Skip to content

command-line.md

Latest commit

 

History

History
76 lines (64 loc) · 4.35 KB

command-line.md

File metadata and controls

76 lines (64 loc) · 4.35 KB
Raw

The src/StardewMalwareScanner project has command-line tools which can be used to interact with the scan results. That includes scanning, searching, and assessing downloads.

Contents

Usage

The project is run using dotnet run --, followed by the tool name and its arguments.

For example, to get the ten latest downloads with critical detections which need to be assessed:

cd src/StardewMalwareScanner
dotnet run -- latest --count 10 --minSeverity critical --assessed false

You can call a tool with --help to view its documentation:

dotnet run -- latest --help

Available tools

You can also see some of the main tool docs in the AI assessment docs.

Agentic AI commands like hunt and assess write detailed logs to the <repo root>/data/logs folder to help troubleshoot API calls. If needed, you can use a chat-based AI in the repo to help investigate (the log path is already in the default AI context).

For initial scan

tool usage
scan Scan the Stardew mod dataset for new downloads (or all downloads if you set --rescan), and create scan result files with metadata and flagged code for review.
decompile

Decompile assemblies for pre-existing scan results produced by scan (for all scan results or those matching a search).

This is only needed when assessing scan results produced on a different computer, since the decompiled code is cached locally.
sideload Add an arbitrary mod download to the repo for scanning (without changing the actual mod dataset). See sideloading.
sideunload Remove a previously sideloaded download and its scan results. See sideloading.

For investigation

tool usage
latest Search across all download scan results and return the top matches, sorted by upload date descending.
hunt Threat hunt downloads programmatically using an AI model API. This passes each download's metadata and file contents to AI to search for suspicious code which the scanner may have missed. If new detections are added, the download's assessment is reset.
setHuntDetections Save threat hunt detections for a download scan result (e.g. from a chat-based threat hunt). If new detections are added, the download's assessment is reset.
assess Assess downloads programmatically using an AI model API without a chat session.
setAssessment Save an assessment for a download scan result.
blacklist Add a mod from a malicious download to the malware blacklist, so SMAPI blocks it for players. See handling malware.

For maintenance

tool usage
archiveMalicious Archives scan results assessed as Malicious into the data/private/archived-scan-results folder, along with a copy of the associated mod dataset file if it still exists.
deleteOrphaned Deletes scan results for downloads which no longer exist in the mod dataset (e.g. because their mod pages were deleted, or they were superseded by newer downloads).
generateTrustedAssemblies Scan download scan results and generate a list of candidate trusted assembly entries. See assembly verification.

Search

The latest command is the most commonly used by both humans and AIs. This lets you search across all scan results based on arbitrary criteria.

For example:

  • Show current downloads marked malicious: 
    dotnet run -- latest --assessedAs Malicious --count 10
  • Show the scan results for a specific mod: 
    dotnet run -- latest --site Nexus --modPageId 1915 --count 10
  • Show downloads uploaded in the past month which have critical detections (in PowerShell): 
    dotnet run -- latest --minDate "$(Get-Date ((Get-Date).AddMonths(-1)) -Format "yyyy-MM-dd")" --minSeverity Critical --count 10

You can also add --statsOnly to the search command to get aggregate stats about the results instead.