English | 한국어

# SCOUT (v3.0.0-rc1) ### AEG-First Firmware Exploitability Platform with Deterministic Evidence Lineage **SCOUT is an AEG-first firmware analysis platform that transforms raw firmware blobs into evidence-anchored exploitability chains, lab-bounded Proof-of-Vulnerability modules, controlled weaponization packages for authorized internal red teams, and audit-ready dossiers. Now featuring a Hybrid Analysis Engine for both Binary and Shell Script auditing.** *While traditional scanners prioritize bulk and speed, SCOUT acts as a high-fidelity AEG copilot for product-security and internal red-team workflows: it reconstructs exploit chains across ELF binaries and shell scripts, explains its reasoning with evidence trails, and promotes lab-bounded PoV/PoC results toward scoped, private, evidence-led weaponization rather than raw public-PoC copies.*

What you can do • Why SCOUT? • Quick Start • Key Features • Changelog

[![Python](https://img.shields.io/badge/Python-3.10+-3776AB?style=for-the-badge&logo=python&logoColor=white)](https://python.org) [![License](https://img.shields.io/badge/License-Apache_2.0-blue?style=for-the-badge)](LICENSE) [![Zero Deps](https://img.shields.io/badge/Dependencies-Zero_(stdlib)-orange?style=for-the-badge)]() [![Version](https://img.shields.io/badge/Version-3.0.0--rc1-red?style=for-the-badge)]() [![SARIF](https://img.shields.io/badge/SARIF-2.1.0-blue?style=for-the-badge&logo=github)]() [![SBOM](https://img.shields.io/badge/SBOM-CycloneDX_1.6+VEX-brightgreen?style=for-the-badge)]() [![SLSA](https://img.shields.io/badge/SLSA-Level_2-purple?style=for-the-badge)]()

1,123
_{Corpus Targets}

98.8%
_{Analysis Success}

1,300+
_{Scripts Scanned}

99.3%
_{FP Reduction (LLM)}

v3.0.0-rc1
_{Hybrid Engine}

---

🚀 What you can do with SCOUT

- **Hybrid Triage**: Audit both ELF binaries and shell scripts in a single unified pipeline. - **Deep Exploit Discovery**: Find complex `Web -> IPC -> Config -> Daemon` or `Shell -> Binary` chains. - **AEG-first AutoPoC**: Leverage the **Exploit Pattern RAG** to generate lab-ready Proof-of-Vulnerability modules from firmware evidence. - SCOUT now includes a runtime `exploit_intel` stage plus a metadata-only PoC-in-GitHub importer, Aqua `vuln-list-update`/NVD enrichment, and a human-review-required draft pattern-card promoter for firmware-relevant CVE seeds before AutoPoC retrieval. - SCOUT does **not** clone, execute, or prompt-inject raw public PoC repositories for copy-based exploitation. A platform-level AEG claim must pass the E2E dynamic/FP gate in [`docs/aeg_e2e_validation.md`](docs/aeg_e2e_validation.md). See also [`docs/exploit-pattern-rag.md`](docs/exploit-pattern-rag.md). - For internal red-team use, SCOUT treats weaponization as a **controlled, private, authorization-bound promotion layer**: scoped target profiling, precondition solving, reproducibility, cleanup, and evidence ledgers. See [`docs/controlled_weaponization_layer.md`](docs/controlled_weaponization_layer.md). - **Evidence Investigation**: Use the Glassmorphism Web Dashboard to walk through decompiled P-code and shell logic. - **Controlled Weaponization Readiness**: Promote verified PoV evidence into private, scope-bound exploit packages for authorized internal red teams without publishing working payloads. - **Audit/compliance-compatible reporting**: Generate SARIF, CycloneDX 1.6 SBOM+VEX, and SLSA L2 attestations. ---

💎 The SCOUT Advantage

> **[1] Hybrid Analysis Engine (v3)** > Bridges the gap between binary-level execution and high-level shell logic, expanding coverage into script-driven firmware attack surfaces that binary-only pipelines miss. > **[2] Hash-Anchored Evidence Lineage** > Every finding is tied to a specific file path, byte offset, and SHA-256 hash. No black-box guesses. > **[3] Intelligent Analyst Copilot** > Built-in LLM tribunal (Advocate/Critic) reduces false positives by 99.3% on the historical Tier-2 benchmark using the registered multi-stage triage pipeline. > **[4] Zero Dependency (Pure Stdlib)** > No `pip install` nightmares. Deploy instantly in air-gapped labs or restricted environments. ---

