dotnet update

Author: moohax

dotnet_reversing/README.md

@@ -2,15 +2,15 @@
 
 ## Description
 
-This agent is designed to perform reverse engineering and analysis of .NET binaries. It can decompile .NET assemblies and leverage a large language model (LLM) to analyze the source code based on a user-defined task, such as identifying security vulnerabilities. The agent can process binaries from a local file path or directly fetch them from the [NuGet package repository](https://www.nuget.org/packages). It operates asynchronously and can run multiple analysis instances in parallel.
+This agent is designed to perform reverse engineering and analysis of .NET binaries. It can decompile .NET assemblies and leverage an LLM to analyze the source code based on a user-defined task, such as identifying security vulnerabilities. The agent can process binaries from a local file path or directly fetch them from the [NuGet package repository](https://www.nuget.org/packages). It operates asynchronously and can run multiple analysis instances in parallel.
 
 ## Intended Use
 
-The primary purpose of this agent is to assist security researchers and developers in automating the process of scanning .NET applications for potential security flaws. A user can provide a high-level task, like "Find only critical vulnerabilities," and the agent will use its tools to decompile the code and use an LLM to analyze it, reporting any findings. It can also be used as a simple utility to decompile and view the source code of .NET assemblies.
+The primary purpose of this agent is to assist security researchers and developers in automating the process of scanning .NET applications for potential security flaws. 
 
 ## Environment
 
-The agent is a command-line application built with Python. It requires a Python environment with the necessary libraries installed, as specified in the script. It interacts with the public [NuGet API](https://learn.microsoft.com/en-us/nuget/api/overview) (api.nuget.org) to fetch packages. For its analysis capabilities, it relies on a configured language model, which can be a remote API (like GPT-4o-mini) or a locally hosted model (e.g., via Ollama). For observability and task tracking, it can be optionally [connected to a Dreadnode server](https://docs.dreadnode.io/strikes/usage/config).
+It interacts with the public [NuGet API](https://learn.microsoft.com/en-us/nuget/api/overview) (api.nuget.org) to fetch packages, or with local dotnet assemblies.
 
 ## Tools
 
@@ -25,16 +25,16 @@ The agent is a command-line application built with Python. It requires a Python
 - `search_for_references`
 - `get_call_flows_to_method`
 
-## Features
-
-- **Multi-Source Analysis**: Capable of analyzing .NET binaries from local paths, directories, or directly from NuGet packages.
-- **LLM-Powered Analysis**: Utilizes a configurable language model to intelligently analyze decompiled source code based on a custom task.
-- **Vulnerability Reporting**: Can identify and report findings, classifying them by criticality (critical, high, medium, low, info).
-- **Concurrent Execution**: Supports running multiple agent instances in parallel to speed up the analysis of many binaries.
-- **Source Code Dumping**: Includes a utility to decompile and save the source code of specified binaries to a text file.
-- **Iterative Analysis**: Performs analysis in an iterative loop, with a configurable maximum number of steps to prevent infinite runs.
-- **Task Completion Summary**: Provides a final summary upon task completion, indicating success or failure and a brief markdown report.
-
 ## References
 
 - [ILSpy](https://github.com/icsharpcode/ILSpy)
+
+## Examples
+
+```bash
+uv run dotnet_reversing/main.py --model "anthropic/claude-haiku-4-5-20251001" --path ./dotnet_reversing/example_binaries/
+```
+
+## Notes
+
+It requires access to dotnet, and for dotnet to be in your path, `export DOTNET_ROOT=~/.dotnet`

dotnet_reversing/example_binaries/flag_protocol/FlagProtocol.dll

@@ -1,5 +1,4 @@
 import io
-import sys
 import typing as t
 import zipfile
 from dataclasses import dataclass
@@ -9,11 +8,15 @@
 import aiohttp
 import cyclopts
 import dreadnode as dn
-import litellm
-import rigging as rg
-from loguru import logger
+from dreadnode.agent import Agent
+from dreadnode.agent.events import AgentStart
+from dreadnode.agent.hooks import Hook
+from dreadnode.agent.tools import tool
+from dreadnode.data_types import Markdown
+from reversing import DotnetReversingTool
+from rich.console import Console
 
