TCPK v2.9.0 -- Architecture Flowchart

260 cmdlets | 78 private helpers | 12 audit buckets | 4 UI surfaces

Entry point / core
Audit pipeline
Mono.Cecil IL engine
WinForms GUI
Agentic workbench
MCP server
1
Entry Points -- How TCPK Launches
TCPK.bat
→
powershell -STA -File Start-TCPKGui.ps1
→
Import-Module TCPK
→
WinForms GUI (15 tabs)
Start-TcpkAgentic
→
Import-Module TCPK
→
TcpListener :random-port
→
Loopback SPA (13 tabs)
Start-TcpkMcpServer.ps1
→
Import-Module TCPK
→
stdin/stdout JSON-RPC 2.0
→
11 tools
CLI: Import-Module .\TCPK
→
Invoke-TcpkAudit -Target ...
All 4 surfaces share the same module -- TCPK.psm1 loads Classes/ then Private/ then Public/ (sorted by path). 260 public functions are exported.
2
Module Loading -- TCPK.psm1
Step 1
Classes/
TcpkFinding.ps1
defines [TcpkFinding] type
(Severity, Confidence,
RuleId, Title, File, etc.)
▶
Step 2
Private/ (51 files)
_Decompile.ps1 (Cecil)
_Finding.ps1 (factory)
_Cvss40.ps1 (FIRST.org)
_Attack.ps1 (ATT&CK)
_Identity.ps1 (terms)
_Expand.ps1 (unwrap)
... 45 more helpers
▶
Step 3
Public/ (260 cmdlets)
Invoke-TcpkAudit
Test-Tcpk* (scanners)
Get-Tcpk* (queries)
Export-Tcpk* (reports)
Confirm-Tcpk* (verify)
Invoke-Tcpk* (exploit)
Start-TcpkAgentic
Loading order: sorted by FullName within each folder. All Private/ functions are module-scoped (not exported). Exploit cmdlets ARE exported but gated by Assert-TcpkExploitEnabled at entry.
3
Audit Pipeline -- Invoke-TcpkAudit
Phase 1
Unwrap Target
Expand-TcpkTarget
routes by extension:
.msix -> Expand-TcpkMsix
.msi -> msiexec /a
.zip -> zip-slip guard
dir/exe -> as-is
▶
Phase 2
Identity Terms
Get-TcpkIdentityTerms
MSIX manifest names,
exe ProductName,
folder leaf, deduped
-> $idTerms[]
▶
Phase 3
Run Checks
_RunCheck x 121
across 12 buckets
(A-L). Each check
emits [TcpkFinding]
+ TCPKFND stream
▶
Phase 4
Triage + IL + LLM
Resolve-TcpkFindings
Confirm-TcpkCallsiteUsage
Invoke-TcpkLlmCodeJudgment
Resolve-TcpkFindings
-AggregateOnly
▶
Phase 5
Reports
findings.json
index.html
report.md / .xlsx
report.sarif
intel.html / sbom.cdx
3b
_RunCheck -- Per-Check Execution
_RunCheck $Name $Block
→
Quick-profile skip?
→
Pause check?
→
$r = & $Block
↓
foreach $f in $r
→
$all.Add($f)
+
Write-Information "TCPKFND\t..."
↓
Log: count + duration
→
Add-TcpkCoverage
Each check's output is captured ($r = & $Block), accumulated into $all, AND live-streamed via Write-Information on stream 6. The GUI's job captures stream 6 via 6>&1 redirect.
3c
Audit Buckets (A-L) -- 121 Checks
A: Static Binary Analysis ~42 checks
  • Test-TcpkSignature
  • Test-TcpkSecrets, EntropySecrets
  • Test-TcpkCallsites, Deserialization
  • Test-TcpkTlsBypass, Xxe
  • Test-TcpkElectron, ElectronJs, Fuses
  • Test-TcpkAppDomainHijack, AotBinary
  • Test-TcpkPhantomDlls, DllSideload
  • Test-TcpkCryptoMisuse, Jwt, ZipSlip
  • ... + 24 more scanners
B: MSIX Manifest 9 checks
  • Test-TcpkMsixCapabilities
  • Test-TcpkMsixProtocols
  • Test-TcpkMsixFileAssocs
  • Test-TcpkMsixComServers
  • Test-TcpkMsixExtensions
  • Test-TcpkMsixDeclaredVsUsed
  • Test-TcpkMsixFrameworkDeps
  • Test-TcpkMsixAppInstaller
  • Test-TcpkUacManifest
C: OS Integration ~25 checks
  • Test-TcpkInstallDirAcl, FolderAcls
  • Test-TcpkWritablePath
  • Test-TcpkWerExposure, ComHijack
  • Test-TcpkRegistryFootprint/Acl/Values
  • Test-TcpkServiceBinaryAcl/Perms
  • Test-TcpkAutoStart, WmiPersistence
  • Test-TcpkFirewallRules, AvExclusions
  • Test-TcpkProtocolHandlers, IfeoHijack
