Instruction: What does the file `modules\adultscan.py` do in AUTARCH?

Output:
`modules\adultscan.py` —
AUTARCH Adult Site Scanner Module
Username OSINT for adult-oriented platforms

Searches usernames across adult content sites, fanfiction platforms,
and related communities.

Category: osint
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AdultScanner` class in `modules\adultscan.py` provide?

Output:
The `AdultScanner` class provides these methods: load_custom_sites, save_custom_sites, add_custom_site, manage_custom_sites, remove_custom_site, auto_detect_site, probe_domain, bulk_import, print_status, run_cmd, check_site, scan_username, display_results, export_results, show_menu, select_categories, list_sites, run_scan, run

Class description: Username scanner for adult-oriented sites.


Instruction: What does `AdultScanner.load_custom_sites()` do?

Output: `load_custom_sites()` — Load custom sites from JSON file.


Instruction: What does `AdultScanner.save_custom_sites()` do?

Output: `save_custom_sites()` — Save custom sites to JSON file.


Instruction: What does `AdultScanner.add_custom_site()` do?

Output: `add_custom_site()` — Interactively add a custom site.


Instruction: What does `AdultScanner.manage_custom_sites()` do?

Output: `manage_custom_sites()` — View and manage custom sites.


Instruction: What does `AdultScanner.remove_custom_site()` do?

Output: `remove_custom_site()` — Remove a custom site.


Instruction: What does `AdultScanner.auto_detect_site()` do?

Output: `auto_detect_site()` — Auto-detect URL pattern for a domain.


Instruction: What does `AdultScanner.probe_domain()` do?

Output: `probe_domain(domain, test_user, quiet)` — Probe a domain for working URL patterns. Returns list of (pattern, status_code, url).


Instruction: What does `AdultScanner.bulk_import()` do?

Output: `bulk_import()` — Bulk import sites from custom_sites.inf file.


Instruction: What does `AdultScanner.check_site()` do?

Output: `check_site(site_info, username)` — Check if username exists on a site.


Instruction: What does `AdultScanner.scan_username()` do?

Output: `scan_username(username, categories)` — Scan username across selected site categories.


Instruction: What does `AdultScanner.display_results()` do?

Output: `display_results()` — Display scan results.


Instruction: What does `AdultScanner.export_results()` do?

Output: `export_results(filename)` — Export results to file.


Instruction: What does `AdultScanner.show_menu()` do?

Output: `show_menu()` — Display main menu.


Instruction: What does `AdultScanner.select_categories()` do?

Output: `select_categories()` — Let user select multiple categories.


Instruction: What does `AdultScanner.list_sites()` do?

Output: `list_sites()` — List all sites in database.


Instruction: What does `AdultScanner.run_scan()` do?

Output: `run_scan(categories)` — Run a scan with given categories.


Instruction: What does `AdultScanner.run()` do?

Output: `run()` — Main loop.


Instruction: What does the file `modules\agent.py` do in AUTARCH?

Output:
`modules\agent.py` —
AUTARCH Agent Module
Interactive interface for running autonomous agent tasks

This module provides an interface to give tasks to the autonomous agent
and watch it work through them step by step.

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AgentInterface` class in `modules\agent.py` provide?

Output:
The `AgentInterface` class provides these methods: print_status, print_header, show_tools, on_step_callback, on_state_callback, run_task, interactive_loop, run

Class description: Interactive interface for the AUTARCH agent.


Instruction: What does `AgentInterface.print_status()` do?

Output: `print_status(message, status)` — Print a status message.


Instruction: What does `AgentInterface.print_header()` do?

Output: `print_header(text)` — Print a section header.


Instruction: What does `AgentInterface.show_tools()` do?

Output: `show_tools()` — Display available tools.


Instruction: What does `AgentInterface.on_step_callback()` do?

Output: `on_step_callback(step)` — Callback for when agent completes a step.


Instruction: What does `AgentInterface.on_state_callback()` do?

Output: `on_state_callback(state)` — Callback for agent state changes.


Instruction: What does `AgentInterface.run_task()` do?

Output:
`run_task(task)` — Run a task through the agent.

Args:
    task: Task description.

Returns:
    AgentResult with execution details.


Instruction: What does `AgentInterface.interactive_loop()` do?

Output: `interactive_loop()` — Run interactive task input loop.


Instruction: What does `AgentInterface.run()` do?

Output: `run()` — Module entry point.


Instruction: What does the file `modules\agent_hal.py` do in AUTARCH?

Output:
`modules\agent_hal.py` —
AUTARCH Agent Hal Module
AI-powered security automation for defense and penetration testing

Uses LLM integration for intelligent security operations including:
- MITM attack detection and monitoring
- Automated Metasploit module execution via natural language
- Network security analysis

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AgentHal` class in `modules\agent_hal.py` provide?

Output:
The `AgentHal` class provides these methods: print_status, run_cmd, mitm_detection_menu, full_mitm_scan, detect_arp_spoofing, detect_dns_spoofing, detect_ssl_stripping, detect_rogue_dhcp, check_gateway_anomaly, continuous_monitoring, msf_automation_menu, natural_language_msf, quick_scan_target, exploit_suggester, post_exploitation_helper, pentest_pipeline_menu, show_menu, run

Class description: AI-powered security automation agent.


Instruction: What does `AgentHal.run_cmd()` do?

Output: `run_cmd(cmd, timeout)` — Run a shell command and return output.


Instruction: What does `AgentHal.mitm_detection_menu()` do?

Output: `mitm_detection_menu()` — MITM attack detection submenu.


Instruction: What does `AgentHal.full_mitm_scan()` do?

Output: `full_mitm_scan()` — Run all MITM detection checks.


Instruction: What does `AgentHal.detect_arp_spoofing()` do?

Output: `detect_arp_spoofing()` — Detailed ARP spoofing detection.


Instruction: What does `AgentHal.detect_dns_spoofing()` do?

Output: `detect_dns_spoofing()` — Detailed DNS spoofing detection.


Instruction: What does `AgentHal.detect_ssl_stripping()` do?

Output: `detect_ssl_stripping()` — Detailed SSL stripping detection.


Instruction: What does `AgentHal.detect_rogue_dhcp()` do?

Output: `detect_rogue_dhcp()` — Detect rogue DHCP servers.


Instruction: What does `AgentHal.check_gateway_anomaly()` do?

Output: `check_gateway_anomaly()` — Check for gateway anomalies.


Instruction: What does `AgentHal.continuous_monitoring()` do?

Output: `continuous_monitoring()` — Continuous MITM monitoring mode.


Instruction: What does `AgentHal.msf_automation_menu()` do?

Output: `msf_automation_menu()` — LLM-driven Metasploit automation menu.


Instruction: What does `AgentHal.natural_language_msf()` do?

Output: `natural_language_msf()` — Process natural language requests for MSF operations.


Instruction: What does `AgentHal.quick_scan_target()` do?

Output: `quick_scan_target()` — Quick scan a target using MSF.


Instruction: What does `AgentHal.exploit_suggester()` do?

Output: `exploit_suggester()` — Use LLM to suggest exploits based on target info.


Instruction: What does `AgentHal.post_exploitation_helper()` do?

Output: `post_exploitation_helper()` — LLM-assisted post-exploitation guidance.


Instruction: What does `AgentHal.pentest_pipeline_menu()` do?

Output: `pentest_pipeline_menu()` — PentestGPT-style structured penetration testing menu.


Instruction: What does the file `modules\analyze.py` do in AUTARCH?

Output:
`modules\analyze.py` —
AUTARCH Analyze Module
Forensics and analysis tools

File analysis, hash generation, string extraction, and more.

Category: analyze
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `Analyzer` class in `modules\analyze.py` provide?

Output:
The `Analyzer` class provides these methods: print_status, run_cmd, get_file_hashes, analyze_file, analyze_executable, extract_strings, hash_lookup, analyze_log, hex_dump, compare_files, show_menu, run

Class description: Forensics and analysis tools.


Instruction: What does `Analyzer.get_file_hashes()` do?

Output: `get_file_hashes(filepath)` — Calculate various hashes for a file.


Instruction: What does `Analyzer.analyze_file()` do?

Output: `analyze_file()` — Comprehensive file analysis.


Instruction: What does `Analyzer.analyze_executable()` do?

Output: `analyze_executable(filepath)` — Additional analysis for executables.


Instruction: What does `Analyzer.extract_strings()` do?

Output: `extract_strings()` — Extract strings from file.


Instruction: What does `Analyzer.hash_lookup()` do?

Output: `hash_lookup()` — Look up hash in threat intel.


Instruction: What does `Analyzer.analyze_log()` do?

Output: `analyze_log()` — Analyze log files for anomalies.


Instruction: What does `Analyzer.hex_dump()` do?

Output: `hex_dump()` — Create hex dump of file.


Instruction: What does `Analyzer.compare_files()` do?

Output: `compare_files()` — Compare two files.


Instruction: What does the file `modules\android_advanced.py` do in AUTARCH?

Output:
`modules\android_advanced.py` —
Android Advanced Exploits - Network, app manipulation, system control, data exfil

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidAdvanced` class in `modules\android_advanced.py` provide?

Output:
The `AndroidAdvanced` class provides these methods: show_menu, run_interactive

Class description: Interactive menu for advanced Android exploits.


Instruction: What does the file `modules\android_apps.py` do in AUTARCH?

Output:
`modules\android_apps.py` —
Android App Extraction - Pull APKs, app data, shared preferences

Category: hardware
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidApps` class in `modules\android_apps.py` provide?

Output:
The `AndroidApps` class provides these methods: show_menu, list_packages, pull_apk, pull_app_data, extract_prefs, run_interactive

Class description: Interactive menu for Android app extraction.


Instruction: What does the file `modules\android_boot.py` do in AUTARCH?

Output:
`modules\android_boot.py` —
Android Boot / Recovery Exploit - Bootloader unlock, flash, dm-verity

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidBoot` class in `modules\android_boot.py` provide?

Output:
The `AndroidBoot` class provides these methods: show_menu, bootloader_info, backup_boot, unlock_bootloader, flash_recovery, flash_boot, disable_verity, temp_boot, run_interactive

Class description: Interactive menu for boot/recovery operations.


Instruction: What does the file `modules\android_payload.py` do in AUTARCH?

Output:
`modules\android_payload.py` —
Android Payload Deployment - Deploy binaries, reverse shells, persistence

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidPayload` class in `modules\android_payload.py` provide?

Output:
The `AndroidPayload` class provides these methods: show_menu, deploy_binary, execute_payload, reverse_shell, persistence, list_payloads, kill_payload, run_interactive

Class description: Interactive menu for Android payload deployment.


Instruction: What does the file `modules\android_protect.py` do in AUTARCH?

Output:
`modules\android_protect.py` —
Android Protection Shield - Anti-stalkerware & anti-spyware defense
Detect, analyze, and remove stalkerware and government-grade spyware from Android devices.

Category: defense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidProtect` class in `modules\android_protect.py` provide?

Output:
The `AndroidProtect` class provides these methods: show_menu, do_quick_scan, do_full_scan, do_export_report, do_scan_stalkerware, do_scan_hidden, do_scan_admins, do_scan_accessibility, do_scan_listeners, do_scan_spyware, do_scan_integrity, do_scan_processes, do_scan_certs, do_scan_network, do_scan_devopt, do_dangerous_apps, do_analyze_perms, do_perm_heatmap, do_disable, do_uninstall, do_revoke, do_remove_admin, do_remove_cert, do_clear_proxy, do_shizuku_status, do_install_shizuku, do_start_shizuku, do_install_shield, do_configure_shield, do_grant_shield_perms, do_honeypot_status, do_scan_tracker_apps, do_scan_tracker_perms, do_ad_settings, do_reset_ad_id, do_opt_out_tracking, do_set_dns, do_disable_location, do_deploy_hosts, do_setup_iptables, do_set_fake_location, do_random_location, do_rotate_identity, do_fake_fingerprint, do_activate_honeypot, do_deactivate_honeypot, do_tracker_stats, do_update_trackers, do_sig_stats, do_update_sigs, run_interactive

Class description: Interactive Android protection menu.