-from dotnet_reversing.reversing import DotnetReversing
+console = Console()
 
 if t.TYPE_CHECKING:
     from loguru import Record as LogRecord
@@ -32,7 +35,7 @@ class Args:
     """Binary or directory of binaries to analyze or other supported identifier"""
     nuget: bool = False
     """Treat the path as a NuGet package id or path to a list of packages"""
-    task: str = "Find only critical vulnerabilities"
+    task: str = "Find all useful vulnerabilities"
     """Task presented to the agent"""
     max_steps: int = 25
     """Maximum number of iterations per agent"""
@@ -49,7 +52,7 @@ class DreadnodeArgs:
     """Dreadnode server URL"""
     token: str | None = None
     """Dreadnode API token"""
-    project: str = "dotnet-reversing"
+    project: str = "dotnet-reversing-example"
     """Project name"""
     console: t.Annotated[bool, cyclopts.Parameter(negative=False)] = False
     """Show span information in the console"""
@@ -65,7 +68,7 @@ def log_formatter(record: "LogRecord") -> str:
     )
 
 
-@dn.task(name="Report finding", log_inputs=False, log_output=False)
+@tool()
 async def report_finding(file: str, method: str, criticality: str, content: str) -> str:
     """
     Report a finding regarding areas or interest or vulnerabilities.
@@ -77,9 +80,7 @@ async def report_finding(file: str, method: str, criticality: str, content: str)
     - "low"
     - "info"
     """
-    logger.success(f"Reporting finding for {file} ({method}) [{criticality}]:")
-    logger.info(content)
-    logger.info("---")
+
     dn.log_output(
         "finding",
         {
@@ -95,30 +96,27 @@ async def report_finding(file: str, method: str, criticality: str, content: str)
     return "Reported"
 
 
-@dn.task(name="Finish task", log_output=False)
-async def finish_task(success: bool, markdown_summary: str) -> None:
+@tool()
+async def finish_task(success: bool, markdown_summary: str) -> str:
     """
     Mark your task as complete with a success/failure status and markdown summary.
     """
     dn.log_metric("task_success", success)
     if success:
         dn.tag("success", to="run")
 
-    log_func = logger.success if success else logger.warning
-    log_func(f"Agent finished the task (success={success}): {markdown_summary}")
-
     dn.log_metric("task_success", success, to="run")
-    dn.log_output("task_summary", markdown_summary, to="run")
+    dn.log_output("task_summary", Markdown(markdown_summary), to="run")
+
+    return "Task Finished"
 
 
-@dn.task(name="Download NuGet package")
 async def download_nuget_package(package: str) -> Path:
     """
     Download a NuGet package and return the path to the package.
     """
 
     package = package.lower()
-    logger.info(f"Downloading NuGet package {package}...")
 
     async with aiohttp.ClientSession() as client:
         # Get the versions
@@ -131,7 +129,6 @@ async def download_nuget_package(package: str) -> Path:
             data = await response.json()
             versions = data["versions"]
             latest_version = versions[-1]
-            logger.info(f" |- Latest version is {latest_version}")
 
         # Download the nupkg and extract it
         async with client.get(
@@ -147,84 +144,16 @@ async def download_nuget_package(package: str) -> Path:
             with io.BytesIO(data) as buffer, zipfile.ZipFile(buffer) as zip_file:
                 zip_file.extractall(output_dir)
 
-            logger.info(f" |- Extracted to {output_dir}")
-
     return output_dir
 
 
-async def agent(args: Args) -> None:
-    with (
-        dn.run(),
-        dn.task_span("Agent"),
-        logger.contextualize(prefix=str(args.path)),
-    ):
-        dn.log_params(
-            model=args.model,
-            path=str(args.path),
-            nuget=args.nuget,
-            task=args.task,
-            max_steps=args.max_steps,
-        )
-
-        path = await download_nuget_package(args.path) if args.nuget else Path(args.path)
-        reversing = DotnetReversing.from_path(path)
-
-        logger.info(f"Analyzing the following binaries with the goal: '{args.task}':")
-        for binary in reversing.binaries:
-            logger.info(f"  |- {binary}")
+def upload_package_hook(
+    package_path: str,
+) -> Hook:
+    async def upload_package(event: AgentStart) -> None:
+        dn.log_artifact(package_path)
 
