SCOUT - Deterministic firmware-to-exploit evidence engine.

项目说明

<p align="right">
<strong>English</strong> |
<a href="README.ko.md">한국어</a>
</p>

SCOUT (v3.0.0-rc1)

AEG-First Firmware Exploitability Platform with Deterministic E Lineage

SCOUT is an AEG-first firmware analysis platform that transforms raw firmware blobs into e exploitability chains, lab-bounded Proof-of- modules, controlled weaponization packages for authorized internal red teams, and audit-ready dossiers. Now featuring a Hybrid Analysis Engine for both Binary and Shell Script auditing.

*While traditional scanners prioritize bulk and speed, SCOUT acts as a high-fidelity AEG copilot for product-security and internal red-team workflows: it reconstructs exploit chains across ELF binaries and shell scripts, explains its reasoning with e trails, and promotes lab-bounded PoV/PoC results toward scoped, private, e weaponization rather than raw public-PoC copies.*

<br />

<di="center">
<a href="#what-you-can-do">What you can do</a> •
<a href="#why-scout">Why SCOUT?</a> •
<a href="#quick-start">Quick Start</a> •
<a href="#key-features">Key Features</a> •
<a href="CHANGELOG.md">Changelog</a>
</div>

<br />

<di="center">

![Python]()
![Zero Deps-orange?style=for-the-badge)]()
![]()

![SARIF]()
![SBOM]()
![SLSA]()

<br />

<table>
<tr>
<td align="center"><strong>1,123</strong><br/>_{Corpus Targets}</td>
<td align="center"><strong>98.8%</strong><br/>_{Analysis Success}</td>
<td align="center"><strong>1,300+</strong><br/>_{Scripts Scanned}</td>
<td align="center"><strong>99.3%</strong><br/>_{FP Reduction (LLM)}</td>
<td align="center"><strong>v3.0.0-rc1</strong><br/>_{Hybrid Engine}</td>
</tr>
</table>

</div>

---

<h2 id="what-you-can-do">🚀 What you can do with SCOUT</h2>

Hybrid Triage: Audit both ELF binaries and shell scripts in a single unified pipeline.

Deep Exploit Discovery: Find complex Web -> IPC -> Config -> Daemon or Shell -> Binary chains.

AEG-first AutoPoC: Le the Exploit Pattern RAG to generate lab-ready Proof-of- modules from firmware e.

- SCOUT now includes a runtime exploit_intel stage plus a metadata-only PoC-in-GitHub importer, Aqua /N, and a human-re draft pattern-card promoter for firmware-relevant C before AutoPoC retrieval.
- SCOUT does not clone, execute, or prompt-inject raw public PoC repositories for copy-based exploitation. A platform-level AEG claim must pass the E2E dynamic/FP gate in docs/aeg_e2e_.md. See also docs/exploit-pattern-rag.md.
- For internal red-team use, SCOUT treats weaponization as a controlled, private, authorization-bound promotion layer: scoped target profiling, precondition solving, reproducibility, cleanup, and e ledgers. See docs/controlled_weaponization_layer.md.

E In: Use the Glassmorphism Web Dashboard to walk through decompiled P-code and shell logic.

Controlled Weaponization Readiness: Promote Po into private, scope-bound exploit packages for authorized internal red teams without publishing working payloads.

Audit/compliance-compatible reporting: Generate SARIF, CycloneDX 1.6 SBOM+VEX, and SLSA L2 attestations.

---

<h2 id="why-scout">💎 The SCOUT Ad</h2>

> [1] Hybrid Analysis Engine (v3)
> Bridges the gap between binary-le and high-le logic, expanding co into script-dri attack surfaces that binary-only pipelines miss.

> [2] Hash-Anchored E Lineage
> Every finding is tied to a specific file path, byte offset, and SHA-256 hash. No black-box guesses.

> [3] Intelligent Analyst Copilot
> Built-in LLM tribunal (Ad/Critic) reduces false positives by 99.3% on the historical Tier-2 benchmark using the registered multi-stage triage pipeline.

> [4] Zero Dependency (Pure Stdlib)
> No pip install nightmares. Deploy instantly in air-gapped labs or restricted en.

---

<h2 id="quick-start">⚡ Quick Start</h2>

---

<h2 id="key-features">✨ Key Features</h2>

| | Feature | Description |
|---|---------|-------------|
| :package: | Hybrid SBOM & CVE | CycloneDX 1.6 + VEX + NVD scan + 2,528 local CVE DB + Integrated Shell Script auditing |
| :mag: | Binary Analysis | Ghidra P-code SSA dataflow taint + ELF hardening detection + 28 sink symbols |
| :shell: | Script Analysis | Heuristic auditing of 1,000+ scripts for insecure eval, backticks, and unquoted usage |
| :dart: | Attack Surface | Source→sink tracing, web ser, cross-binary IPC chains (5 types) |
| :brain: | Taint Analysis | HTTP-aware inter-procedural taint, P-code SSA dataflow, call chain |
| :robot: | LLM Engine | 4 backends + centralized system prompts + structured JSON output + 5-stage parser |
| :books: | Exploit Pattern RAG | Runtime exploit_intel seeds plus curated pattern-card retrieval, PoC-in-GitHub metadata, Aqua /N, and re draft promotion for firmware-relevant AEG candidates |
| :crossed_swords: | LLM-Adjudicated Debate | Ad/Critic LLM debate for high-fidelity FPR reduction |
| :bar_chart: | Web | Glassmorphism dashboard with KPI bar, IPC map, risk heatmap, and e na |

项目信息

开发语言：Python

Star 数：12

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Deterministic firmware-to-exploit evidence engine. Drop a firmware blob, get hash-anchored findings with SARIF + CycloneDX SBOM + verified exploit chains.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。