Instruction: What does the file `modules\android_recon.py` do in AUTARCH?

Output:
`modules\android_recon.py` —
Android Device Reconnaissance - Extract device data, accounts, messages, history

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidRecon` class in `modules\android_recon.py` provide?

Output:
The `AndroidRecon` class provides these methods: show_menu, device_dump, accounts, wifi_passwords, call_logs, sms_messages, contacts, browser_history, saved_credentials, export_report, run_interactive

Class description: Interactive menu for Android device reconnaissance.


Instruction: What does the file `modules\android_root.py` do in AUTARCH?

Output:
`modules\android_root.py` —
Android Root Methods - Root detection, Magisk install, exploit-based rooting

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidRoot` class in `modules\android_root.py` provide?

Output:
The `AndroidRoot` class provides these methods: show_menu, check_root, install_magisk, pull_patched, root_exploit, adb_root, run_interactive

Class description: Interactive menu for Android rooting operations.


Instruction: What does the file `modules\android_screen.py` do in AUTARCH?

Output:
`modules\android_screen.py` —
Android Screen & Input Control - Screenshots, recording, input injection, keylogger

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidScreen` class in `modules\android_screen.py` provide?

Output:
The `AndroidScreen` class provides these methods: show_menu, screenshot, screen_record, camera, audio, tap, swipe, type_text, keyevent, wake_dismiss, disable_lock, start_keylog, stop_keylog, run_interactive

Class description: Interactive menu for screen/input/capture operations.


Instruction: What does the file `modules\android_sms.py` do in AUTARCH?

Output:
`modules\android_sms.py` —
Android SMS/RCS Manipulation - Insert, delete, spoof messages with custom timestamps

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidSms` class in `modules\android_sms.py` provide?

Output:
The `AndroidSms` class provides these methods: show_menu, list_sms, insert_sms, insert_batch, edit_sms, delete_by_id, delete_by_number, delete_all, rcs_check, rcs_list_msgs, rcs_insert_msg, rcs_delete_msg, run_interactive

Class description: Interactive menu for SMS/RCS manipulation.


Instruction: What does the file `modules\chat.py` do in AUTARCH?

Output:
`modules\chat.py` —
AUTARCH Chat Module
Interactive chat interface for the LLM

This module provides a command-line chat interface to interact with the loaded model.

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `ChatInterface` class in `modules\chat.py` provide?

Output:
The `ChatInterface` class provides these methods: print_status, print_help, print_history, print_model_info, handle_command, chat_loop, run

Class description: Interactive chat interface for AUTARCH LLM.


Instruction: What does `ChatInterface.print_status()` do?

Output: `print_status(message, status)` — Print a status message.


Instruction: What does `ChatInterface.print_help()` do?

Output: `print_help()` — Display available commands.


Instruction: What does `ChatInterface.print_history()` do?

Output: `print_history()` — Display conversation history.


Instruction: What does `ChatInterface.print_model_info()` do?

Output: `print_model_info()` — Display model information.


Instruction: What does `ChatInterface.handle_command()` do?

Output:
`handle_command(command)` — Handle a chat command.

Args:
    command: The command string.

Returns:
    True if should continue chat, False if should exit.


Instruction: What does `ChatInterface.chat_loop()` do?

Output: `chat_loop()` — Main chat loop.


Instruction: What does `ChatInterface.run()` do?

Output: `run()` — Run the chat interface.


Instruction: What does the file `modules\counter.py` do in AUTARCH?

Output:
`modules\counter.py` —
AUTARCH Counter Module
Threat detection and incident response

Monitors system for suspicious activity and potential threats.

Category: counter
It contains 2 class(es) and 1 top-level function(s).


Instruction: What methods does the `LoginAttempt` class in `modules\counter.py` provide?

Output:
The `LoginAttempt` class provides these methods:

Class description: Information about a login attempt from an IP.


Instruction: What methods does the `Counter` class in `modules\counter.py` provide?

Output:
The `Counter` class provides these methods: print_status, alert, run_cmd, get_hostname, get_geoip, parse_auth_logs, enrich_login_attempts, check_suspicious_processes, check_network_connections, check_login_anomalies, login_anomalies_menu, view_raw_auth_log, ip_detail_menu, run_msf_recon, check_file_integrity, check_scheduled_tasks, check_rootkits, show_menu, full_scan, run

Class description: Threat detection and response.


Instruction: What does `Counter.alert()` do?

Output: `alert(category, message, severity)` — Record a threat alert.


Instruction: What does `Counter.get_hostname()` do?

Output: `get_hostname(ip)` — Resolve IP to hostname via reverse DNS.


Instruction: What does `Counter.get_geoip()` do?

Output: `get_geoip(ip)` — Get geolocation data for an IP address.


Instruction: What does `Counter.parse_auth_logs()` do?

Output: `parse_auth_logs()` — Parse authentication logs and extract failed login attempts.


Instruction: What does `Counter.enrich_login_attempts()` do?

Output: `enrich_login_attempts(attempts, show_progress)` — Enrich login attempts with GeoIP and hostname data.


Instruction: What does `Counter.check_suspicious_processes()` do?

Output: `check_suspicious_processes()` — Look for suspicious processes.


Instruction: What does `Counter.check_network_connections()` do?

Output: `check_network_connections()` — Analyze network connections for anomalies.


Instruction: What does `Counter.check_login_anomalies()` do?

Output: `check_login_anomalies()` — Check for suspicious login activity - quick summary version.


Instruction: What does `Counter.login_anomalies_menu()` do?

Output: `login_anomalies_menu()` — Interactive login anomalies menu with detailed IP information.


Instruction: What does `Counter.view_raw_auth_log()` do?

Output: `view_raw_auth_log()` — Display raw authentication log entries.


Instruction: What does `Counter.ip_detail_menu()` do?

Output: `ip_detail_menu(attempt)` — Show detailed information and options for a specific IP.


Instruction: What does `Counter.run_msf_recon()` do?

Output: `run_msf_recon(target_ip, module_info)` — Run a Metasploit recon module against the target IP.


Instruction: What does `Counter.check_file_integrity()` do?

Output: `check_file_integrity()` — Check for recently modified critical files.


Instruction: What does `Counter.check_scheduled_tasks()` do?

Output: `check_scheduled_tasks()` — Check cron jobs and scheduled tasks.


Instruction: What does `Counter.check_rootkits()` do?

Output: `check_rootkits()` — Basic rootkit detection.


Instruction: What does `Counter.full_scan()` do?

Output: `full_scan()` — Run all threat checks.


Instruction: What does the file `modules\defender.py` do in AUTARCH?

Output:
`modules\defender.py` —
AUTARCH Defender Module
System hardening and security posture assessment

Checks system configuration for security best practices.

Category: defense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `Defender` class in `modules\defender.py` provide?

Output:
The `Defender` class provides these methods: print_status, check, run_cmd, check_firewall, check_ssh_config, check_open_ports, check_updates, check_users, check_permissions, check_services, check_fail2ban, check_selinux, scan_monitor, honeypot, log_analyzer, firewall_manager, show_menu, full_audit, run

Class description: System security checker.


Instruction: What does `Defender.check()` do?

Output: `check(name, passed, details)` — Record a check result.


Instruction: What does `Defender.run_cmd()` do?

Output: `run_cmd(cmd)` — Run command and return (success, output).


Instruction: What does `Defender.check_firewall()` do?

Output: `check_firewall()` — Check if firewall is enabled.


Instruction: What does `Defender.check_ssh_config()` do?

Output: `check_ssh_config()` — Check SSH hardening.


Instruction: What does `Defender.check_open_ports()` do?

Output: `check_open_ports()` — Check for listening ports.


Instruction: What does `Defender.check_updates()` do?

Output: `check_updates()` — Check for available updates.


Instruction: What does `Defender.check_users()` do?

Output: `check_users()` — Check user security.


Instruction: What does `Defender.check_permissions()` do?

Output: `check_permissions()` — Check critical file permissions.


Instruction: What does `Defender.check_services()` do?

Output: `check_services()` — Check for unnecessary services.


Instruction: What does `Defender.check_fail2ban()` do?

Output: `check_fail2ban()` — Check if fail2ban is installed and running.


Instruction: What does `Defender.check_selinux()` do?

Output: `check_selinux()` — Check SELinux/AppArmor status.


Instruction: What does `Defender.scan_monitor()` do?

Output: `scan_monitor()` — Setup and launch the scan monitor.


Instruction: What does `Defender.honeypot()` do?

Output: `honeypot()` — Honeypot setup submenu.


Instruction: What does `Defender.log_analyzer()` do?

Output: `log_analyzer()` — Log analyzer submenu.


Instruction: What does `Defender.firewall_manager()` do?

Output: `firewall_manager()` — Interactive firewall rule manager.


Instruction: What does `Defender.show_menu()` do?

Output: `show_menu()` — Display defender menu.


Instruction: What does `Defender.full_audit()` do?

Output: `full_audit()` — Run all checks.


Instruction: What does `Defender.run()` do?

Output: `run()` — Main loop.


Instruction: What does the file `modules\defender_monitor.py` do in AUTARCH?

Output:
`modules\defender_monitor.py` —
AUTARCH Threat Monitor Module
Real-time threat detection, monitoring, and counter-attack

Cross-platform network monitoring with active response capabilities.

Category: defense
It contains 1 class(es) and 2 top-level function(s).


Instruction: What methods does the `ThreatMonitor` class in `modules\defender_monitor.py` provide?

Output:
The `ThreatMonitor` class provides these methods: run_cmd, run_ps, get_connections, check_port_scan_indicators, get_suspicious_processes, get_recent_failed_logins, get_dns_cache, get_bandwidth, check_arp_spoofing, check_new_listening_ports, geoip_lookup, get_connections_with_geoip, get_connection_rate, detect_ddos, get_top_talkers, apply_rate_limit, remove_rate_limit, get_syn_protection_status, enable_syn_protection, disable_syn_protection, get_ddos_config, save_ddos_config, auto_mitigate, get_mitigation_history, log_mitigation, clear_mitigation_history, calculate_threat_score, auto_block_ip, kill_process, block_port, get_blocklist, add_to_blocklist, remove_from_blocklist, generate_threat_report, monitor_stream

Class description: Cross-platform real-time threat monitoring.


Instruction: What does `ThreatMonitor.run_cmd()` do?

Output: `run_cmd(cmd, timeout)` — Run command and return (success, output).


Instruction: What does `ThreatMonitor.run_ps()` do?

Output: `run_ps(ps_command, timeout)` — Run a PowerShell command (Windows only).


Instruction: What does `ThreatMonitor.get_connections()` do?

Output: `get_connections()` — Get active network connections with process info.


Instruction: What does `ThreatMonitor.check_port_scan_indicators()` do?

Output: `check_port_scan_indicators()` — Detect port scan patterns in active connections.


Instruction: What does `ThreatMonitor.get_suspicious_processes()` do?

Output: `get_suspicious_processes()` — Identify suspicious processes.


Instruction: What does `ThreatMonitor.get_recent_failed_logins()` do?

Output: `get_recent_failed_logins(minutes)` — Get recent failed login attempts.


Instruction: What does `ThreatMonitor.get_dns_cache()` do?

Output: `get_dns_cache()` — Get DNS cache entries.


Instruction: What does `ThreatMonitor.get_bandwidth()` do?

Output: `get_bandwidth()` — Get bytes in/out per network interface with deltas.


Instruction: What does `ThreatMonitor.check_arp_spoofing()` do?

Output: `check_arp_spoofing()` — Detect ARP spoofing — multiple MACs for same IP.


Instruction: What does `ThreatMonitor.check_new_listening_ports()` do?

Output: `check_new_listening_ports()` — Detect new listening ports since last check.


Instruction: What does `ThreatMonitor.geoip_lookup()` do?

Output: `geoip_lookup(ip)` — GeoIP lookup via ipwho.is (free, no API key).


