======================================================================================
  TRUEVERDICT - LIVE FALSE-POSITIVE STRESS BENCHMARK & ADVERSARIAL VALIDATION
======================================================================================

[PHASE 1] Scanning 32 Legitimate OS & Developer Binaries...
--------------------------------------------------------------------------------------
BINARY NAME                  | SIGNING MODE           | NAIVE  | FINAL  | VERDICT
--------------------------------------------------------------------------------------
notepad.exe                  | OS_CATALOG             |    45  |     0  | BENIGN (99.9%)
cmd.exe                      | OS_CATALOG             |    80  |     0  | BENIGN (99.9%)
svchost.exe                  | EMBEDDED_AUTHENTICODE  |    60  |     0  | BENIGN (99.9%)
calc.exe                     | OS_CATALOG             |    45  |     0  | BENIGN (99.9%)
explorer.exe                 | EMBEDDED_AUTHENTICODE  |    60  |     0  | BENIGN (99.9%)
regedit.exe                  | OS_CATALOG             |    45  |     0  | BENIGN (99.9%)
certutil.exe                 | OS_CATALOG             |    45  |     0  | BENIGN (99.9%)
spoolsv.exe                  | OS_CATALOG             |    80  |     0  | BENIGN (99.9%)
powershell.exe               | OS_CATALOG             |    45  |     0  | BENIGN (99.9%)
python.exe                   | EMBEDDED_AUTHENTICODE  |     0  |     0  | BENIGN (99.9%)
clean_unsigned_dev_tool.exe  | UNSIGNED               |    20  |     0  | BENIGN (98.5%)
... (all 32 legitimate binaries score 0/100)

[PHASE 2] Scanning 5 Synthetic Adversarial Threat Specimens...
--------------------------------------------------------------------------------------
THREAT SPECIMEN              | PRIMARY DETECTION VECTORS    | SCORE  | VERDICT
--------------------------------------------------------------------------------------
svchost.exe                  | L2_RICH_F,L6_MASQUE          |   100  | MALICIOUS (99.4%)
scvhost.exe                  | L2_RICH_F,L6_MASQUE          |   100  | MALICIOUS (99.4%)
reflective_rwx_stub.exe      | L4_RWX_ME,L4_PACKED          |   100  | MALICIOUS (99.4%)
hollow_injector.exe          | L2_RICH_F,L3_TIMEST          |    90  | MALICIOUS (94.6%)
tampered_cert_implant.exe    | L1_CRYPTO,L2_RICH_F          |   100  | MALICIOUS (99.4%)

======================================================================================
  BENCHMARK SUMMARY: NAIVE HEURISTICS vs. TRUEVERDICT CORROBORATION ENGINE
======================================================================================
  Total Binaries Evaluated           : 37 (2.70s)
  Naive Heuristic False Positives    : 18/32 (56.25% FPR)
  TrueVerdict False Positives        : 0/32 (0.00% FPR)
  Total False-Positive Risk Suppressed: -1175 heuristic noise points
  Adversarial Threat Detection Rate  : 5/5 (100.00% TPR)
======================================================================================

====================================================================================
  TRUEVERDICT FORENSIC TRIAGE REPORT : cmd.exe
====================================================================================
  File Path         : C:\Windows\System32\cmd.exe
  File Size         : 344,064 bytes
  SHA-256           : 97ac98b1a92c286054cce55239cfccdfc23a5517bd07fe693072c9ca96c7dabb
  Imphash (MD5)     : 010b165e4c37f484601d3dbd700c9423
  Architecture      : x64 (64-bit) | Linker: 14.38 | Container: NATIVE_UNPACKED
  Compile Timestamp : 2034-02-16 12:02:30 UTC [REPRODUCIBLE_BUILD_HASH]

  [1] CRYPTOGRAPHIC PROVENANCE (AUTHENTICODE + OS CATALOG)
  ------------------------------------------------------------------------------
  Verification Mode : OS_CATALOG
  Status            : Valid Windows Security Catalog Signature
  Verified Signer   : Microsoft Windows Production PCA 2011
  Certificate Issuer: Microsoft Root Certificate Authority 2010
  OS Security Cat   : C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0512~31bf3856ad364e35~amd64~~10.0.26100.9444.cat

  [2] COMPILER PROVENANCE (RICH HEADER & DEBUG METADATA)
  ------------------------------------------------------------------------------
  Rich Header (DanS): Present | XOR Key: 0xD7965A3A | ROL32 Checksum: VALID (Authentic MSVC Build)
  Toolchain Objects : 11 @comp.id records
  CodeView PDB Path : cmd.pdb

  [5] FALSE-POSITIVE SUPPRESSION & CORROBORATION MATRIX
  ------------------------------------------------------------------------------
  [+] TRUST ANCHOR  [L1_CRYPTO_TRUST       ] (-75) Valid Windows Security Catalog Signature (Microsoft Windows Production PCA 2011)
  [+] TRUST ANCHOR  [L2_RICH_PROVENANCE    ] (-15) Authentic MSVC Rich Header ('DanS') verified via ROL32 checksum (0xD7965A3A, 11 toolchain build objects)
  [~] FP SUPPRESSED [L1_CATALOG_RECOVERY   ] (-20) Binary has no embedded Authenticode table, but matched verified OS Catalog
  [~] FP SUPPRESSED [L3_BREPRO_TIMESTAMP   ] (-25) Non-chronological PE TimeDateStamp (0x789F4656) verified as deterministic Reproducible Build (IMAGE_DEBUG_TYPE_REPRO) hash
  [~] FP SUPPRESSED [L5_DUAL_USE_API_SUPPRESSION] (-35) Dual-use Win32 APIs (ResumeThread) suppressed within high-density/trusted IAT (287 total imports)
  [*] Active Risk Vectors: 0 (Zero corroborated threat indicators)

====================================================================================
  NAIVE HEURISTIC SCORE : 80/100  -->  TRUEVERDICT FINAL SCORE : 0/100 (-80 FP noise suppressed)
  FINAL VERDICT         : BENIGN (Confidence: 99.9% | Corroborated Layers: 0)
====================================================================================

git clone https://github.com/prox0959/TrueVerdict.git
cd TrueVerdict

# 1. Run the live False-Positive Stress Benchmark (32 OS/Dev binaries + 5 synthetic threats)
python trueverdict.py --benchmark

# 2. Triage a single binary (.exe, .dll, .sys)
python trueverdict.py C:\Windows\System32\cmd.exe

# 3. Triage an entire directory and export structured JSON
python trueverdict.py --dir C:\Windows\System32 --limit 50 --json system32_triage.json

# 4. Run unit & integration test suite
python -m unittest discover -s tests -v