commit 2bcbaee829285a1200c2d5779fe0ff828b057c76 Author: Jeremy Anderson Date: Fri Jul 3 20:08:18 2026 -0400 Warlock's Stave is a lightweight reverse engineering framework designed for high-velocity dynamic code tracing, predictive instruction auditing, and deep infrastructure pattern inspection. diff --git a/.cargo/config.toml b/.cargo/config.toml new file mode 100644 index 0000000..cd7cc93 --- /dev/null +++ b/.cargo/config.toml @@ -0,0 +1,6 @@ +[build] +rustdocflags = ["--document-private-items"] + +[target.x86_64-unknown-linux-gnu] +# Uncomment to enable eBPF during development without sudo: +# rustflags = ["-C", "link-arg=-lbpf"] \ No newline at end of file diff --git a/.editorconfig b/.editorconfig new file mode 100644 index 0000000..4a94cd6 --- /dev/null +++ b/.editorconfig @@ -0,0 +1,24 @@ +root = true + +[*] +charset = utf-8 +end_of_line = lf +insert_final_newline = true +trim_trailing_whitespace = true +indent_style = space +indent_size = 4 + +[*.rs] +indent_size = 4 + +[*.md] +trim_trailing_whitespace = false + +[*.{yml,yaml,toml}] +indent_size = 2 + +[*.java] +indent_size = 4 + +[*.cpp,*.h] +indent_size = 4 \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..55e7e8d --- /dev/null +++ b/.gitignore @@ -0,0 +1,25 @@ +# Build artifacts +/target/ +*.o +*.so +*.dll +*.dylib +*.dp64 + +# eBPF compiled output (regenerated by build.sh) +/ebpf_bin/stave_probe.o +/ebpf_bin/stave_probe.c + +# IDE +.idea/ +.vscode/ +*.swp +*.swo +*~ + +# OS +.DS_Store +Thumbs.db + +# Environment +.env \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..8174838 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,36 @@ +# Changelog + +All notable changes to Warlock's Stave (`stave-core` crate) will be documented in this file. + +## [7.0.0] - 2026-07-04 + +### Added +- Core engine with hexagonal heatmap timeline (axial coordinates, f64 pixel raycasting) +- Predictive branch evaluator (iced-x86 1.21.0, 15-byte safe decoder bounds) +- Dictionary scanner with default threat-hunting library (6 rules) +- Pluggable signature database engine with `ExternalScannerProvider` trait +- Mirror Illusion section-aware binary diff engine +- Tri-Tier Scope Engine (Global, Local, Micro) +- State Decay System for mutation highlight fadeout +- Shellcode Sentinel (memory permission transition monitor via `/proc//maps`) +- Self-assembling IPC: Unix sockets, TCP loopback, named-pipe translation +- Thread-safe core via `Arc>` +- C-FFI boundary layer (4 public functions with `#[no_mangle]`) +- JNI extension for Java-based host integration +- egui 0.27.0 4-quarter workspace UI +- Linux eBPF kernel tracing (aya 0.11.0, kprobe on `sys_enter_connect`) +- Windows ETW real-time telemetry session +- Polymorphic IPC evasion detection with Shannon entropy analysis +- UEFI NVRAM and ACPI table firmware analysis +- Pre-flight environment validator binary +- Evasion telemetry simulation binary +- Cross-compilation support for Wine plugin bridge (MinGW) +- Comprehensive unit test suite (14 tests) +- `rustdoc` examples on all FFI functions + +### Design Decisions +- Engine is permanent; UI is disposable (Unix Philosophy) +- Host environments are untrusted; core has zero UI toolkit dependencies +- All IPC and FFI communication uses stateless JSON-Lines protocol +- Error paths return static data-segment strings to prevent host memory leaks +- `setcap` is never called inside the build script; printed as optional post-build step \ No newline at end of file diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..cad440d --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,81 @@ +[package] +name = "stave-core" +version = "7.0.0" +edition = "2021" +authors = ["Warlock Architecture Group"] +description = "High-velocity low-overhead binary execution tracker, firmware auditor, and polymorphic IPC analytics engine." +license = "AGPL-3.0-only" +repository = "https://github.com/warlock-architecture/stave-core" +readme = "README.md" +keywords = ["reverse-engineering", "telemetry", "disassembler", "heatmap", "evasion-detection"] +categories = ["development-tools::debugging", "visualization", "security"] + +[lib] +name = "stave_core" +crate-type = ["cdylib", "rlib"] + +[features] +# Enable live eBPF kernel tracing (requires pre-compiled ebpf_bin/stave_probe.o +# from build.sh and elevated permissions at runtime). Default: off. +ebpf = [] + +[dependencies] +# Core disassembly engine +iced-x86 = { version = "1.21.0", features = ["decoder", "instr_info"] } + +# Serialization for IPC and host communication +serde = { version = "1.0", features = ["derive"] } +serde_json = "1.0" + +# Asynchronous trait support for scanner providers +async-trait = "0.1" + +# Java Native Interface bridge for host integration +jni = "0.21.1" + +# Lazy static initialization +lazy_static = "1.4.0" + +# Immediate-mode UI framework +egui = "0.27.0" +eframe = { version = "0.27.0", features = ["default"] } + +# Byte buffer utilities +bytes = "1.5.0" + +# Structured logging facade (active — used via println! currently, +# retained for migration to tracing macros in a future release) +tracing = "0.1" + +[target.'cfg(target_os = "linux")'.dependencies] +# eBPF kernel tracing framework +aya = { version = "0.11.0", features = ["async_tokio"] } +# Async runtime for kernel event processing +tokio = { version = "1.35", features = ["full"] } + +[target.'cfg(target_os = "windows")'.dependencies] +# Windows Event Tracing telemetry bindings +windows-sys = { version = "0.52.0", features = [ + "Win32_System_Diagnostics_Etw", + "Win32_System_Threading", + "Win32_System_Diagnostics_Debug" +] } + +[profile.release] +opt-level = 3 +lto = true +codegen-units = 1 +panic = "abort" +strip = true + +[[bin]] +name = "environment_check" +path = "src/bin/environment_check.rs" + +[[bin]] +name = "simulate_evasion_telemetry" +path = "src/bin/simulate_evasion_telemetry.rs" + +[[bin]] +name = "gui_demo" +path = "src/bin/gui_demo.rs" \ No newline at end of file diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..de7282d --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +GNU AFFERO GENERAL PUBLIC LICENSE + Version 3, 19 November 2007 + + Copyright (C) 2007 Free Software Foundation, Inc. + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +See https://www.gnu.org/licenses/agpl-3.0.txt for the full license text. + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as published +by the Free Software Foundation, either version 3 of the License, or +(at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see . \ No newline at end of file diff --git a/QuickStart.md b/QuickStart.md new file mode 100644 index 0000000..f1f7ee9 --- /dev/null +++ b/QuickStart.md @@ -0,0 +1,64 @@ +# Quick Start + +## Prerequisites + +| Component | Debian/Ubuntu | Arch Linux | Purpose | +|---|---|---|---| +| Rust toolchain | `rustup` | `rustup` | Core compilation | +| LLVM / Clang | `clang`, `llvm` | `clang`, `llvm` | eBPF bytecode compilation | +| MinGW-w64 | `g++-mingw-w64-x86-64` | `mingw-w64-gcc` | Wine plugin cross-compilation | +| libcap | `libcap2-bin` | `libcap` | Capability management | +| X11/Wayland | `libx11-dev`, `libwayland-dev` | `libx11`, `wayland` | egui rendering backend | + +## Build + +```bash +git clone https://github.com/warlock-architecture/stave-core.git +cd stave-core +cargo run --bin environment_check # Verify tooling +chmod +x build.sh +./build.sh # Compile everything +``` + +## Optional: Enable Kernel Tracing + +The eBPF probe requires elevated permissions. This step is **not** required for FFI, JNI, IPC, or UI-only usage: + +```bash +sudo setcap cap_net_admin,cap_perfmon+ep ./target/release/libstave_core.so +``` + +## Verify + +Open two terminals: + +```bash +# Terminal 1: Start the engine (your host application loads libstave_core) +cargo run --bin simulate_evasion_telemetry + +# Terminal 2: Run the evasion simulator +cargo run --bin simulate_evasion_telemetry +``` + +## Hotkey Reference + +| Key | Action | +|---|---| +| F1 | Help overlay | +| F2 | Load target binary / attach to PID | +| F3 | Inline micro-assembler (patch opcodes) | +| F4 | Cycle Q3 view mode (hex / assembly / headers) | +| F5 | Go to address / symbol | +| F6 | Search byte pattern or string | +| F7 | Step into (trace into CALL targets) | +| F8 | Step over (execute loops at native speed) | +| Alt+L | Toggle loop filter on hex grid | +| Alt+B | Toggle breakpoint filter on hex grid | +| Alt+D | Toggle disk I/O filter on hex grid | +| Alt+N | Toggle network I/O filter on hex grid | +| Ctrl+G | Follow pointer address in data viewport | +| Ctrl+T | Cast struct overlay onto hex view | +| Ctrl+Z | Undo last patch | +| F10 | Exit and flush telemetry | + +> **Note:** Hotkeys are documented but not yet wired to the egui event loop. This is a planned feature. \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..2272188 --- /dev/null +++ b/README.md @@ -0,0 +1,179 @@ +# Warlock's Stave + +A lightweight, zero-allocation reverse engineering telemetry hub written in Rust. The library crate is `stave-core`. + +Warlock's Stave compiles to a single dynamic system library (`libstave_core.so`, `stave_core.dll`, `libstave_core.dylib`) that exposes a stateless, C-compatible FFI and JNI interface. It is designed as a permanent analysis engine that communicates via standardized data pipelines, independent of any specific host UI or windowing toolkit. + +**License:** [AGPL-3.0-only](LICENSE) + +--- + +## What It Does + +Warlock's Stave receives raw instruction execution frames from a host debugger or emulator, runs them through an analysis pipeline, and returns structured JSON-Lines telemetry. The host application (a disassembler, a GUI, a headless pipeline) renders the results. + +It handles IPC transport automatically: Unix domain sockets on bare metal, TCP loopback in containers, and named-pipe-to-Unix-socket translation for compatibility-layer environments. + +--- + +## Core Engine + +### Branch Prediction (Branch Evaluator) + +Decodes x86/x64 instructions via iced-x86 and evaluates conditional branches against the current EFLAGS register before the hardware commits. Supports JE, JNE, JG, JL, JMP, and CALL mnemonics. The decoder enforces a strict 15-byte clamp to prevent out-of-bounds reads on unmapped memory pages. + +### Hexagonal Heatmap Timeline + +Maps execution flow onto an axial hexagonal grid using f64-precision pixel raycasting. Each hex cell tracks hit count, I/O activity, breakpoint status, and semantic markers (loop, disk, network). The grid supports four filter toggles (Alt+L/B/D/N) to isolate specific activity types. + +### Dictionary Scanner & Signature Database + +A linear pattern-matching engine with two layers: a built-in hunting dictionary (HTTP/HTTPS URLs, anti-debug APIs, Base64 alphabets, PE headers) and a pluggable signature database designed to accept YARA-compatible and ClamAV-compatible backends via the `ExternalScannerProvider` trait. + +### Tri-Tier Scope Engine + +Classifies each execution frame at three analytical levels: + +- **Global:** Cross-references, export footprints, file entropy. +- **Local:** Active function block boundaries from symbol tables. +- **Micro:** Predicted implicit register and memory side-effects before execution. + +### Mirror Illusion Diff Engine + +Section-aware binary comparison that aligns two files by ELF/PE section boundaries rather than raw byte offsets. This prevents code shifts from compiler changes from shattering the comparison. Operates on 16-byte grid lines with per-byte modified/identical status. + +### State Decay System + +Mutation highlights (registers flash red, memory bytes flash yellow) carry a configurable TTL counter that decrements each frame. Highlights fade smoothly back to the base theme color, communicating recent changes without permanent visual clutter. + +### Self-Assembling IPC + +Automatically detects the host environment at startup and selects the best transport: + +| Environment | Transport | +|---|---| +| Bare metal (Linux) | Unix domain socket (`/tmp/stave_bridge_ipc.sock`) | +| Container (Docker, Podman, Kubernetes) | TCP loopback (`127.0.0.1:21860`) with `TCP_NODELAY` | +| Compatibility layer (Wine, Proton) | Named pipe (mapped to Unix socket by the translation bridge) | + +--- + +## Visualization + +The immediate-mode UI (egui 0.27.0) renders a 4-quarter workspace at a target 60 FPS: + +| Quarter | Content | +|---|---| +| Top panel | Hexagonal heatmap grid with pixel-raycaster mouse tracking | +| Q1 (bottom-left) | Disassembly stream from iced-x86 decoding | +| Q2 (bottom-right) | Register matrix with mutation highlighting + branch prediction outcome | +| Q3 (bottom-left, below Q1) | Dual-pane hex/ASCII data viewport | +| Q4 (bottom-right, below Q2) | Telemetry overlay: firmware alerts, IPC evasion status, entropy sparklines | + +The UI is isolated from the core engine by design. It consumes computed data structures and renders them. The engine has zero dependencies on window layout toolkits. + +--- + +## Security Analysis + +### Shellcode Sentinel + +Monitors runtime memory segment permissions via `/proc//maps`. Detects transitions that indicate shellcode injection: + +- **Execute added to writable page** (RW- to RWX, or R-- to R-X) +- **Write added to executable page** (R-X to RWX) +- **Execute removed** (RWX to RW-, possibly post-exploitation cleanup) + +Fires timed alerts that the UI renders as flashing warnings. + +### Polymorphic IPC Evasion Detection + +Audits processes for communication channel switching patterns. A process that drops its standard IPC connection while simultaneously creating unnamed pipes triggers an evasion alert. Includes Shannon entropy analysis for detecting encrypted channel activity. + +### Firmware Analysis + +Audits UEFI NVRAM variables for entries not belonging to known firmware vendors, and examines ACPI table entries for non-standard tables that could indicate bootkit persistence. + +### Kernel Telemetry + +- **Linux:** eBPF kprobe on `sys_enter_connect` via aya, capturing outbound connection events with PID and network namespace. +- **Windows:** Real-time ETW trace session for system event telemetry. + +--- + +## Plugin System + +Warlock's Stave is not locked into a single frontend. Three integration paths are provided: + +### C/C++ FFI (x64dbg / Wine) + +A compiled plugin DLL (`warlock_bridge.dp64`) that hooks the debugger's step event callback, captures the current instruction context, and forwards it to the IPC daemon over a named pipe. See `bridges/stave_stub.cpp`. + +### JNI (Java-based disassemblers) + +A Java class (`WarlockStaveBridge`) that allocates a DirectByteBuffer, passes it to the native library with zero-copy overhead, and receives JSON telemetry in return. See `bridges/WarlockStaveBridge.java`. + +### Direct Library Link + +Any