Instruction: What does `ThreatMonitor.get_connections_with_geoip()` do?

Output: `get_connections_with_geoip()` — Get connections enriched with GeoIP data.


Instruction: What does `ThreatMonitor.get_connection_rate()` do?

Output: `get_connection_rate()` — Track connections per second with trending.


Instruction: What does `ThreatMonitor.detect_ddos()` do?

Output: `detect_ddos()` — Detect DDoS/DoS attack patterns.


Instruction: What does `ThreatMonitor.get_top_talkers()` do?

Output: `get_top_talkers(limit)` — Get top source IPs by connection count.


Instruction: What does `ThreatMonitor.apply_rate_limit()` do?

Output: `apply_rate_limit(ip, rate)` — Apply rate limit for a specific IP.


Instruction: What does `ThreatMonitor.remove_rate_limit()` do?

Output: `remove_rate_limit(ip)` — Remove rate limit rules for an IP.


Instruction: What does `ThreatMonitor.get_syn_protection_status()` do?

Output: `get_syn_protection_status()` — Check SYN flood protection status.


Instruction: What does `ThreatMonitor.enable_syn_protection()` do?

Output: `enable_syn_protection()` — Enable SYN flood protection.


Instruction: What does `ThreatMonitor.disable_syn_protection()` do?

Output: `disable_syn_protection()` — Disable SYN flood protection.


Instruction: What does `ThreatMonitor.get_ddos_config()` do?

Output: `get_ddos_config()` — Get DDoS auto-mitigation configuration.


Instruction: What does `ThreatMonitor.save_ddos_config()` do?

Output: `save_ddos_config(config)` — Save DDoS auto-mitigation configuration.


Instruction: What does `ThreatMonitor.auto_mitigate()` do?

Output: `auto_mitigate()` — Run auto-mitigation based on DDoS detection.


Instruction: What does `ThreatMonitor.get_mitigation_history()` do?

Output: `get_mitigation_history()` — Get log of all mitigation actions.


Instruction: What does `ThreatMonitor.log_mitigation()` do?

Output: `log_mitigation(action, target, reason, auto)` — Log a mitigation action.


Instruction: What does `ThreatMonitor.clear_mitigation_history()` do?

Output: `clear_mitigation_history()` — Clear mitigation history.


Instruction: What does `ThreatMonitor.calculate_threat_score()` do?

Output: `calculate_threat_score()` — Calculate composite threat score (0-100). Higher = more threats.


Instruction: What does `ThreatMonitor.auto_block_ip()` do?

Output: `auto_block_ip(ip)` — Block an IP address using platform-appropriate firewall.


Instruction: What does `ThreatMonitor.kill_process()` do?

Output: `kill_process(pid)` — Kill a process by PID.


Instruction: What does `ThreatMonitor.block_port()` do?

Output: `block_port(port, direction)` — Block a port using platform-appropriate firewall.


Instruction: What does `ThreatMonitor.get_blocklist()` do?

Output: `get_blocklist()` — Get persistent IP blocklist.


Instruction: What does `ThreatMonitor.add_to_blocklist()` do?

Output: `add_to_blocklist(ip)` — Add IP to persistent blocklist.


Instruction: What does `ThreatMonitor.remove_from_blocklist()` do?

Output: `remove_from_blocklist(ip)` — Remove IP from persistent blocklist.


Instruction: What does `ThreatMonitor.generate_threat_report()` do?

Output: `generate_threat_report()` — Generate comprehensive threat report.


Instruction: What does `ThreatMonitor.monitor_stream()` do?

Output: `monitor_stream()` — Generator for SSE streaming — yields threat data every 3 seconds.


Instruction: What does the file `modules\defender_windows.py` do in AUTARCH?

Output:
`modules\defender_windows.py` —
AUTARCH Windows Defender Module
Windows-native security posture assessment

Checks Windows system configuration for security best practices.

Category: defense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `WindowsDefender` class in `modules\defender_windows.py` provide?

Output:
The `WindowsDefender` class provides these methods: check, run_cmd, run_ps, check_firewall, check_ssh_config, check_open_ports, check_updates, check_users, check_permissions, check_services, check_defender, check_uac, get_firewall_rules, block_ip, unblock_ip, analyze_event_logs

Class description: Windows security checker.


Instruction: What does `WindowsDefender.check()` do?

Output: `check(name, passed, details)` — Record a check result.


Instruction: What does `WindowsDefender.run_cmd()` do?

Output: `run_cmd(cmd, timeout)` — Run command and return (success, output).


Instruction: What does `WindowsDefender.run_ps()` do?

Output: `run_ps(ps_command, timeout)` — Run a PowerShell command and return (success, output).


Instruction: What does `WindowsDefender.check_firewall()` do?

Output: `check_firewall()` — Check Windows Firewall status for all profiles.


Instruction: What does `WindowsDefender.check_ssh_config()` do?

Output: `check_ssh_config()` — Check Windows OpenSSH configuration.


Instruction: What does `WindowsDefender.check_open_ports()` do?

Output: `check_open_ports()` — Check for high-risk listening ports on Windows.


Instruction: What does `WindowsDefender.check_updates()` do?

Output: `check_updates()` — Check Windows update status.


Instruction: What does `WindowsDefender.check_users()` do?

Output: `check_users()` — Check Windows user security.


Instruction: What does `WindowsDefender.check_permissions()` do?

Output: `check_permissions()` — Check critical Windows file/folder permissions.


Instruction: What does `WindowsDefender.check_services()` do?

Output: `check_services()` — Check for dangerous or unnecessary Windows services.


Instruction: What does `WindowsDefender.check_defender()` do?

Output: `check_defender()` — Check Windows Defender antivirus status.


Instruction: What does `WindowsDefender.check_uac()` do?

Output: `check_uac()` — Check UAC (User Account Control) status.


Instruction: What does `WindowsDefender.get_firewall_rules()` do?

Output: `get_firewall_rules()` — Get all Windows Firewall inbound rules.


Instruction: What does `WindowsDefender.block_ip()` do?

Output: `block_ip(ip)` — Block an IP via Windows Firewall.


Instruction: What does `WindowsDefender.unblock_ip()` do?

Output: `unblock_ip(ip)` — Unblock an IP via Windows Firewall.


Instruction: What does `WindowsDefender.analyze_event_logs()` do?

Output: `analyze_event_logs()` — Analyze Windows Security and System event logs.


Instruction: What does the file `modules\dossier.py` do in AUTARCH?

Output:
`modules\dossier.py` —
AUTARCH Dossier Module
Manage and correlate OSINT investigation data

Create dossiers to associate related OSINT findings like email searches,
username scans, phone lookups, and custom notes.

Category: osint
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `DossierManager` class in `modules\dossier.py` provide?

Output:
The `DossierManager` class provides these methods: print_status, save_dossier, load_dossier, list_dossiers, create_new_dossier, view_dossiers_list, view_dossier_detail, show_menu, run

Class description: Manage OSINT investigation dossiers.


Instruction: What does `DossierManager.save_dossier()` do?

Output: `save_dossier(dossier, path)` — Save dossier to file.


Instruction: What does `DossierManager.load_dossier()` do?

Output: `load_dossier(path)` — Load dossier from file.


Instruction: What does `DossierManager.list_dossiers()` do?

Output: `list_dossiers()` — List all saved dossiers.


Instruction: What does `DossierManager.create_new_dossier()` do?

Output: `create_new_dossier()` — Interactive dossier creation.


Instruction: What does `DossierManager.view_dossiers_list()` do?

Output: `view_dossiers_list()` — Display list of saved dossiers.


Instruction: What does `DossierManager.view_dossier_detail()` do?

Output: `view_dossier_detail(dossier, dossier_path)` — View and manage a specific dossier.


Instruction: What does the file `modules\geoip.py` do in AUTARCH?

Output:
`modules\geoip.py` —
AUTARCH GEO IP/Domain Lookup Module
Get geolocation info for IPs, domains, and URLs
Based on Snoop Project's GEO_IP/domain plugin

Category: osint
It contains 1 class(es) and 3 top-level function(s).


Instruction: What methods does the `GeoIPLookup` class in `modules\geoip.py` provide?

Output:
The `GeoIPLookup` class provides these methods: lookup, lookup_self, bulk_lookup

Class description: GEO IP/Domain lookup utility.


Instruction: What does `GeoIPLookup.lookup()` do?

Output:
`lookup(target)` — Perform GEO IP lookup.

Args:
    target: IP address, domain, or URL.

Returns:
    Dict with geolocation information.


Instruction: What does `GeoIPLookup.lookup_self()` do?

Output:
`lookup_self()` — Lookup your own public IP.

Returns:
    Dict with geolocation information.


Instruction: What does `GeoIPLookup.bulk_lookup()` do?

Output:
`bulk_lookup(targets)` — Perform bulk GEO lookups.

Args:
    targets: List of IPs/domains to lookup.

Returns:
    List of result dicts.


Instruction: What does the file `modules\hardware_local.py` do in AUTARCH?

Output:
`modules\hardware_local.py` —
Hardware Local - Physical device access (ADB/Fastboot/Serial)
Direct access to USB-connected devices on this machine.

Category: hardware
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `HardwareLocal` class in `modules\hardware_local.py` provide?

Output:
The `HardwareLocal` class provides these methods: show_menu, list_adb_devices, adb_device_info, adb_shell, adb_sideload, list_fastboot_devices, fastboot_device_info, fastboot_flash, list_serial_ports, detect_esp, flash_esp, run_interactive

Class description: Interactive hardware access menu.


Instruction: What does the file `modules\hardware_remote.py` do in AUTARCH?

Output:
`modules\hardware_remote.py` —
Hardware Remote - Remote physical device access via web UI
Devices connected to the AUTARCH server are accessible through the web browser.

Category: hardware
It contains 0 class(es) and 1 top-level function(s).


Instruction: What does the file `modules\iphone_local.py` do in AUTARCH?

Output:
`modules\iphone_local.py` —
iPhone Local USB - Device access via libimobiledevice

Category: hardware
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `IPhoneLocal` class in `modules\iphone_local.py` provide?

Output:
The `IPhoneLocal` class provides these methods: show_menu, run_interactive

Class description: Interactive menu for iPhone USB device access.


Instruction: What does the file `modules\llm_trainer.py` do in AUTARCH?

Output:
`modules\llm_trainer.py` —
AUTARCH LLM Trainer Module
Fine-tune language models on the AUTARCH codebase and convert to GGUF.

Generates training datasets from source code, trains LoRA adapters,
merges weights, and quantizes to GGUF format for local inference.

Category: analyze
It contains 1 class(es) and 2 top-level function(s).


Instruction: What methods does the `LLMTrainer` class in `modules\llm_trainer.py` provide?

Output:
The `LLMTrainer` class provides these methods: get_status, check_dependencies, install_dependencies, scan_codebase, generate_dataset, list_datasets, preview_dataset, delete_dataset, get_training_config, start_training, get_training_status, stop_training, list_adapters, merge_and_convert, list_models, evaluate_model

Class description: Fine-tuning pipeline: dataset generation, LoRA training, GGUF conversion.


Instruction: What does `LLMTrainer.check_dependencies()` do?

Output: `check_dependencies()` — Check what training dependencies are installed.


Instruction: What does `LLMTrainer.install_dependencies()` do?

Output: `install_dependencies()` — Install training dependencies via pip.


Instruction: What does `LLMTrainer.scan_codebase()` do?

Output: `scan_codebase()` — Scan the AUTARCH codebase and return file inventory.


Instruction: What does `LLMTrainer.generate_dataset()` do?

Output:
`generate_dataset(format, include_source, include_qa, include_module_creation)` — Generate training dataset from the AUTARCH codebase.

Args:
    format: 'sharegpt' (conversations) or 'instruction' (alpaca-style)
    include_source: Include code understanding pairs
    include_qa: Include Q&A about architecture
    include_module_creation: Include module creation examples

Returns:
    Dict with dataset path, sample count, preview


Instruction: What does `LLMTrainer.list_datasets()` do?

Output: `list_datasets()` — List generated training datasets.