D: Credential Storage ~8 checks
  • Test-TcpkDpapiBlobs
  • Test-TcpkPlaintextConfigs
  • Test-TcpkTokenCaches, KeyMaterial
  • Test-TcpkLocalDb
  • Test-TcpkCredentialManager
  • Test-TcpkBrowserTokenStore
  • Test-TcpkAppConfigSecrets
E: Runtime / Live Process ~18 checks
  • Test-TcpkProcessMitigations
  • Test-TcpkListeningPorts
  • Test-TcpkLoadedModuleSignatures
  • Test-TcpkWindowMessages
  • Test-TcpkSharedMemoryDacl
  • Test-TcpkNamedPipes/Dacl
  • Test-TcpkComObjects, MailslotsAlpc
  • Test-TcpkMemorySecrets/Dump
  • Gated: requires -ProcessName
F: Network 10 checks
  • Test-TcpkTlsPinning, TlsProtocols
  • Test-TcpkUpdateFlow
  • Test-TcpkBackendEndpoints
  • Test-TcpkDnsLeakage, CrlOcsp
  • Test-TcpkInsecureSchemes
  • Test-TcpkSelfHostedServer
  • Test-TcpkRpcChannels, GrpcSurface
G: WebView2 7 checks
  • Test-TcpkWv2HostObjects
  • Test-TcpkWv2WebMessage
  • Test-TcpkWv2VirtualHost
  • Test-TcpkWv2DevTools
  • Test-TcpkWv2ScriptInjection
  • Test-TcpkWv2ResourcePolicy
  • Test-TcpkWv2Sideload
H: Logging 4 checks
  • Test-TcpkLogFiles
  • Test-TcpkTelemetrySdks
  • Test-TcpkPiiInLogs
  • Test-TcpkEtwProviders
I: Memory Hygiene 3 checks
  • Test-TcpkWerPolicy
  • Test-TcpkPageFile
  • Test-TcpkSecureStringUsage
J: Anti-Debug 4 checks
  • Test-TcpkAntiDebugRefs
  • Test-TcpkSelfIntegrityCheck
  • Test-TcpkAntiInjection
  • Test-TcpkTimingAntiDebug
4
Post-Check Pipeline -- Triage, IL Verify, LLM, Aggregate
Step 1
Resolve-TcpkFindings
Dedupe + triage
-NoAggregate
(keep per-file)
e.g. 18 -> 15
▶
Step 2 (Cecil)
Confirm-TcpkCallsiteUsage
Deterministic IL verify
Reachable + tainted?
-> Confirmed (IL)
String-only, no call?
-> Likely-FP (IL)
▶
Step 3 (opt-in)
LLM Code Judgment
Invoke-TcpkLlmCodeJudgment
Advisory Confidence:
Confirmed (LLM)
Likely-FP (LLM)
Never changes Severity
▶
Step 4
Aggregate
Resolve-TcpkFindings
-AggregateOnly
Same RuleId+Sev+Conf
-> single finding
with Affected list
▶
Step 5
Enrich + Report
Online CVE (OSV)
Exploit chains
CVSS v4.0 scoring
ATT&CK + TASVS
6 report formats
Report Outputs
findings.json
index.html
report.md
report.xlsx
report.sarif
intel.html
sbom.cdx.json
profile.json
attack-surface.json
exploits.json
strings.json
coverage.json
5
Mono.Cecil IL Engine -- _Decompile.ps1
Initialize-TcpkCecil
→
tools\ILSpy\Mono.Cecil.dll
or
%LOCALAPPDATA%\Programs\ILSpy\
↓
Assembly Reading
  • Get-TcpkCecilAssembly (cache)
  • Test-TcpkIsAotBinary (AOT gate)
  • Get-TcpkMethodIl (disassemble)
  • Get-TcpkCallSites (find callers)
  • Clear-TcpkCecilCache
Verdict Provers
  • Get-TcpkTlsCallbackVerdicts
  • Get-TcpkXxeVerdicts
  • Get-TcpkCryptoVerdicts
  • Get-TcpkTypeNameHandlingVerdicts
  • Get-TcpkCertCallbackIl
  • Test-TcpkIlReturnsTrueUnconditionally
Taint Analysis
  • Get-TcpkCallsiteUsage (main engine)
  • Get-TcpkCallsiteSinkMap (sink defs)
  • Get-TcpkCallsiteSinkApiRegex
  • Get-TcpkTaintedReturningMethods
  • Get-TcpkCrossAsmTaintedReturning
  • Get-TcpkMethodTaintedLocals
  • Get-TcpkTaintedFields
Used By (callers)
  • Confirm-TcpkCallsiteUsage (public)
  • Confirm-TcpkTlsBypass
  • Confirm-TcpkDeserialization
  • Confirm-TcpkCallsites
  • Test-TcpkDebugFlags (DebuggableAttr)
  • GUI: DLL Decompilation tab
  • MCP: tcpk_decompile tool
Cecil is LAZY-LOADED: only initialized when a check or the GUI DLL tab first needs it. AOT binaries are gated (Cecil cannot parse them). Assembly cache ($script:CecilAssemblyCache) avoids re-reads.
