windows-exe-decompiler-mcp-server 0.1.0

package/dist/tools/yara-scan.d.ts

@@ -0,0 +1,554 @@
+/**
+ * yara.scan tool implementation
+ * Scans PE files using YARA rules to identify malware families and packers
+ * Requirements: 5.1, 5.2, 5.3
+ */
+import { z } from 'zod';
+import type { ToolDefinition, ToolArgs, WorkerResult } from '../types.js';
+import type { WorkspaceManager } from '../workspace-manager.js';
+import type { DatabaseManager } from '../database.js';
+import type { CacheManager } from '../cache-manager.js';
+/**
+ * Input schema for yara.scan tool
+ * Requirements: 5.1, 5.2
+ */
+export declare const YaraScanInputSchema: z.ZodObject<{
+    sample_id: z.ZodString;
+    rule_set: z.ZodString;
+    timeout_ms: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    rule_tier: z.ZodDefault<z.ZodOptional<z.ZodEnum<["production", "experimental", "test", "all"]>>>;
+    force_refresh: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, "strip", z.ZodTypeAny, {
+    sample_id: string;
+    force_refresh: boolean;
+    rule_set: string;
+    timeout_ms: number;
+    rule_tier: "all" | "production" | "experimental" | "test";
+}, {
+    sample_id: string;
+    rule_set: string;
+    force_refresh?: boolean | undefined;
+    timeout_ms?: number | undefined;
+    rule_tier?: "all" | "production" | "experimental" | "test" | undefined;
+}>;
+export type YaraScanInput = z.infer<typeof YaraScanInputSchema>;
+/**
+ * Output schema for yara.scan tool
+ * Requirements: 5.2, 5.3
+ */
+export declare const YaraScanOutputSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    data: z.ZodOptional<z.ZodObject<{
+        matches: z.ZodArray<z.ZodObject<{
+            rule: z.ZodString;
+            tags: z.ZodArray<z.ZodString, "many">;
+            meta: z.ZodRecord<z.ZodString, z.ZodAny>;
+            strings: z.ZodArray<z.ZodObject<{
+                identifier: z.ZodString;
+                offset: z.ZodNumber;
+                matched_data: z.ZodString;
+                location: z.ZodOptional<z.ZodObject<{
+                    section: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                    offset_in_section: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                    rva: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                    distance_to_entrypoint: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                    function_hint: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                        name: z.ZodString;
+                        address: z.ZodString;
+                        proximity: z.ZodString;
+                    }, "strip", z.ZodTypeAny, {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    }, {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    }>>>;
+                }, "strip", z.ZodTypeAny, {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                }, {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }, {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }>, "many">;
+            confidence: z.ZodOptional<z.ZodObject<{
+                level: z.ZodEnum<["low", "medium", "high"]>;
+                score: z.ZodNumber;
+                reason: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            }, {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            }>>;
+            evidence: z.ZodOptional<z.ZodObject<{
+                import_dll_hits: z.ZodArray<z.ZodString, "many">;
+                import_api_hits: z.ZodArray<z.ZodString, "many">;
+                section_hits: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                near_entrypoint_hits: z.ZodOptional<z.ZodNumber>;
+                string_only: z.ZodBoolean;
+            }, "strip", z.ZodTypeAny, {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            }, {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            }>>;
+            inference: z.ZodOptional<z.ZodObject<{
+                classification: z.ZodString;
+                summary: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                summary: string;
+                classification: string;
+            }, {
+                summary: string;
+                classification: string;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }, {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }>, "many">;
+        ruleset_version: z.ZodString;
+        timed_out: z.ZodBoolean;
+        rule_set: z.ZodString;
+        rule_tier: z.ZodOptional<z.ZodString>;
+        rule_files: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        confidence_summary: z.ZodOptional<z.ZodObject<{
+            high: z.ZodNumber;
+            medium: z.ZodNumber;
+            low: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            high: number;
+            low: number;
+            medium: number;
+        }, {
+            high: number;
+            low: number;
+            medium: number;
+        }>>;
+        import_evidence: z.ZodOptional<z.ZodObject<{
+            dll_count: z.ZodNumber;
+            api_count: z.ZodNumber;
+        }, "strip", z.ZodTypeAny, {
+            api_count: number;
+            dll_count: number;
+        }, {
+            api_count: number;
+            dll_count: number;
+        }>>;
+        offset_mapping: z.ZodOptional<z.ZodObject<{
+            parser: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            sections_count: z.ZodOptional<z.ZodNumber>;
