hacksguard is a multi-threaded Rust terminal UI for static malware triage, scoring PE, ELF and Mach-O samples with YARA, entropy graphs and imphash for authorized SOC analysts.
| Tool | Rhacknarok/hacksguard — blazing-fast multi-threaded TUI static analysis tool for PE, ELF and Mach-O binaries, written in Rust |
| Category | Malware static analysis / binary triage TUI |
| Primary Use | Rapid first-pass triage of suspicious binaries in a lab: risk scoring, YARA matching, entropy, strings, imports and imphash from one terminal dashboard |
| Safe Use | Intended for SOC analysts, threat hunters and reverse engineers working authorized incident response, malware research and isolated lab analysis of samples they are permitted to handle |
| Telemetry Note | Purely local, read-only static analysis — it executes nothing and beacons nowhere; defenders can freely run it in sandboxes and the --json output integrates into SIEM/SOAR pipelines |
hacksguard positions itself as a single-pane answer to a workflow problem every malware analyst knows: the first ten minutes of triage usually mean juggling a hex editor, a strings dump, a YARA scanner and a PE parser in four separate windows. Built entirely in Rust and rendered through ratatui and crossterm, it packs header parsing, risk scoring, disassembly, entropy visualization and rule matching into one keyboard-driven dashboard. The project sits at roughly 209 stars, is MIT-licensed, and targets Linux, Windows and macOS, which matters because the tool itself analyzes all three executable ecosystems. Version 0.4 is the current release per the README, and it is already packaged in Nixpkgs unstable, which is an unusually fast landing for a young analysis tool and a decent signal of community uptake.
The architecture choices are the interesting part. Binary format parsing is delegated to goblin, the de facto Rust crate for PE, ELF and Mach-O structures, which means hacksguard inherits battle-tested format handling rather than reimplementing parsers. The YARA integration runs on boreal, a pure-Rust YARA engine, and dynamically loads local rule sets — the README explicitly names Elastic's protections-artifacts and Neo23x0's signature-base as compatible sources. Disassembly of entry-point instructions is handled by iced-x86 for x86/x64, with ARM64 instruction words formatted at the word level. The README's dependency list is short and legible, which tells you the heavy lifting is confined to well-scoped crates and the project's own code concentrates on orchestration and presentation.
The headline feature for triage speed is the 0-100% risk score, compiled from five heuristic axes: entropy, suspicious API usage, format anomalies, strings, and packing indicators. Crucially, this is not just a number — it is visualized as an interactive radar chart, so an analyst can see at a glance whether a sample is high-entropy-and-packed versus suspicious-APIs-and-anomalous-headers. That shape information is often more diagnostic than the aggregate score, because it distinguishes a legitimate packed installer from something whose imports and strings are actively lying. The scoring pipeline runs concurrently across threads, and the README claims zero UI latency even on large executables — a promise that matters when you are paging through a 50MB dropper and the interface freezes on every string scan in lesser tools.
Format coverage is broad and genuinely cross-platform. On the Windows side you get deep PE inspection: headers, sections, imports and exports, security mitigation flags (ASLR, DEP/NX), Mandiant imphash for sample clustering, and Rich Header parsing including toolchain ID decoding and RichPE hash — the latter is a niche but valuable pivot for tracking build-environment reuse across campaigns. On Linux, ELF segments are inspected with PIE, RELRO and NX flags surfaced. On macOS, both thin Mach-O and Universal Fat containers are supported, with code signing info and RPATHs shown. One notable omission at this stage is .NET assembly analysis, so MSIL-heavy samples will still need a companion tool like dnSpy or ILSpy.
The Authenticode module deserves its own paragraph because of how it is built: a zero-dependency ASN.1 DER and PKCS#7 parser written in-house that extracts the X.509 leaf certificate details — Subject, Issuer, validity window, digest algorithm, serial number — and explicitly flags self-signed certificates. Self-signing detection is a cheap, high-signal triage heuristic; legitimate enterprise binaries almost always chain to a recognized CA, while a large fraction of commodity malware signs with throwaway self-made certs. Rolling the parser from scratch rather than pulling in a heavyweight crypto stack keeps the binary lean and avoids supply-chain surface, though it also means the validation story is about parsing and presentation rather than full chain-of-trust verification.
