11. Security-analysis tools

AVL Code ships a set of read-only analysis tools, suitable for first-pass triage on a sandboxed sample directory. All of them are governed by tool permissions.

Critical constraint: within the workspace's samples/ subdirectory, all execution-type tools are forcibly disabled and can't be unlocked. This avoids accidentally running a sample as a script.

11.0 Get samples into the workspace

The "+" button at the bottom-left of the input box is the fastest way to drop samples:

1. Click + → system multi-file picker.
2. Pick one or more files → they land in the current workspace's samples/.
3. Real-time file name + progress bar + chunk count appear above the input area; auto-collapse 1.5 s after success or stay for 6 s on failure.
4. A toast appears: "Added N samples to samples/".

Notes:

• Configurable limit: default 300 MiB, configurable in Settings → Data → Attachments / Samples (1–4096 MiB), with a "Restore default" one-click button.
• Chunked upload for large files: files larger than 4 MiB are chunked (4 MiB each, append-write), with the first chunk reserving the name to prevent collisions — avoids the single-RPC 30-second timeout.
• The backend transparently handles local and remote workspaces.
• Duplicate filenames get a timestamp suffix; never silently overwritten.
• Cancelling in the system dialog is silently ignored — no error.
• The button greys out when there's no active workspace, with a toast "No active workspace".

After dropping you can ask the assistant directly, e.g. "Run hash + entropy + ioc_extract on that PE and give me a first take."

11.1 Hash, entropy, hex

• Hash: MD5 / SHA-1 / SHA-256 / GM SM3 etc.
• Entropy: Shannon (total + per-block) — initial check for packers / encrypted regions.
• Hex view: hexdump for the given byte range.

Whole-file coverage for big files: single-pass streaming operators (hash / entropy) cover the entire file (block-by-block, unbounded in length, constant memory) and report the real size. Earlier versions silently truncated samples >128 MiB to the first 128 MiB before computing, giving wrong hashes and VirusTotal lookups that didn't match — this release fixes it at the root. Partial-content operators (sec.strings / sec.ioc_extract / sec.yara_scan etc.) still honour their original caps.

11.2 Strings and IOC extraction

• Strings: ASCII + UTF-16LE with configurable minimum length.
• IOC extraction: auto-detects IPv4 / IPv6 / domain / URL / email, hashes (MD5 / SHA-1 / SHA-256 / SHA-512), paths (Windows / Unix), plus the new CVE ids, Windows registry keys, MAC addresses, and Ethereum / Monero / Bitcoin wallet addresses.
  • Refangs before extracting: recognizes and restores "defanged" notation (hxxp://, 1[.]2[.]3[.]4, user[at]example[.]com, foo(dot)bar), so IOCs in analyst notes / reports aren't missed.
  • More precise, fewer false positives: IPs are validated and tagged (private / loopback / link_local / multicast / cgnat, etc.), with an option to exclude private IPs; domains are public-suffix-validated (so filenames like kernel32.dll are dropped); MACs are no longer misparsed as IPv6.
  • More useful results: values are deduplicated with an occurrence count and type tags (including defanged); results are paginated (like sec.strings); optional defanged output (for safe display) and match context snippets.
  • Extraction is a candidate indicator, not a verdict — corroborate before acting.

11.3 Executable parsing

• PE: sections, imports, exports, resources, signatures.
• ELF: sections, segments, symbols, dynamic dependencies.
• Mach-O: Load Commands, sections, signatures.
• Mandiant-style PE imphash: useful for clustering.

11.4 Disassembly

Linear disassembly, supporting x86 / x86_64 / arm / arm64 / ppc64; architecture is usually auto-detected from the header.

11.5 Decompilation

A proprietary decompiler turns the disassembly into C / Java pseudo-code. Combined with the AI explanation, you get a more direct logical summary.

Privacy: decompilation invokes AVL Code's decompilation model; only use it when the sample is safe to send outside.

