collaborative-analysis

name	Collaborative Analysis
description	Team collaboration — share findings, merge analysis, generate reports
tags	["collaboration","team","sharing","merge","reporting"]
allowed_tools	["export_analysis","list_shared_analyses","generate_team_report","merge_analyses","add_finding"]

Task: Collaborative Analysis. Work with your team to analyze binaries efficiently.

Collaboration Goals

1. Share Your Work - Export findings for teammates
2. Learn from Others - Import and review teammates' analysis
3. Merge Efforts - Combine multiple analysts' work
4. Generate Reports - Create team-friendly documentation

Core Concepts

Snapshot

A snapshot contains:

• All renamed functions
• All comments and annotations
• Detected findings (vulnerabilities, suspicious APIs)
• Binary metadata (name, hash)
• Analyst attribution

Finding

A finding represents:

• Address location
• Type (vulnerability, suspicious, interesting)
• Category (overflow, uaf, crypto, network, api)
• Severity (critical, high, medium, low, info)
• Title and description
• Analyst who found it

Team Workflow

When YOU Complete Analysis

1. Document your findings with `add_finding`
2. Rename important functions
3. Add comments for complex code
4. Export with `export_analysis`
5. Share the JSON file with your team

When Reviewing Teammate's Work

1. Use `list_shared_analyses` to see available snapshots
2. Load interesting snapshots
3. Review their findings and annotations
4. Learn from their approach
5. Build upon their work

When Combining Efforts

1. Collect multiple snapshot files
2. Use `merge_analyses` with file paths
3. Review merged findings (deduplicated)
4. Use `generate_team_report` for final report
5. Share with stakeholders

Tool Usage

export_analysis

Export your current analysis to a shareable snapshot.

Parameters:

• analyst - Your name or handle
• summary - Brief description of your analysis

Example:

export_analysis(
  analyst="SecurityResearcher",
  summary="Analyzed driver.sys, found 3 critical IOCTL vulnerabilities"
)

Output: File path where snapshot was saved

list_shared_analyses

List all available snapshots in the collaboration directory.

Output: Table of snapshots with metadata

generate_team_report

Generate a markdown report from one or more snapshots.

Parameters:

• snapshot_path - Path to specific file, or "all" to merge

Example:

# Report single analysis
generate_team_report("/path/to/snapshot.json")

# Merge and report all analyses
generate_team_report("all")

merge_analyses

Combine multiple snapshots into a merged report.

Parameters:

• snapshot_paths - Comma-separated file paths, or empty for auto-merge

Example:

# Auto-merge all
merge_analyses()

# Merge specific files
merge_analyses("/path/s1.json,/path/s2.json,/path/s3.json")

add_finding

Add a manual finding to be included in snapshots.

Parameters:

• address - Function or code address
• title - Short descriptive title
• severity - critical, high, medium, low, info
• category - overflow, uaf, crypto, network, api, etc.
• description - Detailed description

Example:

add_finding(
  address=0x140001000,
  title="Stack Buffer Overflow in IOCTL 0x222003",
  severity="critical",
  category="overflow",
  description="Unbounded memcpy from user input to 128-byte stack buffer"
)

Best Practices

Finding Quality

• Use accurate severity levels
• Provide detailed descriptions
• Include PoC when applicable
• Reference relevant CVEs if known

Function Naming

• Use descriptive names reflecting actual behavior
• Follow consistent naming conventions
• Include context (e.g., HandleIoctlReadPhysMem)

Comments

• Explain WHY, not WHAT
• Document non-obvious behavior
• Reference vulnerability classes
• Note exploitation prerequisites

Summary Writing

• Be concise but informative
• Highlight critical findings
• Note analysis scope
• Mention limitations

Report Structure

Generated team reports include:

1. Header - Binary info, analysts, date
2. Summary - Combined analysis overview
3. Findings - Grouped by severity and category
4. Annotations - Renamed functions, comments
5. Contributors - Attribution per analyst

Example Team Session

[Analyst A] exports initial analysis:
export_analysis(analyst="Alice", summary="Initial driver analysis")

[Analyst B] reviews and extends:
list_shared_analyses()  # Sees Alice's work
# Reviews findings, adds more

[Analyst C] merges and generates report:
merge_analyses()  # Combines all work
generate_team_report("all")  # Final report

[Team] reviews report and assigns priorities

Storage Location

Snapshots are stored in:

• ~/.spectra/collab/
• Named: {binary_name}_{timestamp}.json
• Can be shared via version control
• Can be emailed/shared directly

Use Cases

1. Parallel Analysis - Multiple analysts on different modules
2. Peer Review - Senior reviews junior's findings
3. Knowledge Transfer - Team learns from each expert
4. Client Reporting - Professional team-generated reports
5. Shift Handoff - Continuity across time zones
6. Audit Trail - Attribution for each finding

Tips

• Export frequently to avoid losing work
• Use meaningful summaries
• Coordinate with team on naming conventions
• Review merged reports before sharing externally
• Keep snapshots in version control for history
• Delete outdated snapshots to avoid confusion