{ "ml": { "v": "7", "eng": "2.12.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.030002335, "rte": "az", "prob": 0.030002335 }, { "cls": 0, "raw": 0.002797534, "rte": "az/native", "prob": 0.002797534 }, { "cls": 0, "raw": 0.005138079, "rte": "az/elf", "prob": 0.005138079 } ], "prob": 0.030002335, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.030002335086464882, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-10-01T00:21:06Z" }, "path": "kernel.so", "raw": { "v": "8", "rev": "c1ea9", "files": [ { "id": 0, "ctx": [ { "b": "E))420S-r400000000000%2!g0rr910000000000kMy=:00000fAImP0000000000kMA+z2()i\u003c8VQ=R0rr911POJ5000000000000000000000000000000H.P)\u002600000H.P)", "ln": 0 }, { "b": ".Wxc\u0026000000SSi27YTKo0rr911][S60006206*I}7YTKo82%Tpfk]wU5G-+g000000000000000000000000000000000000@@Vd[cG6{000000000000000000000@%8pKn]sZ000000000000000I2^OR5=.[i00000000000000000000M\u0026E9^5=.[", "ln": 632 }, { "b": "iSPiX5=-suaq1ON00000pYHE}00000A@=mv5=-suA1J6I000005c8Xg000000af8CzeTr0B97\u0026hByewPuRai\u003euU0.*wOkZ#By/F(o*--nzE(^QvR/PQuRai\u003euVGZ\u003cx(!xcA-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8OBywV{uT)++uUsH\u0026A+2d", "ln": 1256 }, { "b": "x([R2lU{WZwKpiKvGotrBv*sTxjT[Wz!B94B8}sPz!z^Mxk7\u003c\u003emrSlWBo2VPB97\u00262yHpN+yHpWZx(0=RuTX1%wPz)1w)]y\u002608^xvx(!xcA.w\u00260pdm\u0026Fzdd6*06$amB.L(co\u003c}WGv@1UNw]vVEwOkZ#By/F!vp%p:yE@zQzVA^PA+e($B97#logq-Nmnco\u0026vp%cKrC?", "ln": 1541 }, { "b": "B8JV=fAt{6vQ?3iz.r{Fy?bblx(n6reN-7dv}W+Se]$}-f-V02A=bD8e]$}hm[=GvlTIP3f/G7j00000000310rrc20SSl30rrc20rrc20SSl30@@u40rrc20rrc20rrc20rrf30rrc200000000310rx$q000Mg001bw005vFMiEr?0%4rY000000003", "ln": 1738 }, { "b": "5ch=)5F^Uc5txe!aoAUo5ch=)5Gi}g5w!BfaoAUo5ch=)5GTjk5AiXLaoAUo5ch=)5H6Ho5cq({aoAUo5ch=)5HG^s5f.dqaoAUo5ch=)5H{6w5jczWaoAUo5ch=)5IuuA5mLW5aoAUo5ch=)5I=SE5p%}BaoAUo5ch=)5Jh]I5txh/aoAUo5ch=)5JShM5w!EgaoAUo5ch=)5K5FQ", "ln": 2688 }, { "b": "e=L+^ko*oX@D(qU@r04Z@D(wVZAS\u003chZYN@{e?O!fe?ZZMwmY!5fkCctzE)Spv/MGe0000000000x(do\u003ewNxd?w]w!njS(d.z/fSraw3AUxjTULw]w!wdiIw=oItA^x(do\u003e", "ln": 4476 }, { "b": "000000000000000000000000000000000000000000000000000000000000kNWR)00000(\u003cA^[000000rr9100000O=F/\u003e000000rr9100000Xb=Nf000000rr9100000.t%Sp000004GDFe00000/z$%L000003\u0026*nc00000[cG6{000004fcwd00000FdR+Y0000082%Tp00000", "ln": 64888 }, { "b": "vR]K^x\u003e7{*z/Pzvh.G88hz3Tqe[wK5B.pW*\u003eE]rc}++8Ju(G@Y1Mr.!!eRY[h.WlHh8WrKi5\u0026(Tf/7K{i599yg+\u0026GIggSl@wI^)MfK=\u003eGggS1FwNY^{00000P*U+G04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaK6iC(PEmz//LyxkR\u0026AvS=y3wg.Ia04}]4BUmuoB7+Lawo\u00266lD2iKlwo\u00266lBAdvlxkR\u0026AC4CYnx(v\u003e?", "ln": 65728 } ], "mol": "Md₃(BiBkHe₂)", "sha": "0140ac19e31cc90d5bedd7b0766c6527f9a53d1079f0cfa500c6194cf99f4d15", "path": "/data/samples/incoming/forager/raspios/raspberrypi.org/osimage/arm64-img/2026-09-15-raspios-trixie-arm64.img/2026-09-15-raspios-trixie-arm64.img.d/1.img.d/usr/lib/aarch64-linux-gnu/ImageMagick-7.1.1/modules-Q16/coders/kernel.so", "risk": 