application that can call C FFI functions can link against `libstave_core` directly. The public API consists of four functions: + +```c +void* initialize_warlock_stave(); +const char* stave_ingest_frame(void* ctx, const uint8_t* buf, size_t len, uint64_t rip, uint32_t eflags); +void free_stave_string(const char* str); +void destroy_warlock_stave(void* ctx); +``` + +Run `cargo doc --open` for full rustdoc with safety documentation. + +--- + +## Future Work + +- Hotkey-driven action HUD (F1-F10, Alt+L/B/D/N, Ctrl+G/T/Z) — currently documented but not wired to the egui event loop. +- Struct overlay parser for casting C-style struct definitions onto the hex viewport. +- Inline micro-assembler for patching opcodes directly from the UI. +- External scanner provider implementations (YARA-rust, ClamAV FFI). +- IPC response channel (currently sends structured analysis back to the host but the response path needs architecture decisions). +- Render-loop caching for firmware/IPC telemetry queries (currently queried every frame). +- macOS Endpoint Security Framework consumer. + +--- + +## Project Structure + +``` +stave-core/ +├── Cargo.toml +├── build.sh +├── LICENSE +├── README.md +├── QuickStart.md +├── THIRD_PARTY_NOTICES.md +├── .gitignore +├── .editorconfig +├── .cargo/ +│ └── config.toml +├── src/ +│ ├── lib.rs # Core engine, FFI, JNI, all analysis modules +│ ├── ebpf.rs # Linux eBPF kernel tracing (aya) +│ ├── windows_etw.rs # Windows ETW telemetry +│ ├── polymorphic_ipc.rs # IPC evasion detection, Shannon entropy +│ ├── firmware.rs # UEFI NVRAM & ACPI table analysis +│ ├── stave_ui.rs # egui 4-quarter workspace +│ └── bin/ +│ ├── environment_check.rs # Pre-flight dependency validator +│ └── simulate_evasion_telemetry.rs # IPC evasion simulation test +├── bridges/ +│ ├── stave_stub.cpp # C++ plugin for x64dbg/Wine +│ └── WarlockStaveBridge.java # JNI bridge for Java-based hosts +└── ebpf_bin/ # Compiled eBPF bytecode (generated by build.sh) +``` + +--- + +## Legal Notices + +Warlock's Stave is released under the GNU Affero General Public License v3.0 only. See [LICENSE](LICENSE) for the full text. + +Certain product names mentioned in documentation and code comments are trademarks of their respective owners. These references are made for descriptive and compatibility purposes only and do not imply endorsement, sponsorship, or affiliation. See [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) for details. \ No newline at end of file diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md new file mode 100644 index 0000000..0312a23 --- /dev/null +++ b/THIRD_PARTY_NOTICES.md @@ -0,0 +1,69 @@ +# Third-Party Notices and Trademark Acknowledgments + +Warlock's Stave references certain third-party technologies, products, and +projects by name in its documentation, code comments, and build scripts. +These references are made solely for descriptive, compatibility, and +interoperability purposes. No endorsement, sponsorship, or affiliation +with any third party is intended or should be inferred. + +## Trademarks + +The following names are or may be trademarks or registered trademarks +of their respective owners. Warlock's Stave uses these names only to describe +compatibility targets, integration points, or runtime environments. + +| Name | Owner | Context in This Project | +|---|---|---| +| Linux | Linus Torvalds (via Linux Foundation) | Target operating system | +| Windows | Microsoft Corporation | Target operating system, ETW API | +| macOS, OS X | Apple Inc. | Target operating system | +| Java, JVM, JNI | Oracle Corporation | Host integration via JNI bridge | +| Debian | Debian Project | Tested build environment | +| Arch Linux | Arch Linux Project | Tested build environment | +| Docker | Docker, Inc. (now Mirantis) | Container detection | +| Kubernetes | The Linux Foundation | Container detection | +| Podman | Red Hat, Inc. | Container detection | +| Wine, Proton | Wine project / Valve Corporation | Compatibility-layer IPC transport | +| ClamAV | Cisco Systems, Inc. | Referenced as a scanner backend option | +| YARA | VirusTotal (Google LLC) | Referenced as a scanner backend option | +| MinGW | The MinGW-w64 Project | Cross-compilation toolchain | +| LLVM, Clang | LLVM Foundation | eBPF bytecode compilation | +| Rust, cargo | Rust Foundation | Programming language and build tool | +| egui | Emil Ernerfeldt | UI framework | +| iced-x86 | vtto (GitHub) | Disassembly engine | +| Ghidra | National Security Agency | Referenced as a potential host application | +| x64dbg | Duncan Ogilvie | Referenced as a potential host application | +| ELF | UNIX System Laboratories (historical) | File format analyzed | +| Intel | Intel Corporation | CPU architecture, vendor GUID in firmware analysis | +| Microsoft | Microsoft Corporation | Vendor GUID in firmware analysis | +| UPX | Markus Oberhumer and Laszlo Molnar | Packer detection signature | +| VMProtect | Oreans Technologies | Packer detection signature | +| Petite | Ian Luck | Packer detection signature | + +## Open Source Licenses + +This project depends on the following open source crates, each +distributed under their own license. Crate versions are as specified +in `Cargo.toml`. + +| Crate | License | +|---|---| +| iced-x86 | MIT | +| serde | MIT OR Apache-2.0 | +| serde_json | MIT OR Apache-2.0 | +| async-trait | MIT OR Apache-2.0 | +| jni | MIT OR Apache-2.0 | +| lazy_static | MIT OR Apache-2.0 | +| egui | Apache-2.0 | +| eframe | Apache-2.0 | +| bytes | MIT | +| tracing | MIT | +| aya | Apache-2.0 OR MIT | +| tokio | MIT | +| windows-sys | MIT OR Apache-2.0 | + +## No Affiliation + +The "Warlock Architecture Group" listed as the author in `Cargo.toml` +is a project author identifier. It is not a legal entity and does not +represent any company, organization, or institution. \ No newline at end of file diff --git a/bridges/WarlockStaveBridge.java b/bridges/WarlockStaveBridge.java new file mode 100644 index 0000000..5d07449 --- /dev/null +++ b/bridges/WarlockStaveBridge.java @@ -0,0 +1,62 @@ +package org.stave; + +import java.nio.ByteBuffer; + +/** + * Forms the native memory pipeline within a Java-based disassembler host. + * Manages execution events from an emulator or debug interface + * and passes raw byte arrays down to the compiled stave-core library + * with zero-copy overhead via DirectByteBuffer. + */ +public class WarlockStaveBridge { + private long nativeContextHandle = 0; + + static { + // Loads the native library (libstave_core.so / stave_core.dll) + System.loadLibrary("stave_core"); + } + + private native long initializeWarlockStave(); + private native String staveIngestGhidraFrame( + long contextPtr, ByteBuffer buffer, long rip, int eflags + ); + private native void destroyWarlockStave(long contextPtr); + + public void initializeComponent() { + this.nativeContextHandle = initializeWarlockStave(); + } + + public synchronized void processEmulatorStepEvent( + long executionRip, + byte[] memoryPageFrame, + int registerEflags + ) { + if (this.nativeContextHandle == 0) return; + + ByteBuffer directBuffer = + ByteBuffer.allocateDirect(memoryPageFrame.length); + directBuffer.put(memoryPageFrame); + directBuffer.flip(); + + String telemetryJsonOutput = staveIngestGhidraFrame( + this.nativeContextHandle, + directBuffer, + executionRip, + registerEflags + ); + + dispatchToWorkspace(telemetryJsonOutput); + } + + private void dispatchToWorkspace(String jsonStateFrame) { + // Enqueues the serialized tracking snapshot onto + // the main UI event stream for rendering. + } + + public void terminateComponent() { + if (this.nativeContextHandle != 0) { + destroyWarlockStave(this.nativeContextHandle); + this.nativeContextHandle = 0; + } + } +} \ No newline at end of file diff --git a/bridges/stave_stub.cpp b/bridges/stave_stub.cpp new file mode 100644 index 0000000..5ea032d --- /dev/null +++ b/bridges/stave_stub.cpp @@ -0,0 +1,87 @@ +// ============================================================================ +// x64dbg/Wine C++ Plugin Hook Module +// ============================================================================ +// +// Forms the bridge between an x64dbg debug session (running under Wine) +// and the Warlock's Stave IPC daemon. Captures step events and forwards +// them as packed binary payloads over a named pipe (which Wine +// automatically maps to Unix sockets on Linux). + +#include +#include + +#define PLUG_SDKVERSION 5 +typedef size_t CBTYPE; +struct PLUG_INITSTRUCT { + int pluginHandle; + int sdkVersion; + int pluginVersion; + char pluginName[256]; +}; + +int pluginHandle; +HANDLE hPipe = INVALID_HANDLE_VALUE; + +struct __attribute__((packed)) WineIpcPayload { + unsigned __int64 rip; + unsigned int eflags; + unsigned int buffer_len; + unsigned char bytes[15]; +}; + +void AttemptPipeConnection() { + // Wine intercepts named pipe routing and maps them + // to Unix sockets automatically on Linux. + hPipe = CreateFileA( + "\\\\.\\pipe\\stave_bridge_ipc", + GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL + ); +} + +extern "C" __declspec(dllexport) bool pluginit(PLUG_INITSTRUCT* initStruct) { + initStruct->pluginVersion = 7; + initStruct->sdkVersion = PLUG_SDKVERSION; + strcpy(initStruct->pluginName, "StaveCoreWineBridge"); + pluginHandle = initStruct->pluginHandle; + AttemptPipeConnection(); + return true; +} + +extern "C" __declspec(dllexport) void plugstop() { + if (hPipe != INVALID_HANDLE_VALUE) { + CloseHandle(hPipe); + hPipe = INVALID_HANDLE_VALUE; + } +} + +// Triggered automatically on every breakpoint step execution event. +extern "C" __declspec(dllexport) void CBSTEPPED(CBTYPE cbType, void* info) { + if (hPipe == INVALID_HANDLE_VALUE) { + AttemptPipeConnection(); + if (hPipe == INVALID_HANDLE_VALUE) return; + } + + CONTEXT context; + context.ContextFlags = CONTEXT_CONTROL | CONTEXT_INTEGER; + HANDLE currentThread = GetCurrentThread(); + + if (GetThreadContext(currentThread, &context)) { + WineIpcPayload payload; + payload.rip = context.Rip; + payload.eflags = context.EFlags; + payload.buffer_len = 15; + memset(payload.bytes, 0, 15); + + SIZE_T bytesRead = 0; + ReadProcessMemory( + GetCurrentProcess(), + (LPCVOID)context.Rip, + payload.bytes, 15, &bytesRead + ); + if (bytesRead > 0) { + payload.buffer_len = (unsigned int)bytesRead; + DWORD bytesWritten; + WriteFile(hPipe, &payload, sizeof(payload), &bytesWritten, NULL); + } + } +} \ No newline at end of file diff --git a/build.sh b/build.sh new file mode 100755 index 0000000..f2bb2c2 --- /dev/null +++ b/build.sh @@ -0,0 +1,63 @@ +#!/usr/bin/env bash +# ============================================================================ +# WARLOCK'S STAVE PRODUCTION COMPILATION PIPELINE (v7.0) +# ============================================================================ +set -euo pipefail + +log_step() { echo -e "\n [BUILD] $1"; } + +log_step "Detecting host environment..." +if [ -f /etc/arch-release ]; then + echo " Profile: Arch Linux" +elif [ -f /etc/debian_version ]; then + echo " Profile: Debian/Ubuntu" +else + echo " Profile: Unknown (proceeding anyway)" +fi + +log_step "Validating dependency tooling..." +cargo check + +log_step "Compiling core library (release)..." +cargo build --release + +log_step "Compiling embedded eBPF bytecode..." +mkdir -p ebpf_bin +if command -v clang &> /dev/null; then + cat << 'EOF' > ebpf_bin/stave_probe.c +#include +#include +SEC("tracepoint/syscalls/sys_enter_connect") +int trace_sys_connect(void *ctx) { return 0; } +char _license[] SEC("license") = "GPL"; +EOF + clang -O2 -target bpf -c ebpf_bin/stave_probe.c -o ebpf_bin/stave_probe.o + echo " eBPF binary assembled: ebpf_bin/stave_probe.o" +else + echo " Warning: clang missing. Creating stub eBPF object..." + touch ebpf_bin/stave_probe.o +fi + +if command -v x86_64-w64-mingw32-g++ &> /dev/null; then + log_step "Cross-compiling Wine plugin bridge..." + x86_64-w64-mingw32-g++ -shared -static -O3 \ + -o bridges/warlock_bridge.dp64 bridges/stave_stub.cpp -lkernel32 + echo " Plugin output: bridges/warlock_bridge.dp64" +else + echo " Info: MinGW not found. Skipping Wine plugin build." +fi + +log_step "Build complete. Warlock's Stave v7.0 is ready." + +# --------------------------------------------------------------------------- +# Optional post-build steps (do not run automatically) +# --------------------------------------------------------------------------- +TARGET_LIB="./target/release/libstave_core.so" +if [ -f "$TARGET_LIB" ]; then + echo "" + echo " Optional: To enable kernel-level eBPF tracing, run:" + echo " sudo setcap cap_net_admin,cap_perfmon+ep $TARGET_LIB" + echo "" + echo " This grants the library permission to attach eBPF probe programs." + echo " It is NOT required for FFI, JNI, IPC, or UI-only usage." +fi \ No newline at end of file diff --git a/demo.c b/demo.c new file mode 100644 index 0000000..2876b15 --- /dev/null +++ b/demo.c @@ -0,0 +1,102 @@ +/* + * Warlock's Stave — Quick FFI Demo Harness + * + * Compile: gcc -o demo demo.c -ldl -Wl,-rpath,./target/release + * Run: LD_LIBRARY_PATH=./target/release ./demo + */ + +#include +#include +#include +#include + +/* Mirrors the 4 C-FFI functions from libstave_core.so */ +typedef void* (*init_fn)(void); +typedef const char* (*ingest_fn)(void*, const unsigned char*, size_t, unsigned long, unsigned int); +typedef void (*free_str_fn)(const char*); +typedef void (*destroy_fn)(void*); + +int main(void) { + printf("=== Warlock's Stave FFI Demo ===\n\n"); + + /* --- Load the shared library --- */ + void *lib = dlopen("./target/release/libstave_core.so", RTLD_NOW); + if (!lib) { + fprintf(stderr, "dlopen failed: %s\n", dlerror()); + fprintf(stderr, "Run ./build.sh first, then use:\n"); + fprintf(stderr, " LD_LIBRARY_PATH=./target/release ./demo\n"); + return 1; + } + + init_fn init = (init_fn) dlsym(lib, "initialize_warlock_stave"); + ingest_fn ingest = (ingest_fn) dlsym(lib, "stave_ingest_frame"); + free_str_fn freestr = (free_str_fn)dlsym(lib, "free_stave_string"); + destroy_fn destroy = (destroy_fn) dlsym(lib, "destroy_warlock_stave"); + + if (!init || !ingest || !freestr || !destroy) { + fprintf(stderr, "dlsym failed: %s\n", dlerror()); + dlclose(lib); + return 1; + } + + /* --- Initialize the engine --- */ + void *ctx = init(); + printf("[Engine] Context created: %p\n\n", ctx); + + /* + * Feed a realistic x86-64 sequence. + * Each frame: (bytes, length, RIP, EFLAGS) + * + * Instructions: + * 0x7FF0: 48 31 C0 xor rax, rax + * 0x7FF3: 48 89 C3 mov rbx, rax + * 0x7FF6: 0F 84 10 00 00 00 je +0x10 (conditional — ZF=1 in EFLAGS) + * 0x7FFC: E9 05 00 00 00 jmp +0x5 (unconditional) + * 0x8001: 48 83 C4 28 add rsp, 0x28 + */ + struct { unsigned char *bytes; size_t len; unsigned long rip; unsigned int eflags; } frames[] = { + { (unsigned char[]){ 0x48, 0x31, 0xC0 }, 3, 0x7FF0, 0x202 }, /* ZF=1 */ + { (unsigned char[]){ 0x48, 0x89, 0xC3 }, 3, 0x7FF3, 0x202 }, + { (unsigned char[]){ 0x0F, 0x84, 0x10, 0x00, 0x00, 0x00 }, 6, 0x7FF6, 0x246 }, /* ZF=1, SF=1 */ + { (unsigned char[]){ 0xE9, 0x05, 0x00, 0x00, 0x00 }, 5, 0x7FFC, 0x246 }, + { (unsigned char[]){ 0x48, 0x83, 0xC4, 0x28 }, 4, 0x8001, 0x246 }, + }; + int n = sizeof(frames) / sizeof(frames[0]); + + for (int i = 0; i < n; i++) { + const char *json = ingest(ctx, frames[i].bytes, frames[i].len, + frames[i].rip, frames[i].eflags); + printf("[Frame %d] RIP=0x%04lX bytes=%zu EFLAGS=0x%X\n", + i+1, frames[i].rip, frames[i].len, frames[i].eflags); + printf(" %s\n\n", json); + freestr(json); + } + + /* --- Telemetry round-trip: hit the same cell twice --- */ + printf("[Frame 6] Re-visiting RIP=0x7FF0 (heatmap intensity should increase)...