{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.0000161131229106104
      }
    ],
    "prob": 0.000016113123,
    "models": [
      {
        "m": "az",
        "raw": 0.000016113123,
        "prob": 0.000016113123,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00004133582,
        "prob": 0.00004133582,
        "class": 0
      },
      {
        "m": "az/rust",
        "raw": 0.000000029802322,
        "prob": 0.000000029802322,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T10:44:07Z"
  },
  "path": "linux.rs",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Mg)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "memfd_create.map_err"
            ],
            [
              "",
              "memfd_create"
            ],
            [
              "",
              "write_all.map_err"
            ],
            [
              "",
              "write_all"
            ],
            [
              "",
              "exec_memfd.map_err"
            ],
            [
              "",
              "exec_memfd"
            ],
            [
              "",
              "Ok"
            ],
            [
              "",
              "e.to_string"
            ],
            [
              "",
              "Err"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "Ok"
            ],
            [
              "",
              "data.len"
            ],
            [
              "",
              "write"
            ],
            [
              "",
              "data.len"
            ],
            [
              "",
              "Err"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "Ok"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "e.to_string"
            ],
            [
              "",
              "execve"
            ],
            [
              "",
              "c_path.as_ptr"
            ],
            [
              "",
              "argv.as_ptr"
            ],
            [
              "",
              "envp.as_ptr"
            ],
            [
              "",
              "Err"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "Ok"
            ]
          ],
          "m": {
            "ast": {
              "op.le": 1.0,
              "op.lt": 3.0,
              "op.add": 1.0,
              "op.sub": 1.0,
              "max_depth": 16.0,
              "call_count": 32.0,
              "node_count": 1117.0,
              "member_count": 8.0,
              "op_density.le": 0.0,
              "op_density.lt": 0.0,
              "op_density.add": 0.0,
              "op_density.sub": 0.0,
              "identifier_count": 56.0,
              "member_depth_max": 2.0,
              "string_literal_count": 24.0,
              "array_literal_max_length": 1.0
            },
            "file": {
              "size": 3597.0,
              "entropy": 4.85,
              "size_bytes": 3597.0
            },
            "text": {
              "digit_ratio": 0.04,
              "space_count": 936.0,
              "total_lines": 136.0,
              "char_entropy": 4.85,
              "unique_chars": 81.0,
              "string_density": 0.18,
              "avg_line_length": 25.45,
              "max_line_length": 75.0,
              "empty_line_ratio": 0.17,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.3,
              "most_common_ratio": 0.06,
              "identifier_density": 1.27,
              "line_length_stddev": 20.36,
              "normalized_string_count": 2.06,
              "repeated_char_sequences": 22.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.04,
              "normalized_unique_identifiers": 7.9
            },
            "calls": {
              "count": 32.0
            },
            "binary": {
              "overall_entropy": 4.85
            },
            "source": {
              "function_count": 4.0
            },
            "members": {
              "count": 8.0
            },
            "strings": {
              "total": 24.0,
              "avg_length": 6.29,
              "max_length": 25.0,
              "path_count": 1.0,
              "avg_entropy": 1.87,
              "empty_count": 1.0,
              "total_bytes": 151.0,
              "entropy_stddev": 1.03
            },
            "comments": {
              "chars": 749.0,
              "lines": 24.0,
              "total": 24.0,
              "to_code_ratio": 0.21
            },
            "functions": {
              "count": 4.0,
              "avg_params": 1.5,
              "max_params": 2.0,
              "length_stddev": 11.86,
              "avg_name_length": 10.75,
              "avg_length_lines": 26.75,
              "max_length_lines": 46.0,
              "min_length_lines": 16.0,
              "avg_param_name_length": 4.0,
              "density_per_100_lines": 2.94,
              "code_in_functions_ratio": 0.79
            },
            "identifiers": {
              "count": 56.0,
              "total": 173.0,
              "avg_length": 6.07,
              "max_length": 17.0,
              "min_length": 1.0,
              "avg_entropy": 2.15,
              "reuse_ratio": 0.32,
              "unique_count": 56.0,
              "length_stddev": 3.69,
              "sequential_names": 2.0,
              "single_char_count": 2.0,
              "single_char_ratio": 0.04,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.02,
              "all_lowercase_ratio": 0.77,
              "all_uppercase_ratio": 0.05
            }
          },
          "s": [
            [
              541,
              "16",
              "1"
            ],
            [
              580,
              "16",
              "2"
            ],
            [
              1357,
              "u8",
              "x86_64"
            ],
            [
              1358,
              "u8",
              "x86_64"
            ],
            [
              1402,
              "10",
              "319"
            ],
            [
              1432,
              "u8",
              "x86"
            ],
            [
              1433,
              "u8",
              "x86"
            ],
            [
              1474,
              "10",
              "356"
            ],
            [
              1504,
              "u8",
              "aarch64"
            ],
            [
              1505,
              "u8",
              "aarch64"
            ],
            [
              1550,
              "10",
              "279"
            ],
            [
              1614,
              "u8",
              "x86_64"
            ],
            [
              1615,
              "u8",
              "x86_64"
            ],
            [
              1680,
              "u8",
              "syscall"
            ],
            [
              1681,
              "u8",
              "syscall"
            ],
            [
              1710,
              "u8",
              "rax"
            ],
            [
              1711,
              "u8",
              "rax"
            ],
            [
              1754,
              "u8",
              "rdi"
            ],
            [
              1755,
              "u8",
              "rdi"
            ],
            [
              1797,
              "u8",