Instruction: What does `LLMTrainer.preview_dataset()` do?

Output: `preview_dataset(filename, limit)` — Preview samples from a dataset file.


Instruction: What does `LLMTrainer.delete_dataset()` do?

Output: `delete_dataset(filename)` — Delete a dataset file.


Instruction: What does `LLMTrainer.get_training_config()` do?

Output: `get_training_config()` — Get default training configuration.


Instruction: What does `LLMTrainer.start_training()` do?

Output: `start_training(config)` — Start LoRA fine-tuning in a background process.


Instruction: What does `LLMTrainer.get_training_status()` do?

Output: `get_training_status()` — Get current training status including log tail.


Instruction: What does `LLMTrainer.stop_training()` do?

Output: `stop_training()` — Stop the running training process.


Instruction: What does `LLMTrainer.list_adapters()` do?

Output: `list_adapters()` — List saved LoRA adapters.


Instruction: What does `LLMTrainer.merge_and_convert()` do?

Output:
`merge_and_convert(adapter_path, output_name, quantization)` — Merge LoRA adapter with base model and convert to GGUF.

This is a multi-step process:
1. Load base model + LoRA adapter
2. Merge weights
3. Save merged model
4. Convert to GGUF format
5. Quantize


Instruction: What does `LLMTrainer.list_models()` do?

Output: `list_models()` — List available GGUF models.


Instruction: What does `LLMTrainer.evaluate_model()` do?

Output: `evaluate_model(model_path, test_prompts)` — Quick evaluation of a GGUF model with test prompts.


Instruction: What does the file `modules\msf.py` do in AUTARCH?

Output:
`modules\msf.py` —
AUTARCH Metasploit Module
Enhanced interface for Metasploit Framework with module browser.

Provides easy access to MSF modules, exploits, and sessions.
Uses the centralized MSF interface from core/msf_interface.py.
Integrates with msf_terms.py and msf_modules.py for descriptions.

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `MSFMenu` class in `modules\msf.py` provide?

Output:
The `MSFMenu` class provides these methods: print_status, wrap_text, ensure_connected, resolve_hostname, get_local_ip, show_main_menu, show_target_settings, show_module_browser, search_modules, show_current_module, set_option, run_module, show_sessions, interact_session, show_jobs, console_command, quick_scan, exploit_suggester, run

Class description: Enhanced Metasploit menu interface with module browser.


Instruction: What does `MSFMenu.print_status()` do?

Output: `print_status(message, status)` — Print a status message.


Instruction: What does `MSFMenu.wrap_text()` do?

Output: `wrap_text(text, width, indent)` — Word-wrap text with indent for subsequent lines.


Instruction: What does `MSFMenu.ensure_connected()` do?

Output: `ensure_connected()` — Ensure connected to MSF RPC.


Instruction: What does `MSFMenu.resolve_hostname()` do?

Output: `resolve_hostname(hostname)` — Resolve hostname to IP address.


Instruction: What does `MSFMenu.get_local_ip()` do?

Output: `get_local_ip()` — Get local IP address for LHOST.


Instruction: What does `MSFMenu.show_main_menu()` do?

Output: `show_main_menu()` — Display MSF main menu.


Instruction: What does `MSFMenu.show_target_settings()` do?

Output: `show_target_settings()` — Configure global target settings.


Instruction: What does `MSFMenu.show_module_browser()` do?

Output: `show_module_browser()` — Browse modules by category.


Instruction: What does `MSFMenu.search_modules()` do?

Output: `search_modules()` — Search for MSF modules.


Instruction: What does `MSFMenu.show_current_module()` do?

Output: `show_current_module()` — Show and configure current module options.


Instruction: What does `MSFMenu.set_option()` do?

Output: `set_option()` — Set a module option.


Instruction: What does `MSFMenu.run_module()` do?

Output: `run_module()` — Execute the current module.


Instruction: What does `MSFMenu.show_sessions()` do?

Output: `show_sessions()` — Show active sessions.


Instruction: What does `MSFMenu.interact_session()` do?

Output: `interact_session(session_id)` — Interact with a session.


Instruction: What does `MSFMenu.show_jobs()` do?

Output: `show_jobs()` — Show running jobs.


Instruction: What does `MSFMenu.console_command()` do?

Output: `console_command()` — Run console commands directly.


Instruction: What does `MSFMenu.quick_scan()` do?

Output: `quick_scan()` — Quick scanner with pre-set target.


Instruction: What does `MSFMenu.exploit_suggester()` do?

Output: `exploit_suggester()` — Suggest exploits based on vulnerability scan results.


Instruction: What does `MSFMenu.run()` do?

Output: `run()` — Main loop.


Instruction: What does the file `modules\mysystem.py` do in AUTARCH?

Output:
`modules\mysystem.py` —
AUTARCH My System Module
Comprehensive system security audit with CVE detection and remediation

Performs full system audit, saves results, and offers LLM-assisted or manual fixes.

Category: defense
It contains 2 class(es) and 1 top-level function(s).


Instruction: What methods does the `SecurityIssue` class in `modules\mysystem.py` provide?

Output:
The `SecurityIssue` class provides these methods: to_dict, from_dict

Class description: Represents a security issue found during audit.


Instruction: What methods does the `MySystem` class in `modules\mysystem.py` provide?

Output:
The `MySystem` class provides these methods: print_status, run_cmd, collect_system_info, add_issue, check_firewall, check_ssh_config, check_open_ports, check_users, check_permissions, check_services, check_updates, check_fail2ban, check_antivirus, check_cves, run_full_audit, print_summary, save_to_file, load_from_file, show_issue_details, attempt_llm_fix, apply_manual_fix, show_menu, show_issues_menu, handle_issue, show_cve_report, search_cve_interactive, show_cve_details, check_software_cves, sync_database_recent, sync_database_full, show_database_info, run

Class description: Comprehensive system security auditor.


Instruction: What does `MySystem.run_cmd()` do?

Output: `run_cmd(cmd, timeout)` — Run command and return (success, output).


Instruction: What does `MySystem.collect_system_info()` do?

Output: `collect_system_info()` — Collect comprehensive system information.


Instruction: What does `MySystem.add_issue()` do?

Output: `add_issue(name, description, severity, category, fix_command, fix_instructions, score_penalty)` — Add a security issue to the list.


Instruction: What does `MySystem.check_firewall()` do?

Output: `check_firewall()` — Check firewall status.


Instruction: What does `MySystem.check_ssh_config()` do?

Output: `check_ssh_config()` — Check SSH hardening.


Instruction: What does `MySystem.check_open_ports()` do?

Output: `check_open_ports()` — Check for listening ports.


Instruction: What does `MySystem.check_users()` do?

Output: `check_users()` — Check user security.


Instruction: What does `MySystem.check_permissions()` do?

Output: `check_permissions()` — Check critical file permissions.


Instruction: What does `MySystem.check_services()` do?

Output: `check_services()` — Check for unnecessary/dangerous services.


Instruction: What does `MySystem.check_updates()` do?

Output: `check_updates()` — Check for available updates.


Instruction: What does `MySystem.check_fail2ban()` do?

Output: `check_fail2ban()` — Check fail2ban status.


Instruction: What does `MySystem.check_antivirus()` do?

Output: `check_antivirus()` — Check for antivirus.


Instruction: What does `MySystem.check_cves()` do?

Output: `check_cves(verbose)` — Check for CVEs affecting this system using local SQLite database.


Instruction: What does `MySystem.run_full_audit()` do?

Output: `run_full_audit(check_cves)` — Run complete system audit.


Instruction: What does `MySystem.print_summary()` do?

Output: `print_summary()` — Print audit summary.


Instruction: What does `MySystem.save_to_file()` do?

Output: `save_to_file()` — Save audit results to system.inf.


Instruction: What does `MySystem.load_from_file()` do?

Output: `load_from_file()` — Load previous audit results from system.inf.


Instruction: What does `MySystem.show_issue_details()` do?

Output: `show_issue_details(issue)` — Show detailed information about an issue.


Instruction: What does `MySystem.attempt_llm_fix()` do?

Output: `attempt_llm_fix(issue)` — Use LLM to generate and optionally apply a fix.


Instruction: What does `MySystem.apply_manual_fix()` do?

Output: `apply_manual_fix(issue)` — Apply the predefined fix command.


Instruction: What does `MySystem.show_menu()` do?

Output: `show_menu()` — Display main menu.


Instruction: What does `MySystem.show_issues_menu()` do?

Output: `show_issues_menu()` — Display issues as selectable options.


Instruction: What does `MySystem.handle_issue()` do?

Output: `handle_issue(issue)` — Handle remediation of a single issue.


Instruction: What does `MySystem.show_cve_report()` do?

Output: `show_cve_report()` — Show CVE report from audit.


Instruction: What does `MySystem.search_cve_interactive()` do?

Output: `search_cve_interactive()` — Interactive CVE search.


Instruction: What does `MySystem.show_cve_details()` do?

Output: `show_cve_details(cve)` — Show detailed CVE information.


Instruction: What does `MySystem.check_software_cves()` do?

Output: `check_software_cves()` — Check CVEs for specific software.


Instruction: What does `MySystem.sync_database_recent()` do?

Output: `sync_database_recent()` — Sync recent CVEs (last 120 days).


Instruction: What does `MySystem.sync_database_full()` do?

Output: `sync_database_full()` — Full database sync (all CVEs since 1999).


Instruction: What does `MySystem.show_database_info()` do?

Output: `show_database_info()` — Show CVE database information.


Instruction: What does `MySystem.run()` do?

Output: `run()` — Main module loop.


Instruction: What does the file `modules\nettest.py` do in AUTARCH?

Output:
`modules\nettest.py` —
AUTARCH Network Test Module
Test network speed and connectivity

Category: utility
It contains 1 class(es) and 4 top-level function(s).


Instruction: What methods does the `NetworkTester` class in `modules\nettest.py` provide?

Output:
The `NetworkTester` class provides these methods: test_connectivity, test_speed, test_dns

Class description: Network testing utility.


Instruction: What does `NetworkTester.test_connectivity()` do?

Output:
`test_connectivity()` — Test basic internet connectivity.

Returns:
    Dict with connectivity results.


Instruction: What does `NetworkTester.test_speed()` do?

Output:
`test_speed()` — Test network speed using speedtest.

Returns:
    Dict with speed test results.


Instruction: What does `NetworkTester.test_dns()` do?

Output:
`test_dns(domain)` — Test DNS resolution.

Args:
    domain: Domain to resolve.

Returns:
    Dict with DNS test results.


Instruction: What does the file `modules\recon.py` do in AUTARCH?

Output:
`modules\recon.py` —
AUTARCH Recon Module
Open Source Intelligence (OSINT) gathering

Domain, IP, email, username, and phone reconnaissance tools.
Integrates with social-analyzer for social media analysis.
Uses unified sites database from sherlock, maigret, and social-analyzer.

Category: osint
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `Recon` class in `modules\recon.py` provide?

Output:
The `Recon` class provides these methods: print_status, run_cmd, email_lookup, email_permutator, validate_username, username_lookup, social_analyzer_search, phone_lookup, domain_info, ip_info, subdomain_enum, tech_detect, run_geoip_module, run_yandex_module, run_network_test, run_snoop_decoder, run_dossier_manager, show_sites_db_stats, nmap_scanner, network_mapper, web_scanner, vuln_correlator, show_menu, run

Class description: OSINT and reconnaissance tools.


Instruction: What does `Recon.email_lookup()` do?

Output: `email_lookup()` — Email address OSINT.


Instruction: What does `Recon.email_permutator()` do?

Output: `email_permutator()` — Generate email permutations.


Instruction: What does `Recon.validate_username()` do?

Output:
`validate_username(username)` — Validate username before searching (like Snoop).

Returns:
    Tuple of (is_valid, error_message)


Instruction: What does `Recon.username_lookup()` do?

Output: `username_lookup()` — Username OSINT across platforms using sites database.


Instruction: What does `Recon.social_analyzer_search()` do?