\n"); + const char *json = ingest(ctx, + (unsigned char[]){ 0x48, 0x31, 0xC0 }, 3, 0x7FF0, 0x202); + printf(" %s\n\n", json); + freestr(json); + + /* --- Conditional branch with ZF=0 (not-taken path) --- */ + printf("[Frame 7] je with ZF=0 (should report ConditionNotMet)...\n"); + json = ingest(ctx, + (unsigned char[]){ 0x0F, 0x84, 0x10, 0x00, 0x00, 0x00 }, 6, 0x7FF6, 0x242); + printf(" %s\n\n", json); + freestr(json); + + /* --- Dictionary scan: URL pattern in bytes --- */ + printf("[Frame 8] Bytes containing 'http://' (dictionary hit expected)...\n"); + json = ingest(ctx, + (unsigned char[]){ 0x68, 0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F }, 7, 0x9000, 0x246); + printf(" %s\n\n", json); + freestr(json); + + /* --- Cleanup --- */ + destroy(ctx); + dlclose(lib); + + printf("=== Done. ===\n"); + return 0; +} \ No newline at end of file diff --git a/rust-toolchain.toml b/rust-toolchain.toml new file mode 100644 index 0000000..b76aaa3 --- /dev/null +++ b/rust-toolchain.toml @@ -0,0 +1,4 @@ +[toolchain] +channel = "stable" +components = ["rustfmt", "clippy"] +targets = ["x86_64-unknown-linux-gnu"] \ No newline at end of file diff --git a/src/bin/environment_check.rs b/src/bin/environment_check.rs new file mode 100644 index 0000000..1a3774a --- /dev/null +++ b/src/bin/environment_check.rs @@ -0,0 +1,50 @@ +/// Pre-flight environment validator for Warlock's Stave (stave-core crate). +/// Checks that all required tooling and system interfaces are available. + +use std::process::Command; +use std::path::Path; + +fn main() { + println!("==============================================================================="); + println!(" WARLOCK'S STAVE: PRE-FLIGHT ENVIRONMENT VALIDATOR"); + println!("==============================================================================="); + + let mut environment_ready = true; + + match Command::new("rustc").arg("--version").output() { + Ok(out) => println!(" [OK] Rust Compiler: {}", + String::from_utf8_lossy(&out.stdout).trim()), + Err(_) => { + println!(" [FAIL] 'rustc' not found."); + environment_ready = false; + } + } + + match Command::new("clang").arg("--version").output() { + Ok(_) => println!(" [OK] LLVM Clang verified (eBPF ready)."), + Err(_) => println!(" [WARN] 'clang' missing. eBPF layers bypassed."), + } + + match Command::new("x86_64-w64-mingw32-g++").arg("--version").output() { + Ok(_) => println!(" [OK] MinGW-w64 detected (Wine integration ready)."), + Err(_) => println!(" [WARN] MinGW missing. Windows plugin skipped."), + } + + #[cfg(target_os = "linux")] + { + if Path::new("/proc/net/unix").exists() { + println!(" [OK] Linux procfs readable (socket auditing ready)."); + } else { + println!(" [FAIL] procfs not available."); + environment_ready = false; + } + } + + println!("-------------------------------------------------------------------------------"); + if environment_ready { + println!(" RESULT: Environment validated. Ready to build."); + } else { + println!(" RESULT: Critical gaps detected. Resolve errors before building."); + std::process::exit(1); + } +} \ No newline at end of file diff --git a/src/bin/gui_demo.rs b/src/bin/gui_demo.rs new file mode 100644 index 0000000..ea1d539 --- /dev/null +++ b/src/bin/gui_demo.rs @@ -0,0 +1,342 @@ +/// Warlock's Stave — egui GUI Demo +/// +/// Auto-steps through a realistic x86-64 instruction stream, feeding each +/// frame through the core analysis pipeline (branch prediction, dictionary +/// scanning, heatmap accumulation) and rendering the results on the 4-quarter +/// hex grid workspace. +/// +/// Run: cargo run --bin gui_demo +/// +/// Controls: +/// Space — toggle auto-step +/// Right — single step forward +/// R — reset demo state +/// Esc / Q — quit + +use eframe::egui::{self, Color32, RichText}; +use stave_core::stave_ui::{ + AxialCoordinate, VisualCellMetrics, WarlockAppWorkspace, +}; +use stave_core::{BranchEvaluator, DictionaryRule, MemoryScanner}; + +// --------------------------------------------------------------------------- +// Instruction stream: realistic x86-64 bytes with hex + ASM labels +// --------------------------------------------------------------------------- +const STREAM: &[(&[u8], &str, &str)] = &[ + (&[0x48, 0x31, 0xC0], "48 31 C0 ", "xor rax, rax"), + (&[0x48, 0x89, 0xC3], "48 89 C3 ", "mov rbx, rax"), + (&[0x0F, 0x84, 0x10, 0x00, 0x00, 0x00], "0F 84 10 00 00 00 ", "je +0x10"), + (&[0xE9, 0x05, 0x00, 0x00, 0x00], "E9 05 00 00 00 ", "jmp +0x05"), + (&[0x48, 0x83, 0xC4, 0x28], "48 83 C4 28 ", "add rsp, 0x28"), + (&[0x48, 0x8D, 0x05, 0x00, 0x00, 0x00, 0x00], "48 8D 05 00 00 00 00 ", "lea rax, [rip]"), + (&[0x0F, 0x85, 0x20, 0x00, 0x00, 0x00], "0F 85 20 00 00 00 ", "jne +0x20"), + (&[0x48, 0x31, 0xFF], "48 31 FF ", "xor rdi, rdi"), + // This one contains "http://" — dictionary scanner will flag it + (&[0x68, 0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F], "68 74 74 70 3A 2F 2F ", "push 0x2F2F7074_7474_7868"), + (&[0xC3], "C3 ", "ret"), + // Loop back: second pass re-visits cells (heatmap intensity increases) + (&[0x48, 0x31, 0xC0], "48 31 C0 ", "xor rax, rax"), + (&[0x0F, 0x84, 0x10, 0x00, 0x00, 0x00], "0F 84 10 00 00 00 ", "je +0x10"), + (&[0x48, 0x89, 0xE5], "48 89 E5 ", "mov rbp, rsp"), + (&[0x48, 0x83, 0xEC, 0x20], "48 83 EC 20 ", "sub rsp, 0x20"), + (&[0xE8, 0x00, 0x00, 0x00, 0x00], "E8 00 00 00 00 ", "call +0x00"), +]; + +/// Hex positions for each instruction — laid out in a visible cluster. +/// When the stream loops, cells get revisited and their intensity grows. +const HEX_POS: &[(i32, i32)] = &[ + ( 0, 0), ( 1, 0), ( 2, 0), ( 3, 0), ( 2, -1), + ( 1, -1), ( 0, -1), (-1, -1), (-1, 0), ( 0, 1), + // Second pass — overlaps first pass cells + ( 0, 0), ( 2, 0), ( 1, 1), ( 2, 1), ( 3, 1), +]; + +const COLOR_NEON: Color32 = Color32::from_rgb(0, 230, 180); +const COLOR_ACCENT: Color32 = Color32::from_rgb(0, 150, 255); +const COLOR_DIM: Color32 = Color32::from_rgb(120, 120, 130); +const COLOR_BG: Color32 = Color32::from_rgb(10, 10, 12); + +// --------------------------------------------------------------------------- +// Demo application state +// --------------------------------------------------------------------------- +struct GuiDemo { + workspace: WarlockAppWorkspace, + step_index: usize, + auto_step: bool, + interval_ms: u64, + last_step: std::time::Instant, + total_steps: u64, + branch_log: Vec<(u64, String, String)>, + dict_log: Vec<(u64, String)>, +} + +impl GuiDemo { + fn new(_cc: &eframe::CreationContext<'_>) -> Self { + let mut ws = WarlockAppWorkspace::new(); + // Clear seed data — we'll populate from the instruction stream + ws.cell_database.clear(); + ws.register_states.clear(); + ws.disassembly_buffer.clear(); + + Self { + workspace: ws, + step_index: 0, + auto_step: true, + interval_ms: 350, + last_step: std::time::Instant::now(), + total_steps: 0, + branch_log: Vec::new(), + dict_log: Vec::new(), + } + } + + /// Feed one instruction through the analysis pipeline. + fn do_step(&mut self) { + let idx = self.step_index % STREAM.len(); + let (bytes, hex, asm) = STREAM[idx]; + let rip = 0x7FF0 + idx as u64 * 16; + // Alternate EFLAGS to exercise conditional / not-taken paths + let eflags: u32 = match idx % 4 { + 0 => 0x202, // ZF=1 + 1 => 0x246, // ZF=1, SF=1 + 2 => 0x282, // ZF=0 (je won't be taken) + _ => 0x242, // ZF=1, SF=1 + }; + + // --- Branch evaluation --- + let branch = BranchEvaluator::evaluate_execution_flow(bytes, rip, eflags); + let branch_str = format!("{:?}", branch); + + // --- Dictionary scan --- + let dict_hits = MemoryScanner::scan_buffer( + bytes, + &DictionaryRule::get_default_hunting_library(), + ); + + // --- Update heatmap cell --- + let pos = HEX_POS[idx]; + let coord = AxialCoordinate { q: pos.0, r: pos.1 }; + let entry = self + .workspace + .cell_database + .entry(coord) + .or_insert(VisualCellMetrics { + total_hits: 0, + is_breakpoint: asm.starts_with("je") || asm.starts_with("jne"), + address_reference: rip, + }); + entry.total_hits += 1; + + // --- Disassembly buffer --- + self.workspace + .disassembly_buffer + .push((rip, hex.to_string(), asm.to_string())); + if self.workspace.disassembly_buffer.len() > 60 { + self.workspace.disassembly_buffer.remove(0); + } + + // --- Register states (simulated) --- + let rip_val = rip + bytes.len() as u64; + let rax_val = match asm { + "xor rax, rax" => 0, + _ => 0xDEAD_0000_0000_0000 + self.total_steps as u64, + }; + let rsp_val = 0x7FFF_FFFF_E000 - self.total_steps as u64 * 0x28; + + self.workspace + .register_states + .insert("RIP".to_string(), (rip_val, true)); + self.workspace + .register_states + .insert("RAX".to_string(), (rax_val, asm.contains("rax"))); + self.workspace + .register_states + .insert("RBX".to_string(), (0x0000_7FFF_E000, asm.contains("rbx"))); + self.workspace + .register_states + .insert("RSP".to_string(), (rsp_val, asm.contains("rsp"))); + self.workspace + .register_states + .insert("RDI".to_string(), (0, asm.contains("rdi"))); + self.workspace + .register_states + .insert("RBP".to_string(), (rsp_val, asm.contains("rbp"))); + self.workspace + .register_states + .insert("EFLAGS".to_string(), (eflags as u64, true)); + + // --- Logging --- + if !branch_str.contains("NonControlFlow") { + self.branch_log + .push((rip, asm.to_string(), branch_str)); + if self.branch_log.len() > 30 { + self.branch_log.remove(0); + } + } + for dm in &dict_hits { + self.dict_log + .push((rip, format!("[{}] {}", dm.label, asm))); + if self.dict_log.len() > 20 { + self.dict_log.remove(0); + } + } + + self.step_index += 1; + self.total_steps += 1; + } + + /// Render a compact control bar above the workspace. + fn render_controls(&mut self, ctx: &egui::Context) { + egui::TopBottomPanel::top("controls").show(ctx, |ui| { + ui.set_height(36.0); + ui.horizontal(|ui| { + ui.style_mut().visuals.panel_fill = COLOR_BG; + + // Play / Pause + let label = if self.auto_step { "Pause" } else { "Play" }; + if ui.button(label).clicked() { + self.auto_step = !self.auto_step; + } + + // Single step + if ui.button("Step").clicked() { + self.do_step(); + } + + // Speed slider + ui.label(RichText::new("Speed:").color(COLOR_DIM)); + ui.add(egui::Slider::new(&mut self.interval_ms, 50..=1000).suffix("ms")); + + // Reset + if ui.button("Reset").clicked() { + self.step_index = 0; + self.total_steps = 0; + self.workspace.cell_database.clear(); + self.workspace.register_states.clear(); + self.workspace.disassembly_buffer.clear(); + self.branch_log.clear(); + self.dict_log.clear(); + } + + ui.separator(); + + // Status + ui.label( + RichText::new(format!( + "Frame {} | Cells {} | Dict hits {}", + self.total_steps, + self.workspace.cell_database.len(), + self.dict_log.len(), + )) + .color(COLOR_NEON), + ); + }); + }); + } + + /// Render the live log panel below the workspace. + fn render_log_panel(&self, ctx: &egui::Context) { + egui::TopBottomPanel::bottom("log").show(ctx, |ui| { + ui.set_height(100.0); + ui.style_mut().visuals.panel_fill = COLOR_BG; + ui.vertical(|ui| { + ui.horizontal(|ui| { + ui.label( + RichText::new("BRANCH EVALUATOR LOG") + .strong() + .color(COLOR_ACCENT), + ); + ui.separator(); + ui.label( + RichText::new("DICTIONARY SCANNER LOG") + .strong() + .color(Color32::from_rgb(255, 200, 50)), + ); + }); + egui::ScrollArea::vertical() + .max_height(72.0) + .show(ui, |ui| { + ui.horizontal(|ui| { + // Branch log (left half) + ui.vertical(|ui| { + for (rip, asm, outcome) in &self.branch_log { + ui.monospace( + RichText::new(format!( + " {:#010X} {} -> {}", + rip, asm, outcome + )) + .color(Color32::from_rgb(180, 220, 255)), + ); + } + }); + ui.separator(); + // Dict log (right half) + ui.vertical(|ui| { + for (rip, msg) in &self.dict_log { + ui.monospace( + RichText::new(format!( + " {:#010X} {}", + rip, msg + )) + .color(Color32::from_rgb(255, 220, 100)), + ); + } + }); + }); + }); + }); + }); + } +} + +impl eframe::App for GuiDemo { + fn update(&mut self, ctx: &egui::Context, _frame: &mut eframe::Frame) { + // Auto-step timer + if self.auto_step { + if self.last_step.elapsed().as_millis() as u64 >= self.interval_ms { + self.do_step(); + self.last_step = std::time::Instant::now(); + } + ctx.request_repaint_after(std::time::Duration::from_millis(50)); + } + + // Keyboard shortcuts + ctx.input(|i| { + if i.key_pressed(egui::Key::Space) { + self.auto_step = !self.auto_step; + } + if i.key_pressed(egui::Key::ArrowRight) { + self.do_step(); + } + if i.key_pressed(egui::Key::R) { + self.step_index = 0; + self.total_steps = 0; + self.workspace.cell_database.clear(); + self.workspace.register_states.clear(); + self.workspace.disassembly_buffer.clear(); + self.branch_log.clear(); + self.dict_log.clear(); + } + }); + + // Render: controls (top) → workspace (center) → log (bottom) + self.render_controls(ctx); + self.workspace.update_workspace_layout(ctx); + self.render_log_panel(ctx); + } +} + +fn main() -> eframe::Result<()> { + let options = eframe::NativeOptions { + viewport: egui::ViewportBuilder::default() + .with_title("Warlock's Stave — GUI Demo") + .with_inner_size([1280.0, 860.0]) + .with_min_inner_size([800.0, 500.0]), + ..Default::default() + }; + eframe::run_native( + "Warlock's Stave", + options, + Box::new(|cc| Box::new(GuiDemo::new(cc))), + ) +} \ No newline at end of file diff --git a/src/bin/simulate_evasion_telemetry.rs b/src/bin/simulate_evasion_telemetry.rs new file mode 100644 index 0000000..16229c0 --- /dev/null +++ b/src/bin/simulate_evasion_telemetry.rs @@ -0,0 +1,97 @@ +/// Standalone binary that simulates a polymorphic IPC evasion event +/// for verification testing. Connects to the running Stave IPC daemon +/// and sends a sequence of payloads that mimic a process shifting its +/// communication channels. +/// +/// Usage: +/// Terminal 1: cargo run --bin environment_check && ./build.sh +/// Terminal 2: cargo run --bin simulate_evasion_telemetry + +use std::io::Write; +use std::net::TcpStream; +use std::os::unix::net::UnixStream; + +fn main() { + println!