ai-logic-scanner

AI Logic Scanner

Purpose

Find exploitable logic vulnerabilities in Windows PE binaries using LLM-driven code analysis instead of regex pattern matching. The scanner builds a cross-module callgraph from attacker-reachable entry points, classifies every node (MUST_READ / KNOWN_API / TELEMETRY / LIBRARY), and delivers code to the AI agent in depth-level batches. The agent analyzes each batch for authentication, authorization, state management, and trust boundary flaws, returns taint-guided requests for deeper functions, and reads deeper code itself via Shell -- iterating until max depth or taint termination.

This is NOT a pattern scanner. All vulnerability detection decisions are made by the LLM agent using adversarial prompting, invariant decomposition, and type-specific specialist knowledge. A separate skeptic agent independently verifies each finding.

When to Use

• Scan a module for logic vulnerabilities (auth bypass, state machine errors, confused deputy, privilege escalation)
• Analyze a specific RPC handler or COM method for authorization gaps
• Deep analysis of a call chain from an entry point to privileged operations
• AI-driven vulnerability research on decompiled Windows service binaries
• When static analysis produces too many false positives or misses subtle logic bugs that require understanding control flow and state

When NOT to Use

• Memory corruption (buffer overflows, integer overflows, UAF) -- use ai-memory-corruption-scanner or /memory-scan
• Code lifting or rewriting -- use code-lifter
• General function explanation -- use re-analyst or /explain

Data Sources

SQLite Databases (primary)

Individual analysis DBs in extracted_dbs/ provide the raw data:

• functions.decompiled_code -- Hex-Rays decompiled C (read on demand)
• functions.assembly_code -- x64 assembly ground truth (read on demand)
• functions.simple_outbound_xrefs -- Callgraph edges
• functions.function_signature -- Parameter types and names
• file_info.exports -- Exported functions
• file_info.entry_point -- PE entry points