Skip to content

Usage Guide (GUI & CLI)

Jump to bottom
HydraSoft edited this page Jul 20, 2026 · 1 revision

Usage Guide: GUI & CLI Modes

HydraSoft is designed to fit both interactive analysis workflows and automated testing pipelines.

Graphical User Interface (GUI)

The GUI provides an interactive, real-time tree view of scan targets. Users can select a directory, execute a scan, and immediately inspect the findings:

  • Expandable nodes showing which specific DLLs can be targeted.
  • The required export functions that must be forwarded or proxied.
  • Clear visual indicators showing which paths are writable.

Visual Priority Ratings

The color-coded system indicates the level of effort required to successfully construct a stable proxy DLL:

Rating Level Color Icon Proxy Implementation Complexity
Best Green 🟢 Few imported functions and a small binary footprint. Ideal for crafting simple proxy DLLs.
Good Yellow 🟡 Moderate complexity. Requires mapping a standard number of exports to avoid application crashes.
Bad Red 🔴 Large import table or highly complex structure. Difficult to proxy without causing stability issues.

Command Line Interface (CLI)

The CLI binary separates runtime progress (sent to stderr) from structured scan output (sent to stdout), enabling clean piping into parsing tools.

CLI Parameters

HydraSoft.exe --path <dir> [options]

--path <dir>               Target directory to scan (required)
--output <file>            Output destination (.json or .csv). Default: stdout
--image-type any|x86|x64   Filter targets by CPU architecture
--sign any|signed          Filter targets by digital signature status
--rate any|best|good|bad   Filter targets by complexity rating
--write-perm               Display only results where target directory is writable
--best-dll-count <n>       Maximum DLL count threshold for 'Best' rating (default: 2)
--best-exe-size <n>        Maximum size threshold in KB for 'Best' rating (default: 10240)
--help                     Display help text

Practical Examples

  1. Scan for highly exploitable candidates and output to JSON:

    HydraSoft.exe --path "C:\Program Files" --rate best --output results.json

  2. Extract executable paths from output using jq:

    HydraSoft.exe --path "C:\Program Files" | jq '.[].exePath'

  3. Identify signed binaries residing in writable paths (often reviewed for application control bypass testing):

    HydraSoft.exe --path "C:\Tools" --sign signed --write-perm

Clone this wiki locally