("=== Warlock's Stave: Evasion Telemetry Simulator ==="); + println!("Simulating polymorphic IPC evasion pattern...\n"); + + // Stage 1: Attempt Unix socket connection (normal path) + let socket_path = "/tmp/stave_bridge_ipc.sock"; + if std::path::Path::new(socket_path).exists() { + println!("[STAGE 1] Connecting via Unix socket..."); + match UnixStream::connect(socket_path) { + Ok(mut stream) => { + send_test_payload(&mut stream, 0x7FFFFFFE0000, 0x202); + println!("[STAGE 1] Unix socket payload delivered.\n"); + } + Err(e) => { + println!("[STAGE 1] Unix socket failed: {}. Falling back to TCP.", e); + } + } + } else { + println!("[STAGE 1] Unix socket not found. Skipping to TCP."); + } + + // Stage 2: TCP fallback (containerized / evasion scenario) + println!("[STAGE 2] Connecting via TCP fallback (port 21860)..."); + match TcpStream::connect("127.0.0.1:21860") { + Ok(mut stream) => { + stream + .set_nodelay(true) + .expect("Failed to set TCP_NODELAY"); + + let test_rips = [ + 0x7FFFF7A01000u64, + 0x7FFFF7A01003, + 0x7FFFF7A01005, + 0x7FFFF7A0100A, + 0x7FFFF7A0100C, + ]; + + for (i, rip) in test_rips.iter().enumerate() { + send_test_payload(&mut stream, *rip, 0x202); + println!( + "[STAGE 2] Evasion payload {}/{} delivered (RIP: {:#018X})", + i + 1, + test_rips.len(), + rip + ); + } + + send_test_payload(&mut stream, 0x7FFFF7A01010, 0x246); + println!("[STAGE 2] Final payload with altered EFLAGS delivered."); + } + Err(e) => { + println!( + "[STAGE 2] TCP connection failed: {}", + e + ); + println!("Is the Stave daemon running? Try: ./build.sh first."); + return; + } + } + + println!("\n=== Simulation complete. ==="); + println!("Check the Stave dashboard for:"); + println!(" - Hex heatmap updates at the delivered RIP coordinates"); + println!(" - Branch evaluation results in the telemetry output"); + println!(" - Dictionary scanner hits for embedded patterns"); +} + +/// Constructs and sends a payload matching the WineIpcPayload layout. +/// Layout: u64 rip (8) + u32 eflags (4) + u32 buf_len (4) + u8[15] = 31 bytes +fn send_test_payload( + stream: &mut W, + rip: u64, + eflags: u32, +) { + let mut payload = Vec::with_capacity(31); + payload.extend_from_slice(&rip.to_le_bytes()); + payload.extend_from_slice(&eflags.to_le_bytes()); + payload.extend_from_slice(&5u32.to_le_bytes()); + payload.extend_from_slice(&[0x48, 0x31, 0xC0, 0x90, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]); + stream + .write_all(&payload) + .expect("Failed to write payload"); + stream.flush().expect("Failed to flush"); +} \ No newline at end of file diff --git a/src/ebpf.rs b/src/ebpf.rs new file mode 100644 index 0000000..eaf3381 --- /dev/null +++ b/src/ebpf.rs @@ -0,0 +1,82 @@ +// ============================================================================ +// WARLOCK'S STAVE: Linux eBPF Kernel Tracing Engine +// ============================================================================ +// +// Provides kernel-level event tracing via eBPF kprobe programs. +// Requires: aya 0.11.0, clang for eBPF bytecode compilation, +// and elevated permissions (CAP_BPF or root). +// +// The live eBPF probe loader (which embeds a pre-compiled .o via +// include_bytes!) is gated behind the `ebpf` cargo feature. Without +// the feature, spawn_kernel_hooks() is a no-op on Linux. + +#[cfg(all(target_os = "linux", feature = "ebpf"))] +use aya::{Bpf, programs::KProbe, maps::perf::AsyncPerfEventArray}; +#[cfg(all(target_os = "linux", feature = "ebpf"))] +use aya::maps::perf::PerfEventArrayBuffer; +#[cfg(all(target_os = "linux", feature = "ebpf"))] +use bytes::BytesMut; + +/// Kernel-level event structure populated by eBPF probe programs. +#[repr(C)] +#[derive(Clone, Copy, Debug)] +pub struct KernelTraceEvent { + pub pid: u32, + pub vlan_id: u16, + pub network_namespace: u32, +} + +pub struct LinuxEbpfEngine; + +impl LinuxEbpfEngine { + /// Spawns eBPF kprobe on sys_enter_connect to intercept outbound + /// network connections. Requires a pre-compiled eBPF object at + /// `ebpf_bin/stave_probe.o` (built by `build.sh`). + /// + /// When the `ebpf` feature is not enabled, this is a no-op. Build + /// with `cargo build --features ebpf` to activate live kernel tracing. + #[cfg(all(target_os = "linux", feature = "ebpf"))] + pub fn spawn_kernel_hooks() -> Result<(), Box> { + let mut bpf = Bpf::load(include_bytes!("../../ebpf_bin/stave_probe.o"))?; + let program: &mut KProbe = + bpf.program_mut("sys_enter_connect").unwrap().try_into()?; + program.load()?; + program.attach("sys_connect", 0)?; + + let mut perf_array = + AsyncPerfEventArray::try_from(bpf.map_mut("STAVE_EVENTS").unwrap())?; + std::thread::spawn(move || { + let runtime = tokio::runtime::Runtime::new().unwrap(); + runtime.block_on(async { + let mut buffers = vec![BytesMut::with_capacity(1024); 4]; + loop { + if let Ok(events) = perf_array.read_events(&mut buffers).await { + for i in 0..events.read { + let event = unsafe { + *(buffers[i].as_ptr() as *const KernelTraceEvent) + }; + println!( + "[KERNEL ALERT] Intercepted Outbound Connect! \ + PID: {} | NS: {}", + event.pid, event.network_namespace + ); + } + } + } + }); + }); + Ok(()) + } + + /// No-op when the `ebpf` feature is disabled (default). + #[cfg(all(target_os = "linux", not(feature = "ebpf")))] + pub fn spawn_kernel_hooks() -> Result<(), Box> { + Ok(()) + } + + /// No-op on non-Linux platforms. + #[cfg(not(target_os = "linux"))] + pub fn spawn_kernel_hooks() -> Result<(), Box> { + Ok(()) + } +} \ No newline at end of file diff --git a/src/firmware.rs b/src/firmware.rs new file mode 100644 index 0000000..79e3d0e --- /dev/null +++ b/src/firmware.rs @@ -0,0 +1,99 @@ +// ============================================================================ +// WARLOCK'S STAVE: Firmware & Hardware Analysis +// ============================================================================ +// +// Analyzes UEFI NVRAM variables and ACPI table entries for stealth +// persistence mechanisms that survive OS-level analysis. + +use std::path::Path; + +use crate::polymorphic_ipc::{AdvancedTelemetryEvent, TelemetryEventCategory}; + +/// Analyzes UEFI NVRAM variables and firmware-level indicators +/// for stealth persistence mechanisms. +pub struct HardwareFirmwareAnalyzer; + +impl HardwareFirmwareAnalyzer { + /// Audits Linux efivarfs for UEFI NVRAM variables that do not + /// belong to known firmware or OS vendors. + pub fn audit_uefi_nvram() -> Vec { + let mut events = Vec::new(); + let nvram_path = Path::new("/sys/firmware/efi/efivars"); + if !nvram_path.exists() { + return events; // Not UEFI or not Linux + } + + // Known vendor GUID prefixes (simplified) + let known_vendors = [ + "8be4df61", // Microsoft Corporation + "721c8b66", // Firmware vendor + "a1f02e8c", // Linux Foundation + "605dab50", // Intel Corporation + ]; + + if let Ok(entries) = std::fs::read_dir(nvram_path) { + for entry in entries.flatten() { + let name = entry.file_name().to_string_lossy().to_string(); + let is_known = known_vendors + .iter() + .any(|vendor| name.contains(vendor)); + if !is_known { + events.push(AdvancedTelemetryEvent { + category: TelemetryEventCategory::FirmwareAnomaly, + message: format!( + "Unauthorized NVRAM variable: {}", + name + ), + pid: 0, + severity: 3, + }); + } + } + } + events + } + + /// Checks for firmware-level sideloading signals by examining + /// ACPI table entries exported via sysfs. Detects custom ACPI + /// tables that could be used for bootkit persistence. + pub fn detect_stealth_sideload_signals() -> Vec { + let mut events = Vec::new(); + let acpi_path = Path::new("/sys/firmware/acpi/tables"); + if !acpi_path.exists() { + return events; + } + + // Standard ACPI tables + let standard_tables = [ + "DSDT", "FACP", "APIC", "SSDT", "MCFG", "HPET", + ]; + let mut found_tables = Vec::new(); + + if let Ok(entries) = std::fs::read_dir(acpi_path) { + for entry in entries.flatten() { + let name = entry + .file_name() + .to_string_lossy() + .to_string(); + let is_standard = standard_tables + .iter() + .any(|&t| name.starts_with(t)); + if !is_standard && !name.starts_with('.') { + found_tables.push(name); + } + } + } + + for table in &found_tables { + events.push(AdvancedTelemetryEvent { + category: TelemetryEventCategory::FirmwareAnomaly, + message: format!( + "Non-standard ACPI table detected: {}", table + ), + pid: 0, + severity: 2, + }); + } + events + } +} \ No newline at end of file diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..b5c46c4 --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,1577 @@ +// ============================================================================ +// WARLOCK'S STAVE: PRODUCTION CORE IMPLEMENTATION (v7.0) +// ============================================================================ +// +// This is the monolithic core library for Warlock's Stave. +// Submodules are split into separate files and declared below. +// +// Architecture: stateless FFI/JNI boundary -> Arc> +// Design: Unix Philosophy — engine is permanent, UI is disposable. + +use std::collections::{HashMap, HashSet}; +use std::path::Path; +use std::os::raw::c_char; +use std::ffi::{CString, CStr}; +use std::net::TcpListener; +use std::io::Read; +use std::sync::{Arc, Mutex}; + +// Submodule declarations — each file is an independent module. +pub mod ebpf; +pub mod windows_etw; +pub mod polymorphic_ipc; +pub mod firmware; +pub mod stave_ui; + +use iced_x86::{Decoder, DecoderOptions, Instruction, Mnemonic}; +use jni::JNIEnv; +use jni::objects::{JClass, JObject}; +use jni::sys::{jlong, jint, jstring}; +use async_trait::async_trait; + +// Re-export types needed by other modules and the UI layer. +pub use ebpf::{KernelTraceEvent, LinuxEbpfEngine}; +pub use windows_etw::WindowsEtwEngine; +pub use polymorphic_ipc::*; +pub use firmware::HardwareFirmwareAnalyzer; + +// --------------------------------------------------------------------------- +// Global Constants +// --------------------------------------------------------------------------- + +/// Square root of 3, pre-computed to f64 precision. Used by the hexagonal +/// pixel-raycaster to avoid calling .sqrt() on every frame tick. +pub const SQRT_3: f64 = 1.7320508075688772; + +/// Static FFI error string allocated in the data segment. Returned on +/// error paths to prevent host memory leaks when C++ or Java callers +/// forget to invoke the cleanup handler on error branches. +const STATIC_FFI_ERROR: &str = + "{\"status\":\"ERROR\",\"message\":\"Invalid null parameters passed to core\"}\0"; + + +// ============================================================================ +// VECTOR HEX TIMELINE & PIXEL-RAYCASTER +// ============================================================================ + +#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)] +pub struct HexCoordinate { + pub q: i32, + pub r: i32, +} + +pub struct FractionalHex { + pub q: f64, + pub r: f64, + pub s: f64, +} + +/// Semantic markers attached to hex cells to classify execution activity. +/// Used for timeline filtering via Alt+L/B/D/N. +#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)] +pub enum TimelineSemanticMarker { + InsideLoop, + BreakpointHit, + ModuleLoaded, + BulkDiskRead, + BulkNetworkStream, +} + +/// Comprehensive cell state for a single hexagonal grid cell. +pub struct HexCellState { + pub coordinate: HexCoordinate, + pub associated_ticks: Vec, + pub total_disk_bytes: u64, + pub total_mem_bytes: u64, + pub total_net_bytes: u64, + pub has_breakpoint: bool, + pub markers: HashSet, +} + +/// Central analysis engine. Thread-safe via Arc> wrapping. +/// Owns the heatmap grid, dictionary scanner, and signature database. +pub struct HexHeatmapEngine { + pub cell_matrix: HashMap, + pub max_intensity_found: u64, + pub hunting_dictionary: Vec, + pub signature_db: SignatureDatabaseEngine, + pub active_filter_mask: u8, +} + +impl HexHeatmapEngine { + pub fn new() -> Self { + let engine = Self { + cell_matrix: HashMap::new(), + max_intensity_found: 0, + hunting_dictionary: DictionaryRule::get_default_hunting_library(), + signature_db: { + let mut db = SignatureDatabaseEngine::new(); + db.load_default_heuristics(); + db + }, + active_filter_mask: 0x00, + }; + engine + } + + /// Converts absolute mouse screen pixels to axial hex coordinates. + /// Uses f64 for perfect floating-point coordinate stability. + pub fn pixel_to_axial( + &self, + px: f32, + py: f32, + radius: f32, + origin_x: f32, + origin_y: f32, + ) -> HexCoordinate { + let lx = (px - origin_x) as f64; + let ly = (py - origin_y) as f64; + let r_val = radius as f64; + + let frac_q = (2.0 / 3.0 * lx) / r_val; + let frac_r = (-1.0 / 3.0 * lx + SQRT_3 / 3.0 * ly) / r_val; + let frac_s = -frac_q - frac_r; + + self.round_to_nearest_hex(FractionalHex { + q: frac_q, + r: frac_r, + s: frac_s, + }) + } + + fn round_to_nearest_hex(&self, frac: FractionalHex) -> HexCoordinate { + let mut q = frac.q.round() as i32; + let mut r = frac.r.round() as i32; + let s = frac.s.round() as i32; + + let q_diff = (q as f64 - frac.q).abs(); + let r_diff = (r as f64 - frac.r).abs(); + let s_diff = (s as f64 - frac.s).abs(); + + if q_diff > r_diff && q_diff > s_diff { + q = -r - s; + } else if r_diff > s_diff { + r = -q - s; + } + + HexCoordinate { q, r } + } + + /// Determines if an execution cell should paint based on dashboard + /// filtering toggles (Alt+L / Alt+B / Alt+D / Alt+N). + pub fn is_cell_visible(&self, cell: &HexCellState) -> bool { + if (self.active_filter_mask & 0b0000_0001) != 0 + && !cell.markers.contains(&TimelineSemanticMarker::InsideLoop) + { + return false; + } + if (self.active_filter_mask & 0b0000_0010) != 0 + && !cell.markers.contains(&TimelineSemanticMarker::BreakpointHit) + { + return false; + } + if (self.active_filter_mask & 0b0000_0100) != 0 + && !cell.markers.contains(&TimelineSemanticMarker::BulkDiskRead) + { + return false; + } + if (self.active_filter_mask & 0b0000_1000) != 0 + && !cell.markers.contains(&TimelineSemanticMarker::BulkNetworkStream) + { + return false; + } + true + } +} + + +// ============================================================================ +// PREDICTIVE BRANCH EVALUATOR ENGINE +// ============================================================================ + +/// Standalone, zero-allocation processing pipeline driven by iced-x86. +/// Decodes the current opcode segment and checks processor conditional +/// registers to predict instruction outcomes before hardware commits. + +#[derive(Debug, Clone, Copy, PartialEq, Eq)] +pub enum BranchOutcome { + ConditionMet { target_address: u64 }, + ConditionNotMet, + Unconditional { target_address: u64 }, + NonControlFlow, +} + +pub struct BranchEvaluator; + +impl BranchEvaluator { + /// Evaluates execution flow for the instruction at `rip` with + /// the given `eflags`. Enforces strict 15-byte decoder bounds + /// to