Anti-Obfuscation Plugins反混淆插件

┌─────────────────┐     ┌──────────────────────┐     ┌────────────────────┐
│  deep-unpack    │     │ runtime-deobfuscate  │     │  behavior-first    │
│                 │     │                      │     │                    │
│ deep.unpack     │     │ deobf.strings        │     │ behavior.capture   │
│   .pipeline     │────▶│ deobf.api_resolve    │────▶│ behavior.ioc       │
│ deep.unpack     │     │ deobf.cfg_trace      │     │ behavior.network   │
│   .pe_reconstruct│    │ deobf.dotnet         │     │                    │
│ deep.unpack     │     │                      │     │                    │
│   .dump_scan    │     │                      │     │                    │
└─────────────────┘     └──────────────────────┘     └────────────────────┘
       ▲                         ▲                            ▲
       │                         │                            │
  ┌────┴────┐              ┌─────┴─────┐               ┌─────┴──────┐
  │ Docker  │              │  Docker   │               │  Docker    │
  │ UPX     │              │  Frida    │               │  Frida     │
  │ Speakeasy│             │  Wine     │               │  Wine      │
  │ Qiling  │              │  de4dot   │               │            │
  │ Wine    │              │           │               │            │
  └─────────┘              └───────────┘               └────────────┘

// Step 1: Deep unpack
{
  "tool": "deep.unpack.pipeline",
  "args": {
    "sample_id": "sha256:abc123...",
    "max_layers": 5,
    "strategies": ["upx", "speakeasy", "qiling", "memory_carve"],
    "timeout": 120
  }
}

// Step 2: Fix PE if needed
{
  "tool": "deep.unpack.pe_reconstruct",
  "args": {
    "sample_id": "sha256:def456...",
    "api_trace": [
      {"address": "0x7FFE1234", "name": "CreateFileW", "module": "kernel32.dll"},
      {"address": "0x7FFE5678", "name": "RegOpenKeyExW", "module": "advapi32.dll"}
    ],
    "oep_rva": "0x1000"
  }
}

// Step 3: Re-ingest unpacked binary
{
  "tool": "unpack.reingest",
  "args": { "sample_id": "sha256:abc123...", "artifact_id": "..." }
}

// 1. Capture decrypted strings
{ "tool": "deobf.strings", "args": { "sample_id": "sha256:...", "timeout": 60 } }
// → Returns: unique_strings: 142, strings: [{value: "http://c2.evil.com", ...}, ...]

// 2. Capture resolved APIs
{ "tool": "deobf.api_resolve", "args": { "sample_id": "sha256:...", "timeout": 60 } }
// → Returns: iat_map: [{name: "CreateFileW", module: "kernel32.dll", ...}, ...]

// 3. Recover actual CFG
{ "tool": "deobf.cfg_trace", "args": { "sample_id": "sha256:...", "timeout": 60 } }
// → Returns: unique_blocks: 847, edges: [{from: "0x1000", to: "0x1020"}, ...]

// 4. Feed API trace into PE reconstruction
{ "tool": "deep.unpack.pe_reconstruct", "args": {
    "sample_id": "sha256:...",
    "api_trace": [...iat_map from step 2...],
    "oep_rva": "0x1000"
  }
}

Step 1: Standard Analysis (may fail quickly)第1步：标准分析（可能快速失败）
  → packer.detect         Identify packer/obfuscator识别加壳器/混淆器
  → pe.fingerprint        Check entropy, imports检查熵值、导入表
  → strings.extract       Try static strings (likely empty)尝试静态字符串（可能为空）

Step 2: Deep Unpacking第2步：深度脱壳
  → deep.unpack.pipeline  Multi-strategy, multi-layer unpack多策略、多层脱壳
  → deep.unpack.dump_scan Find PE images in memory dumps在内存转储中查找PE镜像
  → deep.unpack.pe_reconstruct Fix IAT, headers, alignment修复IAT、头、对齐

Step 3: Runtime Deobfuscation第3步：运行时去混淆
  → deobf.strings         Capture decrypted strings捕获解密字符串
  → deobf.api_resolve     Capture resolved APIs → feed to pe_reconstruct捕获解析的API → 输入pe_reconstruct
  → deobf.cfg_trace       Recover actual CFG恢复实际CFG
  → deobf.dotnet          .NET specific (if applicable).NET特定（如适用）

Step 4: Behavioral Analysis (last resort)第4步：行为分析（最后手段）
  → behavior.capture      What does it DO?它做了什么？
  → behavior.ioc          Extract indicators提取指标
  → behavior.network      Network behavior + C2 detection网络行为 + C2检测

# Generate Docker image with all anti-obfuscation backends# 生成包含所有反混淆后端的Docker镜像
npm run docker:generate

# Or include specific plugins only# 或仅包含特定插件
npm run docker:generate -- --profile=full --include=deep-unpack,runtime-deobfuscate,behavior-first

# Build and start# 构建并启动
docker compose --env-file .docker-runtime.env -f docker-compose.yml up -d --build mcp-server