11.6 Packet metadata

• PCAP overview: total counts, start / end times, protocol mix, top-N flows.
• Flow enumeration (sec.pcap_stream_list): list all TCP / UDP / ICMP flows in the PCAP and assign each a stable id. Default 200 per page, max 2000, sortable by packets / bytes / first_ts (chronological default), pageable via offset — the id is always the chronological global id, stable across pages and sort orders, so it can be passed straight to sec.pcap_stream_extract. Fixes the old behaviour where listing huge captures dumped tens of MB at once and froze the whole turn.
• Flow payload export: dump a chosen flow's L7 payload to a workspace path for further analysis.
• Protocol field extraction: DNS queries / answers, HTTP request / response, TLS ClientHello SNI, plus protocol-level IOCs (IPs).

This release does single-packet inspection only — no TCP reassembly.

11.7 Rule matching

• Supports mainstream YARA syntax (full module system).
• The default install may be a stub; for the full ruleset and module support, ask your internal distribution channel.

11.8 Security domain knowledge base sec.ontology — fact-layer SSOT

A structured fact store for the AI: record "who depends on whom, what's exposed, what has which CVE" — supply-chain / attack-surface facts that persist long-term. Even after the original report is forgotten via conversation compaction, these structured facts are still queryable, and you can do reachability inference (A depends on B, B depends on C → A reaches C). Currently v1, local workspace.

Entity-naming convention: prefer typed prefixes (pkg:lodash / svc:api / cve:CVE-2021-23337) so cross-class queries don't collide.

11.9 Software bill of materials (SBOM) and supply-chain vulnerability scanning

Where sec.ontology records facts you already know, the sbom.* tools discover them first: they scan the workspace's dependency manifests to map "what third-party components does this project actually use", then audit those components against vulnerability databases and tell you which vulnerabilities your code can really reach. Five tools, all invoked through the AI in conversation; result files land in the workspace's .avlcode/ directory by default.

sbom.generate — build the bill of materials

Generates an SBOM for the project, auto-detecting mainstream ecosystems and manifests: npm (package-lock.json / yarn.lock incl. yarn Berry / pnpm-lock.yaml incl. v5), Go (go.mod), Python (uv.lock / pdm.lock / poetry.lock / Pipfile.lock / requirements.txt), Maven (pom.xml / gradle.lockfile / Bazel maven_install.json), Rust, Ruby, PHP, .NET (NuGet), Swift, Dart, C/C++ (conan), conda, Elixir, CocoaPods, R, Haskell, plus the newly-added Deno and Julia. Default output is CycloneDX 1.5 JSON; switch with format to spdx / dsdx / swid, append -xml for XML (e.g. cyclonedx-xml) or dsdx-tag for DSDX native tag-value. Output is reproducible (no timestamps / random serial numbers; components sorted deterministically). A missing manifest skips that ecosystem; all missing yields an empty 0-component BOM, not an error.

Coverage & accuracy improvements (this release): manifest scanning recurses into subdirectories and falls back to manifest-file parsing when a lock file is missing; it stops mis-counting the project itself as a third-party dependency, handles Go replace / exclude correctly, and improves version-comparison fidelity (fewer false positives / negatives). The audit supports per-ecosystem fallback, adds precision notes for Maven / Gradle / pip / Conda / Conan / npm, spells out ecosystems it couldn't audit, and attaches exploitability notes to help prioritize risk.

sbom.convert — multi-format hub, any-to-any

Reads and writes the four mainstream formats — CycloneDX (JSON + XML), SPDX (2.3), DSDX, SWID — and converts freely between them (via one canonical intermediate model: N readers + N writers, not an N² matrix). input (file to convert) and to (target format) are required; from auto-detects. Conversion preserves components, purls, licenses, hashes and dependency relationships; fields the target can't hold are dropped per rule (e.g. DSDX has no hashes).

sbom.audit — find known vulnerabilities

Generates the BOM, then matches each component against the OSV database, returning per-finding severity, CVE id, fixed versions, and a flag for whether it's on the CISA KEV (Known Exploited Vulnerabilities) list. Severity is computed accurately from CVSS v2 / v3 / v4 vectors (critical ≥9 / high ≥7 / medium ≥4 / low). mode controls the source: auto (default — offline DB if present, else online) / online (api.osv.dev) / offline (local snapshot). Findings are sorted worst-first, with KEV always on top.