prevent reading unmapped memory pages. + pub fn evaluate_execution_flow( + bytes: &[u8], + rip: u64, + eflags: u32, + ) -> BranchOutcome { + let max_safe_length = std::cmp::min(bytes.len(), 15); + if max_safe_length == 0 { + return BranchOutcome::NonControlFlow; + } + let safe_decoding_slice = &bytes[0..max_safe_length]; + + let mut decoder = + Decoder::with_ip(64, safe_decoding_slice, rip, DecoderOptions::NONE); + let mut instruction = Instruction::default(); + decoder.decode_out(&mut instruction); + + if instruction.is_invalid() { + return BranchOutcome::NonControlFlow; + } + + let zf = (eflags & (1 << 6)) != 0; + let sf = (eflags & (1 << 7)) != 0; + let of = (eflags & (1 << 11)) != 0; + + match instruction.mnemonic() { + Mnemonic::Jmp | Mnemonic::Call => BranchOutcome::Unconditional { + target_address: instruction.near_branch_target(), + }, + Mnemonic::Je => { + if zf { + BranchOutcome::ConditionMet { + target_address: instruction.near_branch_target(), + } + } else { + BranchOutcome::ConditionNotMet + } + } + Mnemonic::Jne => { + if !zf { + BranchOutcome::ConditionMet { + target_address: instruction.near_branch_target(), + } + } else { + BranchOutcome::ConditionNotMet + } + } + Mnemonic::Jg => { + if !zf && (sf == of) { + BranchOutcome::ConditionMet { + target_address: instruction.near_branch_target(), + } + } else { + BranchOutcome::ConditionNotMet + } + } + Mnemonic::Jl => { + if sf != of { + BranchOutcome::ConditionMet { + target_address: instruction.near_branch_target(), + } + } else { + BranchOutcome::ConditionNotMet + } + } + _ => BranchOutcome::NonControlFlow, + } + } +} + + +// ============================================================================ +// DICTIONARY SCANNER & SIGNATURE DATABASE +// ============================================================================ + +/// A hunting rule for real-time binary pattern matching. +/// NOTE: Does not derive Copy — contains heap-allocated Strings. +pub struct DictionaryRule { + pub label: String, + pub pattern: Vec, + pub description: String, +} + +#[derive(Debug, Clone)] +pub struct DictionaryMatch { + pub label: String, + pub start_offset: usize, + pub length: usize, +} + +impl DictionaryRule { + /// Returns the default threat-hunting library containing common + /// indicators: outbound URLs, anti-debugging signatures, encoding + /// alphabets, and embedded executable headers. + pub fn get_default_hunting_library() -> Vec { + vec![ + DictionaryRule { + label: "NET_URI_HTTP".to_string(), + pattern: b"http://".to_vec(), + description: "Outbound HTTP Connection String".to_string(), + }, + DictionaryRule { + label: "NET_URI_HTTPS".to_string(), + pattern: b"https://".to_vec(), + description: "Encrypted HTTPS Connection String".to_string(), + }, + DictionaryRule { + label: "ANTI_DBG_PRESENT".to_string(), + pattern: b"IsDebuggerPresent".to_vec(), + description: "Anti-Debug Presence Check API".to_string(), + }, + DictionaryRule { + label: "ANTI_DBG_PTRACE".to_string(), + pattern: b"ptrace".to_vec(), + description: "Process Trace Request (Linux)".to_string(), + }, + DictionaryRule { + label: "CRYPTO_BASE64".to_string(), + pattern: b"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".to_vec(), + description: "Base64 Encoding Alphabet Matrix".to_string(), + }, + DictionaryRule { + label: "PE_MAGIC_HEADER".to_string(), + pattern: b"MZ".to_vec(), + description: "Embedded Portable Executable Header".to_string(), + }, + ] + } +} + +/// Linear scanner that searches target memory buffers against +/// the active dictionary rule set. +pub struct MemoryScanner; + +impl MemoryScanner { + pub fn scan_buffer( + buffer: &[u8], + dictionary: &[DictionaryRule], + ) -> Vec { + let mut matches = Vec::new(); + for rule in dictionary { + let p_len = rule.pattern.len(); + if p_len == 0 || p_len > buffer.len() { + continue; + } + for i in 0..=(buffer.len() - p_len) { + if &buffer[i..(i + p_len)] == rule.pattern.as_slice() { + matches.push(DictionaryMatch { + label: rule.label.clone(), + start_offset: i, + length: p_len, + }); + } + } + } + matches + } +} + +/// External signature rule for loading from YARA-compatible rule files, +/// ClamAV-compatible signature databases, or custom byte-sequence definitions. +#[derive(Debug, Clone)] +pub struct SignatureRule { + pub rule_id: String, + pub engine_source: String, + pub pattern: Vec, + pub description: String, + pub severity: u8, // 0=info, 1=low, 2=medium, 3=high, 4=critical +} + +/// Pluggable signature database engine supporting multiple backends. +/// Performs multi-pass buffer evaluation against all registered rules. +pub struct SignatureDatabaseEngine { + pub active_rules_count: u32, + rules: Vec, +} + +impl SignatureDatabaseEngine { + pub fn new() -> Self { + Self { + active_rules_count: 0, + rules: Vec::new(), + } + } + + pub fn register_rule(&mut self, rule: SignatureRule) { + self.active_rules_count += 1; + self.rules.push(rule); + } + + /// Loads default heuristics covering common packing and + /// anti-analysis indicators. + pub fn load_default_heuristics(&mut self) { + let defaults = vec![ + SignatureRule { + rule_id: "SIG_UPX_PACKED".to_string(), + engine_source: "custom".to_string(), + pattern: b"UPX0".to_vec(), + description: "UPX-compressed binary section marker detected".to_string(), + severity: 1, + }, + SignatureRule { + rule_id: "SIG_PETITE_PACKED".to_string(), + engine_source: "custom".to_string(), + pattern: b"petite".to_vec(), + description: "Petite packer section header detected".to_string(), + severity: 1, + }, + SignatureRule { + rule_id: "SIG_VM_PROTECT".to_string(), + engine_source: "custom".to_string(), + pattern: b".vmp0".to_vec(), + description: "VMProtect virtualization section marker".to_string(), + severity: 3, + }, + SignatureRule { + rule_id: "SIG_IMPORT_DLL_INJECT".to_string(), + engine_source: "custom".to_string(), + pattern: b"LoadLibraryA".to_vec(), + description: "Dynamic library injection API import".to_string(), + severity: 2, + }, + ]; + for rule in defaults { + self.register_rule(rule); + } + } + + /// Evaluates a buffer against all registered signature rules. + /// Primary hook point for integrating external scanner backends + /// (YARA via yara-rust, ClamAV via libclamav FFI). + pub fn evaluate_buffer(&self, buffer: &[u8]) -> Vec { + let mut hits = Vec::new(); + for rule in &self.rules { + let p_len = rule.pattern.len(); + if p_len == 0 || p_len > buffer.len() { + continue; + } + for i in 0..=(buffer.len() - p_len) { + if &buffer[i..(i + p_len)] == rule.pattern.as_slice() { + hits.push(format!( + "[{}] {} (severity: {})", + rule.engine_source, rule.rule_id, rule.severity + )); + break; + } + } + } + hits + } +} + + +// ============================================================================ +// MIRROR ILLUSION STRUCTURAL DIFF ENGINE +// ============================================================================ + +/// Status of a single 16-byte grid line in the dual-pane diff viewport. +#[derive(Debug, Clone, PartialEq)] +pub enum DiffStatus { + Identical, + Modified, + Inserted, + Deleted, +} + +/// A single row in the diff grid. Represents 16 bytes of aligned +/// comparison data with per-byte status flags and section context. +#[derive(Debug, Clone)] +pub struct DiffGridLine { + pub file_a_offset: u64, + pub file_a_bytes: Vec, + pub file_b_offset: u64, + pub file_b_bytes: Vec, + pub per_byte_status: Vec, + pub section_name: String, +} + +/// Describes a binary section boundary (ELF/PE segment or section header). +/// Used to align diffs by logical structure rather than raw file offsets. +#[derive(Debug, Clone)] +pub struct BinarySectionBoundary { + pub name: String, + pub virtual_address: u64, + pub file_offset: u64, + pub size: u64, +} + +/// Quick structural diff comparing two instruction streams by +/// (address, length) pairs for the hex heatmap. +pub fn calculate_structural_diff( + baseline: &[(u64, u8)], + current: &[(u64, u8)], +) -> Vec { + let base_set: HashSet<(u64, u8)> = baseline.iter().cloned().collect(); + let curr_set: HashSet<(u64, u8)> = current.iter().cloned().collect(); + let mut diffs = Vec::new(); + + for &(addr, len) in baseline.iter() { + if curr_set.contains(&(addr, len)) { + continue; + } + let is_deleted = !current.iter().any(|(a, _)| *a == addr); + diffs.push(DiffEntry { + address: addr, + length: len, + status: if is_deleted { + DiffStatus::Deleted + } else { + DiffStatus::Modified + }, + }); + } + + for &(addr, len) in current.iter() { + if !base_set.contains(&(addr, len)) { + if !baseline.iter().any(|(a, _)| *a == addr) { + diffs.push(DiffEntry { + address: addr, + length: len, + status: DiffStatus::Inserted, + }); + } + } + } + + diffs.sort_by_key(|d| d.address); + diffs +} + +/// Lightweight diff entry for heatmap integration. +#[derive(Debug, Clone)] +pub struct DiffEntry { + pub address: u64, + pub length: u8, + pub status: DiffStatus, +} + +/// Full section-aware binary diff that aligns two files by their +/// ELF/PE section boundaries rather than raw byte offsets. +pub fn calculate_section_aware_diff( + data_a: &[u8], + data_b: &[u8], + sections_a: &[BinarySectionBoundary], + sections_b: &[BinarySectionBoundary], +) -> Vec { + let mut grid_lines = Vec::new(); + + for sec_a in sections_a { + let sec_b = match sections_b.iter().find(|s| s.name == sec_a.name) { + Some(s) => s, + None => continue, + }; + + let compare_length = sec_a.size.min(sec_b.size) as usize; + let start_a = sec_a.file_offset as usize; + let start_b = sec_b.file_offset as usize; + + let safe_len = compare_length + .min(data_a.len().saturating_sub(start_a)) + .min(data_b.len().saturating_sub(start_b)); + + let mut offset = 0; + while offset + 16 <= safe_len { + let chunk_a = &data_a[start_a + offset..start_a + offset + 16]; + let chunk_b = &data_b[start_b + offset..start_b + offset + 16]; + + let mut per_byte = Vec::with_capacity(16); + let mut has_any_diff = false; + for i in 0..16 { + if chunk_a[i] != chunk_b[i] { + per_byte.push(DiffStatus::Modified); + has_any_diff = true; + } else { + per_byte.push(DiffStatus::Identical); + } + } + + if has_any_diff { + grid_lines.push(DiffGridLine { + file_a_offset: sec_a.file_offset + offset as u64, + file_a_bytes: chunk_a.to_vec(), + file_b_offset: sec_b.file_offset + offset as u64, + file_b_bytes: chunk_b.to_vec(), + per_byte_status: per_byte, + section_name: sec_a.name.clone(), + }); + } + + offset += 16; + } + } + + grid_lines +} + + +// ============================================================================ +// TRI-TIER SCOPE ENGINE +// ============================================================================ + +/// Three concurrent analytical layers that classify the context of each +/// execution frame: Global (cross-references), Local (function block), +/// and Micro (individual instruction side-effects). + +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum ScopeTier { + /// Global: maps cross-references, export footprints, and entropy strips. + Global, + /// Local: isolates analysis to the active function block. + /// NOTE: Contains a String, so this enum cannot be Copy. + Local { function_name: String, start_rip: u64 }, + /// Micro: monitors individual instruction side-effects. + Micro, +} + +/// Predicted implicit register and memory modifications for an instruction. +#[derive(Debug, Clone)] +pub struct MicroSideEffect { + pub implicit_write_registers: Vec, + pub implicit_memory_writes: Vec, + pub flags_affected: bool, +} + +/// The scope engine that determines the current analytical context +/// based on the instruction pointer and control flow history. +pub struct ScopeEngine { + pub current_tier: ScopeTier, + pub function_boundaries: HashMap, + pub global_xref_count: usize, + pub region_entropy: f64, +} + +impl ScopeEngine { + pub fn new() -> Self { + Self { + current_tier: ScopeTier::Global, + function_boundaries: HashMap::new(), + global_xref_count: 0, + region_entropy: 0.0, + } + } + + /// Determines the active scope tier based on the current RIP. + pub fn update_scope_for_rip(&mut self, rip: u64) { + for (name, (start, end)) in &self.function_boundaries { + if rip >= *start && rip < *end { + self.current_tier = ScopeTier::Local { + function_name: name.clone(), + start_rip: *start, + }; + return; + } + } + self.current_tier = ScopeTier::Global; + } + + /// Registers a function boundary for local scope tracking. + pub fn register_function(&mut self, name: String, start: u64, end: u64) { + self.function_boundaries.insert(name, (start, end)); + } + + /// Analyzes the decoded instruction to predict which registers + /// and memory locations will be implicitly modified. + pub fn predict_side_effects( + &self, + bytes: &[u8], + rip: u64, + ) -> MicroSideEffect { + let max_safe = std::cmp::min(bytes.len(), 15); + if max_safe == 0 { + return MicroSideEffect { + implicit_write_registers: Vec::new(), + implicit_memory_writes: Vec::new(), + flags_affected: false, + }; + } + + let mut decoder = + Decoder::with_ip(64, &bytes[0..max_safe], rip, DecoderOptions::NONE); + let mut instruction = Instruction::default(); + decoder.decode_out(&mut instruction); + + if instruction.is_invalid() { + return MicroSideEffect { + implicit_write_registers: Vec::new(), + implicit_memory_writes: Vec::new(), + flags_affected: false, + }; + } + + let mut written_regs = Vec::new(); + let mut mem_writes = Vec::new(); + let mut flags = false; + + let mut info_factory = iced_x86::InstructionInfoFactory::new(); + let info = info_factory.info(&instruction); + + for i in 0..instruction.op_count() { + let access = info.op_access(i); + match instruction.op_kind(i) { + iced_x86::OpKind::Register => { + let reg = instruction.op_register(i); + if reg != iced_x86::Register::None { + let name = format!("{:?