Output: `social_analyzer_search(username)` — Run social-analyzer on a username.


Instruction: What does `Recon.phone_lookup()` do?

Output: `phone_lookup()` — Phone number OSINT.


Instruction: What does `Recon.domain_info()` do?

Output: `domain_info()` — Gather domain information.


Instruction: What does `Recon.ip_info()` do?

Output: `ip_info()` — Gather IP address information.


Instruction: What does `Recon.subdomain_enum()` do?

Output: `subdomain_enum()` — Enumerate subdomains.


Instruction: What does `Recon.tech_detect()` do?

Output: `tech_detect()` — Detect technologies on a website.


Instruction: What does `Recon.run_geoip_module()` do?

Output: `run_geoip_module()` — Run the GEO IP/Domain Lookup module.


Instruction: What does `Recon.run_yandex_module()` do?

Output: `run_yandex_module()` — Run the Yandex OSINT module.


Instruction: What does `Recon.run_network_test()` do?

Output: `run_network_test()` — Run the Network Test module.


Instruction: What does `Recon.run_snoop_decoder()` do?

Output: `run_snoop_decoder()` — Run the Snoop Database Decoder module.


Instruction: What does `Recon.run_dossier_manager()` do?

Output: `run_dossier_manager()` — Run the Dossier Manager module.


Instruction: What does `Recon.show_sites_db_stats()` do?

Output: `show_sites_db_stats()` — Display sites database statistics.


Instruction: What does `Recon.nmap_scanner()` do?

Output: `nmap_scanner()` — Nmap scanner submenu.


Instruction: What does `Recon.network_mapper()` do?

Output: `network_mapper()` — Network mapper - discover hosts and services on a subnet.


Instruction: What does `Recon.web_scanner()` do?

Output: `web_scanner()` — Web application security scanner.


Instruction: What does `Recon.vuln_correlator()` do?

Output: `vuln_correlator()` — Vulnerability correlator - match services to CVEs.


Instruction: What does the file `modules\revshell.py` do in AUTARCH?

Output:
`modules\revshell.py` —
Reverse Shell Manager - Manage incoming reverse shell connections from Archon companion app.
Control the RevShell listener, manage sessions, execute commands, transfer files.

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `RevShellManager` class in `modules\revshell.py` provide?

Output:
The `RevShellManager` class provides these methods: listener, show_menu, do_start, do_stop, do_status, do_list_sessions, do_interactive_shell, do_execute_command, do_disconnect_session, do_sysinfo, do_packages, do_processes, do_netstat, do_logcat, do_screenshot, do_download, do_upload, run_interactive

Class description: Interactive reverse shell management menu.


Instruction: What does the file `modules\rsf.py` do in AUTARCH?

Output:
`modules\rsf.py` —
AUTARCH RouterSploit Module
Interface for RouterSploit Framework with module browser.

Provides easy access to RSF modules for IoT/embedded device testing.
Uses the RSF interface from core/rsf_interface.py.
Integrates with rsf_terms.py and rsf_modules.py for descriptions.

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `RSFMenu` class in `modules\rsf.py` provide?

Output:
The `RSFMenu` class provides these methods: print_status, wrap_text, resolve_hostname, show_main_menu, show_target_settings, show_module_browser, search_modules, show_current_module, run_check, run_module, quick_scan, credential_check

Class description: RouterSploit menu interface with module browser.


Instruction: What does `RSFMenu.print_status()` do?

Output: `print_status(message, status)` — Print a status message.


Instruction: What does `RSFMenu.wrap_text()` do?

Output: `wrap_text(text, width, indent)` — Word-wrap text with indent.


Instruction: What does `RSFMenu.resolve_hostname()` do?

Output: `resolve_hostname(hostname)` — Resolve hostname to IP address.


Instruction: What does `RSFMenu.show_main_menu()` do?

Output: `show_main_menu()` — Display RSF main menu.


Instruction: What does `RSFMenu.show_target_settings()` do?

Output: `show_target_settings()` — Configure target device settings.


Instruction: What does `RSFMenu.show_module_browser()` do?

Output: `show_module_browser()` — Browse modules by category.


Instruction: What does `RSFMenu.search_modules()` do?

Output: `search_modules()` — Search for modules by keyword.


Instruction: What does `RSFMenu.show_current_module()` do?

Output: `show_current_module()` — View and configure the current selected module.


Instruction: What does `RSFMenu.run_check()` do?

Output: `run_check()` — Run check from main menu (option 5).


Instruction: What does `RSFMenu.run_module()` do?

Output: `run_module()` — Run module from main menu (option 6).


Instruction: What does `RSFMenu.quick_scan()` do?

Output: `quick_scan()` — Quick scan presets using RSF scanners.


Instruction: What does `RSFMenu.credential_check()` do?

Output: `credential_check()` — Run credential checking modules.


Instruction: What does the file `modules\setup.py` do in AUTARCH?

Output:
`modules\setup.py` —
AUTARCH Setup Module
First-time configuration wizard for LLM settings
Supports GGUF (llama.cpp) and SafeTensors (transformers) models

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `SetupWizard` class in `modules\setup.py` provide?

Output:
The `SetupWizard` class provides these methods: print_header, print_info, print_warning, print_error, get_input, get_int_input, get_float_input, validate_model_path, validate_model_path_legacy, resolve_model_path, skip_setup, run

Class description: Interactive setup wizard for AUTARCH configuration.


Instruction: What does `SetupWizard.print_header()` do?

Output: `print_header(text)` — Print a formatted section header.


Instruction: What does `SetupWizard.print_info()` do?

Output: `print_info(text)` — Print info message.


Instruction: What does `SetupWizard.print_warning()` do?

Output: `print_warning(text)` — Print warning message.


Instruction: What does `SetupWizard.print_error()` do?

Output: `print_error(text)` — Print error message.


Instruction: What does `SetupWizard.get_input()` do?

Output:
`get_input(prompt, default)` — Get user input with optional default value.

Args:
    prompt: The prompt to display
    default: Default value if user presses enter

Returns:
    User input or default value


Instruction: What does `SetupWizard.get_int_input()` do?

Output:
`get_int_input(prompt, default, min_val, max_val)` — Get integer input with validation.

Args:
    prompt: The prompt to display
    default: Default value
    min_val: Minimum allowed value
    max_val: Maximum allowed value

Returns:
    Validated integer value


Instruction: What does `SetupWizard.get_float_input()` do?

Output: `get_float_input(prompt, default, min_val, max_val)` — Get float input with validation.


Instruction: What does `SetupWizard.validate_model_path()` do?

Output:
`validate_model_path(path)` — Validate that a model file or directory exists.

Args:
    path: Path to the model file or directory

Returns:
    Tuple of (is_valid, model_type) where model_type is 'gguf', 'transformers', or None


Instruction: What does `SetupWizard.validate_model_path_legacy()` do?

Output:
`validate_model_path_legacy(path)` — Legacy validation - just checks if file exists.

Args:
    path: Path to the model file

Returns:
    True if valid, False otherwise


Instruction: What does `SetupWizard.resolve_model_path()` do?

Output:
`resolve_model_path(path)` — Resolve a model path, trying multiple variations.

Args:
    path: User-provided path (may be relative or have variations)

Returns:
    Resolved absolute path if found, None otherwise


Instruction: What does `SetupWizard.skip_setup()` do?

Output:
`skip_setup()` — Skip setup and mark as complete without LLM configuration.

Returns:
    True always (setup skipped successfully)


Instruction: What does `SetupWizard.run()` do?

Output:
`run(allow_skip)` — Run the setup wizard.

Args:
    allow_skip: Whether to show the skip option

Returns:
    True if setup completed successfully, False if cancelled


Instruction: What does the file `modules\simulate.py` do in AUTARCH?

Output:
`modules\simulate.py` —
AUTARCH Simulate Module
Attack simulation and security testing

Red team exercises and controlled attack simulations.

Category: simulate
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `Simulator` class in `modules\simulate.py` provide?

Output:
The `Simulator` class provides these methods: print_status, run_cmd, password_audit, port_scanner, banner_grabber, payload_generator, network_stress, credential_sprayer, show_menu, run

Class description: Attack simulation tools.


Instruction: What does `Simulator.password_audit()` do?

Output: `password_audit()` — Audit password strength and check common passwords.


Instruction: What does `Simulator.port_scanner()` do?

Output: `port_scanner()` — TCP port scanner.


Instruction: What does `Simulator.banner_grabber()` do?

Output: `banner_grabber()` — Grab service banners.


Instruction: What does `Simulator.payload_generator()` do?

Output: `payload_generator()` — Generate various payloads for testing.


Instruction: What does `Simulator.network_stress()` do?

Output: `network_stress()` — Network stress test (controlled).


Instruction: What does `Simulator.credential_sprayer()` do?

Output: `credential_sprayer()` — Credential spraying against network services.


Instruction: What does the file `modules\snoop_decoder.py` do in AUTARCH?

Output:
`modules\snoop_decoder.py` —
AUTARCH Snoop Database Decoder Module
Decrypts and imports Snoop Project databases into AUTARCH

Category: osint
It contains 1 class(es) and 3 top-level function(s).


Instruction: What methods does the `SnoopDecoder` class in `modules\snoop_decoder.py` provide?

Output:
The `SnoopDecoder` class provides these methods: decode_database, save_decoded, import_to_database, show_sample, get_stats

Class description: Decoder for Snoop Project encoded databases.


Instruction: What does `SnoopDecoder.decode_database()` do?

Output:
`decode_database(filepath)` — Decode a Snoop database file.

Args:
    filepath: Path to the encoded database file (BDdemo, BDfull, etc.)

Returns:
    Decoded dictionary of sites.


Instruction: What does `SnoopDecoder.save_decoded()` do?

Output:
`save_decoded(data, output_name)` — Save decoded database to JSON file.

Args:
    data: Decoded site dictionary.
    output_name: Output filename.

Returns:
    Path to saved file.


Instruction: What does `SnoopDecoder.import_to_database()` do?

Output:
`import_to_database(data)` — Import decoded Snoop data into AUTARCH sites database.

Args:
    data: Decoded site dictionary.

Returns:
    Import statistics.


Instruction: What does `SnoopDecoder.show_sample()` do?

Output:
`show_sample(data, count)` — Display sample sites from decoded database.

Args:
    data: Decoded site dictionary.
    count: Number of samples to show.


Instruction: What does `SnoopDecoder.get_stats()` do?

Output:
`get_stats(data)` — Get statistics about decoded database.

Args:
    data: Decoded site dictionary.

Returns:
    Statistics dictionary.


Instruction: What does the file `modules\upnp_manager.py` do in AUTARCH?

Output:
`modules\upnp_manager.py` —
AUTARCH UPnP Port Manager Module
Manage UPnP port forwarding and cron refresh jobs

Requires: miniupnpc (upnpc command)

Category: defense
It contains 0 class(es) and 11 top-level function(s).


Instruction: What does the file `modules\wireguard_manager.py` do in AUTARCH?

Output:
`modules\wireguard_manager.py` —
WireGuard VPN Manager - Server management, client CRUD, remote ADB
Manage WireGuard VPN server, clients, and remote ADB connections over VPN tunnel.

Category: defense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `WireGuardVPN` class in `modules\wireguard_manager.py` provide?

Output:
The `WireGuardVPN` class provides these methods: show_menu, do_server_status, do_start, do_stop, do_restart, do_list_clients, do_create_client, do_view_client, do_delete_client, do_toggle_client, do_import_peers, do_adb_connect, do_adb_disconnect, do_auto_connect, do_list_adb_devices, do_usbip_status, do_load_modules, do_list_remote_usb, do_attach_usb, do_detach_usb, do_list_ports, do_gen_config, do_show_qr, do_refresh_upnp, run_interactive

Class description: Interactive WireGuard VPN menu.


Instruction: What does the file `modules\wireshark.py` do in AUTARCH?

Output:
`modules\wireshark.py` —
AUTARCH Wireshark Module
Packet capture and analysis (scapy + optional tshark)

Live capture, PCAP analysis, protocol/conversation/DNS/HTTP analysis,
credential detection.

