Security and analysis tools - TurenOS

TurenOS bundles local analyzers so security workflows do not depend on an unreviewed global toolchain. Most analyzers are bounded and static: they inspect selected files without executing them.

Capability groups

Group	Examples
Source and rules	Batou analysis, YARA-X, code search, secret and dependency evidence
Executables	PE/ELF/Mach-O inspection, imports, symbols, disassembly, strings, entropy, packer detection
Reverse engineering	Bounded Ghidra function decompilation, debug symbols, static unpacking
Documents	PDF indicators, Office relationships, OLE streams, EXIF, certificates, plists, LNK, minidumps
Email	MIME inspection, attachments, deceptive-link analysis, HTML sanitization, offline DKIM/SPF/DMARC
Network	Offline PCAP/protocol parsing and Wi-Fi capture summaries
Forensics	Windows artifacts and timeline reconstruction
Embedded content	Archive listing/extraction, signature scanning, carving, Binwalk-style scans, WASM inspection

Evidence, not verdicts

Analyzer output records bounded metadata, offsets, hashes, indicators, or parser findings. It does not automatically prove maliciousness. Correlate results with source, behavior, provenance, and independent verification.

Safety boundaries

Static tools do not execute targets.
Offline packet tools do not capture live traffic.
Email tools do not send messages or fetch links.
Carving and extraction require explicit selected ranges or members.
Rosetta execution, penetration testing, and network requests use separate explicit authorization boundaries.

Use Review and remediation to turn findings into verified fixes.