}", reg); + if instruction.mnemonic() != Mnemonic::Push + && instruction.mnemonic() != Mnemonic::Pop + { + match access { + iced_x86::OpAccess::Write + | iced_x86::OpAccess::ReadWrite => { + written_regs.push(name); + } + _ => {} + } + } + } + } + iced_x86::OpKind::Memory => { + match access { + iced_x86::OpAccess::Write + | iced_x86::OpAccess::ReadWrite => { + let disp = instruction.memory_displacement64(); + if disp != 0 { + mem_writes.push(disp as u64); + } + } + _ => {} + } + } + _ => {} + } + } + + use iced_x86::FlowControl; + match instruction.flow_control() { + FlowControl::Next | FlowControl::ConditionalBranch => { + flags = true; + } + _ => {} + } + + MicroSideEffect { + implicit_write_registers: written_regs, + implicit_memory_writes: mem_writes, + flags_affected: flags, + } + } +} + + +// ============================================================================ +// MULTIVERSE SECURITY INFRASTRUCTURE PROVIDERS +// ============================================================================ + +/// Orchestrates independent local scanners and cloud intelligence +/// infrastructure using decoupled background pipelines. + +#[derive(Debug, Clone)] +pub struct GlobalSpreadMetrics { + pub detection_count: u32, + pub total_scanners: u32, + pub velocity_flag: String, +} + +#[derive(Debug, Clone)] +pub enum ScanEngineStatus { + Clean, + Infected { threat_name: String }, + GlobalAwarenessUpdate(GlobalSpreadMetrics), + Pending, + Error(String), +} + +/// Trait for external scanner backends. Implementations can wrap +/// YARA-compatible engines, ClamAV-compatible engines, or cloud +/// hash-lookup services. +#[async_trait] +pub trait ExternalScannerProvider: Send + Sync { + fn name(&self) -> &'static str; + async fn scan_file_path(&self, path: &std::path::Path) -> ScanEngineStatus; + async fn scan_hash(&self, sha256: &str) -> ScanEngineStatus; +} + + +// ============================================================================ +// SELF-ASSEMBLING IPC TRANSMISSION FRAMEWORK +// ============================================================================ + +pub enum IpcTransport { + UnixSocket(String), + TcpNetwork(u16), +} + +/// Wire-format payload for the Wine/Windows named-pipe translation bridge. +/// Packed to match the C++ struct layout on the other side of the FFI. +#[repr(C, packed)] +#[derive(Clone, Copy)] +pub struct WineIpcPayload { + pub rip: u64, + pub eflags: u32, + pub buffer_len: u32, + pub bytes: [u8; 15], +} + +/// Dynamically assembles the most efficient IPC transport for the +/// current host environment at startup. +pub struct HybridIpcOrchestrator; + +impl HybridIpcOrchestrator { + pub fn is_containerized() -> bool { + Path::new("/.dockerenv").exists() + || Path::new("/var/run/secrets/kubernetes.io").exists() + || std::env::var("STAVE_CONTAINER_MODE").is_ok() + } + + pub fn is_waydroid_environment() -> bool { + Path::new("/dev/waydroid-binder").exists() + || std::fs::read_to_string("/proc/self/cgroup") + .map(|c| c.contains("waydroid")) + .unwrap_or(false) + } + + pub fn auto_assemble_transport() -> IpcTransport { + if Self::is_containerized() { + IpcTransport::TcpNetwork(21860) + } else { + IpcTransport::UnixSocket("/tmp/stave_bridge_ipc.sock".to_string()) + } + } + + /// Launches the IPC listener on a background thread. Uses Arc> + /// for thread-safe access to the core engine from multiple IPC clients. + pub fn launch( + core_context: Arc>, + ) -> std::io::Result<()> { + let transport = Self::auto_assemble_transport(); + std::thread::spawn(move || { + let mut struct_buffer = + vec![0u8; std::mem::size_of::()]; + match transport { + IpcTransport::UnixSocket(path) => { + if Path::new(&path).exists() { + let _ = std::fs::remove_file(&path); + } + let listener = + std::os::unix::net::UnixListener::bind(path).unwrap(); + for mut stream in listener.incoming().flatten() { + while stream.read_exact(&mut struct_buffer).is_ok() { + Self::process_buffer(&struct_buffer, &core_context); + } + } + } + IpcTransport::TcpNetwork(port) => { + let listener = + TcpListener::bind(format!("0.0.0.0:{}", port)).unwrap(); + for stream in listener.incoming().flatten() { + let _ = stream.set_nodelay(true); + let mut s = stream; + while s.read_exact(&mut struct_buffer).is_ok() { + Self::process_buffer(&struct_buffer, &core_context); + } + } + } + } + }); + Ok(()) + } + + fn process_buffer( + raw_buffer: &[u8], + context: &Arc>, + ) { + let payload = + unsafe { &*(raw_buffer.as_ptr() as *const WineIpcPayload) }; + let mut core = context.lock().unwrap(); + + let coord = HexCoordinate { + q: (payload.rip & 0xFF) as i32, + r: ((payload.rip >> 8) & 0xFF) as i32, + }; + { + let entry = core.cell_matrix.entry(coord).or_insert(HexCellState { + coordinate: coord, + associated_ticks: Vec::new(), + total_disk_bytes: 0, + total_mem_bytes: 0, + total_net_bytes: 0, + has_breakpoint: false, + markers: HashSet::new(), + }); + entry.associated_ticks.push(payload.rip); + + let hit_count = entry.associated_ticks.len() as u64; + if hit_count > core.max_intensity_found { + core.max_intensity_found = hit_count; + } + } + // Borrow on `entry` is now dropped; safe to access other fields. + + let usable_len = std::cmp::min(payload.buffer_len as usize, 15); + let instr_bytes = &payload.bytes[0..usable_len]; + + let _branch = BranchEvaluator::evaluate_execution_flow( + instr_bytes, payload.rip, payload.eflags, + ); + + let _dict_hits = + MemoryScanner::scan_buffer(instr_bytes, &core.hunting_dictionary); + + let _sig_hits = core.signature_db.evaluate_buffer(instr_bytes); + } +} + + +// ============================================================================ +// C-COMPATIBLE FFI BOUNDARY LAYER +// ============================================================================ + +/// Opaque context handle exposed to C/C++ host environments. +/// Internally wraps the thread-safe Arc> core engine. +pub struct StaveCoreContext; + +/// Initializes the Warlock's Stave engine and returns an opaque handle. +/// +/// # Safety +/// The returned pointer must be passed to `destroy_warlock_stave()` to +/// free resources. Do not double-free. +/// +/// # Example (C) +/// ```c +/// void* ctx = initialize_warlock_stave(); +/// const char* result = stave_ingest_frame(ctx, buf, len, rip, eflags); +/// free_stave_string(result); +/// destroy_warlock_stave(ctx); +/// ``` +#[no_mangle] +pub unsafe extern "C" fn initialize_warlock_stave() -> *mut StaveCoreContext { + let core = Arc::new(Mutex::new(HexHeatmapEngine::new())); + let _ = HybridIpcOrchestrator::launch(core.clone()); + Box::into_raw(Box::new(core)) as *mut StaveCoreContext +} + +/// Ingests a single execution frame from the host debugger. +/// Returns a JSON-Lines string describing branch evaluation and threat hits. +/// +/// # Safety +/// - `context` must be a valid pointer from `initialize_warlock_stave()`. +/// - `raw_buffer_ptr` must be a valid pointer to at least `buffer_length` bytes. +/// - The returned pointer must be freed with `free_stave_string()`. +#[no_mangle] +pub unsafe extern "C" fn stave_ingest_frame( + context: *mut StaveCoreContext, + raw_buffer_ptr: *const u8, + buffer_length: usize, + current_rip: u64, + eflags: u32, +) -> *mut c_char { + if context.is_null() || raw_buffer_ptr.is_null() || buffer_length == 0 { + return STATIC_FFI_ERROR.as_ptr() as *mut c_char; + } + + let core_arc = &*(context as *mut Arc>); + let mut core = core_arc.lock().unwrap(); + let memory_slice = std::slice::from_raw_parts(raw_buffer_ptr, buffer_length); + + let hex_coord = HexCoordinate { + q: (current_rip & 0xFF) as i32, + r: ((current_rip >> 8) & 0xFF) as i32, + }; + + { + let entry = core.cell_matrix.entry(hex_coord).or_insert(HexCellState { + coordinate: hex_coord, + associated_ticks: Vec::new(), + total_disk_bytes: 0, + total_mem_bytes: 0, + total_net_bytes: 0, + has_breakpoint: false, + markers: HashSet::new(), + }); + entry.associated_ticks.push(current_rip); + let hits = entry.associated_ticks.len() as u64; + if hits > core.max_intensity_found { + core.max_intensity_found = hits; + } + } + + let branch_outcome = + BranchEvaluator::evaluate_execution_flow(memory_slice, current_rip, eflags); + let local_dict_matches = + MemoryScanner::scan_buffer(memory_slice, &core.hunting_dictionary); + let signature_hits = core.signature_db.evaluate_buffer(memory_slice); + + let dict_labels: HashSet<&str> = local_dict_matches + .iter() + .map(|m| m.label.as_str()) + .collect(); + let has_network_io = dict_labels.contains("NET_URI_HTTP") + || dict_labels.contains("NET_URI_HTTPS"); + let has_disk_io = dict_labels.contains("PE_MAGIC_HEADER"); + + let payload = serde_json::json!({ + "status": "OK", + "tick": core.max_intensity_found, + "event": "STATE_SYNCHRONIZATION", + "execution_pointer": format!("{:#018X}", current_rip), + "hex_coords": { + "q": hex_coord.q, + "r": hex_coord.r + }, + "branch_evaluation": format!("{:?}", branch_outcome), + "threat_signatures": { + "dictionary_hits": local_dict_matches.len(), + "dictionary_labels": local_dict_matches.iter().map(|m| &m.label).collect::>(), + "signature_engine_hits": signature_hits + }, + "io_activity": { + "disk_bytes": if has_disk_io { buffer_length as u64 } else { 0 }, + "memory_bytes": buffer_length as u64, + "network_bytes": if has_network_io { buffer_length as u64 } else { 0 } + } + }); + + let json_string = CString::new(payload.to_string()).unwrap(); + json_string.into_raw() +} + +/// Frees a JSON string previously returned by `stave_ingest_frame`. +/// Guards against double-freeing the static error string. +/// +/// # Safety +/// `ptr` must be either null or a pointer returned by `stave_ingest_frame`. +#[no_mangle] +pub unsafe extern "C" fn free_stave_string(ptr: *mut c_char) { + if !ptr.is_null() && ptr != STATIC_FFI_ERROR.as_ptr() as *mut c_char { + let _ = CString::from_raw(ptr); + } +} + +/// Destroys the core engine context and releases all resources. +/// +/// # Safety +/// `context` must be a valid pointer from `initialize_warlock_stave()`. +/// Do not use the pointer after calling this function. +#[no_mangle] +pub unsafe extern "C" fn destroy_warlock_stave(context: *mut StaveCoreContext) { + if !context.is_null() { + let _ = Box::from_raw( + context as *mut Arc>, + ); + } +} + + +// ============================================================================ +// JAVA NATIVE INTERFACE (JNI) EXTENSION +// ============================================================================ + +/// Host integration entry point. Receives a DirectByteBuffer from the +/// JVM containing raw instruction bytes, passes them through the core +/// analysis pipeline, and returns a JSON telemetry string. +/// +/// # Safety +/// - `context_ptr` must be a valid pointer from `initializeWarlockStave()`. +/// - `byte_buffer` must be a valid direct NIO ByteBuffer. +#[no_mangle] +pub unsafe extern "system" fn Java_org_stave_WarlockStaveBridge_staveIngestGhidraFrame( + env: JNIEnv, + _class: JClass, + context_ptr: jlong, + byte_buffer: JObject, + rip: jlong, + eflags: jint, +) -> jstring { + if context_ptr == 0 || byte_buffer.is_null() { + return env + .new_string("{\"status\":\"ERROR\",\"message\":\"Null parameter in JNI link\"}") + .unwrap() + .into_raw(); + } + + let jbb: jni::objects::JByteBuffer = byte_buffer.into(); + let buffer_address = env.get_direct_buffer_address(&jbb).unwrap(); + let buffer_capacity = env.get_direct_buffer_capacity(&jbb).unwrap(); + let raw_memory_slice = + std::slice::from_raw_parts(buffer_address, buffer_capacity); + + let res_ptr = stave_ingest_frame( + context_ptr as *mut StaveCoreContext, + raw_memory_slice.as_ptr(), + raw_memory_slice.len(), + rip as u64, + eflags as u32, + ); + let cstr_result = CStr::from_ptr(res_ptr); + let output_string = env.new_string(cstr_result.to_str().unwrap()).unwrap(); + + free_stave_string(res_ptr); + output_string.into_raw() +} + + +// ============================================================================ +// CROSS-PLATFORM SYSTEM INTELLIGENCE INTERFACES +// ============================================================================ + +/// Dispatches platform-specific telemetry hooks at engine startup. +pub struct MultiplatformTelemetryHub; + +impl MultiplatformTelemetryHub { + pub fn start_native_hooks(&self) { + #[cfg(target_os = "linux")] + { + println!( + "[PLATFORM] Linux kernel environment. \ + Mounting raw eBPF context tracking frames." + ); + // NOTE: LinuxEbpfEngine::spawn_kernel_hooks() requires + // elevated permissions. Callers who need kernel tracing + // should invoke it explicitly after confirming permissions. + } + #[cfg(target_os = "windows")] + { + println!( + "[PLATFORM] Windows environment. \ + Attaching Event Tracing for Windows (ETW) hooks." + ); + unsafe { WindowsEtwEngine::spawn_windows_tap() }; + } + #[cfg(target_os = "macos")] + { + println!( + "[PLATFORM] macOS environment. \ + Endpoint Security Framework consumers reserved." + ); + } + } +} + + +// ============================================================================ +// STATE DECAY SYSTEM +// ============================================================================ + +/// Default number of frames a highlight persists before fading. +/// At 60 FPS this gives roughly 2 seconds of visible highlight. +const DEFAULT_HIGHLIGHT_TTL: u8 = 120; + +/// Tracks a single register's mutation state and its decay counter. +#[derive(Debug, Clone)] +pub struct RegisterHighlight { + pub register_name: String, + pub old_value: u64, + pub new_value: u64, + pub frames_remaining: u8, +} + +/// Tracks a single memory byte's mutation state and its decay counter. +#[derive(Debug, Clone)] +pub struct MemoryHighlight { + pub address: u64, + pub old_byte: u8, + pub new_byte: u8, + pub frames_remaining: u8, +} + +/// Manages all active highlights and drives the per-frame decay cycle. +pub struct StateDecayEngine { + pub register_highlights: HashMap, + pub memory_highlights: HashMap, + pub highlight_ttl: u8, +} + +impl StateDecayEngine { + pub fn new() -> Self { + Self { + register_highlights: HashMap::new(), + memory_highlights: HashMap::new(), + highlight_ttl: DEFAULT_HIGHLIGHT_TTL, + } + } + + pub fn mark_register_mutated( + &mut self, + name: &str, + old_val: u64, + new_val: u64, + ) { + self.register_highlights.insert( + name.to_uppercase(), + RegisterHighlight { + register_name: name.to_uppercase(), + old_value: old_val, + new_value: new_val, + frames_remaining: self.highlight_ttl, + }, + ); + } + + pub fn mark_memory_mutated( + &mut self, + address: u64, + old_byte: u8, + new_byte: u8, + ) { + self.memory_highlights.insert( + address, + MemoryHighlight { + address, + old_byte, + new_byte, + frames_remaining: self.highlight_ttl, + }, + ); + } + + /// Advances the decay clock by one frame. Returns the set of + /// register names and memory addresses that expired this tick. + pub fn tick(&mut self) -> (Vec, Vec) { + let mut expired_registers = Vec::new(); + let mut expired_memory = Vec::new(); + + self.register_highlights.retain(|name, highlight| { + highlight.frames_remaining = highlight.frames_remaining.saturating_sub(1); + if highlight.frames_remaining == 0 { + expired_registers.push(name.clone()); + false + } else { + true + } + }); + + self.memory_highlights.retain(|addr, highlight| { + highlight.frames_remaining = highlight.frames_remaining.saturating_sub(1); + if highlight.frames_remaining == 0 { + expired_memory.push(*addr); + false + } else { + true + } + }); + + (expired_registers, expired_memory) + } + + pub fn is_register_highlighted(&self, name: &str) -> bool { + self.register_highlights.contains_key(&name.to_uppercase()) + } + + pub fn is_memory_highlighted(&self, addr: u64) -> bool { + self.memory_highlights.contains_key(&addr) + } +} + + +// ============================================================================ +// SHELLCODE SENTINEL (HEAP PERMISSION TRANSITION MONITOR) +// ============================================================================ + +/// Watches runtime memory segment permissions for transitions that +/// indicate shellcode injection or JIT-spray attacks. The canonical +/// indicator is a page transitioning from writable (RW-) to executable +/// (R-X or RWX) — legitimate code does not write to executable memory +/// at runtime. + +/// Describes a tracked memory region and its observed permission state. +#[derive(Debug, Clone)] +pub struct TrackedMemoryRegion { + pub start_address: u64, + pub end_address: u64, + pub permissions: String, + pub pathname: Option, + pub transition_count: u32, + pub last_transition_kind: Option, +} + +/// The kind of permission transition that was detected. +#[derive(Debug, Clone, PartialEq, Eq)] +pub enum PermissionTransition { + WriteAddedToExecutable, + ExecuteAddedToWritable, + ExecuteRemoved, +} + +/// A shellcode sentinel alert event. +#[derive(Debug, Clone)] +pub struct ShellcodeAlert { + pub pid: u32, + pub region: TrackedMemoryRegion, + pub transition: PermissionTransition, + pub timestamp: std::time::Instant, +} + +/// The sentinel engine that monitors memory permission transitions. +pub struct ShellcodeSentinel { + previous_snapshots: HashMap>, + pub active_alerts: Vec, +} + +impl ShellcodeSentinel { + pub fn new() -> Self { + Self { + previous_snapshots: HashMap::new(), + active_alerts: Vec::new(), + } + } + + /// Parses /proc//maps into tracked memory regions. + fn parse_proc_maps(pid: u32) -> Vec { + let mut regions = Vec::new(); + let maps_path = format!