Category: analyze
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `PacketAnalyzer` class in `modules\wireshark.py` provide?

Output:
The `PacketAnalyzer` class provides these methods: print_status, show_menu, list_interfaces, start_capture, open_pcap, protocol_analysis, conversation_analysis, dns_analysis, http_analysis, credential_detection, export_results

Class description: Packet capture and analysis tools.


Instruction: What does `PacketAnalyzer.list_interfaces()` do?

Output: `list_interfaces()` — List network interfaces.


Instruction: What does `PacketAnalyzer.start_capture()` do?

Output: `start_capture()` — Start a live packet capture.


Instruction: What does `PacketAnalyzer.open_pcap()` do?

Output: `open_pcap()` — Open and load a PCAP file.


Instruction: What does `PacketAnalyzer.protocol_analysis()` do?

Output: `protocol_analysis()` — Show protocol distribution.


Instruction: What does `PacketAnalyzer.conversation_analysis()` do?

Output: `conversation_analysis()` — Show IP conversations.


Instruction: What does `PacketAnalyzer.dns_analysis()` do?

Output: `dns_analysis()` — Show DNS queries.


Instruction: What does `PacketAnalyzer.http_analysis()` do?

Output: `http_analysis()` — Show HTTP requests.


Instruction: What does `PacketAnalyzer.credential_detection()` do?

Output: `credential_detection()` — Detect plaintext credentials.


Instruction: What does `PacketAnalyzer.export_results()` do?

Output: `export_results()` — Export packets.


Instruction: What does the file `modules\workflow.py` do in AUTARCH?

Output:
`modules\workflow.py` —
AUTARCH Workflow Module
Automated pentest pipeline orchestration

Run multi-step security assessments with automated data flow between tools.

Category: offense
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `WorkflowRunner` class in `modules\workflow.py` provide?

Output:
The `WorkflowRunner` class provides these methods: print_status, show_menu, run_workflow, quick_scan, resume_workflow, run

Class description: Orchestrate multi-step pentest workflows.


Instruction: What does `WorkflowRunner.run_workflow()` do?

Output: `run_workflow(target)` — Run full automated pentest workflow.


Instruction: What does `WorkflowRunner.quick_scan()` do?

Output: `quick_scan(target)` — Run quick scan: Nmap → CVE → Report (no LLM).


Instruction: What does `WorkflowRunner.resume_workflow()` do?

Output: `resume_workflow()` — Resume a saved workflow from JSON state.


Instruction: What does `WorkflowRunner.run()` do?

Output: `run()` — Main menu loop.


Instruction: What does the file `modules\yandex_osint.py` do in AUTARCH?

Output:
`modules\yandex_osint.py` —
AUTARCH Yandex OSINT Module
Gather information about Yandex users from their login, email, or public links

Category: osint
It contains 1 class(es) and 3 top-level function(s).


Instruction: What methods does the `YandexParser` class in `modules\yandex_osint.py` provide?

Output:
The `YandexParser` class provides these methods: lookup_by_login, lookup_by_disk_link, lookup_by_public_id

Class description: Parser for Yandex user information.


Instruction: What does `YandexParser.lookup_by_login()` do?

Output:
`lookup_by_login(login)` — Lookup Yandex user by login/email.

Args:
    login: Yandex login or email.

Returns:
    Dict with user information.


Instruction: What does `YandexParser.lookup_by_disk_link()` do?

Output:
`lookup_by_disk_link(url)` — Extract user info from Yandex.Disk public link.

Args:
    url: Public Yandex.Disk link.

Returns:
    Dict with user information.


Instruction: What does `YandexParser.lookup_by_public_id()` do?

Output:
`lookup_by_public_id(public_id)` — Lookup user by Yandex public ID.

Args:
    public_id: 26-character Yandex user identifier.

Returns:
    Dict with user information.


Instruction: What does the file `core\agent.py` do in AUTARCH?

Output:
`core\agent.py` —
AUTARCH Agent System
Autonomous agent that uses LLM to accomplish tasks with tools

Category: core
It contains 4 class(es) and 0 top-level function(s).


Instruction: What methods does the `Agent` class in `core\agent.py` provide?

Output:
The `Agent` class provides these methods: run, get_steps_summary

Class description: Autonomous agent that uses LLM and tools to accomplish tasks.


Instruction: What does `Agent.run()` do?

Output:
`run(task, user_input_handler, step_callback)` — Run the agent on a task.

Args:
    task: The task description.
    user_input_handler: Callback for handling ask_user actions.
                       If None, uses default input().
    step_callback: Optional per-step callback invoked after each step completes.
                  Overrides self.on_step for this run if provided.

Returns:
    AgentResult with execution details.


Instruction: What does `Agent.get_steps_summary()` do?

Output: `get_steps_summary()` — Get a formatted summary of all steps taken.


Instruction: What does the file `core\android_exploit.py` do in AUTARCH?

Output:
`core\android_exploit.py` —
AUTARCH Android Exploitation Manager
App extraction, device recon, payload deployment, boot/recovery exploits, rooting.
Wraps HardwareManager for offensive Android operations.

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidExploitManager` class in `core\android_exploit.py` provide?

Output:
The `AndroidExploitManager` class provides these methods: list_packages, pull_apk, pull_app_data, extract_shared_prefs, full_device_dump, get_accounts, get_wifi_passwords, extract_call_logs, extract_sms, extract_contacts, extract_browser_history, extract_saved_credentials, export_recon_report, deploy_binary, execute_payload, setup_reverse_shell, install_persistence, list_running_payloads, kill_payload, sms_list, sms_insert, sms_delete, sms_delete_all, sms_update, sms_bulk_insert, rcs_check_support, rcs_list, rcs_insert, rcs_delete, get_bootloader_info, backup_boot_image, flash_recovery, flash_boot, disable_verity, boot_temp, unlock_bootloader, check_root, install_magisk, pull_patched_boot, root_via_exploit, adb_root_shell, screen_capture, screen_record, input_tap, input_swipe, input_text, input_keyevent, start_keylogger, stop_keylogger, camera_capture, audio_record, dismiss_lockscreen, disable_lockscreen, extract_clipboard, dump_notifications, extract_location, extract_media_list, pull_media_folder, extract_whatsapp_db, extract_telegram_db, extract_signal_db, dump_all_settings, set_proxy, clear_proxy, install_ca_cert_user, install_ca_cert_system, get_network_info, set_dns, wifi_scan, wifi_connect, wifi_disconnect, wifi_enable, enable_hotspot, capture_traffic, port_forward, port_forward_list, enable_adb_wifi, grant_permission, revoke_permission, list_permissions, disable_app, enable_app, clear_app_data, force_stop_app, launch_app, launch_activity, send_broadcast, content_query, overlay_attack_enable, set_selinux, remount_system, logcat_sensitive, deploy_frida, get_running_processes, get_open_ports, modify_setting, get_device_fingerprint, dump_database, get_commands_for_op, parse_op_output

Class description: All Android exploitation logic.


Instruction: What does `AndroidExploitManager.list_packages()` do?

Output: `list_packages(serial, include_system)` — List installed packages. Returns [{package, path, is_system}].


Instruction: What does `AndroidExploitManager.pull_apk()` do?

Output: `pull_apk(serial, package)` — Pull APK for a package.


Instruction: What does `AndroidExploitManager.pull_app_data()` do?

Output: `pull_app_data(serial, package)` — Pull app data (databases, shared_prefs, files). Tries run-as then root.


Instruction: What does `AndroidExploitManager.extract_shared_prefs()` do?

Output: `extract_shared_prefs(serial, package)` — Extract shared_prefs XML files for a package.


Instruction: What does `AndroidExploitManager.full_device_dump()` do?

Output: `full_device_dump(serial)` — Full device reconnaissance dump.


Instruction: What does `AndroidExploitManager.get_accounts()` do?

Output: `get_accounts(serial)` — Get accounts registered on device.


Instruction: What does `AndroidExploitManager.get_wifi_passwords()` do?

Output: `get_wifi_passwords(serial)` — Extract saved WiFi passwords. Requires ROOT.


Instruction: What does `AndroidExploitManager.extract_call_logs()` do?

Output: `extract_call_logs(serial, limit)` — Extract call logs via content provider.


Instruction: What does `AndroidExploitManager.extract_sms()` do?

Output: `extract_sms(serial, limit)` — Extract SMS messages via content provider.


Instruction: What does `AndroidExploitManager.extract_contacts()` do?

Output: `extract_contacts(serial)` — Extract contacts via content provider.


Instruction: What does `AndroidExploitManager.extract_browser_history()` do?

Output: `extract_browser_history(serial)` — Pull Chrome History SQLite and query it locally. Requires ROOT.


Instruction: What does `AndroidExploitManager.extract_saved_credentials()` do?

Output: `extract_saved_credentials(serial)` — Pull Chrome Login Data SQLite. Requires ROOT.


Instruction: What does `AndroidExploitManager.export_recon_report()` do?

Output: `export_recon_report(serial)` — Run all recon methods and save to JSON.


Instruction: What does `AndroidExploitManager.deploy_binary()` do?

Output: `deploy_binary(serial, local_path, remote_path)` — Push a binary and make it executable.


Instruction: What does `AndroidExploitManager.execute_payload()` do?

Output: `execute_payload(serial, remote_path, args, background)` — Execute a deployed payload.


Instruction: What does `AndroidExploitManager.setup_reverse_shell()` do?

Output: `setup_reverse_shell(serial, lhost, lport, method)` — Set up a reverse shell on device.


Instruction: What does `AndroidExploitManager.install_persistence()` do?

Output: `install_persistence(serial, method)` — Install persistence mechanism. Requires ROOT.


Instruction: What does `AndroidExploitManager.list_running_payloads()` do?

Output: `list_running_payloads(serial)` — List processes in /data/local/tmp/.


Instruction: What does `AndroidExploitManager.kill_payload()` do?

Output: `kill_payload(serial, pid)` — Kill a running payload by PID.


Instruction: What does `AndroidExploitManager.sms_list()` do?

Output: `sms_list(serial, limit, address)` — List SMS messages on device. Optional filter by address (phone number).


Instruction: What does `AndroidExploitManager.sms_insert()` do?

Output:
`sms_insert(serial, address, body, date_str, time_str, msg_type, read)` — Insert a spoofed SMS message.

Args:
    address: Phone number (sender for inbox, recipient for sent)
    body: Message text
    date_str: Date as YYYY-MM-DD (default: now)
    time_str: Time as HH:MM:SS (default: now)
    msg_type: 'inbox' (1), 'sent' (2), 'draft' (3)
    read: Mark as read


Instruction: What does `AndroidExploitManager.sms_delete()` do?

Output:
`sms_delete(serial, sms_id, address, delete_all_from)` — Delete SMS messages.

Args:
    sms_id: Delete specific message by _id
    address: Delete messages from/to this number
    delete_all_from: If True and address set, delete ALL from that number


Instruction: What does `AndroidExploitManager.sms_delete_all()` do?

Output: `sms_delete_all(serial)` — Delete ALL SMS messages on the device.


Instruction: What does `AndroidExploitManager.sms_update()` do?

Output: `sms_update(serial, sms_id, body, date_str, time_str, address, msg_type, read)` — Update an existing SMS message fields.


Instruction: What does `AndroidExploitManager.sms_bulk_insert()` do?

Output:
`sms_bulk_insert(serial, messages)` — Insert multiple SMS messages.

Args:
    messages: List of dicts with keys: address, body, date, time, type, read


Instruction: What does `AndroidExploitManager.rcs_check_support()` do?

Output: `rcs_check_support(serial)` — Check if Google Messages / RCS is available on device.


Instruction: What does `AndroidExploitManager.rcs_list()` do?

Output: `rcs_list(serial, limit)` — List RCS messages from Google Messages bugle_db. Requires ROOT.


Instruction: What does `AndroidExploitManager.rcs_insert()` do?

Output:
`rcs_insert(serial, address, body, date_str, time_str, sender_name, is_outgoing)` — Insert a spoofed RCS message into Google Messages bugle_db. Requires ROOT.