+            entry_point: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+        }, "strip", z.ZodTypeAny, {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        }, {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        }>>;
+        quality_notes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        timed_out: boolean;
+        matches: {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }[];
+        rule_set: string;
+        ruleset_version: string;
+        rule_tier?: string | undefined;
+        rule_files?: string[] | undefined;
+        confidence_summary?: {
+            high: number;
+            low: number;
+            medium: number;
+        } | undefined;
+        import_evidence?: {
+            api_count: number;
+            dll_count: number;
+        } | undefined;
+        offset_mapping?: {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        } | undefined;
+        quality_notes?: string[] | undefined;
+    }, {
+        timed_out: boolean;
+        matches: {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }[];
+        rule_set: string;
+        ruleset_version: string;
+        rule_tier?: string | undefined;
+        rule_files?: string[] | undefined;
+        confidence_summary?: {
+            high: number;
+            low: number;
+            medium: number;
+        } | undefined;
+        import_evidence?: {
+            api_count: number;
+            dll_count: number;
+        } | undefined;
+        offset_mapping?: {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        } | undefined;
+        quality_notes?: string[] | undefined;
+    }>>;
+    warnings: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    errors: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    artifacts: z.ZodOptional<z.ZodArray<z.ZodAny, "many">>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        elapsed_ms: z.ZodNumber;
+        tool: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        elapsed_ms: number;
+        tool: string;
+    }, {
+        elapsed_ms: number;
+        tool: string;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        timed_out: boolean;
+        matches: {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }[];
+        rule_set: string;
+        ruleset_version: string;
+        rule_tier?: string | undefined;
+        rule_files?: string[] | undefined;
+        confidence_summary?: {
+            high: number;
+            low: number;
+            medium: number;
+        } | undefined;
+        import_evidence?: {
+            api_count: number;
+            dll_count: number;
+        } | undefined;
+        offset_mapping?: {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        } | undefined;
+        quality_notes?: string[] | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+    artifacts?: any[] | undefined;
+}, {
+    ok: boolean;
+    metrics?: {
+        elapsed_ms: number;
+        tool: string;
+    } | undefined;
+    data?: {
+        timed_out: boolean;
+        matches: {
+            tags: string[];
+            strings: {
+                offset: number;
+                identifier: string;
+                matched_data: string;
+                location?: {
+                    section?: string | null | undefined;
+                    offset_in_section?: number | null | undefined;
+                    rva?: number | null | undefined;
+                    distance_to_entrypoint?: number | null | undefined;
+                    function_hint?: {
+                        address: string;
+                        name: string;
+                        proximity: string;
+                    } | null | undefined;
+                } | undefined;
+            }[];
+            rule: string;
+            meta: Record<string, any>;
+            confidence?: {
+                level: "high" | "low" | "medium";
+                score: number;
+                reason: string;
+            } | undefined;
+            evidence?: {
+                import_dll_hits: string[];
+                import_api_hits: string[];
+                string_only: boolean;
+                section_hits?: string[] | undefined;
+                near_entrypoint_hits?: number | undefined;
+            } | undefined;
+            inference?: {
+                summary: string;
+                classification: string;
+            } | undefined;
+        }[];
+        rule_set: string;
+        ruleset_version: string;
+        rule_tier?: string | undefined;
+        rule_files?: string[] | undefined;
+        confidence_summary?: {
+            high: number;
+            low: number;
+            medium: number;
+        } | undefined;
+        import_evidence?: {
+            api_count: number;
+            dll_count: number;
+        } | undefined;
+        offset_mapping?: {
+            entry_point?: Record<string, any> | undefined;
+            parser?: string | null | undefined;
+            sections_count?: number | undefined;
+        } | undefined;
+        quality_notes?: string[] | undefined;
+    } | undefined;
+    warnings?: string[] | undefined;
+    errors?: string[] | undefined;
+    artifacts?: any[] | undefined;
+}>;
+export type YaraScanOutput = z.infer<typeof YaraScanOutputSchema>;
+/**
+ * Tool definition for yara.scan
+ */
+export declare const yaraScanToolDefinition: ToolDefinition;
+/**
+ * Create yara.scan tool handler
+ * Requirements: 5.1, 5.2, 5.3, 5.5
+ */
+export declare function createYaraScanHandler(workspaceManager: WorkspaceManager, database: DatabaseManager, cacheManager: CacheManager): (args: ToolArgs) => Promise<WorkerResult>;
+//# sourceMappingURL=yara-scan.d.ts.map