The Long Game: MalChela v4.0

When I started building MalChela, I had a narrow problem to solve. I was doing a lot of malware triage during incident response engagements and I kept reaching for the same scattered set of tools — VirusTotal, some strings extraction, a hash lookup here, a YARA scan there. The workflow existed, but it wasn’t a workflow. It was a series of scripts and context switches dressed up as a process. I wanted something that unified those steps under one roof, ran locally, and felt like a tool a forensicator actually built.

What I got was MalChela. What I didn’t expect was how far it would go.

From Rust Experiment to Field Platform

The first version was modest. A handful of tools with a unifying CLI runner. The goal was simple: hash a malware sample, look it up, pull strings, run YARA. The kind of triage you want to do in the first ten minutes with an unknown file.

Version 2 brought a desktop GUI — MalChelaGUI, built on egui/eframe. It was a genuine step up in accessibility. Analysts who weren’t comfortable in the terminal had a way in. The toolset kept growing.

Version 3 added structure around the investigation itself. Case management landed, giving results somewhere to live across a session. MCP server integration followed, opening up a whole new mode of operation — Claude working alongside the tools, not just alongside me.

But the GUI carried freight. It meant building for a specific platform, managing a Rust GUI dependency chain, and ultimately shipping something that couldn’t easily follow MalChela into its most interesting new use case: the field.

Toby Changed Everything

If you’ve been following Baker Street Forensics for the last few months, you’ve seen the ‘TOBYgotchi‘ project take shape — a Raspberry Pi Zero 2W running Kali Linux, with a Waveshare e-ink display, PiSugar battery, and MalChela pre-installed. Boot it up, it announces itself on the network, and you’re ready to triage. And yes, I am working on making a full build of TOBY available to the public. Stay tuned…

The original field kit vision was: SSH in, run tools from the CLI, pull results. Simple and functional. But the more I used Toby in practice, the more I wanted a better interface — something that worked without a terminal, something a colleague could pick up at a scene without knowing the command syntax.

MalChelaGUI on a Pi Zero 2W is possible but not comfortable. The egui overhead, the X display stack, remote display via VNC — it all works, but it’s friction. What I wanted was something lighter. Something any browser on the network could reach. Something that felt native on an iPad.

That’s what pulled me toward the PWA.

v4.0: The PWA Takes Over

MalChela v4.0 retires the desktop GUI entirely and replaces it with a Progressive Web App as the primary interface.

Every tool that lived in MalChelaGUI has been ported. Most have been improved in the process. The PWA is served locally from the server/ directory — run setup-server.sh once after building the binaries, then start-server.sh on every subsequent boot. Open any browser on the local network and you’re in.

On Toby, this is now part of autostart. Boot the Pi — battery-powered, no cables required — and the server comes up automatically. Connect from your desktop, phone or iPad directly to the PWA. No VNC, no X display overhead, no SSH tunnel. Just a browser pointing at the Pi’s IP.

And here’s the part that makes it genuinely useful in the field: you can upload files directly from whatever device you’re browsing from to the MalChela server. Phone, iPad, laptop — if it has a browser and can reach Toby on the network, it can submit a sample for analysis. The triage station travels with you, and so does the interface.

This is still a work in progress, but the direction is clear: a battery-powered Pi you can drop on a table at a scene, pull out your tablet, and start triaging — no keyboard, no monitor, no additional hardware required.

The field kit I was imagining finally snapped into focus.

REMnux Support

Running MalChela on a REMnux instance? It’s now even easier to load the REMnux configuration tools.yaml.

Configuration > tools.yaml > Load REMnux

then refresh the browser and you’ve got access to all the REMnux CLI tools from within MalChela.

What Else Is New

Simplified case management. This one’s been on my list for a while. In previous versions, case management was tied to starting with a file or folder — you had to know what you were investigating before you could create a case. That’s not how IR actually works. v4.0 breaks that dependency: any result can be saved to a case, and you can create a new case from within a running tool session. All the output, whether from the included cargo tools, or 3rd party add-ons like TShark or Volatility, can be saved to your case. The investigation defines the case, not the other way around.

Improved Volatility support. The Volatility integration got a meaningful UX overhaul. The reference panel has been improved, and output now streams inline within the PWA — no more spawning a separate terminal window to see results, which was one of the more awkward edges of the old GUI experience.