4, "size": 67824, "supp": [ { "by": [ { "id": "metadata/binary/linking/runtime::elf-dynamic-linking-metadata" } ], "id": "metadata/binary/linking/static::static-linked-heuristic", "crit": "notable", "kind": "unless" } ], "type": "elf", "facts": { "exp": [ [ "RegisterKERNELImage" ], [ "UnregisterKERNELImage" ] ], "imp": [ [ "", "UnregisterMagickInfo" ], [ "", "FormatLocaleString" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "cxa_finalize" ], [ "", "IsEventLogging" ], [ "", "SetImageProgress" ], [ "", "GetMagickPrecision" ], [ "", "AcquireMagickInfo" ], [ "", "LogMagickEvent" ], [ "", "stack_chk_fail" ], [ "", "gmon_start__" ], [ "", "stack_chk_guard" ], [ "", "GetVirtualPixels" ], [ "", "RegisterMagickInfo" ], [ "", "TransformImageColorspace" ], [ "", "GetPixelIntensity" ], [ "", "OpenBlob" ], [ "", "WriteBlobString" ], [ "", "CloseBlob" ], [ "", "ITM_registerTMCloneTable" ], [ "", "assert_fail" ] ], "sec": [ [ ".note.gnu.property", 568, 32, 1.69, "alloc" ], [ ".note.gnu.build-id", 600, 36, 4.14, "alloc" ], [ ".gnu.hash", 640, 40, 2.57, "alloc" ], [ ".dynsym", 680, 624, 0.99, "alloc" ], [ ".dynstr", 1304, 493, 4.97, "alloc" ], [ ".gnu.version", 1798, 52, 1.35, "alloc" ], [ ".gnu.version_r", 1856, 64, 2.22, "alloc" ], [ ".rela.dyn", 1920, 192, 1.83, "alloc" ], [ ".rela.plt", 2112, 432, 1.44, "alloc,info_link" ], [ ".init", 2544, 28, 3.9, "alloc,executable" ], [ ".plt", 2576, 320, 4.38, "alloc,executable" ], [ ".text", 2912, 1568, 6.04, "alloc,executable" ], [ ".fini", 4480, 24, 3.72, "alloc,executable" ], [ ".rodata", 4504, 409, 4.7, "alloc" ], [ ".eh_frame_hdr", 4916, 68, 3.44, "alloc" ], [ ".eh_frame", 4984, 528, 5.14, "alloc" ], [ ".init_array", 64936, 8, 1.06, "write,alloc" ], [ ".fini_array", 64944, 8, 1.06, "write,alloc" ], [ ".dynamic", 64952, 512, 1.51, "write,alloc" ], [ ".got", 65464, 48, 0.44, "write,alloc" ], [ ".got.plt", 65512, 168, 0.96, "write,alloc" ], [ ".data", 65680, 8, 1.06, "write,alloc" ], [ ".gnu_debugaltlink", 65688, 87, 5.31, "" ], [ ".gnu_debuglink", 65776, 52, 4.22, "" ], [ ".shstrtab", 65828, 264, 4.26, "" ] ], "tgt": [ "entry0", "fcn.00000b80", "sym.imp.AcquireMagickInfo", "sym.imp.CloseBlob", "sym.imp.FormatLocaleString", "sym.imp.GetMagickPrecision", "sym.imp.GetPixelIntensity", "sym.imp.GetVirtualPixels", "sym.imp.IsEventLogging", "sym.imp.LogMagickEvent", "sym.imp.OpenBlob", "sym.imp.RegisterMagickInfo", "sym.imp.SetImageProgress", "sym.imp.TransformImageColorspace", "sym.imp.WriteBlobString", "sym.imp.__assert_fail", "sym.imp.__cxa_finalize", "sym.imp.__stack_chk_fail" ], "funcs": [ [ "fcn.000009f4", 2548 ], [ "fcn.00000a14", 2580 ], [ "sym.imp.UnregisterMagickInfo", 2608 ], [ "sym.imp.FormatLocaleString", 2624 ], [ "sym.imp.__cxa_finalize", 2640 ], [ "sym.imp.IsEventLogging", 2656 ], [ "sym.imp.SetImageProgress", 2672 ], [ "sym.imp.GetMagickPrecision", 2688 ], [ "sym.imp.AcquireMagickInfo", 2704 ], [ "sym.imp.LogMagickEvent", 2720 ], [ "sym.imp.