("/proc/{}/maps", pid); + if let Ok(content) = std::fs::read_to_string(&maps_path) { + for line in content.lines() { + let parts: Vec<&str> = line.split_whitespace().collect(); + if parts.len() < 2 { + continue; + } + let addrs: Vec<&str> = parts[0].split('-').collect(); + if addrs.len() != 2 { + continue; + } + let start = u64::from_str_radix(addrs[0], 16).unwrap_or(0); + let end = u64::from_str_radix(addrs[1], 16).unwrap_or(0); + let pathname = if parts.len() >= 6 { + Some(parts[5..].join(" ")) + } else { + None + }; + regions.push(TrackedMemoryRegion { + start_address: start, + end_address: end, + permissions: parts[1].to_string(), + pathname, + transition_count: 0, + last_transition_kind: None, + }); + } + } + regions + } + + /// Compares two permission strings and returns the transition + /// kind if a suspicious change is detected. + fn detect_suspicious_transition( + old_perms: &str, + new_perms: &str, + ) -> Option { + let old_w = old_perms.chars().nth(1).unwrap_or('-') == 'w'; + let old_x = old_perms.chars().nth(2).unwrap_or('-') == 'x'; + let new_w = new_perms.chars().nth(1).unwrap_or('-') == 'w'; + let new_x = new_perms.chars().nth(2).unwrap_or('-') == 'x'; + + if !old_x && new_x && (new_w || old_w) { + return Some(PermissionTransition::ExecuteAddedToWritable); + } + if !old_w && new_w && (new_x || old_x) { + return Some(PermissionTransition::WriteAddedToExecutable); + } + if old_x && !new_x { + return Some(PermissionTransition::ExecuteRemoved); + } + None + } + + /// Takes a fresh snapshot of the target process's memory map, + /// compares against the previous snapshot, and fires alerts. + pub fn scan_process(&mut self, pid: u32) { + let current_regions = Self::parse_proc_maps(pid); + let previous = self + .previous_snapshots + .entry(pid) + .or_insert_with(Vec::new); + + for curr in ¤t_regions { + for prev in previous.iter_mut() { + if curr.start_address == prev.start_address + && curr.end_address == prev.end_address + { + if let Some(transition) = + Self::detect_suspicious_transition( + &prev.permissions, + &curr.permissions, + ) + { + prev.transition_count += 1; + prev.last_transition_kind = Some(transition.clone()); + prev.permissions = curr.permissions.clone(); + + self.active_alerts.push(ShellcodeAlert { + pid, + region: prev.clone(), + transition, + timestamp: std::time::Instant::now(), + }); + } else { + prev.permissions = curr.permissions.clone(); + } + break; + } + } + } + + *previous = current_regions; + } + + /// Clears alerts older than the given duration. + pub fn expire_old_alerts(&mut self, max_age: std::time::Duration) { + let now = std::time::Instant::now(); + self.active_alerts + .retain(|a| now.duration_since(a.timestamp) < max_age); + } +} + + +// ============================================================================ +// UNIT TESTS +// ============================================================================ + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn test_branch_evaluator_unconditional_jmp() { + // EB 05 = jmp rel8 +5 + let bytes = [0xEB, 0x05]; + let result = BranchEvaluator::evaluate_execution_flow(&bytes, 0x1000, 0); + assert_eq!( + result, + BranchOutcome::Unconditional { target_address: 0x1007 } + ); + } + + #[test] + fn test_branch_evaluator_conditional_je_taken() { + // 74 05 = je +5, with ZF=1 + let bytes = [0x74, 0x05]; + let result = BranchEvaluator::evaluate_execution_flow(&bytes, 0x2000, 1 << 6); + assert_eq!( + result, + BranchOutcome::ConditionMet { target_address: 0x2007 } + ); + } + + #[test] + fn test_branch_evaluator_conditional_je_not_taken() { + // 74 05 = je +5, with ZF=0 + let bytes = [0x74, 0x05]; + let result = BranchEvaluator::evaluate_execution_flow(&bytes, 0x2000, 0); + assert_eq!(result, BranchOutcome::ConditionNotMet); + } + + #[test] + fn test_branch_evaluator_non_control_flow() { + // 48 31 C0 = xor rax, rax + let bytes = [0x48, 0x31, 0xC0]; + let result = BranchEvaluator::evaluate_execution_flow(&bytes, 0x3000, 0); + assert_eq!(result, BranchOutcome::NonControlFlow); + } + + #[test] + fn test_branch_evaluator_empty_buffer() { + let result = BranchEvaluator::evaluate_execution_flow(&[], 0x4000, 0); + assert_eq!(result, BranchOutcome::NonControlFlow); + } + + #[test] + fn test_branch_evaluator_15_byte_clamp() { + // Should not panic even with a 20-byte buffer + let bytes = [0u8; 20]; + let _ = BranchEvaluator::evaluate_execution_flow(&bytes, 0x5000, 0); + } + + #[test] + fn test_dictionary_scanner_finds_http() { + let rules = DictionaryRule::get_default_hunting_library(); + let buffer = b"GET http://example.com HTTP/1.1"; + let matches = MemoryScanner::scan_buffer(buffer, &rules); + assert!(matches.iter().any(|m| m.label == "NET_URI_HTTP")); + } + + #[test] + fn test_dictionary_scanner_empty_buffer() { + let rules = DictionaryRule::get_default_hunting_library(); + let matches = MemoryScanner::scan_buffer(&[], &rules); + assert!(matches.is_empty()); + } + + #[test] + fn test_signature_db_load_and_evaluate() { + let mut db = SignatureDatabaseEngine::new(); + db.load_default_heuristics(); + assert!(db.active_rules_count > 0); + + let buffer = b"UPX0"; + let hits = db.evaluate_buffer(buffer); + assert!(hits.iter().any(|h| h.contains("SIG_UPX_PACKED"))); + } + + #[test] + fn test_structural_diff_insertion() { + let baseline = [(0x1000u64, 5u8), (0x1005u64, 3u8)]; + let current = [(0x1000u64, 5u8), (0x1005u64, 3u8), (0x2000u64, 7u8)]; + let diffs = calculate_structural_diff(&baseline, ¤t); + assert!(diffs.iter().any(|d| d.status == DiffStatus::Inserted)); + } + + #[test] + fn test_structural_diff_modification() { + let baseline = [(0x1000u64, 5u8)]; + let current = [(0x1000u64, 7u8)]; + let diffs = calculate_structural_diff(&baseline, ¤t); + assert_eq!(diffs.len(), 1); + assert_eq!(diffs[0].status, DiffStatus::Modified); + } + + #[test] + fn test_shannon_entropy_uniform() { + let buffer = [0u8; 256]; + let entropy = crate::polymorphic_ipc::calculate_shannon_entropy(&buffer); + assert_eq!(entropy, 0); + } + + #[test] + fn test_shannon_entropy_empty() { + let entropy = crate::polymorphic_ipc::calculate_shannon_entropy(&[]); + assert_eq!(entropy, 0); + } + + #[test] + fn test_state_decay_tick() { + let mut engine = StateDecayEngine::new(); + engine.mark_register_mutated("RAX", 0, 1); + assert!(engine.is_register_highlighted("rax")); + + // Decay until expired + for _ in 0..DEFAULT_HIGHLIGHT_TTL { + engine.tick(); + } + assert!(!engine.is_register_highlighted("RAX")); + } + + #[test] + fn test_scope_engine_function_boundary() { + let mut scope = ScopeEngine::new(); + scope.register_function("main".to_string(), 0x1000, 0x1100); + + scope.update_scope_for_rip(0x1050); + match scope.current_tier { + ScopeTier::Local { ref function_name, .. } => { + assert_eq!(function_name, "main"); + } + _ => panic!("Expected Local scope"), + } + + scope.update_scope_for_rip(0x2000); + assert_eq!(scope.current_tier, ScopeTier::Global); + } + + #[test] + fn test_pixel_to_axial_roundtrip() { + let engine = HexHeatmapEngine::new(); + // Center pixel should map to (0, 0) + let coord = engine.pixel_to_axial(0.0, 0.0, 18.0, 0.0, 0.0); + assert_eq!(coord.q, 0); + assert_eq!(coord.r, 0); + } +} \ No newline at end of file diff --git a/src/polymorphic_ipc.rs b/src/polymorphic_ipc.rs new file mode 100644 index 0000000..59414b5 --- /dev/null +++ b/src/polymorphic_ipc.rs @@ -0,0 +1,150 @@ +// ============================================================================ +// WARLOCK'S STAVE: Polymorphic IPC Evasion Detection +// ============================================================================ +// +// Audits processes for IPC channel switching patterns that indicate +// evasion — e.g., a process dropping its standard IPC connection and +// simultaneously creating an unnamed pipe to bypass monitoring. + +use std::collections::HashMap; +use std::sync::Mutex; +use lazy_static::lazy_static; + +use crate::firmware::HardwareFirmwareAnalyzer; + +/// Category of an evasion or anomaly event, used by the UI to +/// select display formatting and severity coloring. +#[derive(Debug, Clone)] +pub enum TelemetryEventCategory { + IpcEvasionDetected, + FirmwareAnomaly, + HiddenChannelDiscovered, + EntropySpike, + PermissionTransition, +} + +/// A single telemetry event produced by the platform auditors. +#[derive(Debug, Clone)] +pub struct AdvancedTelemetryEvent { + pub category: TelemetryEventCategory, + pub message: String, + pub pid: u32, + pub severity: u8, // 0=info .. 4=critical +} + +/// Per-process IPC behavioral tracking record. +#[derive(Debug, Clone)] +pub struct IpcBehaviorRecord { + pub pid: u32, + pub process_name: String, + pub dbus_active: bool, + pub unix_socket_count: u32, + pub unnamed_pipe_count: u32, + pub tcp_connection_count: u32, + pub fallback_violation_triggered: bool, + pub entropy_snapshots: Vec, +} + +// Global IPC state matrix. The UI reads this via `IPC_STATE_MATRIX.lock()`. +// NOTE: rustdoc does not generate documentation for items produced by macro +// invocations, so this is a regular comment rather than a doc comment. +lazy_static! { + pub static ref IPC_STATE_MATRIX: Mutex> = + Mutex::new(HashMap::new()); +} + +/// Calculates byte-distribution Shannon entropy for a buffer. +/// Returns a value in 0..=100 (scaled from bits-per-byte). +pub fn calculate_shannon_entropy(buffer: &[u8]) -> u8 { + if buffer.is_empty() { + return 0; + } + let mut freq = [0u64; 256]; + for &byte in buffer { + freq[byte as usize] += 1; + } + let len = buffer.len() as f64; + let mut entropy = 0.0f64; + for &count in &freq { + if count > 0 { + let p = count as f64 / len; + entropy -= p * p.log2(); + } + } + (entropy / 8.0 * 100.0).round().min(100.0) as u8 +} + +/// Audits /proc/self/maps for anonymous RWX memory regions +/// (indicator of shellcode injection or JIT-spray attacks). +pub fn audit_cache_abuse() -> Vec { + let mut events = Vec::new(); + if let Ok(maps) = std::fs::read_to_string("/proc/self/maps") { + for line in maps.lines() { + let parts: Vec<&str> = line.split_whitespace().collect(); + if parts.len() < 2 { + continue; + } + let perms = parts[1]; + if perms.contains('w') && perms.contains('x') { + let is_anon = parts.len() < 6; + if is_anon { + events.push(AdvancedTelemetryEvent { + category: TelemetryEventCategory::PermissionTransition, + message: format!( + "Anonymous RWX memory region: {}", + parts[0] + ), + pid: std::process::id(), + severity: 4, + }); + } + } + } + } + events +} + +/// Scans /dev/shm for IPC channels not associated with any known +/// system service — potential hidden communication channels. +pub fn scan_hidden_ipc_channels() -> Vec { + let mut events = Vec::new(); + if let Ok(entries) = std::fs::read_dir("/dev/shm") { + for entry in entries.flatten() { + let name = entry.file_name().to_string_lossy().to_string(); + if name.len() > 16 && name.chars().all(|c| c.is_alphanumeric()) { + events.push(AdvancedTelemetryEvent { + category: TelemetryEventCategory::HiddenChannelDiscovered, + message: format!("Suspicious shared-memory segment: /dev/shm/{}", name), + pid: 0, + severity: 2, + }); + } + } + } + events +} + +/// The primary auditor combining firmware, IPC evasion, and +/// hidden channel detection into a single full-spectrum pass. +pub struct AdvancedPlatformAuditor; + +impl AdvancedPlatformAuditor { + /// Returns firmware-related alerts. + pub fn audit_firmware() -> Vec { + HardwareFirmwareAnalyzer::audit_uefi_nvram() + } + + /// Returns cache/permission abuse alerts from /proc/self/maps. + pub fn audit_cache_abuse() -> Vec { + audit_cache_abuse() + } + + /// Performs a full-spectrum platform audit. + pub fn full_audit() -> Vec { + let mut all_events = Vec::new(); + all_events.extend(Self::audit_firmware()); + all_events.extend(audit_cache_abuse()); + all_events.extend(scan_hidden_ipc_channels()); + all_events + } +} \ No newline at end of file diff --git a/src/stave_ui.rs b/src/stave_ui.rs new file mode 100644 index 0000000..0d11121 --- /dev/null +++ b/src/stave_ui.rs @@ -0,0 +1,506 @@ +// ============================================================================ +// WARLOCK'S STAVE: 4-Quarter High-Performance Presentation Engine (v7.0) +// ============================================================================ +// +// Immediate-mode UI using egui. Organizes structural telemetry views +// into a 4-quarter grid: Disassembly, Registers, Data Viewport, +// and Architectural Telemetry. + +use egui::{Color32, Pos2, Rect, Stroke, Ui, Vec2, Shape, RichText}; +use std::collections::HashMap; + +use crate::{HardwareFirmwareAnalyzer, IPC_STATE_MATRIX, SQRT_3}; + +/// Spacing between crow positions on the grid (pixels). +const CROW_SPACING: f32 = 42.0; +const COLOR_BG_DARK: Color32 = Color32::from_rgb(10, 10, 12); +const COLOR_GRID_LINE: Color32 = Color32::from_rgb(30, 30, 35); +const COLOR_HEX_HOVER: Color32 = Color32::from_rgb(0, 255, 200); +const COLOR_HEX_MUTATED: Color32 = Color32::from_rgb(255, 45, 85); +const COLOR_TEXT_NEON: Color32 = Color32::from_rgb(0, 230, 180); +const COLOR_TEXT_MUTATED: Color32 = Color32::from_rgb(255, 60, 100); + +// --------------------------------------------------------------------------- +// Crow silhouette shapes (normalized coordinates, centered at origin) +// --------------------------------------------------------------------------- + +/// Profile crow facing right — perched, watching the landscape. +/// Points trace beak-tip → crown → tail → belly → throat → beak-tip. +const CROW_PROFILE: &[(f32, f32)] = &[ + ( 0.52, -0.02), // beak tip + ( 0.38, -0.10), // beak top + ( 0.28, -0.18), // forehead + ( 0.18, -0.24), // crown + ( 0.02, -0.26), // back of head + (-0.15, -0.28), // upper back + (-0.32, -0.30), // wing peak + (-0.46, -0.22), // wing trailing edge + (-0.42, -0.08), // lower back + (-0.52, -0.06), // tail tip (upper) + (-0.48, 0.02), // tail tip (lower) + (-0.35, 0.06), // rump + (-0.15, 0.16), // belly + ( 0.08, 0.14), // chest + ( 0.22, 0.06), // throat + ( 0.32, 0.00), // chin + ( 0.38, -0.04), // beak bottom +]; + +/// Front-facing crow — head turned toward the viewer, wings half-spread. +/// Used for breakpoint / warning cells. +const CROW_FACING: &[(f32, f32)] = &[ + (-0.52, -0.04), // left wing tip + (-0.42, -0.22), // left wing top + (-0.22, -0.30), // left shoulder + (-0.06, -0.32), // crown left + ( 0.06, -0.32), // crown right + ( 0.22, -0.30), // right shoulder + ( 0.42, -0.22), // right wing top + ( 0.52, -0.04), // right wing tip + ( 0.38, 0.06), // right body + ( 0.18, 0.16), // right lower + ( 0.00, 0.20), // bottom center + (-0.18, 0.16), // left lower + (-0.38, 0.06), // left body +]; + +/// Beak triangle for front-facing crow (pointing downward at viewer). +const CROW_BEAK: &[(f32, f32)] = &[ + ( 0.00, -0.32), // base center (head bottom) + ( 0.07, -0.20), // right corner + (-0.07, -0.20), // left corner +]; + +/// Maps heatmap hit count to an "aged crow" color. +/// Fresh crows are nearly invisible; ancient crows glow with the theme neon. +fn crow_heatmap_color(hits: u64) -> Color32 { + match hits { + 0 => Color32::from_rgb(28, 24, 30), // ghost — barely materialized + 1 => Color32::from_rgb(48, 40, 55), // fledgling — dark charcoal + 2..