This pulls the database, inserts locally, then pushes back.
The messaging app must be force-stopped before and restarted after.


Instruction: What does `AndroidExploitManager.rcs_delete()` do?

Output: `rcs_delete(serial, message_id)` — Delete an RCS message from bugle_db by message _id. Requires ROOT.


Instruction: What does `AndroidExploitManager.get_bootloader_info()` do?

Output: `get_bootloader_info(serial)` — Get all fastboot variables.


Instruction: What does `AndroidExploitManager.backup_boot_image()` do?

Output: `backup_boot_image(serial)` — Backup boot partition via dd. Requires ROOT in ADB mode.


Instruction: What does `AndroidExploitManager.flash_recovery()` do?

Output: `flash_recovery(serial, img_path)` — Flash custom recovery image via fastboot.


Instruction: What does `AndroidExploitManager.flash_boot()` do?

Output: `flash_boot(serial, img_path)` — Flash boot image via fastboot.


Instruction: What does `AndroidExploitManager.disable_verity()` do?

Output: `disable_verity(serial, vbmeta_path)` — Disable dm-verity/AVB by flashing vbmeta with disable flags.


Instruction: What does `AndroidExploitManager.boot_temp()` do?

Output: `boot_temp(serial, img_path)` — Temporarily boot an image without flashing.


Instruction: What does `AndroidExploitManager.unlock_bootloader()` do?

Output: `unlock_bootloader(serial)` — Unlock bootloader. WIPES DATA.


Instruction: What does `AndroidExploitManager.check_root()` do?

Output: `check_root(serial)` — Check if device is rooted and by what method.


Instruction: What does `AndroidExploitManager.install_magisk()` do?

Output: `install_magisk(serial, apk_path)` — Install Magisk APK on device.


Instruction: What does `AndroidExploitManager.pull_patched_boot()` do?

Output: `pull_patched_boot(serial)` — Pull Magisk-patched boot image from /sdcard/Download/.


Instruction: What does `AndroidExploitManager.root_via_exploit()` do?

Output: `root_via_exploit(serial, exploit_binary)` — Deploy and execute a root exploit binary.


Instruction: What does `AndroidExploitManager.adb_root_shell()` do?

Output: `adb_root_shell(serial)` — Attempt adb root for userdebug/eng builds.


Instruction: What does `AndroidExploitManager.screen_capture()` do?

Output: `screen_capture(serial)` — Take a screenshot and pull it.


Instruction: What does `AndroidExploitManager.screen_record()` do?

Output: `screen_record(serial, duration, size)` — Record screen video and pull it. Max 180s.


Instruction: What does `AndroidExploitManager.input_tap()` do?

Output: `input_tap(serial, x, y)` — Tap at screen coordinates.


Instruction: What does `AndroidExploitManager.input_swipe()` do?

Output: `input_swipe(serial, x1, y1, x2, y2, duration_ms)` — Swipe from (x1,y1) to (x2,y2).


Instruction: What does `AndroidExploitManager.input_text()` do?

Output: `input_text(serial, text)` — Type text on device. Spaces become %s.


Instruction: What does `AndroidExploitManager.input_keyevent()` do?

Output: `input_keyevent(serial, keycode)` — Send keyevent. Common: 3=HOME, 4=BACK, 26=POWER, 82=MENU, 187=RECENTS.


Instruction: What does `AndroidExploitManager.start_keylogger()` do?

Output: `start_keylogger(serial)` — Start getevent-based keylogger in background. Returns PID.


Instruction: What does `AndroidExploitManager.stop_keylogger()` do?

Output: `stop_keylogger(serial)` — Stop keylogger and pull log file.


Instruction: What does `AndroidExploitManager.camera_capture()` do?

Output: `camera_capture(serial, camera)` — Take photo using device camera via intent.


Instruction: What does `AndroidExploitManager.audio_record()` do?

Output: `audio_record(serial, duration)` — Record audio from microphone. Needs Android 10+ or root for silent.


Instruction: What does `AndroidExploitManager.dismiss_lockscreen()` do?

Output: `dismiss_lockscreen(serial)` — Attempt to dismiss lock screen / wake device.


Instruction: What does `AndroidExploitManager.disable_lockscreen()` do?

Output: `disable_lockscreen(serial)` — Disable lock screen via settings (debug builds or root).


Instruction: What does `AndroidExploitManager.extract_clipboard()` do?

Output: `extract_clipboard(serial)` — Get current clipboard content.


Instruction: What does `AndroidExploitManager.dump_notifications()` do?

Output: `dump_notifications(serial)` — Dump current notifications.


Instruction: What does `AndroidExploitManager.extract_location()` do?

Output: `extract_location(serial)` — Get device location data.


Instruction: What does `AndroidExploitManager.extract_media_list()` do?

Output: `extract_media_list(serial, media_type)` — List media files on device.


Instruction: What does `AndroidExploitManager.pull_media_folder()` do?

Output: `pull_media_folder(serial, media_type, limit)` — Pull media files from device.


Instruction: What does `AndroidExploitManager.extract_whatsapp_db()` do?

Output: `extract_whatsapp_db(serial)` — Extract WhatsApp message database. Requires ROOT.


Instruction: What does `AndroidExploitManager.extract_telegram_db()` do?

Output: `extract_telegram_db(serial)` — Extract Telegram database. Requires ROOT.


Instruction: What does `AndroidExploitManager.extract_signal_db()` do?

Output: `extract_signal_db(serial)` — Extract Signal database. Requires ROOT.


Instruction: What does `AndroidExploitManager.dump_all_settings()` do?

Output: `dump_all_settings(serial)` — Dump all Android settings (system, secure, global).


Instruction: What does `AndroidExploitManager.set_proxy()` do?

Output: `set_proxy(serial, host, port)` — Set global HTTP proxy.


Instruction: What does `AndroidExploitManager.clear_proxy()` do?

Output: `clear_proxy(serial)` — Remove global proxy.


Instruction: What does `AndroidExploitManager.install_ca_cert_user()` do?

Output: `install_ca_cert_user(serial, cert_path)` — Install CA certificate to user store.


Instruction: What does `AndroidExploitManager.install_ca_cert_system()` do?

Output: `install_ca_cert_system(serial, cert_path)` — Install CA certificate to system store. Requires ROOT + remounted /system.


Instruction: What does `AndroidExploitManager.get_network_info()` do?

Output: `get_network_info(serial)` — Get comprehensive network information.


Instruction: What does `AndroidExploitManager.set_dns()` do?

Output: `set_dns(serial, dns1, dns2)` — Set DNS servers. Requires ROOT.


Instruction: What does `AndroidExploitManager.wifi_scan()` do?

Output: `wifi_scan(serial)` — Scan for nearby WiFi networks.


Instruction: What does `AndroidExploitManager.wifi_connect()` do?

Output: `wifi_connect(serial, ssid, password, security)` — Connect to a WiFi network. Android 10+ uses cmd wifi.


Instruction: What does `AndroidExploitManager.wifi_disconnect()` do?

Output: `wifi_disconnect(serial)` — Disconnect from WiFi.


Instruction: What does `AndroidExploitManager.wifi_enable()` do?

Output: `wifi_enable(serial)` — Enable WiFi.


Instruction: What does `AndroidExploitManager.enable_hotspot()` do?

Output: `enable_hotspot(serial, ssid, password)` — Enable WiFi hotspot. Android 10+.


Instruction: What does `AndroidExploitManager.capture_traffic()` do?

Output: `capture_traffic(serial, interface, duration, pcap_filter)` — Capture network traffic via tcpdump. Requires ROOT or tcpdump binary.


Instruction: What does `AndroidExploitManager.port_forward()` do?

Output: `port_forward(serial, local_port, remote_port)` — Set up ADB port forwarding.


Instruction: What does `AndroidExploitManager.port_forward_list()` do?

Output: `port_forward_list(serial)` — List active port forwards.


Instruction: What does `AndroidExploitManager.enable_adb_wifi()` do?

Output: `enable_adb_wifi(serial, port)` — Enable ADB over WiFi.


Instruction: What does `AndroidExploitManager.grant_permission()` do?

Output: `grant_permission(serial, package, permission)` — Grant a runtime permission to an app.


Instruction: What does `AndroidExploitManager.revoke_permission()` do?

Output: `revoke_permission(serial, package, permission)` — Revoke a runtime permission from an app.


Instruction: What does `AndroidExploitManager.list_permissions()` do?

Output: `list_permissions(serial, package)` — List all permissions for a package.


Instruction: What does `AndroidExploitManager.disable_app()` do?

Output: `disable_app(serial, package)` — Disable (freeze) an app.


Instruction: What does `AndroidExploitManager.enable_app()` do?

Output: `enable_app(serial, package)` — Enable a disabled app.


Instruction: What does `AndroidExploitManager.clear_app_data()` do?

Output: `clear_app_data(serial, package)` — Clear all data for an app.


Instruction: What does `AndroidExploitManager.force_stop_app()` do?

Output: `force_stop_app(serial, package)` — Force stop an app.


Instruction: What does `AndroidExploitManager.launch_app()` do?

Output: `launch_app(serial, package)` — Launch an app.


Instruction: What does `AndroidExploitManager.launch_activity()` do?

Output: `launch_activity(serial, component, extras)` — Start a specific activity. component format: com.pkg/.Activity


Instruction: What does `AndroidExploitManager.send_broadcast()` do?

Output: `send_broadcast(serial, action, extras)` — Send a broadcast intent.


Instruction: What does `AndroidExploitManager.content_query()` do?

Output: `content_query(serial, uri, projection, where)` — Query any content provider.


Instruction: What does `AndroidExploitManager.overlay_attack_enable()` do?

Output: `overlay_attack_enable(serial, package)` — Grant SYSTEM_ALERT_WINDOW to an app (overlay/tapjacking).


Instruction: What does `AndroidExploitManager.set_selinux()` do?

Output: `set_selinux(serial, mode)` — Set SELinux mode. Requires ROOT.


Instruction: What does `AndroidExploitManager.remount_system()` do?

Output: `remount_system(serial, rw)` — Remount /system. Requires ROOT.


Instruction: What does `AndroidExploitManager.logcat_sensitive()` do?

Output: `logcat_sensitive(serial, duration)` — Capture logcat and grep for sensitive data (passwords, tokens, keys).


Instruction: What does `AndroidExploitManager.deploy_frida()` do?

Output: `deploy_frida(serial, frida_path)` — Deploy and start Frida server. Requires ROOT.


Instruction: What does `AndroidExploitManager.get_running_processes()` do?

Output: `get_running_processes(serial)` — List running processes.


Instruction: What does `AndroidExploitManager.get_open_ports()` do?

Output: `get_open_ports(serial)` — List open network ports.


Instruction: What does `AndroidExploitManager.modify_setting()` do?

Output: `modify_setting(serial, namespace, key, value)` — Modify an Android setting. namespace: system/secure/global.


Instruction: What does `AndroidExploitManager.get_device_fingerprint()` do?

Output: `get_device_fingerprint(serial)` — Comprehensive device fingerprint for identification.


Instruction: What does `AndroidExploitManager.dump_database()` do?

Output: `dump_database(serial, db_path, table, limit)` — Pull and query any SQLite database from device. Requires ROOT for app databases.


Instruction: What does `AndroidExploitManager.get_commands_for_op()` do?

Output:
`get_commands_for_op(op, params)` — Return ADB shell command(s) for a given operation without executing them.

Used by WebUSB Direct mode so the browser can execute via navigator.usb.
Returns one of:
  {'commands': ['cmd1', ...]}    — execute each via adbShell in order
  {'pullPath': '/device/path'}   — pull this file from device
  {'error': 'message'}           — unsupported or invalid params


Instruction: What does `AndroidExploitManager.parse_op_output()` do?

Output:
`parse_op_output(op, params, raw)` — Parse raw ADB shell output from WebUSB Direct mode.

Reuses the same parsing logic as the regular methods but feeds in
the raw text that the browser collected via adbShell().
Returns the same structured JSON the server-mode route would return.


