TCPK Security Audit Report

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\DBAccess.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Checks the file's Authenticode digital signature.
# STEP 1 - RUN THIS IN POWERSHELL:
Get-AuthenticodeSignature -FilePath 'C:\ProgramData\DVTA\DBAccess.dll' | Format-List Status,StatusMessage,SignerCertificate
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  Status is NotSigned, HashMismatch, or Unknown (the file is unsigned, tampered, or untrusted).
#   OK          if  Status is Valid.
# TOOL: PowerShell

# WHAT THIS CHECKS: Checks the file's Authenticode digital signature.
# STEP 1 - RUN THIS IN POWERSHELL:
Get-AuthenticodeSignature -FilePath 'C:\ProgramData\DVTA\DVTA.vshost.exe' | Format-List Status,StatusMessage,SignerCertificate
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  Status is NotSigned, HashMismatch, or Unknown (the file is unsigned, tampered, or untrusted).
#   OK          if  Status is Valid.
# TOOL: PowerShell

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'devartifact.debug-symbols'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'authflags.client-side-gate'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Confirms whether a backend host the app talks to is reachable, and how the connection is secured.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-NetConnection <host> -Port 443
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the host is contacted over http:// (credentials sent in cleartext) or it accepts a forged/invalid certificate.
#   OK          if  it uses https with a valid, properly-validated certificate.
# NOTE: to see the real traffic, capture it with Burp or Fiddler while using the app.
# TOOL: PowerShell + an intercepting proxy (Burp / Fiddler)

# WHAT THIS CHECKS: Confirms whether a backend host the app talks to is reachable, and how the connection is secured.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-NetConnection <host> -Port 443
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the host is contacted over http:// (credentials sent in cleartext) or it accepts a forged/invalid certificate.
#   OK          if  it uses https with a valid, properly-validated certificate.
# NOTE: to see the real traffic, capture it with Burp or Fiddler while using the app.
# TOOL: PowerShell + an intercepting proxy (Burp / Fiddler)

# WHAT THIS CHECKS: Scans the file's text for things that look like LIVE secrets - Azure storage keys, connection strings, PEM private keys, AWS access keys, or JWT tokens.
# STEP 1 - RUN THIS IN POWERSHELL:
([regex]::Matches([Text.Encoding]::Unicode.GetString([IO.File]::ReadAllBytes('C:\ProgramData\DVTA\DVTA.exe.config')),'DefaultEndpointsProtocol=https?;[A-Za-z0-9=;._/+\-]{0,300}AccountKey=[A-Za-z0-9+/=]{20,}|AccountKey=[A-Za-z0-9+/=]{20,}|-----BEGIN [A-Z ]+KEY|AKIA[A-Z0-9]{16}|eyJ[A-Za-z0-9_-]{10,}')).Value
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  it prints a real secret - e.g. AccountKey=..., a DefaultEndpointsProtocol=... connection string, an AKIA... AWS key, an eyJ... JWT, or a -----BEGIN ... KEY----- block.
#   OK          if  it prints nothing (only placeholders, or there are no secrets in the file).
# NOTE: this reads the file as UTF-16 (Unicode) text. If the secret is stored as plain ASCII, change ::Unicode to ::UTF8 and run it again. To dump EVERY readable string instead: strings.exe -u 'C:\ProgramData\DVTA\DVTA.exe.config'
# TOOL: PowerShell built-in (alternative: Sysinternals strings.exe)

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\DVTA.exe'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\ExcelLibrary.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'obfuscation.absent'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Checks crash-dump and pagefile settings that could leak secrets to disk.
# STEP 1 - RUN THIS IN POWERSHELL:
reg query "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting"
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  full crash dumps are enabled, or the pagefile is not cleared at shutdown (in-memory secrets can reach disk).
#   OK          if  crash dumps are minidump-only AND ClearPageFileAtShutdown = 1.
# TOOL: reg.exe / PowerShell

# WHAT THIS CHECKS: Checks whether a .NET assembly is strong-named (which makes it harder to silently replace).
# STEP 1 - RUN THIS IN POWERSHELL:
[Reflection.AssemblyName]::GetAssemblyName('C:\ProgramData\DVTA\DBAccess.dll').GetPublicKeyToken()
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the output is EMPTY - the assembly is not strong-named and can be modified or swapped out.
#   OK          if  a public-key token (a row of bytes) is printed.
# TOOL: PowerShell

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\EntityFramework.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\DVTA.exe'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\EntityFramework.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Checks whether data the app exports to CSV/Excel could be interpreted as a spreadsheet FORMULA (CSV/formula injection).
# STEP 1 - DO THIS MANUALLY:
#   - In the app, put a value that STARTS WITH = into a field that later gets exported -- e.g. type   =1+1   (or   =HYPERLINK('http://attacker/x','click')  ) into a name/comment/description field.
#   - Use the app's normal Export-to-CSV / Export-to-Excel feature to export that data.
#   - Open the exported .csv / .xlsx in Microsoft Excel and look at the cell you controlled.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  Excel shows '2' (the formula ran) or a clickable hyperlink -- the leading '=' was NOT escaped, so =WEBSERVICE(...)/=HYPERLINK(...) can exfiltrate data and (older Excel) =cmd|... can run commands.
#   OK          if  Excel shows the literal text   =1+1   (the cell was prefixed with a single quote or the formula characters were neutralized).
# NOTE: Also try leading   +   -   @   tab and carriage-return; all are treated as formula starters by spreadsheet apps.
# TOOL: the app + Microsoft Excel