=3 => Color32::from_rgb(68, 52, 85), // juvenile — deep plum + 4..=6 => Color32::from_rgb(100, 68, 125), // adult — rich purple + 7..=10 => Color32::from_rgb(145, 95, 175), // elder — bright plumage + _ => Color32::from_rgb(0, 210, 165), // ancient — neon raven + } +} + +/// Scales crow size based on hit count. Crows grow as a cell is revisited. +fn crow_heatmap_scale(hits: u64) -> f32 { + 0.55 + 0.12 * (hits as f32).min(12.0) +} + +/// Build a Pos2 list from normalized shape coordinates, scaled and translated. +fn shape_at(pts: &[(f32, f32)], cx: f32, cy: f32, size: f32) -> Vec { + pts.iter() + .map(|&(x, y)| Pos2::new(cx + x * size, cy + y * size)) + .collect() +} + +#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)] +pub struct AxialCoordinate { + pub q: i32, + pub r: i32, +} + +pub struct VisualCellMetrics { + pub total_hits: u64, + pub is_breakpoint: bool, + pub address_reference: u64, +} + +pub struct WarlockAppWorkspace { + pub cell_database: HashMap, + pub active_hovered_coord: Option, + pub register_states: HashMap, + pub disassembly_buffer: Vec<(u64, String, String)>, +} + +impl WarlockAppWorkspace { + pub fn new() -> Self { + let mut app = Self { + cell_database: HashMap::new(), + active_hovered_coord: None, + register_states: HashMap::new(), + disassembly_buffer: Vec::new(), + }; + + // Seed demo data for development + for q in -6i32..=6i32 { + for r in -6i32..=6i32 { + if q.abs() + r.abs() < 10 { + app.cell_database.insert( + AxialCoordinate { q, r }, + VisualCellMetrics { + total_hits: if q == 0 { 15 } else { 0 }, + is_breakpoint: (q == 2 && r == -1), + address_reference: 0x7FFFFFFE0000 + + ((q + 6) as u64 * 0x100), + }, + ); + } + } + } + app.register_states + .insert("RAX".to_string(), (0x000000000000004C, true)); + app.register_states + .insert("RIP".to_string(), (0x7FFFFFFE0005, true)); + app.disassembly_buffer + .push((0x7FFFFFFE0000, "48 31 C0".to_string(), "xor rax, rax".to_string())); + app.disassembly_buffer + .push((0x7FFFFFFE0003, "48 89 C3".to_string(), "mov rbx, rax".to_string())); + app + } + + pub fn update_workspace_layout(&mut self, ctx: &egui::Context) { + let mut styles = (*ctx.style()).clone(); + styles.visuals.panel_fill = COLOR_BG_DARK; + ctx.set_style(styles); + + egui::CentralPanel::default().show(ctx, |ui| { + let total_h = ui.available_height(); + let mut q1_rect = Rect::NOTHING; + let mut q2_rect = Rect::NOTHING; + + // Top section: Hexagonal Timeline Matrix + ui.allocate_ui_with_layout( + Vec2::new(ui.available_width(), total_h * 0.45), + egui::Layout::top_down(egui::Align::Min), + |ui| { + ui.heading( + RichText::new("WARLOCK'S STAVE ENGINE") + .color(COLOR_TEXT_NEON), + ); + self.render_hexagonal_timeline_matrix(ui); + }, + ); + + ui.separator(); + + // Bottom section: 4-Quarter Grid + ui.allocate_ui_with_layout( + Vec2::new(ui.available_width(), total_h * 0.50), + egui::Layout::left_to_right(egui::Align::Min), + |ui| { + let half_w = ui.available_width() * 0.50; + + // Left column: Q1 + Q3 + ui.allocate_ui_with_layout( + Vec2::new(half_w, ui.available_height()), + egui::Layout::top_down(egui::Align::Min), + |ui| { + q1_rect = ui.available_rect_before_wrap(); + ui.label( + RichText::new("Q1: DISASSEMBLY ENGINE") + .strong() + .color(Color32::WHITE), + ); + for (addr, bytes, asm) in &self.disassembly_buffer { + ui.monospace(format!( + "{:#018X} | {:12} | {}", + addr, bytes, asm + )); + } + ui.separator(); + ui.label( + RichText::new("Q3: DATA VIEWPORT") + .strong() + .color(Color32::WHITE), + ); + ui.monospace( + "0000 48 31 C0 48 89 C3 EB 02 | H1.H.C.", + ); + }, + ); + + ui.separator(); + + // Right column: Q2 + Q4 + ui.allocate_ui_with_layout( + Vec2::new(ui.available_width(), ui.available_height()), + egui::Layout::top_down(egui::Align::Min), + |ui| { + q2_rect = ui.available_rect_before_wrap(); + ui.label( + RichText::new("Q2: REGISTERS & CONTROL FLOW") + .strong() + .color(Color32::WHITE), + ); + for (reg, (val, muta)) in &self.register_states { + let c = if *muta { + COLOR_TEXT_MUTATED + } else { + Color32::GREEN + }; + ui.monospace( + RichText::new(format!( + "{} = {:#018X}", + reg, val + )) + .color(c), + ); + } + ui.separator(); + ui.label( + RichText::new( + "Q4: ARCHITECTURAL TELEMETRY OVERLAYS" + ) + .strong() + .color(Color32::WHITE), + ); + self.render_dynamic_telemetry_hud_blocks(ui); + }, + ); + }, + ); + + // Draw Q1<->Q2 connector path + if q1_rect != Rect::NOTHING && q2_rect != Rect::NOTHING { + let bp = + ui.ctx().layer_painter(egui::LayerId::background()); + bp.add(Shape::CubicBezier(egui::epaint::CubicBezierShape { + points: [ + Pos2::new( + q1_rect.right() - 5.0, + q1_rect.center().y, + ), + Pos2::new( + q1_rect.right() + 30.0, + q1_rect.center().y, + ), + Pos2::new( + q2_rect.left() - 30.0, + q2_rect.center().y, + ), + Pos2::new( + q2_rect.left() + 5.0, + q2_rect.center().y, + ), + ], + stroke: Stroke::new(1.5, Color32::from_rgb(0, 150, 255)), + fill: Color32::TRANSPARENT, + closed: false, + })); + } + }); + } + + fn render_hexagonal_timeline_matrix(&mut self, ui: &mut Ui) { + let (response, painter) = + ui.allocate_painter(ui.available_size(), egui::Sense::hover()); + let center = response.rect.center(); + + // Pixel-raycaster: map mouse to axial coordinate (same math, crow spacing) + if let Some(mouse) = response.hover_pos() { + let lx = (mouse.x - center.x) as f64; + let ly = (mouse.y - center.y) as f64; + let sp = CROW_SPACING as f64; + let fq = (2.0 / 3.0 * lx) / sp; + let fr = (-1.0 / 3.0 * lx + SQRT_3 / 3.0 * ly) / sp; + let fs = -fq - fr; + + let mut q = fq.round() as i32; + let mut r = fr.round() as i32; + let s = fs.round() as i32; + + if (q as f64 - fq).abs() > (r as f64 - fr).abs() + && (q as f64 - fq).abs() > (s as f64 - fs).abs() + { + q = -r - s; + } else if (r as f64 - fr).abs() > (s as f64 - fs).abs() { + r = -q - s; + } + + self.active_hovered_coord = Some(AxialCoordinate { q, r }); + } + + // Render the murder of crows + let eye_color = Color32::from_rgb(255, 240, 180); // pale yellow + let beak_color = Color32::from_rgb(55, 40, 30); + + for (&coord, cell) in &self.cell_database { + let cx = center.x + + CROW_SPACING * (1.5 * coord.q as f32); + let cy = center.y + + CROW_SPACING + * ((3.0f32).sqrt() + * (coord.r as f32 + coord.q as f32 * 0.5)); + + let is_hovered = self.active_hovered_coord == Some(coord); + + // Determine color: aged-crow palette, hover glow, or warning tint + let body_color = if is_hovered { + COLOR_HEX_HOVER + } else if cell.is_breakpoint { + // Warning crow — blend the aged color with a red tint + let aged = crow_heatmap_color(cell.total_hits); + let r = (aged.r() as u16 + 120).min(255) as u8; + let g = aged.g() / 3; + let b = aged.b() / 3; + Color32::from_rgb(r, g, b) + } else { + crow_heatmap_color(cell.total_hits) + }; + + let size = CROW_SPACING * crow_heatmap_scale(cell.total_hits); + + // Some crows face left, some face right (deterministic from coords) + let face_right = (coord.q + coord.r) % 2 != 0; + + if cell.is_breakpoint { + // --- WARNING CROW: front-facing, looking at you --- + let body_pts = shape_at(CROW_FACING, cx, cy, size); + painter.add(Shape::Path(egui::epaint::PathShape { + points: body_pts, + closed: true, + fill: body_color, + stroke: Stroke::new(1.2, COLOR_HEX_MUTATED), + })); + + // Beak pointing at viewer + let beak_pts = shape_at(CROW_BEAK, cx, cy, size); + painter.add(Shape::Path(egui::epaint::PathShape { + points: beak_pts, + closed: true, + fill: beak_color, + stroke: Stroke::NONE, + })); + + // Eyes — two pale dots staring at you + let eye_r = (size * 0.035).max(1.2); + let eye_y = cy - size * 0.24; + painter.circle_filled( + Pos2::new(cx - size * 0.10, eye_y), + eye_r, + eye_color, + ); + painter.circle_filled( + Pos2::new(cx + size * 0.10, eye_y), + eye_r, + eye_color, + ); + + // Pupils — tiny dark dots inside the eyes + let pupil_r = eye_r * 0.5; + painter.circle_filled( + Pos2::new(cx - size * 0.10, eye_y), + pupil_r, + Color32::BLACK, + ); + painter.circle_filled( + Pos2::new(cx + size * 0.10, eye_y), + pupil_r, + Color32::BLACK, + ); + } else { + // --- PROFILE CROW: perched, watching the landscape --- + let pts = if face_right { + shape_at(CROW_PROFILE, cx, cy, size) + } else { + // Mirror: negate x coordinates + CROW_PROFILE + .iter() + .map(|&(x, y)| Pos2::new(cx - x * size, cy + y * size)) + .collect() + }; + painter.add(Shape::Path(egui::epaint::PathShape { + points: pts, + closed: true, + fill: body_color, + stroke: Stroke::new(0.8, COLOR_GRID_LINE), + })); + + // Small eye dot on profile crow + let eye_r = (size * 0.028).max(1.0); + let (ex, ey) = if face_right { + (cx + size * 0.22, cy - size * 0.18) + } else { + (cx - size * 0.22, cy - size * 0.18) + }; + painter.circle_filled(Pos2::new(ex, ey), eye_r, eye_color); + } + + // Hover glow: soft circle behind the crow + if is_hovered { + painter.circle_filled( + Pos2::new(cx, cy), + size * 0.55, + Color32::from_rgba_premultiplied(0, 255, 200, 25), + ); + } + } + } + + fn render_dynamic_telemetry_hud_blocks(&mut self, ui: &mut Ui) { + // PERFORMANCE NOTE: HardwareFirmwareAnalyzer and IPC_STATE_MATRIX + // queries involve filesystem I/O and mutex locking. In a production + // 60 FPS loop, these must be cached and refreshed on a timer (e.g., + // every 500ms) rather than called every frame. + + let nvram = HardwareFirmwareAnalyzer::audit_uefi_nvram(); + let signals = HardwareFirmwareAnalyzer::detect_stealth_sideload_signals(); + for ev in nvram.iter().chain(signals.iter()) { + ui.colored_label( + Color32::from_rgb(255, 30, 60), + format!(" [FIRMWARE ALERT] {:?}", ev.category), + ); + ui.colored_label( + Color32::from_rgb(200, 200, 200), + format!(" {}", ev.message), + ); + } + + let matrix = IPC_STATE_MATRIX.lock().unwrap(); + if matrix.values().any(|r| r.fallback_violation_triggered) { + for record in matrix + .values() + .filter(|r| r.fallback_violation_triggered) + { + ui.colored_label( + Color32::from_rgb(255, 150, 0), + format!( + " [EVASION DETECTED] PID {}: {} \ + switched to hidden IPC channel", + record.pid, record.process_name + ), + ); + self.render_entropy_sparkline_canvas( + ui, + &record.entropy_snapshots, + ); + } + } else { + ui.colored_label( + Color32::GREEN, + " Local IPC Transport Validation Stable", + ); + } + } + + fn render_entropy_sparkline_canvas( + &self, + ui: &mut Ui, + snapshots: &[u8], + ) { + let (resp, painter) = ui.allocate_painter( + Vec2::new(140.0, 16.0), + egui::Sense::hover(), + ); + let rect = resp.rect; + if snapshots.len() < 2 { + return; + } + let step_x = rect.width() / (snapshots.len() - 1) as f32; + let mut pts = Vec::new(); + for (i, &score) in snapshots.iter().enumerate() { + let x = rect.left() + (i as f32 * step_x); + let y = rect.bottom() - ((score as f32 / 100.0) * rect.height()); + pts.push(Pos2::new(x, y)); + } + for w in pts.windows(2) { + painter.line_segment( + [w[0], w[1]], + Stroke::new(1.2, Color32::LIGHT_GRAY), + ); + } + } +} \ No newline at end of file diff --git a/src/windows_etw.rs b/src/windows_etw.rs new file mode 100644 index 0000000..d9ebd72 --- /dev/null +++ b/src/windows_etw.rs @@ -0,0 +1,45 @@ +// ============================================================================ +// WARLOCK'S STAVE: Windows ETW Telemetry Engine +// ============================================================================ +// +// Provides kernel-level event tracing via Event Tracing for Windows (ETW). +// This module is only compiled on Windows targets. + +#[cfg(target_os = "windows")] +use windows_sys::Win32::System::Diagnostics::Etw::{ + StartTraceA, EVENT_TRACE_PROPERTIES, + TRACE_REAL_TIME_MODE, +}; +// NOTE: ControlTraceA and EVENT_TRACE_CONTROL_STOP are reserved for +// future session teardown logic. Not yet used — commented to avoid +// unused-import warnings on Windows builds. +// use windows_sys::Win32::System::Diagnostics::Etw::{ControlTraceA, EVENT_TRACE_CONTROL_STOP}; + +pub struct WindowsEtwEngine; + +impl WindowsEtwEngine { + /// Creates a real-time ETW trace session for telemetry capture. + #[cfg(target_os = "windows")] + pub unsafe fn spawn_windows_tap() { + std::thread::spawn(|| { + const SESSION_NAME: &str = "WarlockStaveEtwSession\0"; + let allocation_size = std::mem::size_of::() + + SESSION_NAME.len() + + 100; + let mut buffer = vec![0u8; allocation_size]; + let props = &mut *(buffer.as_mut_ptr() as *mut EVENT_TRACE_PROPERTIES); + props.Wnode.BufferSize = allocation_size as u32; + props.Wnode.Flags = 0x00020000; + props.LogFileMode = TRACE_REAL_TIME_MODE; + props.LoggerNameOffset = + std::mem::size_of::() as u32; + let mut trace_handle: u64 = 0; + StartTraceA(&mut trace_handle, SESSION_NAME.as_ptr(), props); + // Real-time consumer loop processes telemetry events + }); + } + + /// No-op on non-Windows platforms. + #[cfg(not(target_os = "windows"))] + pub unsafe fn spawn_windows_tap() {} +} \ No newline at end of file