[PR #3] [MERGED] feat(re-lief): categorize_strings tool + catalog-driven string bucketing #3

New Issue

2026-06-06T15:59:18-04:00

yindo commented

2026-06-06 15:59:18 -04:00

📋 Pull Request Information

Original PR: https://github.com/Heretek-AI/RE-AI/pull/3
Author: @BillyOutlast
Created: 6/5/2026
Status: ✅ Merged
Merged: 6/5/2026
Merged by: @BillyOutlast

Base: main ← Head: feat/categorize-strings

📝 Commits (1)

f5e5e9e feat(re-lief): categorize_strings tool + catalog-driven string bucketing

📊 Changes

16 files changed (+1219 additions, -31 deletions)

View changed files

📝 ANTI-TAMPER-TAXONOMY.md (+132 -0)
📝 CHANGELOG.md (+18 -0)
📝 data/drm-indicators.yaml (+290 -0)
📝 docs/MCP_SERVERS.md (+10 -0)
📝 docs/SKILLS.md (+3 -3)
📝 servers/re-lief/README.md (+30 -0)
➕ servers/re-lief/src/re_lief/categorizers.py (+160 -0)
📝 servers/re-lief/src/re_lief/parsers.py (+168 -17)
📝 servers/re-lief/src/re_lief/server.py (+78 -0)
📝 skills/re-drm-fingerprint/SKILL.md (+8 -5)
📝 skills/re-format-decode/SKILL.md (+1 -1)
📝 skills/re-malware-triage/SKILL.md (+2 -2)
📝 skills/re-static-triage/SKILL.md (+3 -2)
📝 skills/re-vm-reverse/SKILL.md (+1 -1)
➕ tests/test_re_lief_categorize_strings.py (+314 -0)
📝 tests/test_servers_import.py (+1 -0)

📄 Description

Summary

Adds a keyword-bucketed strings dump (re-lief.categorize_strings) that turns the manual-grep step that today lives in the LLM's head into a catalog-driven, deterministic lookup.

What changed

New MCP tool re-lief.categorize_strings — superset of extract_strings (same {ascii, utf16le, totals, truncated} shape for backward compat) plus a by_category block with 11 semantic categories (anti_debug, hwid, crypto, network, registry, process, file, fingerprint, activation, obfuscation, misc).
Catalog extension — new data/drm-indicators.yaml::string_categories section. Two seed categories (anti_debug, hwid) inherit their keyword lists from existing catalog sections (anti_debug_indicators.checks[].name and hwid_apis.high_signal[].api) via a seed_from: / seed_field: YAML pointer. Add a HWID API to the catalog → categorizer picks it up on next MCP-server reload, zero Python change.
5 skills updated — re-static-triage, re-malware-triage, re-drm-fingerprint, re-vm-reverse, re-format-decode had their manual-grep step replaced with a call to re-lief.categorize_strings. No new workflow steps were added.
New taxonomy section — ANTI-TAMPER-TAXONOMY.md gains "Recognizing the patterns in arbitrary binaries" with Pattern A (encrypted-VM bytecode interpreter: 7 section-name co-occurrence + W^X .idata + .text virt>>raw + .ecode lazy-decrypt stub + vendor-tagged PDB + late-bound export tail + 8+ HWID APIs) and Pattern B (hardware-fingerprinting routine in a third-party launcher activation library) in vendor-neutral category terms.
7 new soft-skip tests in tests/test_re_lief_categorize_strings.py covering the result shape, the seed_from: inheritance, the bundled Activation64.dll high-signal hits, the legacy extract_strings wrapper, and the GameAssembly full-section vs skip_sections paths.

Vendor neutrality

Every new file references only categories (encrypted-VM bytecode interpreter, hardware-fingerprinting routine, third-party launcher activation library). The literal vendor attribution strings remain only in the gitignored Output/ reports. tests/test_no_vendor_leakage.py (14 needles) passes with zero hits on the new content.

Verification

pytest -q tests/test_re_lief_categorize_strings.py — 7 passed in 31s (dominated by the 530 MB GameAssembly walk)
pytest -q tests/test_no_vendor_leakage.py tests/test_skills_frontmatter.py tests/test_servers_import.py tests/test_smoke.py tests/test_plugin_manifest.py — 46 passed, 2 skipped
./verify.sh — 7/7 checks passed

