LISH command: capture replay surface for IPX spool evidence #188

New issue

Open

opened 2026-09-05 04:35:23 +00:00 by mara · 0 comments

mara commented

2026-09-05 04:35:23 +00:00

Collaborator

Reviewed at commit 3b4e2da.

Observation
replay-ipx-http-spool and ipx-replay-result are exported from the hackmode package (package.lisp lines ~225-234) but there is no operator surface: no LISH command, CLI tool under source/hackmode-tools/, or recon-script wrapper invokes replay. Operators must call it from the REPL with all three identity args by hand.

Why it matters
Hackmode's stated goal is being the most interactive Common Lisp exploit framework with strong recon pipelining. Capture replay is exactly the kind of evidence-to-graph operation operators need at their fingertips, especially for post-operation review of a spool.

Suggested feature
Add a LISH command like capture replay <spool-path> that:

reads operation_id / capture_session_id / spool_id from the first valid frame of the spool (with identity override flags),
calls replay-ipx-http-spool and prints the typed ipx-replay-result (offsets, committed, quarantined, truncated-p) as a compact table,
exits non-zero when quarantine-count > 0 so it composes into scripted pipelines.

This pairs naturally with the recon pipelining story (issue #50) and the LISH typed shell direction (#14).

Reviewed at commit 3b4e2da. **Observation** `replay-ipx-http-spool` and `ipx-replay-result` are exported from the hackmode package (package.lisp lines ~225-234) but there is no operator surface: no LISH command, CLI tool under `source/hackmode-tools/`, or recon-script wrapper invokes replay. Operators must call it from the REPL with all three identity args by hand. **Why it matters** Hackmode's stated goal is being the most interactive Common Lisp exploit framework with strong recon pipelining. Capture replay is exactly the kind of evidence-to-graph operation operators need at their fingertips, especially for post-operation review of a spool. **Suggested feature** Add a LISH command like `capture replay <spool-path>` that: - reads operation_id / capture_session_id / spool_id from the first valid frame of the spool (with identity override flags), - calls `replay-ipx-http-spool` and prints the typed `ipx-replay-result` (offsets, committed, quarantined, truncated-p) as a compact table, - exits non-zero when quarantine-count > 0 so it composes into scripted pipelines. This pairs naturally with the recon pipelining story (issue #50) and the LISH typed shell direction (#14).

mara added the

feature

label

2026-09-05 04:35:23 +00:00