Skip to content

MethodWhite/Noctua-C

BranchesTags

Repository files navigation

⚡ Noctua-C

Tool-CyberSec-Forensic-Noctua-C

Framework profesional de Reverse Engineering y Análisis Forense de Malware

Modules Architecture Sandbox CI


Noctua-C es un framework profesional de Reverse Engineering y Análisis Forense de Malware escrito en C con Clean Architecture. Incluye 72 módulos de análisis, sandbox multicapa, ejecutor en RAM, decompilador IL propio, detección de evasión, threat intelligence, y generación de reportes profesionales.

Multi-plataforma: Windows · Linux · macOS · BSD

📊 Estado Actual (72 módulos · 0 warnings · 0 errores)

🛡️ SandBox + RAM        →  6 módulos
🔬 Análisis Forense      → 30 módulos
📊 Análisis Estático     → 12 módulos
📱 Móvil/Multimedia      → 10 módulos
🧠 Decompilador + IL     →  4 módulos
🔧 Profesional/Threat    → 10 módulos

✨ Características

🛡️ SandBox Multicapa (6 capas)

Capa Descripción
Filesystem Aislamiento tmpfs + bind mounts
Network Network namespace + CLOEXEC
Seccomp Filtro BPF de syscalls
Memory Guardia mprotect
Process Fork + ptrace child isolation
Watchdog Timeout + límite de memoria

🔬 Forense (30+ módulos)

Módulo Comando Descripción
Anti-Debug/Anti-VM evasion CPUID, strings VM, MAC, DMI, TracerPid
Anti-VM Pro antivm-pro SIDT/SGDT/SLDT/STR, I/O backdoors, timing
Process Injection injection Remote thread, APC, hollowing, reflective DLL
MITRE ATT&CK mitre 44 técnicas, 14 tácticas
Persistence persistence Servicios, systemd, cron, bootkits
Memory Forensics memforensic Árbol procesos, conexiones, hidden PIDs
Network network C2 indicators, conexiones activas
PCAP pcap Parseo Ethernet/IP/TCP/UDP/DNS/HTTP/TLS
Storage storage MBR/GPT, ATA IDENTIFY, NVMe, SMART
Anti-Forensics anti-forensics Timestomping, wiping, evidence elimination
Debug debug Debug sections, compilation flags
Ransomware ransomware Notas, familias, backup deletion
Obfuscation obfuscation XOR/RC4/base64, junk code, anti-disassembly
Anti-Sandbox anti-sandbox Sleep, user interaction, RDTSC timing
Registry registry Registry paths, APIs, persistence, IFEO
Decrypt decrypt XOR/RC4/base64/AES, config extractor, shellcode
Escalation escalation UAC bypass, token theft, Linux SUID, CVEs
Autopack autopack Auto-analysis: find/decrypt/decompress/unpack
File Carving carving JPEG/PNG/PDF/ZIP/ELF/AVI/MP3/GZIP/BMP/GIF/PE
Firmware firmware Squashfs, JFFS2, UBI/UBIFS
Steganography stego LSB chi-square, file append, WAV PCM
YARA Scanner yara_scanner 24 reglas built-in, escaneo de directorios
Fuzzing fuzz Fuzzing harness generator (AFL/libFuzzer)

🧠 Threat Intelligence

Módulo Comando Descripción
Threat Intel intel IOC extraction, hashes, 33 familias, YARA rules
Classification classify 10 tipos, CVSS v3 scoring, confidence
IOC Database ioc DB local con 123+ entradas, CSV loading
Behavioral behavior API tracing vía ptrace, timeline
Position position ASLR, PIE, offsets, address space
Side-Channel sidechannel Cache-timing, Spectre gadgets

📊 Reportes

Módulo Comando Descripción
Report report Reporte agregado con risk scoring
Professional Report report-pro HTML, MITRE heatmap, executive summary
Export export JSON/CSV estructurado
Batch batch Escaneo de directorios + scoring

⚙️ Automatización

Herramienta Descripción
Pipeline ./noctua pipeline [quick|network|full|list]
REST API tools/noctua_rest_api — Servidor HTTP puerto 8080
Web GUI tools/noctua_web/run.sh — Dashboard HTML
TUI ./noctua tui — Terminal interactiva
Updater ./noctua updater — Auto-updater + systemd service

🔧 Decompilador + IL

ASM (AArch64/x86) → [Lifter] → IL (Noctua IR) → [Decompiler] → Pseudocode C
  • IR propio con 20+ expresiones y 8 instrucciones
  • Decompilador mejorado: variable renaming, xref table, DOT call graph

📱 Móvil

  • Il2Cpp analysis / dumper v2 / key extractor / strings extractor
  • APK analyzer / manifest parser / JNI analyzer
  • iOS ObjC runtime / Swift demangler / entitlements parser

🏗️ Arquitectura

┌────────────────────────────────────────────────────────┐
│  Interface Layer   CLI · REST API · Web GUI · TUI      │
├────────────────────────────────────────────────────────┤
│  Application Layer Pipeline · Decompiler · Modules      │
├────────────────────────────────────────────────────────┤
│  Domain Layer      Config · Result · IL · Type System   │
├────────────────────────────────────────────────────────┤
│  Infrastructure    Loaders · Lifter · Signal · Sandbox  │
└────────────────────────────────────────────────────────┘

Multi-plataforma: Windows (WinSock/Toolhelp), Linux (ptrace/seccomp), macOS (Mach API), BSD (sysctl)

