Prog-Prober/GOAL.md

Project Architectural Specification & Engineering Roadmap: Unified Binary Analysis & Defense Probing Workbench

Role & Mission

Act as a Principal Systems Security Architect and Lead Software Engineer. You are designing an end-to-end technical architecture and phased engineering roadmap for an open-source, modular analysis workbench for static analysis, isolated dynamic execution, network sinkholing, and automated defense probing.

Mandatory Directive: Do NOT rely solely on static internal training weights for component recommendations or ecosystem libraries. You MUST actively execute live research via your available MCP tools (github, firecrawl, context7) to benchmark and identify active, production-ready open-source projects (prioritizing active commits, permissive licensing, and modern runtime footprints) to incorporate or adapt.

---

Phase 0: Required MCP Pre-Flight Research Protocol

Before outlining the roadmap or finalizing the architecture, execute targeted queries using your toolset:

1. GitHub Tool (github)

Audit current, actively maintained open-source repositories:

• Headless Static Engines & Parsers: Inspect active wrappers and headless bindings for Ghidra, Rizin/Cutter, Angr, or Triton. (Check commit frequency, open issues, and release activity).
• Windows Sandboxing in Linux: Query modern container/VM runtimes for Windows execution on Linux hosts (e.g., evaluate active forks of CAPE sandbox, dockur/windows, QEMU/KVM headless orchestration engines, and Wine/Proton micro-containers).
• Network Blackholing/Interception: Research open-source projects built on top of mitmproxy or ebpf network drivers configured specifically as an isolated sinkhole/fake-DNS/mock responder.
• Large-Scale Graph Visualization: Check high-performance graph visualizers capable of handling 10,000+ nodes/edges without canvas stutter (e.g., Sigma.js v3, Cytoscape.js canvas/WebGL, Cosmograph, Reagraph).

2. Web Scraping & Deep Extraction (firecrawl)

• Crawl the documentation, technical blogs, and architectural benchmarks of the shortlisted libraries identified via GitHub.
• Extract details on headless resource consumption, Docker compatibility, and anti-analysis evasion limitations (especially regarding Wine vs. KVM virtualization artifacts).

3. Context & API Verification (context7)

• Retrieve the latest documentation and API integration patterns for your primary candidates (e.g., Docker SDK, Tauri v2 vs Electron, gRPC/WebSocket streaming protocols, and the Model Context Protocol / MCP SDK).

---

Core System Architecture & Functional Domains

Incorporate your live research findings across four key architectural pillars:

1. Workspace Ingestion & Static Execution Graphing

• Directory Ingestion: Allow users to open project folders, select a primary entrypoint binary (PE/ELF), and auto-detect bundled libraries (DLLs, .so), sidecars, and child processes.
• Call-Graph Generation: Trace call graphs (CG) and control-flow graphs (CFG) from entry points to dangerous/high-risk API sinks (e.g., memory allocations, process injections, crypto routines, network calls).
• UI Graph Scalability: Specify WebGL/Canvas rendering strategies, cluster grouping, and viewport virtualization to prevent rendering crashes on massive binaries.

2. Isolated Dynamic Sandbox & Network Sinkholing

• The Windows-on-Linux Architecture: Compare the trade-offs of the active projects found during your research:
  • Containerized Wine/Proton (lightweight, but easily fingerprinted by anti-analysis checks).
  • Headless QEMU/KVM microVMs running stripped Windows guests (stealthy, high fidelity, heavier orchestration).
  • Provide a clear recommendation backed by current open-source tooling.
• Network Containment: Detail a transparent inline proxy architecture using mitmproxy running in a dedicated isolated bridge network configured to:
  • Intercept and log all TLS/HTTP/raw TCP/UDP streams.
  • Deterministically block or mock outbound requests to prevent live C2 contact or data leaks.

3. Instrumentation, Crash Telemetry & Anti-Analysis Probing

• Runtime Instrumentation: Detail dynamic hooks (e.g., via Frida, DynamoRIO, or hypervisor introspection) to log execution traces.
• Defense Probing: Monitor for common defensive behaviors: timing checks (RDTSC), PEB traversal (BeingDebugged), hardware breakpoint scanning, API hooking detection, and hypervisor/VM footprint detection.
• Fault Triage: Structured crash dumps, unhandled exception logs, and register states for fuzzing triage.

4. AI Tooling & Intelligence Layer

• MCP Server Implementation: Define a native MCP interface exposing tools (e.g., inspect_call_graph, extract_strings, trace_function_refs, trigger_sandbox_run, get_crash_telemetry).
• Defense Signature RAG: Outline a vector-indexed retrieval layer cataloging known packers, protectors (Themida, VMProtect, Denuvo, UPX), and anti-tamper heuristics to contextualize findings for the user.

---

Deliverables Required

Generate a structured, modular architectural specification and execution roadmap containing:

1. Tooling Audit & Prior Art Matrix (Grounded in Tool Research):
   • Provide a comparison table of projects discovered via github and firecrawl.
   • Columns: Component / Layer, Candidate Project (with GitHub URL), License, Maintenance Status (Last Commit / Activity), Pros, Cons / Architectural Fit.
2. System Architecture & Data Flow:
   • Decoupled architecture diagram (Frontend, Orchestrator Daemon, Sandbox Worker, Sinkhole Proxy).
   • Real-time communication protocols (gRPC, WebSockets, or Unix domain sockets).
   • Data schema for nodes/edges in the Call Graph Visualizer.
3. Phased Implementation Roadmap:
   • Phase 1: Workspace Ingestion & Static Graph MVP (Dependency mapping, headless decompilation/CFG generation, WebGL graph viewer).
   • Phase 2: Dynamic Execution Sandbox & Network Sinkhole (Isolated runner, mitmproxy blackhole sidecar, event streaming).
   • Phase 3: Anti-Analysis Probing & Crash Diagnostics (Instrumentation hooks, evasion detection heuristics, register/stack dump logging).
   • Phase 4: Agentic Integration & RAG Knowledgebase (MCP Server tools, signature vector database).
4. Critical Engineering Roadblocks & Proposed Mitigations:
   • Addressing Wine/KVM evasion artifacts in defensive software.
   • Graph visualizer memory footprint when rendering 50,000+ instructions.
   • Deterministic teardown and state restoration of sandboxed environments.