⚡ Quick Start

```bash # Analyze a firmware image (Hybrid mode enabled by default) ./scout analyze firmware.bin # Explore findings in the Web Dashboard ./scout serve aiedge-runs/ --port 8080 # Deep dive in the Terminal UI ./scout tui # Seed Exploit Pattern RAG candidates from PoC-in-GitHub metadata only python scripts/import_poc_in_github_candidates.py --dry-run # Optionally enrich from a local Aqua vuln-list checkout generated by vuln-list-update AIEDGE_VULN_LIST_DIR=/opt/vuln-list \ python scripts/import_poc_in_github_candidates.py --cve CVE-2023-1389 --vuln-list-dir /opt/vuln-list # Draft a human-review-required pattern card from one candidate python scripts/draft_exploit_pattern_card.py data/exploit_references/candidates/poc_in_github/cve-2024-1781.json --print-json # After a real authorized lab run, enforce dynamic proof + FP/FPR evidence ./scout aeg-e2e-gate aiedge-runs/ # Lower evidence + private package metadata into a bounded SCOUT-W Plan IR, # then fail closed on scope/profile/precondition checks before private execution. ./scout weaponization-plan aiedge-runs/ \ --package-manifest /secure/private/package.manifest.json \ --out aiedge-runs//weaponization_plan.json ./scout weaponization-preflight aiedge-runs/ \ --plan aiedge-runs//weaponization_plan.json \ --package-manifest /secure/private/package.manifest.json \ --out aiedge-runs//weaponization_preflight.json # Lint and register private package metadata in a hash-only vault allowlist. ./scout weaponization-package lint \ --package-manifest /secure/private/package.manifest.json \ --out /secure/private/package.lint.json ./scout weaponization-package register \ --registry /secure/private/package_vault.json \ --package-manifest /secure/private/package.manifest.json # Promote a private internal red-team package only after scope, firmware binding, # cleanup, control-pair, and AEG evidence gates pass (no exploit source is loaded). ./scout weaponization-readiness aiedge-runs/ \ --package-manifest /secure/private/package.manifest.json \ --out aiedge-runs//controlled_weaponization_readiness.json # Execute the private package only after plan/preflight/readiness gates pass, # then write the L6/L7 execution ledger. ./scout weaponization-execute aiedge-runs/ \ --exploit-dir /secure/private/exploits \ --plan aiedge-runs//weaponization_plan.json \ --preflight aiedge-runs//weaponization_preflight.json \ --readiness aiedge-runs//controlled_weaponization_readiness.json \ --cleanup-log /secure/private/cleanup.log \ --vault-registry /secure/private/package_vault.json \ --approval /secure/private/engagement_approval.json \ --out-ledger aiedge-runs//weaponization_ledger.json # Or aggregate already-captured execution evidence, cleanup proof, # and optional engagement approval into the L6/L7 ledger. ./scout weaponization-ledger aiedge-runs/ \ --plan aiedge-runs//weaponization_plan.json \ --preflight aiedge-runs//weaponization_preflight.json \ --readiness aiedge-runs//controlled_weaponization_readiness.json \ --execution-evidence aiedge-runs//exploits/chain_/evidence_bundle.json \ --cleanup-log /secure/private/cleanup.log \ --approval /secure/private/engagement_approval.json \ --out aiedge-runs//weaponization_ledger.json # CI-safe AEG regression: vulnerable lab service must pass, patched control must fail closed python scripts/run_aeg_synthetic_pair.py --work-root /tmp/scout-aeg-synthetic-pair python scripts/run_aeg_synthetic_pair.py --pattern cgi_param_cmd_injection --work-root /tmp/scout-aeg-cgi-pair python scripts/run_aeg_synthetic_pair.py --pattern config_derived_cmd_injection --work-root /tmp/scout-aeg-config-pair # Inspect which Exploit Pattern RAG cards have vulnerable/control evidence python scripts/check_exploit_pattern_evidence.py python scripts/check_exploit_pattern_evidence.py --require-real-firmware-pair # Audit AEG platform readiness from card evidence + stable real-firmware pair proof ./scout aeg-readiness --out docs/pov/aeg_platform_readiness.json # Run/reuse an official known-vulnerable/patched firmware pair and emit the fail-closed gate report. ./scout aeg-real-pair --pair-id --fetch --no-llm \ --pattern-id --out docs/pov/.json # Record real known-vulnerable/patched firmware pair evidence on a pattern card. python scripts/record_pattern_pair_evidence.py --kind real_firmware_pair \ --vulnerable-run-dir aiedge-runs/ \ --control-run-dir aiedge-runs/ \ --artifact docs/pov/.json \ --vulnerable-firmware-sha256 \ --control-firmware-sha256 \ --cve CVE-YYYY-NNNN --apply ``` ---

✨ Key Features

| | Feature | Description | |---|---------|-------------| | :package: | **Hybrid SBOM & CVE** | CycloneDX 1.6 + VEX + NVD scan + 2,528 local CVE DB + Integrated Shell Script auditing | | :mag: | **Binary Analysis** | Ghidra P-code SSA dataflow taint + ELF hardening detection + 28 sink symbols | | :shell: | **Script Analysis** | Heuristic auditing of 1,000+ scripts for insecure `eval`, backticks, and unquoted variable usage | | :dart: | **Attack Surface** | Source→sink tracing, web server auto-detection, cross-binary IPC chains (5 types) | | :brain: | **Taint Analysis** | HTTP-aware inter-procedural taint, P-code SSA dataflow, call chain visualization | | :robot: | **LLM Engine** | 4 backends + centralized system prompts + structured JSON output + 5-stage parser | | :books: | **Exploit Pattern RAG** | Runtime `exploit_intel` seeds plus curated pattern-card retrieval, PoC-in-GitHub metadata, Aqua vuln-list-update/NVD enrichment, and reviewed draft promotion for firmware-relevant AEG candidates | | :crossed_swords: | **LLM-Adjudicated Debate** | Advocate/Critic LLM debate for high-fidelity FPR reduction | | :bar_chart: | **Web Viewer** | Glassmorphism dashboard with KPI bar, IPC map, risk heatmap, and evidence navigation |