# WHAT THIS CHECKS: Checks crash-dump and pagefile settings that could leak secrets to disk.
# STEP 1 - RUN THIS IN POWERSHELL:
reg query "HKLM\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting"
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  full crash dumps are enabled, or the pagefile is not cleared at shutdown (in-memory secrets can reach disk).
#   OK          if  crash dumps are minidump-only AND ClearPageFileAtShutdown = 1.
# TOOL: reg.exe / PowerShell

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'storage.registry-credential'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Tests whether the app pins or validates its TLS server certificates.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkTlsPinning -Path 'C:\ProgramData\DVTA'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the app's HTTPS calls SUCCEED when routed through your forged-certificate proxy (no pinning / no validation).
#   OK          if  those calls FAIL through the proxy (pinning or validation is working).
# NOTE: to test live, MITM the running app with mitmproxy or Burp using a self-signed CA.
# TOOL: PowerShell + mitmproxy / Burp

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'alpc.enumerated-clean'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: A map of the entry points TCPK found - protocols, pipes, COM, RPC, ports, listeners.
# STEP 1 - DO THIS MANUALLY:
#   - Open attack-surface.json in the output folder.
#   - Triage each entry point for authentication and input validation.
# STEP 2 - WHAT IT MEANS:
#   Informational map, not a vulnerability by itself. Use it to decide what to test next.
# TOOL: TCPK

# WHAT THIS CHECKS: Checks the file's Authenticode digital signature.
# STEP 1 - RUN THIS IN POWERSHELL:
Get-AuthenticodeSignature -FilePath 'C:\ProgramData\DVTA\DVTA.vshost.exe' | Format-List Status,StatusMessage,SignerCertificate
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  Status is NotSigned, HashMismatch, or Unknown (the file is unsigned, tampered, or untrusted).
#   OK          if  Status is Valid.
# TOOL: PowerShell

# WHAT THIS CHECKS: Checks the file's Authenticode digital signature.
# STEP 1 - RUN THIS IN POWERSHELL:
Get-AuthenticodeSignature -FilePath 'C:\ProgramData\DVTA' | Format-List Status,StatusMessage,SignerCertificate
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  Status is NotSigned, HashMismatch, or Unknown (the file is unsigned, tampered, or untrusted).
#   OK          if  Status is Valid.
# TOOL: PowerShell

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'strings.summary'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'sxs.manifest'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Confirms whether a backend host the app talks to is reachable, and how the connection is secured.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-NetConnection <host> -Port 443
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the host is contacted over http:// (credentials sent in cleartext) or it accepts a forged/invalid certificate.
#   OK          if  it uses https with a valid, properly-validated certificate.
# NOTE: to see the real traffic, capture it with Burp or Fiddler while using the app.
# TOOL: PowerShell + an intercepting proxy (Burp / Fiddler)

# WHAT THIS CHECKS: These are anti-tamper / hardening signals, not vulnerabilities by themselves.
# STEP 1 - DO THIS MANUALLY:
#   - Decompile the flagged routine in a .NET or native decompiler.
#   - Check whether the anti-debug / integrity check actually gates execution.
# STEP 2 - WHAT IT MEANS:
#   Informational. It is GOOD if the check genuinely stops execution when triggered; it is WEAK (but still not a vuln) if the check is present but never enforced.
# TOOL: a .NET / native decompiler

# WHAT THIS CHECKS: Re-validate this finding using its reported File and Evidence values.
# STEP 1 - DO THIS MANUALLY:
#   - Re-run the TCPK check for rule 'ui.no-screen-capture-protection'.
#   - Inspect the reported File and Evidence; use the Evidence value as a search term.
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the Evidence value is real, reachable, and does what the finding describes.
#   OK          if  the Evidence is a false positive (a placeholder, dead code, or unreachable).
# TOOL: TCPK / PowerShell

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\EntityFramework.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)

# WHAT THIS CHECKS: Finds the exact code locations TCPK flagged so you can read the real logic in a decompiler.
# STEP 1 - RUN THIS IN POWERSHELL:
Test-TcpkCallsites -Path 'C:\ProgramData\DVTA\ExcelLibrary.dll'
# STEP 2 - READ THE OUTPUT:
#   VULNERABLE  if  the flagged method returns a constant 'true' for certificate validation, or it deserializes/parses untrusted input with no checks.
#   OK          if  it builds an X509Chain, compares a certificate thumbprint, or validates the input before using it.
# NOTE: open the flagged method in a .NET decompiler (ILSpy or dnSpy) to read the method body.
# TOOL: PowerShell + a .NET decompiler (ILSpy / dnSpy)