__stack_chk_fail", 2736 ], [ "sym.imp.GetVirtualPixels", 2768 ], [ "sym.imp.RegisterMagickInfo", 2784 ], [ "sym.imp.TransformImageColorspace", 2800 ], [ "sym.imp.GetPixelIntensity", 2816 ], [ "sym.imp.OpenBlob", 2832 ], [ "sym.imp.WriteBlobString", 2848 ], [ "sym.imp.CloseBlob", 2864 ], [ "sym.imp.__assert_fail", 2880 ], [ "entry0", 2912 ], [ "fcn.00000b80", 2944 ], [ "entry.fini0", 3052 ], [ "entry.init0", 3136 ], [ "fcn.00000c64", 3172 ], [ "sym.RegisterKERNELImage", 4384 ], [ "sym.UnregisterKERNELImage", 4464 ], [ "fcn.00001184", 4484 ] ], "metrics": { "elf": { "bits": 64, "entry": 0, "has_got": 1, "has_plt": 1, "has_note": 1, "relacount": 3, "note_count": 2, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 26, "has_build_id": 1, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 0, "dynrela_count": 8, "has_debuglink": 1, "little_endian": 1, "pltreloc_count": 18, "build_id_length": 20, "dt_versym_count": 26, "has_aarch64_bti": 1, "has_aarch64_pac": 1, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 1, "wx_segment_count": 0, "program_header_count": 9, "stripped_with_symtab": 0, "has_direct_loader_dep": 1, "executable_segment_count": 1, "load_segment_max_file_size": 5512, "load_segment_max_memory_size": 5512, "section_relocation_group_count": 2, "stripped_metadata_section_count": 8 }, "file": { "size": 67824, "entropy": 0.76 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 1, "basic_blocks": 80, "code_entropy": 5.7, "data_entropy": 1.3, "overlay_size": 1732, "string_count": 65, "overlay_ratio": 0.03, "avg_complexity": 2.52, "max_complexity": 32, "huge_func_count": 0, "leaf_func_count": 22, "overlay_entropy": 1.42, "tiny_func_count": 22, "avg_basic_blocks": 2.96, "entropy_variance": 2.83, "avg_string_length": 16.85, "max_string_length": 66, "peak_region_bytes": 2048, "code_to_data_ratio": 0.72, "peak_region_entropy": 6.1, "string_length_stddev": 11.42, "largest_section_ratio": 0.02, "sentence_string_count": 6, "sentence_string_ratio": 0.09, "high_entropy_string_count": 0 }, "exports": { "count": 2, "api_count": 2 }, "imports": { "count": 21 }, "strings": { "truncated": 0, "retained_count": 65, "extracted_count": 65 }, "sections": { "count": 27, "code_size": 1940, "entropy_max": 6.04, "entropy_mean": 2.9, "name_entropy": 4.22, "writable_count": 7, "executable_count": 4, "nonstandard_count": 7, "executable_writable_count": 0 }, "functions": { "count": 27 }, "dependencies": { "count": 3 } } }, "traits": [ { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader" }, { "id": "metadata/hardening/mitigation::partial-relro", "conf": 0.8, "crit": 3, "desc": "Partial RELRO (GOT partially protected)" }, { "id": "metadata/build/artifact::stripped-toolchain-comment", "conf": 1.0, "crit": 3, "desc": "ELF omits compiler metadata (.comment)" }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)" } ] } ] } }