# TasoX Security Tools

> Documentation hub for TasoX open-source security research tools.

## Docs

- [Overview](https://witchking.mintlify.app/tools/triage-llm-lab/overview.md): AI-powered malware and forensics analysis lab orchestrated through Claude Code and MCP servers.
- [Architecture](https://witchking.mintlify.app/tools/triage-llm-lab/architecture.md): Network topology and data flow of the triage-llm-lab.
- [Prerequisites](https://witchking.mintlify.app/tools/triage-llm-lab/prerequisites.md): Hardware, software, and account requirements before building the lab.
- [VM1 — Ubuntu LLM Host](https://witchking.mintlify.app/tools/triage-llm-lab/vm1-setup.md): Install and configure the Claude Code orchestration host.
- [VM2 — REMnux Analysis Machine](https://witchking.mintlify.app/tools/triage-llm-lab/vm2-setup.md): Import REMnux and install additional analysis tools.
- [VM3 — SIFT Workstation](https://witchking.mintlify.app/tools/triage-llm-lab/vm3-setup.md): Import SIFT Workstation and configure it for AI-driven digital forensics.
- [VM4 — Windows 11 Setup](https://witchking.mintlify.app/tools/triage-llm-lab/vm4-setup.md): Configure Windows 11 for dynamic malware analysis with x64dbg, WinDbg, and FakeNet-NG.
- [Network & SSH Setup](https://witchking.mintlify.app/tools/triage-llm-lab/network-ssh.md): Configure static IPs and passwordless SSH between VM1 and VM2.
- [remnux-ssh MCP](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/remnux-ssh.md): Custom MCP server that lets Claude Code run analysis commands on REMnux over SSH.
- [sift-ssh MCP](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/sift-ssh.md): Build and register the sift-ssh MCP server — gives Claude direct access to SIFT forensic tools over SSH.
- [VirusTotal MCP](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/virustotal.md): Hash lookups, file reports, behavioral analysis, and sample downloads via VirusTotal.
- [Ghidra MCP (Docker)](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/ghidra.md): Headless Ghidra decompilation via Docker on REMnux.
- [x64dbg MCP](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/x64dbg.md): Connect Claude Code to x64dbg on Windows VM4 via SSH tunnel for AI-driven malware debugging.
- [WinDbg MCP](https://witchking.mintlify.app/tools/triage-llm-lab/mcp-servers/windbg.md): Connect Claude Code to WinDbg/CDB on Windows VM4 via SSH tunnel for crash dump and kernel analysis.
- [REMnux Analysis Tools](https://witchking.mintlify.app/tools/triage-llm-lab/analysis-tools.md): Complete reference of all analysis tools available on REMnux, organized by category.
- [SIFT Forensic Tools](https://witchking.mintlify.app/tools/triage-llm-lab/sift-tools.md): Complete reference of forensic tools available on the SIFT Workstation.
- [Windows Dynamic Analysis Tools](https://witchking.mintlify.app/tools/triage-llm-lab/windows-tools.md): Reference for x64dbg, WinDbg, FakeNet-NG, and their MCP integrations on VM4.
- [Troubleshooting](https://witchking.mintlify.app/tools/triage-llm-lab/troubleshooting.md): Common issues and fixes when setting up or running the lab.
- [Full PE Sample Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/pe-analysis.md): End-to-end workflow for analyzing a Windows PE binary.
- [Shellcode / Raw Binary Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/shellcode-analysis.md): Load and decompile headerless shellcode or raw binaries with Ghidra via remnux-ssh.
- [Office Document Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/office-docs.md): Analyze malicious Office documents with macro emulation.
- [JavaScript Deobfuscation](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/js-deobfuscation.md): Deobfuscate and analyze malicious JavaScript.
- [.NET Assembly Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/dotnet-analysis.md): Reverse engineer C#, VB.NET, and F# compiled assemblies.
