Security Dossier

Security Context Dossier

Purpose

One-command deep context gathering for security auditing. Before manually reviewing a decompiled function, the researcher needs to understand its security landscape. This skill builds a comprehensive dossier covering:

1. Function Identity -- Name, signature, class membership, mangled name
2. Attack Reachability -- Exported? Entry point? Reachable from exports? Shortest path from entry? + RPC/COM/WinRT IPC entry points
3. Untrusted Data Exposure -- Which export callers can feed external data? How many hops? + parameter risk scoring
4. Dangerous Operations -- Direct dangerous APIs, security-relevant callees by category, callee-depth analysis + BFS transitive to configurable depth
5. Resource Patterns -- Synchronization, memory operations, global variable reads/writes
6. Complexity Assessment -- Instructions, branches, loops, cyclomatic complexity, stack frame
7. Neighboring Context -- Class methods, direct callees/callers
8. Data Quality -- Extraction-time error warnings

Data Sources

• Individual analysis DBs (extracted_dbs/{module}_{hash}.db): Function records, xrefs, assembly, loop analysis, stack frame, dangerous APIs, global accesses
• Tracking DB (extracted_dbs/analyzed_files.db): Module name to DB path mapping
• Exports/Entry points: From file_info table in individual DBs

For DB schema details, see [dataformatreference.md](../../docs/dataformatreference.md).

Finding a Module DB

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

Quick Cross-Dimensional Search

To search across function names, signatures, strings, APIs, classes, and exports in one call:

python .claude/helpers/unified_search.py  --query "SearchTerm"
python .claude/helpers/unified_search.py  --query "SearchTerm" --json

Utility Scripts

All scripts are in scripts/. Run from the workspace root.

build_dossier.py -- Build Security Dossier (Start Here)

Single command to produce the full dossier:

# By function name
python .claude/skills/security-dossier/scripts/build_dossier.py  

# By function ID
python .claude/skills/security-dossier/scripts/build_dossier.py  --id 

# Search for functions matching a pattern
python .claude/skills/security-dossier/scripts/build_dossier.py  --search 

# JSON output (machine-readable)
python .claude/skills/security-dossier/scripts/build_dossier.py   --json

# Deeper callee analysis (check callees' callees for dangerous APIs)
python .claude/skills/security-dossier/scripts/build_dossier.py   --callee-depth 4

Examples:

python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/appinfo_dll_e98d25a9e8.db AiCheckSecureApplicationDirectory
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db --search "BatLoop"
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db BatLoop --json

Workflows

Security Dossier Progress:
- [ ] Step 1: Find the module DB
- [ ] Step 2: Build the dossier
- [ ] Step 3: Review the dossier sections
- [ ] Step 4: Deep dive into flagged areas

Step 1: Find the Module DB

python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll

Step 2: Build the Dossier

python .claude/skills/security-dossier/scripts/build_dossier.py  

Step 3: Review the Dossier

Focus on these high-priority indicators:

| Indicator | Meaning | | -------------------------------- | ---------------------------------------------------------------- | | Externally Reachable = YES | Function can be triggered from outside the module | | Direct Dangerous APIs | Immediate dangerous behavior (memory-unsafe, command exec, etc.) | | Security-Relevant Callees | Sensitive operations performed via callees | | Receives External Data = YES | Untrusted data can flow to this function | | Global Writes | State mutation affecting other functions | | High Cyclomatic Complexity | Complex control flow, higher bug probability |

Step 4: Deep Dive

Based on dossier findings, use complementary skills:

• Code extraction -- extract the function for detailed review:

python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py  

• Call graph tracing -- follow execution paths across modules:

python .claude/skills/callgraph-tracer/scripts/chain_analysis.py   --depth 3

Dossier Section Reference

1. Function Identity

Source: functions table -- function_name, function_signature, function_signature_extended, mangled_name. Class membership inferred from :: in the function name.

Library tag: When available, lookup_function() from helpers provides the function's library tag (WIL/STL/WRL/CRT/ETW) and .cpp source file path.

2. Attack Reachability

Source: file_info.exports, file_info.entry_point, simple_inbound_xrefs. BFS upward through callers to find paths from exports/entry points. Reports whether the function is externally reachable and the shortest path from an entry point. Also includes ipc_context with ground-truth RPC/COM/WinRT classification from rpc_index, com_index, and winrt_index helper modules.

3. Untrusted Data Exposure

Combines reachability with exports analysis. Functions reachable from exports may receive untrusted external input. Traces data paths from export callers to the target. Now includes param_surface (structured metadata) from signature analysis, and considers entry points and IPC handlers as data sources alongside exports.

4. Dangerous Operations

Source: dangerous_api_calls (direct), simple_outbound_xrefs classified by security API category. Uses BFS via CallGraph to --callee-depth (default 4) for transitive dangerous API discovery. Also reports indirect_calls from detailed outbound_xrefs. Categories: memoryunsafe, commandexecution, codeinjection, privilege, filewrite, registrywrite, network, crypto, sync, memoryalloc.

5. Resource Patterns

Source: simple_outbound_xrefs classified for sync/memory/file APIs. global_var_accesses for global state reads/writes.

6. Complexity Assessment

Source: assembly_code (instruction/branch/call counts), loop_analysis (loop count, cyclomatic complexity), stack_frame (sizes, exception handler). Includes has_syscall for direct syscall detection.

7. Neighboring Context

Source: Functions sharing the same ClassName:: prefix. Direct callees/callers from xrefs.

Direct Helper Module Access

For programmatic use without skill scripts:

• helpers.classify_api_security(api_name) -- Classify API for security relevance
• helpers.get_dangerous_api_set() -- Get the set of known dangerous APIs
• helpers.CallGraph.from_functions(functions) -- Build call graph for reachability analysis
• helpers.resolve_function(db, name_or_id) -- Resolve function by name or ID

Integration with Other Skills

| Task | Recommended Skill | |------|-------------------| | Trace call chains from audited functions | callgraph-tracer | | Classify functions in the audit neighborhood | classify-functions | | Map entry points reachable from audited function | map-attack-surface | | Lift audited functions to clean code for review | batch-lift |

Performance

| Operation | Typical Time | Notes | |-----------|-------------|-------| | Build single function dossier | ~5-10s | Gathers from multiple skills | | Build dossier (deep callee scan) | ~15-45s | With --callee-depth 4+ (BFS) |

Additional Resources

• For detailed technical reference, see [reference.md](reference.md)
• For DB schema and JSON formats, see [dataformatreference.md](../../docs/dataformatreference.md)
• For fileinfo.json schema, see [fileinfoformatreference.md](../../docs/fileinfoformat_reference.md)
• For call graph tracing, see [callgraph-tracer](../callgraph-tracer/SKILL.md)
• For function classification, see [classify-functions](../classify-functions/SKILL.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: marcosd4h
• Source: marcosd4h/DeepExtractRuntime
• License: MIT

Install and usage instructions live in the source repository linked above.