🔧 Compilación

git clone https://github.com/MethodWhite/Noctua-C.git
cd Noctua-C
make

Dependencias (todas opcionales): capstone · fftw3 · libcurl · yara

Comando Resultado
make noctua + lib/libnoctua.a + lib/libnoctua.so
make CC=clang Compilar con Clang
make test Tests
make clean Limpia build
make updater Check de actualizaciones
make updater-service Instalar systemd service

🚀 Uso

# Análisis completo
./noctua /bin/ls

# SandBox
./noctua sandbox isolate          # Activar sandbox
./noctua sandbox exec /bin/ls     # Ejecutar en sandbox
./noctua ramexec malware.exe      # Ejecutar en RAM

# Forense
./noctua /bin/ls evasion          # Anti-Debug/Anti-VM
./noctua /bin/ls injection        # Process injection
./noctua /bin/ls mitre            # MITRE ATT&CK
./noctua /bin/ls ransomware       # Ransomware
./noctua /bin/ls decrypt          # Decryption engine
./noctua /bin/ls intel            # Threat intelligence
./noctua /bin/ls classify         # Classification + CVSS
./noctua /bin/ls behavior         # Behavioral analysis
./noctua memforensic              # Memory forensics
./noctua network                  # Network analysis
./noctua storage                  # NVMe/SATA/disk RE
./noctua pcap capture.pcap        # PCAP analysis
./noctua carving disk.img         # File carving
./noctua firmware firmware.bin    # Firmware analysis
./noctua /tmp yara_scanner        # YARA directorio recursivo

# Threat Intelligence
./noctua /bin/ls intel            # IOCs, hashes, YARA, families
./noctua /bin/ls classify         # Classification + CVSS
./noctua ioc /bin/ls              # IOC database lookup

# Automatización
./noctua pipeline quick           # Pipeline rápido
./noctua batch /bin               # Batch analysis
./noctua tui                      # Terminal interactiva

# Web GUI
tools/noctua_rest_api &           # REST API (puerto 8080)
bash tools/noctua_web/run.sh      # Dashboard HTML

# YARA
NOCTUA_YARA_RULES=myrules ./noctua /bin/ls yara_scanner

📋 Listado de Módulos (72)

SandBox + RAM (6):     sandbox, ramexec, ramanalyze, position, sidechannel, autopack

Forense (30):          evasion, antivm-pro, injection, mitre, persistence,
                       memforensic, network, pcap, storage, report, export,
                       debug, anti-forensics, batch, carving, firmware, stego,
                       ransomware, obfuscation, anti-sandbox, registry, decrypt,
                       decompile, intel, report-pro, pipeline, classify, behavior,
                       escalation, fuzz

Threat Intel (4):      intel, classify, ioc, behavior

Estáticos (12):        binary_analysis, packer_detector, yara_scanner, entropy_map,
                       dataflow, xref_analyzer, cfg, diff, cs_disassembler,
                       branch_timing, sca_timing, aes_sca, aes_key_extract,
                       aes_key_tracer, aes_emulator

Móvil (10):            apk_analyzer, manifest_parser, jni_analyzer,
                       il2cpp_analysis, il2cpp_dumper, il2cpp_dumper_v2,
                       il2cpp_strings_extractor, il2cpp_key_extractor,
                       objc_runtime, swift_demangler

Profesional (10):      report-pro, intel, classify, behavior, pipeline,
                       decrypt, decompile, autopack, tui, updater

Multimedia (2):        audio_extractor, unity_data_extractor

✅ Roadmap Completado

  • SandBox multicapa (6 capas: FS/NET/SECCOMP/MEM/PROC/TIME)
  • RAM executor + analyzer
  • 72 módulos de análisis forense
  • Anti-Debug & Anti-VM (técnicas conocidas y oscuras)
  • Process injection, MITRE ATT&CK, persistence
  • Memory forensics, network C2, PCAP parser
  • Storage RE (MBR/GPT/ATA/NVMe/SMART)
  • Anti-forensics, ransomware, obfuscation
  • Decryption engine (XOR/RC4/base64/AES)
  • Threat intelligence, IOC database, YARA scanner
  • Classification (CVSS v3, 10 familias)
  • Behavioral analysis (ptrace API tracing)
  • Professional HTML reports + JSON/CSV export
  • Configurable pipeline + batch analysis
  • REST API + Web GUI dashboard
  • TUI interactiva
  • Auto-updater (systemd, cron, background daemon)
  • Fuzzing harness generator
  • Escalación de privilegios y movimiento lateral
  • YARA: 24 reglas built-in, escaneo de directorios
  • File carving (11 formatos)
  • Firmware analysis (squashfs/jffs2/ubi)
  • Steganography detection
  • Multi-plataforma: Windows, Linux, macOS, BSD
  • Python bindings (libnoctua.so + 65/72 módulos portados)
  • CI/CD: CodeQL, Secrets, auto-merge, labeler
  • 0 warnings · 0 errores de compilación

📜 Licencia

MIT

About

Tool-CyberSec-Forensic-Noctua-C - High-performance C reverse engineering framework. Supports ELF, DEX, PE, Mach-O, WASM, WebP, FSB5, Unity formats. Modules: AES SCA, IL2CPP, Capstone disasm, branch timing, dataflow, audio extraction, XREF, type recovery, memory forensics.

Resources

Readme

Code of conduct

Code of conduct

Contributing

Contributing

Security policy

Security policy
Activity

Stars

6 stars

Watchers

0 watching

Forks

2 forks
Report repository

Releases

Packages

Contributors

Languages