[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93159":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":21,"createdAt":10,"pushedAt":10,"updatedAt":32,"readmeContent":33,"aiSummary":34,"trendingCount":15,"starSnapshotCount":15,"syncStatus":35,"lastSyncTime":36,"discoverSource":37},93159,"hacksguard","Rhacknarok\u002Fhacksguard","Rhacknarok","A blazingly fast, multi-threaded TUI malware analysis tool built in Rust. Features deep PE parsing, YARA scanning, and heuristic risk scoring.","",null,"Rust",119,17,90,0,27,46.47,"MIT License",false,"main",[22,23,24,25,26,27,28,29,30,31],"cybersecurity","malware","malware-analysis","pe-parser","reverse-engineering","rust","static-analysis","threat-hunting","tui","yara","2026-07-22 04:02:08","# Hacksguard 0.3 - Blazing Fast TUI Malware Analysis Tool 🛡️\n\n![Rust](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Frust-stable-orange?style=flat-square&logo=rust)\n![License](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-MIT-blue?style=flat-square)\n![Platform](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fplatform-linux%20%7C%20windows%20%7C%20macos-lightgrey?style=flat-square)\n\n![Hacksguard TUI Malware Analysis Dashboard](assets\u002Fhacksguard.gif)\n\nHacksguard is a blazingly fast, multi-threaded Terminal UI (TUI) static analysis tool designed for SOC analysts, threat hunters, and reverse engineers. Built entirely in Rust, it provides an intuitive dashboard for quick triage and deep inspection of Portable Executable (PE) files right from your terminal.\n\n## 🌟 Key Features\n\n- **Blazing Fast & Multi-Threaded**: The core analysis pipeline (PE parsing, YARA scanning, and entropy calculation) runs concurrently. This ensures zero UI latency, even when analyzing large executables.\n- **Advanced Risk Scoring**: Hacksguard automatically compiles a 0-100% Risk Score based on 5 heuristic axes (Entropy, Suspicious APIs, PE Anomalies, Strings, and Packing), visualized beautifully through an interactive radar chart.\n- **Integrated YARA Engine**: Powered by the `boreal` crate, Hacksguard dynamically loads local YARA rules (e.g., Elastic protections-artifacts and Neo23x0 signature-base) to detect known threats, packers, and evasion techniques.\n- **Deep PE Inspection**: Comprehensive breakdown of the PE format, including Headers, Sections, Imports (categorized by severity), Exports, Security Mitigations (ASLR, DEP, CFG), and Authenticode verification.\n- **Visual Entropy Graph**: A dedicated Entropy tab plots the Shannon entropy distribution of the file using sparklines, allowing analysts to visually spot encrypted or packed payloads instantly.\n- **Auto-Decoding Strings**: Automatically extracts and categorizes strings (IPs, URLs, Registry keys). Suspicious strings matching the Base64 alphabet are decoded on the fly directly in the interface.\n- **Built-in Disassembler & Hex View**: Inspect raw x86\u002Fx64 opcodes at the Entry Point via the `iced-x86` integration, or dive into raw bytes with the built-in Hex Dump viewer.\n- **Overlay Detection**: Automatically detects appended hidden data at the end of the binary, a technique commonly used by droppers and malicious installers.\n- **CLI Mode \u002F CI-CD Ready**: Run `hacksguard --json \u003Cfile>` to bypass the terminal UI and export the full analysis report as a structured JSON object for SIEM\u002FSOAR integrations.\n\n## 📦 Installation\n\n### Building from source\n\nMake sure you have Rust and Cargo installed. Clone the repository with its submodules:\n\n```bash\ngit clone --recursive https:\u002F\u002Fgithub.com\u002FRhacknarok\u002Fhacksguard.git\ncd hacksguard\ncargo build --release\n```\n\nIf already cloned without submodules:\n\n```bash\ngit submodule update --init --recursive\ncargo build --release\n```\n\nThe compiled binary will be available at `target\u002Frelease\u002Fhacksguard`.\n\n### Nixpkgs\n\nFor Nix or NixOS users is a [package](https:\u002F\u002Fsearch.nixos.org\u002Fpackages?channel=unstable&from=0&size=50&sort=relevance&type=packages&query=hacksguard)\navailable in Nixpkgs. Keep in mind that the lastest releases might only\nbe present in the ``unstable`` channel.\n\n```bash\n$ nix-env -iA nixos.hacksguard\n```\n\n## 🚀 Usage\n\nRun Hacksguard by providing the path to the executable you want to analyze:\n\n```bash\ncargo run --release -- \u003Cpath\u002Fto\u002Fbinary.exe>\n```\n\n### Keyboard Shortcuts\n\n- `Tab` \u002F `Right Arrow`: Next Tab\n- `Shift+Tab` \u002F `Left Arrow`: Previous Tab\n- `Up` \u002F `Down` \u002F `k` \u002F `j`: Scroll\n- `PageUp` \u002F `PageDown`: Fast Scroll\n- `q` \u002F `Esc`: Quit\n\n## Dependencies\n\n- `ratatui` & `crossterm` - TUI rendering\n- `goblin` - PE\u002FELF parsing\n- `boreal` - Pure Rust YARA engine\n- `iced-x86` - Disassembler\n\n\n## 🔗 Related Projects\n\n- [Elastic Protections Artifacts](https:\u002F\u002Fgithub.com\u002Felastic\u002Fprotections-artifacts) - YARA rules\n- [Neo23x0 Signature Base](https:\u002F\u002Fgithub.com\u002FNeo23x0\u002Fsignature-base) - YARA rules\n\n## 📸 Screenshots\n\n### Overview\n![Overview](assets\u002Fscreenshots\u002F1%20-%20overview.png)\n\n### PE Headers\n![PE Headers](assets\u002Fscreenshots\u002F2%20-%20headers.png)\n\n### Sections\n![Sections](assets\u002Fscreenshots\u002F3%20-%20sections.png)\n\n### Imports\n![Imports](assets\u002Fscreenshots\u002F4%20-%20imports.png)\n\n### Disassembly\n![Disassembly](assets\u002Fscreenshots\u002F5%20-%20disasm.png)\n\n### Hex View\n![Hex View](assets\u002Fscreenshots\u002F6%20-%20hex.png)\n\n### Strings\n![Strings](assets\u002Fscreenshots\u002F7%20-%20strings.png)\n\n### Entropy\n![Entropy](assets\u002Fscreenshots\u002F8%20-%20entropy.png)\n\n### Analyst Guide\n![Analyst Guide](assets\u002Fscreenshots\u002F9%20-%20guide.png)\n","Hacksguard 是一款基于 Rust 开发的终端界面（TUI）静态恶意软件分析工具，专为快速研判 PE 文件设计。它支持多线程并行处理，提供深度 PE 结构解析、YARA 规则扫描、熵值可视化、启发式风险评分（0–100%）、字符串自动解码、Overlay 检测及内置反汇编\u002F十六进制查看等功能。所有分析在本地完成，无需网络依赖，兼顾交互效率与分析深度。适用于安全运营中心（SOC）日常样本初筛、威胁狩猎中的批量文件评估以及逆向工程师的轻量级静态分析场景。",2,"2026-07-12 02:30:05","CREATED_QUERY"]