Instruction: What does the file `core\android_protect.py` do in AUTARCH?

Output:
`core\android_protect.py` —
AUTARCH Android Protection Shield
Anti-stalkerware and anti-spyware detection, analysis, and remediation.

Detects:
- Commercial stalkerware (400+ package signatures)
- Government-grade spyware (Pegasus, Predator, Hermit, FinSpy, etc.)
- Hidden apps, rogue device admins, suspicious accessibility services
- MITM certificates, proxy hijacking, dangerous permission combos

Remediates:
- Disable/uninstall threats, revoke permissions, remove device admins
- Clear rogue CA certs, proxy settings, developer options

Uses HardwareManager for ADB access. Shizuku for privileged ops on non-rooted devices.

Category: core
It contains 1 class(es) and 1 top-level function(s).


Instruction: What methods does the `AndroidProtectManager` class in `core\android_protect.py` provide?

Output:
The `AndroidProtectManager` class provides these methods: update_signatures, get_signature_stats, check_shizuku, install_shizuku, start_shizuku, stop_shizuku, shizuku_status, check_shield_app, install_shield_app, configure_shield, get_shield_status, grant_shield_permissions, scan_stalkerware, scan_hidden_apps, scan_device_admins, scan_accessibility_services, scan_usage_access, scan_notification_listeners, scan_spyware_indicators, scan_system_integrity, scan_suspicious_processes, scan_certificates, scan_network_config, scan_developer_options, analyze_app_permissions, find_dangerous_apps, permission_heatmap, disable_threat, uninstall_threat, revoke_dangerous_perms, remove_device_admin, remove_ca_cert, clear_proxy, disable_usb_debug, quick_scan, full_protection_scan, export_scan_report, generate_hosts_content, honeypot_status, scan_tracker_apps, scan_tracker_permissions, get_advertising_id, get_tracking_settings, reset_advertising_id, opt_out_ad_tracking, set_private_dns, clear_private_dns, disable_location_accuracy, disable_usage_diagnostics, restrict_app_background, revoke_tracker_permissions, clear_app_tracking_data, force_stop_trackers, deploy_hosts_blocklist, remove_hosts_blocklist, get_hosts_status, setup_iptables_redirect, clear_iptables_redirect, set_fake_location, set_random_fake_location, clear_fake_location, rotate_device_identity, generate_fake_fingerprint, honeypot_activate, honeypot_deactivate, get_fake_data_set, update_tracker_domains, get_tracker_stats

Class description: Anti-stalkerware / anti-spyware shield for Android devices.


Instruction: What does `AndroidProtectManager.update_signatures()` do?

Output: `update_signatures(url)` — Download latest signatures from GitHub.


Instruction: What does `AndroidProtectManager.get_signature_stats()` do?

Output: `get_signature_stats()` — Count known threats by category.


Instruction: What does `AndroidProtectManager.check_shizuku()` do?

Output: `check_shizuku(serial)` — Check Shizuku installation and status.


Instruction: What does `AndroidProtectManager.install_shizuku()` do?

Output: `install_shizuku(serial, apk_path)` — Install Shizuku APK via ADB.


Instruction: What does `AndroidProtectManager.start_shizuku()` do?

Output: `start_shizuku(serial)` — Start Shizuku service via ADB.


Instruction: What does `AndroidProtectManager.stop_shizuku()` do?

Output: `stop_shizuku(serial)` — Stop Shizuku server process.


Instruction: What does `AndroidProtectManager.shizuku_status()` do?

Output: `shizuku_status(serial)` — Full Shizuku status check.


Instruction: What does `AndroidProtectManager.check_shield_app()` do?

Output: `check_shield_app(serial)` — Check if our protection app is installed.


Instruction: What does `AndroidProtectManager.install_shield_app()` do?

Output: `install_shield_app(serial, apk_path)` — Install our Shield APK via ADB.


Instruction: What does `AndroidProtectManager.configure_shield()` do?

Output: `configure_shield(serial, config)` — Push config to shield app via broadcast intent.


Instruction: What does `AndroidProtectManager.get_shield_status()` do?

Output: `get_shield_status(serial)` — Query shield app status via broadcast + logcat.


Instruction: What does `AndroidProtectManager.grant_shield_permissions()` do?

Output: `grant_shield_permissions(serial)` — Auto-grant required permissions to Shield app.


Instruction: What does `AndroidProtectManager.scan_stalkerware()` do?

Output: `scan_stalkerware(serial)` — Scan all installed packages against signature database.


Instruction: What does `AndroidProtectManager.scan_hidden_apps()` do?

Output: `scan_hidden_apps(serial)` — Detect apps with no launcher icon (hidden from app drawer).


Instruction: What does `AndroidProtectManager.scan_device_admins()` do?

Output: `scan_device_admins(serial)` — List device admin apps, flag suspicious ones.


Instruction: What does `AndroidProtectManager.scan_accessibility_services()` do?

Output: `scan_accessibility_services(serial)` — List accessibility services, flag non-legitimate ones.


Instruction: What does `AndroidProtectManager.scan_usage_access()` do?

Output: `scan_usage_access(serial)` — Apps with usage stats access.


Instruction: What does `AndroidProtectManager.scan_notification_listeners()` do?

Output: `scan_notification_listeners(serial)` — Apps reading notifications.


Instruction: What does `AndroidProtectManager.scan_spyware_indicators()` do?

Output: `scan_spyware_indicators(serial)` — Check for known government spyware file paths, processes.


Instruction: What does `AndroidProtectManager.scan_system_integrity()` do?

Output: `scan_system_integrity(serial)` — Verify system hasn't been tampered with.


Instruction: What does `AndroidProtectManager.scan_suspicious_processes()` do?

Output: `scan_suspicious_processes(serial)` — Find suspicious processes.


Instruction: What does `AndroidProtectManager.scan_certificates()` do?

Output: `scan_certificates(serial)` — Check CA certificate store for MITM certs.


Instruction: What does `AndroidProtectManager.scan_network_config()` do?

Output: `scan_network_config(serial)` — Check for rogue proxy, DNS, VPN.


Instruction: What does `AndroidProtectManager.scan_developer_options()` do?

Output: `scan_developer_options(serial)` — Check developer options state.


Instruction: What does `AndroidProtectManager.analyze_app_permissions()` do?

Output: `analyze_app_permissions(serial, package)` — Full permission breakdown for one app.


Instruction: What does `AndroidProtectManager.find_dangerous_apps()` do?

Output: `find_dangerous_apps(serial)` — Find apps with dangerous permission combinations.


Instruction: What does `AndroidProtectManager.permission_heatmap()` do?

Output: `permission_heatmap(serial)` — Which apps have which dangerous permissions (matrix view).


Instruction: What does `AndroidProtectManager.disable_threat()` do?

Output: `disable_threat(serial, package)` — Disable a stalkerware package.


Instruction: What does `AndroidProtectManager.uninstall_threat()` do?

Output: `uninstall_threat(serial, package)` — Uninstall a stalkerware package.


Instruction: What does `AndroidProtectManager.revoke_dangerous_perms()` do?

Output: `revoke_dangerous_perms(serial, package)` — Revoke all dangerous permissions from a package.


Instruction: What does `AndroidProtectManager.remove_device_admin()` do?

Output: `remove_device_admin(serial, package)` — Remove device admin before uninstall.


Instruction: What does `AndroidProtectManager.remove_ca_cert()` do?

Output: `remove_ca_cert(serial, cert_hash)` — Remove a user-installed CA cert.


Instruction: What does `AndroidProtectManager.clear_proxy()` do?

Output: `clear_proxy(serial)` — Remove proxy settings.


Instruction: What does `AndroidProtectManager.disable_usb_debug()` do?

Output: `disable_usb_debug(serial)` — Turn off USB debugging.


Instruction: What does `AndroidProtectManager.quick_scan()` do?

Output: `quick_scan(serial)` — Fast scan: stalkerware + device admins + accessibility only.


Instruction: What does `AndroidProtectManager.full_protection_scan()` do?

Output: `full_protection_scan(serial)` — Run ALL scans, return comprehensive report.


Instruction: What does `AndroidProtectManager.export_scan_report()` do?

Output: `export_scan_report(serial, scan_result)` — Save scan report as JSON file.


Instruction: What does `AndroidProtectManager.generate_hosts_content()` do?

Output: `generate_hosts_content()` — Generate hosts-file blocklist from all tracker domains.


Instruction: What does `AndroidProtectManager.honeypot_status()` do?

Output: `honeypot_status(serial)` — Report honeypot status for a device.


Instruction: What does `AndroidProtectManager.scan_tracker_apps()` do?

Output: `scan_tracker_apps(serial)` — Match installed packages against known tracker packages.


Instruction: What does `AndroidProtectManager.scan_tracker_permissions()` do?

Output: `scan_tracker_permissions(serial)` — Find non-system apps with tracking-related permissions.


Instruction: What does `AndroidProtectManager.get_advertising_id()` do?

Output: `get_advertising_id(serial)` — Read the device advertising ID.


Instruction: What does `AndroidProtectManager.get_tracking_settings()` do?

Output: `get_tracking_settings(serial)` — Read all tracking-related device settings.


Instruction: What does `AndroidProtectManager.reset_advertising_id()` do?

Output: `reset_advertising_id(serial)` — Reset Google Advertising ID.


Instruction: What does `AndroidProtectManager.opt_out_ad_tracking()` do?

Output: `opt_out_ad_tracking(serial)` — Enable limit_ad_tracking opt-out.


Instruction: What does `AndroidProtectManager.set_private_dns()` do?

Output: `set_private_dns(serial, provider)` — Set private DNS to an ad-blocking provider.


Instruction: What does `AndroidProtectManager.clear_private_dns()` do?

Output: `clear_private_dns(serial)` — Revert private DNS to system default (opportunistic).


Instruction: What does `AndroidProtectManager.disable_location_accuracy()` do?

Output: `disable_location_accuracy(serial)` — Disable WiFi and Bluetooth background scanning.


Instruction: What does `AndroidProtectManager.disable_usage_diagnostics()` do?

Output: `disable_usage_diagnostics(serial)` — Turn off usage & diagnostics reporting.


Instruction: What does `AndroidProtectManager.restrict_app_background()` do?

Output: `restrict_app_background(serial, package)` — Restrict an app's background activity.


Instruction: What does `AndroidProtectManager.revoke_tracker_permissions()` do?

Output: `revoke_tracker_permissions(serial, package)` — Revoke tracking-related permissions from an app.


Instruction: What does `AndroidProtectManager.clear_app_tracking_data()` do?

Output: `clear_app_tracking_data(serial, package)` — Clear tracking data for an app (cache + storage).


Instruction: What does `AndroidProtectManager.force_stop_trackers()` do?

Output: `force_stop_trackers(serial)` — Force-stop all known tracker packages found on device.


Instruction: What does `AndroidProtectManager.deploy_hosts_blocklist()` do?

Output: `deploy_hosts_blocklist(serial)` — Deploy tracker-blocking hosts file (requires root).


Instruction: What does `AndroidProtectManager.remove_hosts_blocklist()` do?

Output: `remove_hosts_blocklist(serial)` — Restore original hosts file.


Instruction: What does `AndroidProtectManager.get_hosts_status()` do?

Output: `get_hosts_status(serial)` — Check current hosts file status.


Instruction: What does `AndroidProtectManager.setup_iptables_redirect()` do?

Output: `setup_iptables_redirect(serial, port)` — Redirect tracker traffic through local proxy via iptables.


Instruction: What does `AndroidProtectManager.clear_iptables_redirect()` do?

Output: `clear_iptables_redirect(serial)` — Remove iptables redirect rules.


Instruction: What does `AndroidProtectManager.set_fake_location()` do?

Output: `set_fake_location(serial, lat, lon)` — Set fake GPS location for tracker apps (requires root).


Instruction: What does `AndroidProtectManager.set_random_fake_location()` do?

Output: `set_random_fake_location(serial)` — Pick a random famous location from templates.