-        dn.log_inputs(
-            binaries=[str(b) for b in reversing.binaries],
-        )
-
-        binary_list = "\n".join(reversing.binaries)
-
-        prompt = dedent(f"""\
-        Analyze the following binaries and resolve the task below using all the tools available to you.
-        Provide a report for all interesting findings you discover while performing the task.
-
-        <task>
-        {args.task}
-        </task>
-
-        <files>
-        {binary_list}
-        </files>
-        """)
-
-        dn.log_input("task", args.task, to="run")
-        dn.log_input("binaries", binary_list, to="run")
-
-        generator = rg.get_generator(args.model)
-        chat = (
-            await generator.chat(prompt)
-            .catch(
-                *litellm.exceptions.LITELLM_EXCEPTION_TYPES,
-                on_failed="include",
-            )
-            .using(
-                reversing.tools,
-                report_finding,
-                finish_task,
-                max_depth=args.max_steps,
-            )
-            .cache("latest")
-            .run()
-        )
-
-        if chat.failed and chat.error:
-            if isinstance(chat.error, rg.error.MaxDepthError):
-                logger.warning(f"Max steps reached ({args.max_steps})")
-                dn.log_metric("max_steps_reached", 1)
-                dn.log_output("task_summary", f"Max steps ({args.max_steps}) reached", to="run")
-            else:
-                logger.warning(f"Failed with {chat.error}")
-                dn.log_metric("inference_failed", 1)
-                dn.log_output("task_summary", f"Inference failed with {chat.error}", to="run")
-
-        elif chat.last.role == "assistant":
-            dn.log_output("last_message", chat.last.content)
-            logger.info(str(chat.last))
+    return upload_package
 
 
 @app.default
@@ -233,10 +162,6 @@ async def main(*, args: Args, dn_args: DreadnodeArgs | None = None) -> None:
     Agent to analyze .NET binaries and report findings.
     """
 
-    logger.remove()
-    logger.add(sys.stderr, format=log_formatter, level=args.log_level)
-    logger.enable("rigging")
-
     dn_args = dn_args or DreadnodeArgs()
     dn.configure(
         server=dn_args.server,
@@ -245,37 +170,46 @@ async def main(*, args: Args, dn_args: DreadnodeArgs | None = None) -> None:
         console=dn_args.console,
     )
 
-    await agent(args)
+    path = await download_nuget_package(args.path) if args.nuget else Path(args.path)
+    reversing = DotnetReversingTool(variant="all", base_path=path)
 
-    logger.info("Done.")
+    binary_list = "\n".join(reversing.binaries)
 
+    instructions = dedent("""\
+        You are a .NET reversing expert.
 
-@app.command
-async def dump(*, args: Args, dn_args: DreadnodeArgs | None = None) -> None:
-    """
-    Dump the source code of the binaries in the specified path.
-    """
-    logger.remove()
-    logger.add(sys.stderr, format=log_formatter, level=args.log_level)
-    logger.enable("rigging")
+        Use the Dotnet Reversing tool to decompile and analyze the binaries.
+        For each finding, use the Report Finding tool to log your discoveries.
 
-    dn_args = dn_args or DreadnodeArgs()
-    dn.configure(
-        server=dn_args.server,
-        token=dn_args.token,
-        project=dn_args.project,
-        console=dn_args.console,
+        Once you have completed your analysis, use the Finish Task tool to summarize your findings
+        and indicate whether you successfully completed the task.
+        """)
+
+    user_input = dedent(f"""\
+        Here is your task:
+
+        <task>
+        {args.task}
+        </task>
+
+        <files>
+        {binary_list}
+        </files>
+        """)
+
+    agent = Agent(
+        name="Dotnet Reversing Agent",
+        description="Agent to analyze .NET binaries and report findings.",
+        model=args.model,
+        instructions=instructions,
+        tools=[reversing, report_finding, finish_task],
+        max_steps=args.max_steps,
+        hooks=[upload_package_hook(str(path))],
     )
 
-    path = await download_nuget_package(args.path) if args.nuget else Path(args.path)
-    reversing = DotnetReversing.from_path(path)
-
-    for binary in reversing.binaries:
-        logger.info(f"Dumping source code for {binary}...")
-        source_code = reversing.decompile_module(binary)
-        output_file = Path(f"{binary}_source.txt")
-        output_file.write_text(source_code)
-        logger.success(f"Source code dumped to {output_file}")
+    async with agent.stream(user_input) as events:
+        async for event in events:
+            console.print(event)
 
 
 if __name__ == "__main__":