SCOUT: SCOUT Firmware Exploitability Platform

SCOUT, a firmware analysis platform from developer r00t-kim, uses an LLM-based Advocate/Critic tribunal to cut false positives by 99.3% on historical Tier-2 benchmarks while auditing ELF binaries and shell scripts. The platform generates evidence-anchored exploitability chains for internal red-team use and promotes verified Proof-of-Vulnerability evidence into private, scope-bound exploit packages without publishing raw public payloads, seeding hypotheses through metadata-only imports from GitHub and NVD rather than cloning or executing public PoC repositories. Development is at Phase 3 AEG Plan IR readiness, and the author cautions that broad firmware pass-rate generalizations should not be claimed from current readiness artifacts while Phase 1 scale-out and Phase 4 corpus expansion continue.

Evidence at a glance Based on the linked sources. The author's reported result and independent confirmation are separate checks. - AI involvement - Reported models: LLM Advocate/Critic Tribunal . Tools: Ghidra, SARIF, CycloneDX, ruff, pyright, pytest. The writeup below describes the work attributed to AI. - Reported result - Research. This is the directory's source-based outcome classification. - Independent confirmation - Not reported. - Human work and limitations - The platform distinguishes between metadata-only RAG seeding and actual exploit execution, enforcing strict gates for weaponization. Development is tracked through specific phases 0-3 with rigorous testing requirements, including linting, type checking, and CI validation. Original sources What was done SCOUT is a firmware analysis platform that uses a hybrid engine to audit ELF binaries and shell scripts, employing an LLM-based tribunal to reduce false positives and generate evidence-anchored exploitability chains for internal red-team use. SCOUT is an AEG-first firmware analysis platform designed to transform firmware blobs into evidence-anchored exploitability chains and audit-ready dossiers. The platform features a Hybrid Analysis Engine capable of auditing both ELF binaries and shell scripts. A core component of its triage pipeline is an LLM-based tribunal, which utilizes an Advocate/Critic debate model to reduce false positives by 99.3% on historical Tier-2 benchmarks. The platform supports controlled weaponization by promoting verified Proof-of-Vulnerability PoV evidence into private, scope-bound exploit packages without publishing raw public payloads. SCOUT integrates an Exploit Pattern RAG that uses metadata-only imports from GitHub and NVD sources to seed hypotheses, explicitly rejecting the cloning or execution of public PoC repositories to maintain safety boundaries. Recent development has focused on Phase 3 AEG Plan IR readiness, with implementation gates and tests required to prove contract compliance. The author notes that broad firmware pass-rate generalizations should not be claimed from current readiness artifacts, as ongoing work includes Phase 1 scale-out and Phase 4 corpus expansion. See SCOUT README https://raw.githubusercontent.com/r00t-kim/scout/HEAD/README.md for full documentation. Reproduce it ./scout analyze firmware.bin