6
WinForms GUI -- Start-TCPKGui.ps1
TCPK.bat
→
powershell -STA
→
Import-Module TCPK
→
Build WinForms UI
↓
[Run Audit] clicked
→
Start-Job { Invoke-TcpkAudit @params 6>&1 | ForEach-Object {...} }
↓
Job ForEach-Object
→
InformationRecord TCPKFND\t...
→
"LOG\t..." + "FND\t..."
↓
Poll every 150ms (Receive-Job)
→
^LOG\t -> Write-LogLine (log pane)
→
^FND\t -> Add-Finding (live table)
↓
Job completes
→
$lvFindings.Items.Clear()
→
Load findings.json + CVSS enrich
→
Final sorted table
GUI Tabs (15)
Dashboard KPI cards
Findings live table
Recon / Target profile
DLL Mitigation matrix
DLL Signing certs
DLL Decompile Cecil
Exploit / CVE plan
SBOM components
Hex PE overlay
Strings extraction
Intercept proxy
Process Mon live
Asar Electron
Logs / Runtime
Report preview
DLL Decompilation tab triggers Mono.Cecil: Get-TcpkCecilAssembly -> type/method browser -> Get-TcpkMethodIl for IL disassembly + C# decompilation view.
7
Agentic Workbench -- Start-TcpkAgentic
Start-TcpkAgentic
→
TcpListener :0 (random port)
→
_Agentic.ps1 serves SPA
↓
Browser: http://localhost:PORT/?token=...
→
Inline HTML/JS SPA (13 tabs)
↓
POST /api/audit
→
Invoke-TcpkAudit (in-process)
→
JSON response -> SPA
SPA Tabs (13)
Dashboard
Audit Runner
Findings
Recon
Exploit / CVE
Strings
Decompiler Cecil
SBOM
DLL Matrix
Hex
Intercept
Coverage
Settings
8
MCP Server -- Start-TcpkMcpServer.ps1
Start-TcpkMcpServer.ps1
→
Import-Module TCPK
→
stdin/stdout loop
↓
JSON-RPC 2.0
→
$handlers[$method].Invoke($params)
→
Send-Result
MCP Tools (11)
tcpk_info
tcpk_audit
tcpk_get_findings
tcpk_recon_profile
tcpk_strings
tcpk_cve_match
tcpk_list_modules
tcpk_decompile Cecil
tcpk_exploit_plan
tcpk_generate_poc
9
Key Private Helpers (51 files in Private/)
_Decompile.ps1Mono.Cecil bridge (21 functions)
_Finding.ps1New-TcpkFinding factory + CVSS vector
_Cvss40.ps1FIRST.org CVSS v4.0 score engine
_Attack.ps1MITRE ATT&CK technique mapping
_Tasvs.ps1OWASP TASVS v1.8 control mapping
_Identity.ps1App identity terms + name matching
_Expand.ps1Target unwrap (MSI/ZIP/MSIX)
_Intel.ps1Intel report generation
_ExploitGate.ps1Enable/Assert exploit bucket
_PeReader.ps1PE header parser + hardening
_Llm.ps1LLM backend (Ollama/cloud)
_Agentic.ps1Loopback SPA server + API
_WebUi.ps1Web panel HTML builder
_Recon.ps1Endpoint classification + profile
_Js.ps1JS comment stripper
_Xlsx.ps1New-TcpkXlsx Excel builder
_VerifyHint.ps1How-to-verify per RuleId
_SecretRecovery.ps1DPAPI / credential decrypt
_Intercept.ps1HTTP proxy interception
_Entropy.ps1Shannon entropy calculator
_Log.ps1Write-TcpkLog structured logger
_Sweep.ps1Multi-target audit orchestration
_Coverage.ps1Check coverage tracking
_Msix.ps1MSIX manifest parser
+ 27 more: _Agent, _Bypass, _Checklist, _CredVault, _Data, _EcosystemCve, _EnsureDir, _Eol, _HtmlEsc, _Kev, _Launch, _Liveness, _Logger, _ManagedCve, _MemRead, _Nvd, _Osv, _Platform, _Process, _Progress, _Sbom, _SingleFile, _Strings, _TokenInfo, _UriSink, _Version, _WinCrypto
10
Confidence Ladder -- How Findings Get Proven
Tier 1
Inferred
Regex/string match
presence != invoked
"We found the text"
▶
Tier 2
Confirmed
Factual observation
signing/PE-bit/ACL/file
"We observed the state"
▶
Tier 3 (Cecil)
Confirmed (IL)
Mono.Cecil bytecode
reachable + tainted
"IL proves the call
is live + fed by input"
▶
Tier 4
Confirmed (dynamic)
Invoke-TcpkDynamic
Confirm observed
real behavior at
runtime (gated)
▶
Downgrade
Likely-FP (IL)
String match only,
no real call site,
or all args constant
-> demoted to INFO