sbom.vex — exploitability convergence, cut the noise

On top of audit, uses deterministic symbol-level reachability analysis to decide whether each vulnerability is actually reachable in your code, converging "installed but never called" noise away, and emits a standard OpenVEX document. Each conclusion is one of affected (truly affected, fix it) / not_affected (used, but the vulnerable code is unreachable) / under_investigation / fixed, with a machine-readable justification for not_affected. A pure offline import scan suffices (air-gap friendly); Go can be converged directly to not_affected from OSV-provided affected symbols, while other ecosystems can be narrowed further via optional lsp_confirm (use the language server to confirm at least one real reference, default off) or an App-side symbol match. Statements are sorted so what still needs action comes first.

sbom.dbsync — maintain the local offline vulnerability DB (air-gap)

Syncs the local OSV database used by audit / vex offline mode. action: status (default, local-only — record counts and freshness per ecosystem) / sync (fetch OSV dumps per ecosystem over the network) / import (import an OSV zip transferred offline, via zip_path + osv_eco, for fully isolated environments) / kev (refresh the CISA KEV catalog). 13 ecosystems have OSV offline-dump coverage (conan / conda / CocoaPods have no offline DB and can only be audited online).

Air-gapped use: point the data sources at an internal mirror (and a proxy if needed), fill the local DB with sync or import, and audit / vex then run fully offline. The source URLs, proxy and default mode are configured under Settings → Security → Supply chain / SBOM; leave blank to use the built-in defaults (direct public access). That panel also shows per-ecosystem offline record counts / freshness and the KEV entry count, with a multi-select ecosystem sync and a "Sync KEV" button. The save button is "Test & Save": it first validates URL / path format, then probes availability per the Default audit source, and refuses to save if a blocking source is unavailable; offline-related fields (local vulnerability-DB path, etc.) are grouped under the "Offline vulnerability DB" section, with the path normalized to an absolute path on save. A "Reset to defaults" button clears the fields back to the built-in defaults (form-only — you still click "Test & Save" to apply, so a custom mirror config isn't wiped in one click).

11.10 Cloud threat intelligence and Sentinel scanning (VirusTotal / Google Threat Intelligence)

AVL Code integrates VirusTotal / Google Threat Intelligence (GTI) for cloud threat intelligence, along two orthogonal axes configured under Settings → Security:

• Threat detection (capability): once a detection method is configured, the Agent can call the scan / intelligence tools for analysis.
  • Cloud detection service (single-select): VirusTotal AI · free-hosted (zero-config; file hashes and suspicious files are uploaded for public analysis and your alias appears on a public leaderboard) / Google Threat Intelligence · your own API key (uses your key; results aren't public) / No cloud.
  • Local YARA rules (independent toggle): fully offline rule matching; can run alongside the cloud, or on its own.
• Auto-scan interception · Sentinel: when on, the Agent's file read / write / execute is automatically scanned and malicious hits are blocked.

Key change: detection capability is decoupled from Sentinel interception. Configuring a cloud backend or local YARA makes the scan / intelligence tools callable by the Agent right away — without turning Sentinel on. The two axes are independent.

Sentinel-side hash-scan tools (sec.vtai_*):

Full intelligence tools (vt.*, independently gated, see §11.10.1): query VirusTotal / GTI's v3 API directly for enrichment; coexist with Sentinel under their own switch.

11.10.1 The vt.* full intelligence tools

Once enabled under Settings → Security → "Google Threat Intelligence full intelligence tools" (needs a usable API key first), the Agent can call:

Gating tiers (Settings → Security): the master Enable (with a usable key) → Query-only mode (default on — read-only, blocks writes / submits / uploads) → Enable paid features (default off — opens Premium/GTI endpoints, still bounded by your key's tier) → Confirm before uploading a sample (default on, shown only when query-only is off). Responses are compactly summarized (verdict / detection ratio / names / tags / link) to avoid filling context; raw=true returns the raw JSON. An unusable key is flagged at enable time (no longer only at call time). The "Reset to defaults" button is non-destructive — it deselects the cloud and turns off uploads but keeps your API key / VirusTotal AI registration and full-intelligence-tools config.

11.11 Data visibility

All results land directly in the conversation; you can inspect / copy / export each independently. AVL Code never uploads samples to a third party; only decompilation (relevant disassembly fragments, on demand) and vt.submit / sec.vtai_scan uploads (which require your explicit confirmation / opt-in) send content to the VirusTotal cloud.