              "rsi"
            ],
            [
              1798,
              "u8",
              "rsi"
            ],
            [
              1835,
              "u8",
              "rax"
            ],
            [
              1836,
              "u8",
              "rax"
            ],
            [
              1866,
              "u8",
              "rcx"
            ],
            [
              1867,
              "u8",
              "rcx"
            ],
            [
              1896,
              "u8",
              "r11"
            ],
            [
              1897,
              "u8",
              "r11"
            ],
            [
              1960,
              "u8",
              "aarch64"
            ],
            [
              1961,
              "u8",
              "aarch64"
            ],
            [
              2027,
              "u8",
              "svc #0"
            ],
            [
              2028,
              "u8",
              "svc #0"
            ],
            [
              2056,
              "u8",
              "x8"
            ],
            [
              2057,
              "u8",
              "x8"
            ],
            [
              2099,
              "u8",
              "x0"
            ],
            [
              2100,
              "u8",
              "x0"
            ],
            [
              2141,
              "u8",
              "x1"
            ],
            [
              2142,
              "u8",
              "x1"
            ],
            [
              2178,
              "u8",
              "x0"
            ],
            [
              2179,
              "u8",
              "x0"
            ],
            [
              2232,
              "10",
              "0"
            ],
            [
              2263,
              "u8",
              "memfd_create failed: {}"
            ],
            [
              2264,
              "u8",
              "memfd_create failed: {}"
            ],
            [
              2437,
              "u8",
              "C"
            ],
            [
              2438,
              "u8",
              "C"
            ],
            [
              2538,
              "10",
              "0"
            ],
            [
              2696,
              "10",
              "0"
            ],
            [
              2731,
              "u8",
              "write failed at offset {}"
            ],
            [
              2732,
              "u8",
              "write failed at offset {}"
            ],
            [
              2932,
              "u8",
              "C"
            ],
            [
              2933,
              "u8",
              "C"
            ],
            [
              3137,
              "u8",
              "/proc/self/fd/{}"
            ],
            [
              3138,
              "u8",
              "/proc/self/fd/{}"
            ],
            [
              3284,
              "10",
              "1"
            ],
            [
              3335,
              "10",
              "1"
            ],
            [
              3470,
              "10",
              "0"
            ],
            [
              3505,
              "u8",
              "execve failed: {}"
            ],
            [
              3506,
              "u8",
              "execve failed: {}"
            ]
          ],
          "v": {
            "file.stem": "linux",
            "file.basename": "linux.rs",
            "source.language": "rust",
            "source.imports[0]": "Err",
            "source.imports[1]": "Ok",
            "source.imports[2]": "argv.as_ptr",
            "source.imports[3]": "c_path.as_ptr",
            "source.imports[4]": "data.len",
            "source.imports[5]": "e.to_string",
            "source.imports[6]": "envp.as_ptr",
            "source.imports[7]": "exec_memfd",
            "source.imports[8]": "exec_memfd.map_err",
            "source.imports[9]": "execve",
            "source.strings[0]": "/proc/self/fd/{}",
            "source.strings[1]": "aarch64",
            "source.strings[2]": "execve failed: {}",
            "source.strings[3]": "memfd_create failed: {}",
            "source.strings[4]": "svc #0",
            "source.strings[5]": "syscall",
            "source.strings[6]": "write failed at offset {}",
            "source.strings[7]": "x86_64",
            "source.has_imports": true,
            "source.imports[10]": "format",
            "source.imports[11]": "memfd_create",
            "source.imports[12]": "memfd_create.map_err",
            "source.imports[13]": "write",
            "source.imports[14]": "write_all",
            "source.imports[15]": "write_all.map_err",
            "source.functions[0]": "exec_memfd",
            "source.functions[1]": "memfd_create",
            "source.functions[2]": "run_fileless",
            "source.functions[3]": "write_all"
          },
          "ct": [
            "Err",
            "Ok",
            "argv.as_ptr",
            "c_path.as_ptr",
            "data.len",
            "e.to_string",
            "envp.as_ptr",
            "exec_memfd",
            "exec_memfd().map_err",
            "execve",
            "memfd_create",
            "memfd_create().map_err",
            "write",
            "write_all",
            "write_all().map_err"
          ],
          "id": "rust",
          "mc": [
            "argv.as_ptr",
            "c_path.as_ptr",
            "data.len",
            "e.to_string",
            "envp.as_ptr",
            "exec_memfd().map_err",
            "memfd_create().map_err",
            "write_all().map_err"
          ]
        },
        "id": 0,
        "sz": 3597,
        "ts": [
          {
            "c": 1.0,
            "d": "Inline assembly macro",
            "e": [
              "asm!("
            ],
            "i": "micro-behaviors/mem/inline-asm/arch::macro",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "Rust while loop",
            "e": [
              "while "
            ],
            "i": "micro-behaviors/data/control-flow/loop::rust-while-loop",
            "l": 2
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary string",
            "e": [
              "String"
            ],
            "i": "metadata/file/text/format::vocab-string",
            "l": 1
          },
          {
            "c": 0.9700000286102295,
            "d": "Validation vocabulary number",
            "e": [
              "number"
            ],
            "i": "metadata/file/text/format::vocab-number",
            "l": 1
          },
          {
            "c": 0.6000000238418579,
            "d": "payload keyword",
            "e": [
              "payload"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::payload",
            "l": 1
          },
          {
            "c": 0.4000000059604645,
            "d": "cmd/command/result vocabulary word",
            "e": [
              "Result"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word",
            "l": 1
          }
        ],
        "sha": "0fd2ccb13a976e158df1b9c3baba43b943e40e2f6170d8ba3d2e2bfb6afefe7c",
        "path": "linux.rs",
        "type": "rust"
      }
    ],
    "tv": "8e9ac"
  }
}