler-worker.js';
10
+ import { logger } from '../logger.js';
11
+ /**
12
+ * Input schema for code.functions.rank tool
13
+ */
14
+ export const codeFunctionsRankInputSchema = z.object({
15
+ sample_id: z.string().describe('Sample identifier (sha256:<hex>)'),
16
+ topk: z.number().optional().describe('Number of top functions to return (default: 20)')
17
+ });
18
+ /**
19
+ * Tool definition for code.functions.rank
20
+ */
21
+ export const codeFunctionsRankToolDefinition = {
22
+ name: 'code.functions.rank',
23
+ description: 'Rank functions by interest score based on size, callers, sensitive API calls, and entry points. Returns top K functions.',
24
+ inputSchema: codeFunctionsRankInputSchema
25
+ };
26
+ /**
27
+ * Create handler for code.functions.rank tool
28
+ */
29
+ export function createCodeFunctionsRankHandler(workspaceManager, database) {
30
+ return async (args) => {
31
+ try {
32
+ const input = codeFunctionsRankInputSchema.parse(args);
33
+ logger.info({
34
+ sample_id: input.sample_id,
35
+ topk: input.topk
36
+ }, 'code.functions.rank tool called');
37
+ // Check if sample exists
38
+ const sample = database.findSample(input.sample_id);
39
+ if (!sample) {
40
+ return {
41
+ content: [{
42
+ type: 'text',
43
+ text: JSON.stringify({
44
+ ok: false,
45
+ errors: [`Sample not found: ${input.sample_id}`]
46
+ }, null, 2)
47
+ }],
48
+ isError: true
49
+ };
50
+ }
51
+ // Create decompiler worker
52
+ const decompilerWorker = new DecompilerWorker(database, workspaceManager);
53
+ // Rank functions
54
+ const rankedFunctions = await decompilerWorker.rankFunctions(input.sample_id, input.topk || 20);
55
+ logger.info({
56
+ sample_id: input.sample_id,
57
+ function_count: rankedFunctions.length
58
+ }, 'Functions ranked successfully');
59
+ return {
60
+ content: [{
61
+ type: 'text',
62
+ text: JSON.stringify({
63
+ ok: true,
64
+ data: {
65
+ functions: rankedFunctions,
66
+ count: rankedFunctions.length
67
+ }
68
+ }, null, 2)
69
+ }]
70
+ };
71
+ }
72
+ catch (error) {
73
+ const errorMessage = error instanceof Error ? error.message : String(error);
74
+ logger.error({
75
+ error: errorMessage
76
+ }, 'code.functions.rank tool failed');
77
+ return {
78
+ content: [{
79
+ type: 'text',
80
+ text: JSON.stringify({
81
+ ok: false,
82
+ errors: [errorMessage]
83
+ }, null, 2)
84
+ }],
85
+ isError: true
86
+ };
87
+ }
88
+ };
89
+ }
90
+ //# sourceMappingURL=code-functions-rank.js.map