mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.6 KiB

Raw Blame History

API Reference: Malware Reverse Engineering with Ghidra Agent

Overview

Combines Ghidra headless analysis with r2pipe (radare2) for automated malware binary analysis: function enumeration, import classification, section entropy, cryptographic constant detection, and network indicator extraction.

Dependencies

Package	Version	Purpose
r2pipe	>= 1.8	Radare2 scripting interface for binary analysis
hashlib	stdlib	File hash computation

External Tools

Tool	Purpose
Ghidra (analyzeHeadless)	Automated disassembly and decompilation
radare2	Binary analysis, function detection, string extraction

Core Functions

`run_ghidra_headless(ghidra_path, project_dir, project_name, binary_path, script)`

Executes Ghidra in headless mode with optional post-analysis script.

Timeout: 600 seconds
Returns: dict with command, returncode, stdout/stderr

`export_functions_ghidra(...)`

Generates and runs a Ghidra script to export function list as JSON.

Exports: name, address, size, calling convention, is_thunk

`analyze_with_radare2(filepath)`

Full r2pipe analysis: binary info, functions, imports, strings, sections, entry points.

Classifies imports: injection, network, evasion, crypto, persistence
Extracts: network indicators (URLs, IPs) from strings
Returns: dict with info, function_count, suspicious_imports, sections, etc.

`extract_crypto_constants(filepath)`

Searches binary for known cryptographic constants: AES S-box, RC4 init table, SHA-256 init vector, RSA magic bytes.

Returns: list[dict] with constant name and file offset

`analyze_malware(filepath, ghidra_path, output_dir)`

Full pipeline: hashes -> crypto constants -> radare2 analysis -> Ghidra headless.

Suspicious Import Categories

Category	Example Functions
injection	VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
network	InternetOpenA, WSAStartup, URLDownloadToFileA
evasion	IsDebuggerPresent, NtQueryInformationProcess
crypto	CryptEncrypt, CryptDecrypt
persistence	RegSetValueExA, CreateServiceA

Radare2 Commands Used

Command	Purpose
`aaa`	Full auto-analysis
`ij`	Binary info as JSON
`aflj`	Function list as JSON
`iij`	Import list as JSON
`izj`	String list as JSON
`iSj`	Section list as JSON
`iej`	Entry points as JSON

Usage

# With radare2 only
python agent.py malware.exe

# With Ghidra headless analysis
python agent.py malware.exe /opt/ghidra

2.6 KiB Raw Blame History