- [PyInstaller Sample Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/pyinstaller.md): Unpack and decompile compiled Python malware.
- [Java / JAR Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/java-analysis.md): Decompile and analyze JAR files and Android APKs via remnux-ssh.
- [Go Binary Analysis](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/go-analysis.md): Analyze compiled Go binaries to extract modules, capabilities, and IOCs via remnux-ssh.
- [Memory Forensics](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/memory-forensics.md): Analyze Windows/Linux memory dumps with Volatility3 via the sift-ssh MCP.
- [Disk Image Forensics](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/disk-forensics.md): Investigate disk images with Sleuthkit, Plaso, and file carving via the sift-ssh MCP.
- [Dynamic Analysis with x64dbg + FakeNet](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/dynamic-analysis.md): Run malware under x64dbg with FakeNet network simulation on Windows VM4.
- [Unpacking with x64dbg](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/unpacking.md): Detect the Original Entry Point and dump an unpacked binary from memory using x64dbg MCP.
- [Crash Dump Analysis with WinDbg](https://witchking.mintlify.app/tools/triage-llm-lab/workflows/crash-dump.md): Analyze Windows crash dumps (.dmp) using the WinDbg MCP on VM4.
- [Overview](https://witchking.mintlify.app/tools/ti-agent/overview.md): AI-powered threat intelligence briefing tool powered by Claude.
- [Installation](https://witchking.mintlify.app/tools/ti-agent/install.md): Install TI Agent and its dependencies.
- [Quick Start](https://witchking.mintlify.app/tools/ti-agent/quickstart.md): Run TI Agent and generate your first briefing.
- [API Reference](https://witchking.mintlify.app/tools/ti-agent/api-reference.md): All REST endpoints exposed by the TI Agent backend.
- [Database](https://witchking.mintlify.app/tools/ti-agent/database.md): SQLite schema used by TI Agent for persistence.
- [Export Formats](https://witchking.mintlify.app/tools/ti-agent/exports.md): Export TI Agent reports in Markdown, HTML, PDF, or DOCX.
- [Troubleshooting](https://witchking.mintlify.app/tools/ti-agent/troubleshooting.md): Common issues and fixes for TI Agent.
- [Overview](https://witchking.mintlify.app/tools/dmphunter/overview.md): Hunt indicators inside Windows mini/full process dumps.
- [Installation](https://witchking.mintlify.app/tools/dmphunter/install.md): Install dmpHunter on Linux, macOS, or Windows.
- [Quick Start](https://witchking.mintlify.app/tools/dmphunter/quickstart.md): Common dmpHunter commands to get started fast.
- [memmap](https://witchking.mintlify.app/tools/dmphunter/commands/memmap.md): Show memory regions with decoded protection flags.
- [handles](https://witchking.mintlify.app/tools/dmphunter/commands/handles.md): List handles with decoded access masks.
- [threads](https://witchking.mintlify.app/tools/dmphunter/commands/threads.md): List threads with TEB and stack ranges.
- [modules](https://witchking.mintlify.app/tools/dmphunter/commands/modules.md): List modules and their import tables (IAT).
- [strings](https://witchking.mintlify.app/tools/dmphunter/commands/strings.md): Stream-extract ASCII and UTF-16LE strings from dump regions.
- [scan](https://witchking.mintlify.app/tools/dmphunter/commands/scan.md): Streaming YARA scan over selected memory regions.
- [net](https://witchking.mintlify.app/tools/dmphunter/commands/net.md): Correlate socket handles to threads and extract network endpoints.
- [dump / dump-json / dump-csv](https://witchking.mintlify.app/tools/dmphunter/commands/dump.md): Dump raw bytes for a VA range or export triage data.
- [Recipes](https://witchking.mintlify.app/tools/dmphunter/recipes.md): Common investigation workflows with dmpHunter.