Rapid tool iteration via tools.yaml. The PWA is built around a tools.yaml configuration file that defines the tool manifest. Add a new tool, update the YAML, refresh the interface — done. No recompiling the GUI, no rebuilding the binary for a UI change. This makes extending MalChela considerably faster in practice, and opens the door for community-contributed tool configs down the road.

Try MalChela for Yourself

MalChela v4.0 is available on GitHub now: https://github.com/dwmetz/MalChela/

The CLI isn’t going anywhere. If you’re scripting triage workflows, running MalChela headless in an automated pipeline, or just prefer the terminal, everything you relied on in v3.x is still there. The PWA is the new face of MalChela; the CLI is still the engine.

Want to run MalChela on Windows? You can build it in an Ubuntu instance in WSL. Once you start the server in WSL, the Windows host can access the PWA via http://localhost:8675. (In modern WSL2 Microsoft automatically forwards WSL loopback → Windows localhost.)

If you hit any constraints, open an issue on GitHub. I tried to be as thorough as possible in my testing, but there’s only so much a one-man dev team can do. I’m happy assist in troubleshooting and improve the documentation. Rest assured you won’t get a “well, it works in my environment…”

Good morning everyone 🌞 I'm just up from a good long lie as Grant got up for the birds today. I always feel a bit guilty about lying in, but I was nice and dozy this morning for sure. I was going to sit in the living room and have a coffee, but Toby had other ideas, screaming at me constantly, and I'm really not nearly awake enough yet for *that* so I am now in the dining room, chased from my own comfy couch by a parrot 🥴 Grant is still dozing on the couch mind you, Toby having no problem with him being there!

No real plans for today other than the usual Sunday chores. Maybe a catch up later with my sisters and daughter on the phone. I need to start looking out yarn for the competition toy too. (This is where I no doubt find out I don't have enough of the correct colours and have to order more as is always the way 😂)

Have a very lovely day, whatever you get up to 🤗

#GoodMorning #Parrots #Toby

Good morning you lovely lot 💕 I am up with the parrots again this morning, but there is no work to rush into, do I can sit and have a leisurely cuddle with Ziggy while listening to Toby chomp away 😊

I'm glad to say there was no repeat of the toe tapping episode the other night, so it looks like it might be too many dried papaya treats that did it.

All my birds love those treats - they are like parrot crack cocaine if their reactions when you rattle the pack are anything to go by 😊 But he had about three or four that day and Eclectus are known to be sensitive to dried fruit - even without any sulphate as these are apparently. I'm glad it was an easy explanation though. Chasing down food intolerances is a painful process of elimination that I haven't had to do in a while. It's why his diet isn't very adventurous- I stick to the foods I know don't cause him any issues.

When he first came to us it took me a while to figure out that corn and strawberries both caused wing flipping and budgie seed - cited by Eclectus breeders as something they feed to their birds - caused awful toe tapping. They are very complex parrots for sure, and every one is different.

I have to go to the dentist this morning to have that wobbly molar pulled out. Not looking forward to that, but it needs to be done. Until then I am going to relax with some Stardew Valley and later , afterwards, it's back to crochet orders.

Have a very lovely day, whatever you get up to 🤗

#GoodMorning #Parrots #Toby

Good morning my Fine Fedi Friends 💕 I'm up early with the parrots once again. Grant offered to get up for them, but I don't really get much of a long lie on a work day so I prefer just to get up and sort them out. They are all munching away after a very brief cuddle with Ziggy who was too hungry for much playtime today.

Toby has started mimicking the microwave and he has the beeping sound down to a T..I ran through yesterday thinking something was up with it (we had one previously catch fire due to an electrical fault) before I realised the sound was actually coming from the living room 🙂 He seems to prefer noises to talking. At night when he sits with me he loves it if I make "too too too" sounds. He puts his beak right up against my face and repeats the noise. He also likes the "Kiss, mwah!" game. Anything that involves sticking his beak in my face basically 😂

Work again today. Lots to get on with, but happily fairly free of meetings for a change.

Have a lovely day, whatever you get up to 🤗

#GoodMorning #Parrots #Toby

《天選之人》：「演算法」如何逐步瓦解那些根深蒂固的地位階級？