The 2 pre-existing tests/test_re_kaitai_formats.py failures (kaitaistruct 0.10 vs 0.11 API mismatch) are unrelated to this PR; they also fail on the parent commit.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/Heretek-AI/RE-AI/pull/3 **Author:** [@BillyOutlast](https://github.com/BillyOutlast) **Created:** 6/5/2026 **Status:** ✅ Merged **Merged:** 6/5/2026 **Merged by:** [@BillyOutlast](https://github.com/BillyOutlast) **Base:** `main` ← **Head:** `feat/categorize-strings` --- ### 📝 Commits (1) - [`f5e5e9e`](https://github.com/Heretek-AI/RE-AI/commit/f5e5e9e72cc584336f76e42fe0e241fe62115799) feat(re-lief): categorize_strings tool + catalog-driven string bucketing ### 📊 Changes **16 files changed** (+1219 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `ANTI-TAMPER-TAXONOMY.md` (+132 -0) 📝 `CHANGELOG.md` (+18 -0) 📝 `data/drm-indicators.yaml` (+290 -0) 📝 `docs/MCP_SERVERS.md` (+10 -0) 📝 `docs/SKILLS.md` (+3 -3) 📝 `servers/re-lief/README.md` (+30 -0) ➕ `servers/re-lief/src/re_lief/categorizers.py` (+160 -0) 📝 `servers/re-lief/src/re_lief/parsers.py` (+168 -17) 📝 `servers/re-lief/src/re_lief/server.py` (+78 -0) 📝 `skills/re-drm-fingerprint/SKILL.md` (+8 -5) 📝 `skills/re-format-decode/SKILL.md` (+1 -1) 📝 `skills/re-malware-triage/SKILL.md` (+2 -2) 📝 `skills/re-static-triage/SKILL.md` (+3 -2) 📝 `skills/re-vm-reverse/SKILL.md` (+1 -1) ➕ `tests/test_re_lief_categorize_strings.py` (+314 -0) 📝 `tests/test_servers_import.py` (+1 -0) </details> ### 📄 Description ## Summary Adds a keyword-bucketed strings dump (`re-lief.categorize_strings`) that turns the manual-grep step that today lives in the LLM's head into a catalog-driven, deterministic lookup. ## What changed - **New MCP tool `re-lief.categorize_strings`** — superset of `extract_strings` (same `{ascii, utf16le, totals, truncated}` shape for backward compat) plus a `by_category` block with 11 semantic categories (`anti_debug`, `hwid`, `crypto`, `network`, `registry`, `process`, `file`, `fingerprint`, `activation`, `obfuscation`, `misc`). - **Catalog extension** — new `data/drm-indicators.yaml::string_categories` section. Two seed categories (`anti_debug`, `hwid`) inherit their keyword lists from existing catalog sections (`anti_debug_indicators.checks[].name` and `hwid_apis.high_signal[].api`) via a `seed_from:` / `seed_field:` YAML pointer. Add a HWID API to the catalog → categorizer picks it up on next MCP-server reload, zero Python change. - **5 skills updated** — `re-static-triage`, `re-malware-triage`, `re-drm-fingerprint`, `re-vm-reverse`, `re-format-decode` had their manual-grep step replaced with a call to `re-lief.categorize_strings`. No new workflow steps were added. - **New taxonomy section** — `ANTI-TAMPER-TAXONOMY.md` gains "Recognizing the patterns in arbitrary binaries" with Pattern A (encrypted-VM bytecode interpreter: 7 section-name co-occurrence + W^X .idata + `.text` virt>>raw + `.ecode` lazy-decrypt stub + vendor-tagged PDB + late-bound export tail + 8+ HWID APIs) and Pattern B (hardware-fingerprinting routine in a third-party launcher activation library) in vendor-neutral category terms. - **7 new soft-skip tests** in `tests/test_re_lief_categorize_strings.py` covering the result shape, the `seed_from:` inheritance, the bundled `Activation64.dll` high-signal hits, the legacy `extract_strings` wrapper, and the `GameAssembly` full-section vs `skip_sections` paths. ## Vendor neutrality Every new file references only *categories* (encrypted-VM bytecode interpreter, hardware-fingerprinting routine, third-party launcher activation library). The literal vendor attribution strings remain only in the gitignored `Output/` reports. `tests/test_no_vendor_leakage.py` (14 needles) passes with zero hits on the new content. ## Verification - `pytest -q tests/test_re_lief_categorize_strings.py` — 7 passed in 31s (dominated by the 530 MB `GameAssembly` walk) - `pytest -q tests/test_no_vendor_leakage.py tests/test_skills_frontmatter.py tests/test_servers_import.py tests/test_smoke.py tests/test_plugin_manifest.py` — 46 passed, 2 skipped - `./verify.sh` — 7/7 checks passed The 2 pre-existing `tests/test_re_kaitai_formats.py` failures (kaitaistruct 0.10 vs 0.11 API mismatch) are unrelated to this PR; they also fail on the parent commit. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

yindo added the pull-request label 2026-06-06 15:59:18 -04:00

yindo closed this issue

2026-06-06 15:59:18 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Heretek-AI/RE-AI#3