- [Troubleshooting & FAQ](https://witchking.mintlify.app/tools/dmphunter/troubleshooting.md): Common issues and answers for dmpHunter.
- [Overview](https://witchking.mintlify.app/tools/accdu-inspector/overview.md): Forensic analyzer for Microsoft Access databases.
- [Installation](https://witchking.mintlify.app/tools/accdu-inspector/install.md): Install accdu_inspector and its dependencies.
- [How It Works](https://witchking.mintlify.app/tools/accdu-inspector/how-it-works.md): Processing pipeline inside accdu_inspector.
- [CLI Reference](https://witchking.mintlify.app/tools/accdu-inspector/cli-reference.md): All flags and tuning parameters for accdu_inspector.
- [Heuristic Scoring](https://witchking.mintlify.app/tools/accdu-inspector/scoring.md): How accdu_inspector calculates suspicion scores.
- [Output Structure](https://witchking.mintlify.app/tools/accdu-inspector/output-structure.md): Directory layout produced by accdu_inspector.
- [Example Workflows](https://witchking.mintlify.app/tools/accdu-inspector/workflows.md): Common investigation patterns with accdu_inspector.
- [Best Practices](https://witchking.mintlify.app/tools/accdu-inspector/best-practices.md): Tips for effective accdu_inspector triage.
- [Overview](https://witchking.mintlify.app/tools/raradsextractor/overview.md): Safe Python-only parser for RAR5 archives targeting Alternate Data Streams.
- [How It Works](https://witchking.mintlify.app/tools/raradsextractor/how-it-works.md): RAR5 parsing and ADS extraction pipeline.
- [Usage](https://witchking.mintlify.app/tools/raradsextractor/usage.md): Run rarADSExtractor against a suspicious RAR5 archive.
- [Overview](https://witchking.mintlify.app/tools/apophis/overview.md): Bash script that generates shellcode runners in multiple formats.
- [Installation](https://witchking.mintlify.app/tools/apophis/install.md): Install Apophis and its dependencies on Kali Linux.
- [Usage & Folder Layout](https://witchking.mintlify.app/tools/apophis/usage.md): How Apophis is organized and what it produces.
- [Triple DES](https://witchking.mintlify.app/tools/apophis/runners/3des.md): 3DES-encrypted shellcode runners.
- [AMSI Bypass](https://witchking.mintlify.app/tools/apophis/runners/amsi-bypass.md): AMSI patching and unhooking shellcode runners.
- [XSL / JS / HTA](https://witchking.mintlify.app/tools/apophis/runners/dotnet-script.md): Script-based shellcode runners via DotNetToJScript.
- [ConfuserEx + Net-Obfuscator](https://witchking.mintlify.app/tools/apophis/runners/confuserex.md): Double-obfuscated shellcode runners.
- [MSI Runner](https://witchking.mintlify.app/tools/apophis/runners/msi.md): Generate and execute MSI-based shellcode runners.
- [InstallUtil (AppLocker Bypass)](https://witchking.mintlify.app/tools/apophis/runners/installutil.md): Execute shellcode runners via InstallUtil.
- [AES + Compression](https://witchking.mintlify.app/tools/apophis/runners/aes.md): AES-encrypted and compressed shellcode runners.
- [Downloaders (One-Liners)](https://witchking.mintlify.app/tools/apophis/downloaders.md): PowerShell one-liners for downloading and executing runners.
- [Execute via Reflection](https://witchking.mintlify.app/tools/apophis/reflection.md): Reflective loading of .NET assemblies.
- [Overview](https://witchking.mintlify.app/tools/browser-extension/overview.md): Chrome/Edge extension that uses Native Messaging to execute code from the browser.
- [Installation](https://witchking.mintlify.app/tools/browser-extension/install.md): Install the extension and configure the native messaging host.
- [Troubleshooting](https://witchking.mintlify.app/tools/browser-extension/troubleshooting.md): Common issues and fixes for the browser extension.

## Optional

- [GitHub](https://github.com/tasox)
- [X / Twitter](https://x.com/taso_x)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.