mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.5 KiB

Raw Blame History

API Reference: .NET Malware Reverse Engineering with dnSpy Agent

Overview

Analyzes .NET malware: validates CLR headers, detects obfuscators (ConfuserEx, SmartAssembly), deobfuscates with de4dot, extracts strings/IOCs, and parses .NET metadata via monodis.

Dependencies

Package	Version	Purpose
hashlib	stdlib	Sample hash computation
struct	stdlib	PE/CLR header parsing
re	stdlib	String pattern extraction

External Tools (Optional)

Tool	Purpose
diec (Detect It Easy)	Obfuscator identification
de4dot	Automated .NET deobfuscation
monodis	.NET assembly metadata extraction

Core Functions

`detect_dotnet_assembly(filepath)`

Validates PE file has CLR header (COM descriptor directory entry).

Checks: MZ signature, PE signature, optional header magic, CLR RVA
Returns: dict with is_dotnet, clr_header_rva

`detect_obfuscator(filepath)`

Runs Detect It Easy to identify ConfuserEx, SmartAssembly, .NET Reactor, Dotfuscator, Babel, Eazfuscator, Crypto Obfuscator.

Returns: dict with detected list

`deobfuscate_with_de4dot(filepath, output_path)`

Runs de4dot to remove obfuscation, producing a cleaner assembly.

Timeout: 120 seconds
Returns: dict with success, output_path

`extract_strings(filepath, min_length)`

Extracts ASCII and Unicode strings, classifies into URLs, IPs, emails, registry keys, base64, and suspicious keywords (keylog, stealer, webhook, etc.).

Returns: dict[str, list[str]] - categorized indicator lists

`analyze_dotnet_metadata(filepath)`

Uses monodis to extract assembly info, type definitions, and method counts.

Returns: dict with type_count, method_count, types

`analyze_dotnet_malware(filepath, output_dir)`

Full pipeline: hashes -> .NET check -> obfuscator detection -> deobfuscation -> strings -> metadata.

Obfuscators Detected

Obfuscator	Indicator
ConfuserEx	Most common open-source .NET obfuscator
SmartAssembly	Commercial obfuscator by Redgate
.NET Reactor	Code protection with native stub
Dotfuscator	Microsoft-provided obfuscator
Eazfuscator	Commercial string/flow obfuscation

Suspicious String Keywords

keylog, screenshot, clipboard, password, credential, smtp, telegram, discord, webhook, stealer, inject, hook, persist, startup

Usage

python agent.py suspect.exe

2.5 KiB Raw Blame History