map-attack-surface

Mapping entry points in a Windows binary involves analyzing the module to locate explicit and non-obvious entry points like exports, COM methods, and TLS callbacks. It then ranks these entry points by attack value using a callgraph-based reachability model.

For threat modeling, you should discover non-obvious Windows PE entry points including TLS callbacks, COM/VTable methods, RPC handlers, named pipes, and sockets. Discovering these ensures all potential attacker access paths are mapped and evaluated.

Binary entry points are ranked by attack value using a callgraph-based reachability model combined with parameter risk scoring. This evaluates how reachable each entry point is and how risky its parameters are to prioritize targets.

Yes, you can generate CRS-compatible output for downstream fuzzing workflows. The analysis produces a CRS-compatible entrypoints.json file that integrates directly into downstream tooling and fuzzing workflows.

Yes, you need a module analysis database to discover RPC handlers and named pipes. The tool operates on these databases to perform cross-module correlation and locate various entry-point types effectively.

The best way to trace cross-module entry point correlation in Windows binaries is by operating on module analysis databases. This enables cross-module correlation alongside callgraph reachability to map interconnected attack paths.