Deobfuscation gets targeted, bounded treatment rather than a generic unpacker. The 1-byte XOR brute-forcer is a high-speed single-pass scanner that looks for obfuscated MZ...PE signatures, DOS stubs, and URLs hidden in overlays or high-entropy sections. Single-byte XOR is ancient but still astonishingly common in droppers, loaders and scripted malware, so an automated sweep for it saves real analyst time. Overlay detection runs independently, flagging appended data at the end of the binary — the classic dropper technique of gluing an encrypted second stage onto a legitimate host executable. Combined with the entropy graph, these three features form a coherent "where is the payload hiding" workflow.
The entropy tab plots Shannon entropy distribution as sparklines across the file, letting an analyst visually localize packed or encrypted regions rather than just seeing one aggregate number. Strings extraction covers both ASCII and UTF-16LE, with automatic categorization into IPs, URLs, registry keys, commands, paths and suspicious indicators. The interactive filtering is the thoughtful part: / opens a live search across strings, imports and sections, and single-key shortcuts (u/i/r/c/s/p/a) jump straight to URLs, IPs, registry, commands, suspicious strings, paths or all. Anyone who has grepped a 40,000-line strings dump for hxxp:// manually will appreciate the category-first ergonomics.
Evasion-technique detection is a differentiator you do not often see in triage TUIs. hacksguard scans for direct and indirect syscall usage — syscall, sysenter and int 0x80 on x86/x64 — as well as ARM64 supervisor calls (svc #0 on Linux AArch64, svc #0x80 on macOS ARM64). Direct syscalls are the hallmark of EDR-evasion malware bypassing userland API hooks, so having this surfaced during static triage, alongside the disassembly view where syscall instructions are highlighted in the entry-point decode, gives defenders an early read on how hostile a sample intends to be at runtime. The built-in hex viewer rounds out inspection for raw-byte work without leaving the tool.
Two practical touches reveal the author has actually lived the analyst workflow. Clipboard integration via the y key uses ANSI OSC 52 escape sequences for zero-dependency copy, which works even over SSH sessions where X11 clipboard plumbing usually fails — a detail that only matters to people who triage on remote analysis boxes. The other is CLI mode: hacksguard --json <file> bypasses the TUI entirely and emits the full analysis report as structured JSON, explicitly targeting SIEM and SOAR integration. That single flag transforms the tool from an interactive dashboard into a pipeline component, usable for automated enrichment of quarantined samples in an authorized detection workflow.
Installation is straightforward if unglamorous: git clone --recursive https://github.com/Rhacknarok/hacksguard.git followed by cargo build --release, with the recursive flag pulling the rule submodules; an already-cloned tree just needs git submodule update --init --recursive. Nix users get nix-env -iA nixos.hacksguard from the unstable channel. Running it is simply hacksguard <path/to/binary> for the TUI or hacksguard --json <file> for machine-readable output. Navigation is vi-flavored — k/j to scroll, Tab to move between tabs, q to quit — so the learning curve for anyone living in a terminal is essentially zero.
Where does this fit in an authorized workflow? It is a triage and first-pass tool, not a full dynamic-analysis replacement: it tells you what a binary is, what it might hide, and whether known rules match, before you commit sandbox time or deep RE hours. For SOC analysts fielding dozens of quarantined samples a day, the radar score plus category-filtered strings plus YARA verdict in one screen is a genuine throughput multiplier; for threat hunters, imphash and RichPE hash give immediate pivoting into sample clusters. It reads only — it never executes the sample — so it is safe to run in your analysis VM against anything you are authorized to handle. The gaps to watch are .NET support, deeper unpacking beyond 1-byte XOR, and how quickly the boreal engine tracks upstream YARA syntax as your rule sets evolve.
Rhacknarok/hacksguard.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.