| name | security-dossier |
| description | Build comprehensive security context dossiers for functions in DeepExtractIDA binaries -- gathering identity, attack reachability, data flow exposure, dangerous operations, resource patterns, complexity metrics, and neighboring context in one command. Use when the user asks to audit a function's security posture, build a security dossier, assess attack surface, check function reachability from exports, find dangerous API usage, or needs pre-audit context gathering for a decompiled function. |
| cacheable | true |
| depends_on | ["decompiled-code-extractor","callgraph-tracer","classify-functions"] |
Security Context Dossier
Purpose
One-command deep context gathering for security auditing. Before manually reviewing a decompiled function, the researcher needs to understand its security landscape. This skill builds a comprehensive dossier covering:
- Function Identity -- Name, signature, class membership, mangled name
- Attack Reachability -- Exported? Entry point? Reachable from exports? Shortest path from entry? + RPC/COM/WinRT IPC entry points
- Untrusted Data Exposure -- Which export callers can feed external data? How many hops? + parameter risk scoring
- Dangerous Operations -- Direct dangerous APIs, security-relevant callees by category, callee-depth analysis + BFS transitive to configurable depth
- Resource Patterns -- Synchronization, memory operations, global variable reads/writes
- Complexity Assessment -- Instructions, branches, loops, cyclomatic complexity, stack frame
- Neighboring Context -- Class methods, direct callees/callers
- Data Quality -- Extraction-time error warnings
Data Sources
- Individual analysis DBs (
extracted_dbs/{module}_{hash}.db): Function records, xrefs, assembly, loop analysis, stack frame, dangerous APIs, global accesses
- Tracking DB (
extracted_dbs/analyzed_files.db): Module name to DB path mapping
- Exports/Entry points: From
file_info table in individual DBs
For DB schema details, see data_format_reference.md.
Finding a Module DB
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py --list
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
Quick Cross-Dimensional Search
To search across function names, signatures, strings, APIs, classes, and exports in one call:
python .claude/helpers/unified_search.py <db_path> --query "SearchTerm"
python .claude/helpers/unified_search.py <db_path> --query "SearchTerm" --json
Utility Scripts
All scripts are in scripts/. Run from the workspace root.
build_dossier.py -- Build Security Dossier (Start Here)
Single command to produce the full dossier:
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> <function_name>
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> --id <function_id>
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> --search <pattern>
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> <function_name> --json
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> <function_name> --callee-depth 4
Examples:
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/appinfo_dll_e98d25a9e8.db AiCheckSecureApplicationDirectory
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db --search "BatLoop"
python .claude/skills/security-dossier/scripts/build_dossier.py extracted_dbs/cmd_exe_6d109a3a00.db BatLoop --json
Workflows
Security Dossier Progress:
- [ ] Step 1: Find the module DB
- [ ] Step 2: Build the dossier
- [ ] Step 3: Review the dossier sections
- [ ] Step 4: Deep dive into flagged areas
Step 1: Find the Module DB
python .claude/skills/decompiled-code-extractor/scripts/find_module_db.py appinfo.dll
Step 2: Build the Dossier
python .claude/skills/security-dossier/scripts/build_dossier.py <db_path> <function_name>
Step 3: Review the Dossier
Focus on these high-priority indicators:
| Indicator | Meaning |
|---|
| Externally Reachable = YES | Function can be triggered from outside the module |
| Direct Dangerous APIs | Immediate dangerous behavior (memory-unsafe, command exec, etc.) |
| Security-Relevant Callees | Sensitive operations performed via callees |
| Receives External Data = YES | Untrusted data can flow to this function |
| Global Writes | State mutation affecting other functions |
| High Cyclomatic Complexity | Complex control flow, higher bug probability |
Step 4: Deep Dive
Based on dossier findings, use complementary skills:
- Code extraction -- extract the function for detailed review:
python .claude/skills/decompiled-code-extractor/scripts/extract_function_data.py <db_path> <function>
- Call graph tracing -- follow execution paths across modules:
python .claude/skills/callgraph-tracer/scripts/chain_analysis.py <db_path> <function> --depth 3
Dossier Section Reference
1. Function Identity
Source: functions table -- function_name, function_signature, function_signature_extended, mangled_name. Class membership inferred from :: in the function name.
Library tag: When available, lookup_function() from helpers provides the function's library tag (WIL/STL/WRL/CRT/ETW) and .cpp source file path.
2. Attack Reachability
Source: file_info.exports, file_info.entry_point, simple_inbound_xrefs. BFS upward through callers to find paths from exports/entry points. Reports whether the function is externally reachable and the shortest path from an entry point. Also includes ipc_context with ground-truth RPC/COM/WinRT classification from rpc_index, com_index, and winrt_index helper modules.
3. Untrusted Data Exposure
Combines reachability with exports analysis. Functions reachable from exports may receive untrusted external input. Traces data paths from export callers to the target. Now includes param_surface (structured metadata) from signature analysis, and considers entry points and IPC handlers as data sources alongside exports.
4. Dangerous Operations
Source: dangerous_api_calls (direct), simple_outbound_xrefs classified by security API category. Uses BFS via CallGraph to --callee-depth (default 4) for transitive dangerous API discovery. Also reports indirect_calls from detailed outbound_xrefs. Categories: memory_unsafe, command_execution, code_injection, privilege, file_write, registry_write, network, crypto, sync, memory_alloc.
5. Resource Patterns
Source: simple_outbound_xrefs classified for sync/memory/file APIs. global_var_accesses for global state reads/writes.
6. Complexity Assessment
Source: assembly_code (instruction/branch/call counts), loop_analysis (loop count, cyclomatic complexity), stack_frame (sizes, exception handler). Includes has_syscall for direct syscall detection.
7. Neighboring Context
Source: Functions sharing the same ClassName:: prefix. Direct callees/callers from xrefs.
Direct Helper Module Access
For programmatic use without skill scripts:
helpers.classify_api_security(api_name) -- Classify API for security relevancehelpers.get_dangerous_api_set() -- Get the set of known dangerous APIshelpers.CallGraph.from_functions(functions) -- Build call graph for reachability analysishelpers.resolve_function(db, name_or_id) -- Resolve function by name or ID
Integration with Other Skills
| Task | Recommended Skill |
|---|
| Trace call chains from audited functions | callgraph-tracer |
| Classify functions in the audit neighborhood | classify-functions |
| Map entry points reachable from audited function | map-attack-surface |
| Lift audited functions to clean code for review | batch-lift |
Performance
| Operation | Typical Time | Notes |
|---|
| Build single function dossier | ~5-10s | Gathers from multiple skills |
| Build dossier (deep callee scan) | ~15-45s | With --callee-depth 4+ (BFS) |
Additional Resources
