{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000017106533, "rte": "az", "prob": 0.000017106533 }, { "cls": 0, "raw": 0.621573, "rte": "az/source", "prob": 0.621573 }, { "cls": 0, "raw": 0.74054134, "rte": "az/c", "prob": 0.74054134 } ], "prob": 0.000017106533, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00001710653305053711, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T09:52:44Z" }, "path": "linux.c", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 246, "b": "bwz49y\u0026%o1ar\u0026A\u003cfd[\u003egv@Dj3z/djrz/6ufzz2PD", "l": 14 }, { "a": 279, "b": "", "l": 15 }, { "a": 280, "b": "fdF8Oz/fVqz!{Lux(4Pdx(n37A=u5gBrC1fC{40Ezdm6%az+FbxjV9aBzb92azC}saAI*Hv{%g\u0026aAR43y?i", "l": 16, "n": [ { "c": 3, "d": "Inline assembly with direct syscall", "i": "objectives/evasion/kernel-hide/lkm/internals::asm-syscall-invocation", "o": 333, "z": 7 } ] }, { "a": 347, "b": "asXHxB0a)lv@Dj3vqYP#Bz\u0026piy?m3}ayP85ay/LmA+fcgaz\u003eLdyJz9", "l": 17 }, { "a": 391, "b": "asXHFBshbLvixi3z!6#1wPP5pxKM09y?W^fCP.iAy?$kiwP?T9azthbwGS(*h8v9jB9R?pvqG+3e=", "l": 18, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 410, "z": 4 } ] }, { "a": 453, "b": "asY2", "l": 19 }, { "a": 457, "b": "bv\u003ev$x(mG8lRG{mqErc:m[D5\u003ca#RqogC{u", "l": 20 }, { "a": 1283, "b": "arR^RawDo\u0026vR3V\u003caAITkBzkkcC42A9vpB4:aARp9BrC^saARgoBs*{swg.\u003elBuY", "l": 40 }, { "a": 1334, "b": "arR^Rf8", "l": 41 }, { "a": 1340, "b": "arUxgasFTIwfs2Tz/xo9c{{^9r8MH=uQ^QXmjYMSuSQc3pe1!tdiH.}fEXb\u003e", "l": 42, "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::open-base", "o": 1352, "z": 4 } ] }, { "a": 1389, "b": "arR^HwPz/twPz*ez.91Pz/xo9ar?{}pFK\u003e!pFta+nLzM4i@", "l": 43 }, { "a": 1427, "b": "arV7", "l": 44 }, { "a": 1574, "b": "arV7", "l": 50 }, { "a": 1578, "b": "", "l": 51 }, { "a": 1579, "b": "arUxgasICOx()]mw[iCnB9R?lzGP!EaAITBy?mGjB9R?lzGP!BdiH.}fEXb\u003e", "l": 52, "n": [ { "c": 3, "d": "File content manipulation (read/write/seek)", "i": "micro-behaviors/fs/file/binary::file-manipulation", "o": 1585, "z": 5 } ] }, { "a": 1628, "b": "arR^HfdF8RA+P95wnDJlwPz*fAV/jgB8$=5wGU]eaA.NyB-qqrA=+(6aAI*Hv{%g\u0026asY2", "l": 53 }, { "a": 1684, "b": "arR^Hx\u003ewFowPz*ezY?haavP75pes?/rzVHvaBs", "l": 54 }, { "a": 2817, "b": "arV7", "l": 114 }, { "a": 2821, "b": "", "l": 115 }, { "a": 2822, "b": "arUxgasInwvpQ=#wgO\u003cjB.ifEB7]@iz!pzbB.i6BeG=+%auQ=2diJ%", "l": 116, "n": [ { "c": 2, "d": "Read file descriptor (read/pread)", "i": "micro-behaviors/fs/file/read::read", "o": 2828, "z": 4 } ] }, { "a": 2866, "b": "arR^HwPz/twPz*ez.91PA+eV\u0026ar?}4pE!+Yk#*PTq^S0=oHQx(", "l": 117 }, { "a": 2907, "b": "arV7", "l": 118 }, { "a": 3002, "b": "arU-Evru66jS\u003e[?Byxo5i@", "l": 124 }, { "a": 3020, "b": "arUJjzf6ogc$mshefDR$aAImywP8fevS=oidlv", "l": 125 }, { "a": 3051, "b": "arU-yAb]VgBy(}gB.ifEB7]@iz!pzbB.i6Nar\u0026aOa$K\u003cTByxo5dlv", "l": 126, "n": [ { "c": 2, "d": "snprintf formatting function", "i": "micro-behaviors/data/format/string::snprintf-format", "o": 3053, "z": 8 } ] }, { "a": 3094, "b": "", "l": 127 }, { "a": 3095, "b": "arUxgasICOx()]mw[iCnvS=olaAITBy?mGjvS=oidiH.}fEXb\u003e", "l": 128 } ], "mol": "O(Er)H(F)", "sha": "164f3c6892394f509569159b2acabea802e27cc54ab3379335749574e66f330c", "fact": { "id": "c", "imp": [ [ "", "strcmp" ], [ "", "strcmp" ], [ "", "fprintf" ], [ "", "open" ], [ "", "err" ], [ "", "lookup_syscall_number" ], [ "", "warnx" ], [ "", "close" ], [ "", "write" ], [ "", "strlen" ], [ "", "errx" ], [ "", "err" ], [ "", "close" ], [ "", "open" ], [ "", "err" ], [ "", "write" ], [ "", "strlen" ], [ "", "err" ], [ "", "close" ], [ "", "open" ], [ "", "err" ], [ "", "write" ], [ "", "strlen" ], [ "", "err" ], [ "", "close" ], [ "", "open" ], [ "", "err" ], [ "", "write" ], [ "", "strlen" ], [ "", "err" ], [ "", "close" ], [ "", "open" ], [ "", "err" ], [ "", "read" ], [ "", "err" ], [ "", "sscanf" ], [ "", "errx" ], [ "", "memset" ], [ "", "snprintf" ], [ "", "write" ], [ "", "strlen" ], [ "", "err" ], [ "", "close" ], [ "", "open" ], [ "", "err" ], [ "", "snprintf" ], [ "", "err" ], [ "", "write" ], [ "", "strlen" ], [ "", "err" ], [ "", "close" ], [ "", "../../common/common.h" ], [ "", "../krfctl.h" ], [ "", "\u003cerr.h\u003e" ], [ "", "\u003cerrno.h\u003e" ], [ "", "\u003cfcntl.h\u003e" ], [ "", "\u003cstdio.h\u003e" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "\u003csys/errno.h\u003e" ], [ "", "\u003csys/stat.h\u003e" ], [ "", "\u003csys/types.h\u003e" ], [ "", "\u003cunistd.h\u003e" ] ], "met": { "ast": { "op.eq": 1.0, "op.lt": 14.0, "op.ne": 1.0, "op.lor": 1.0, "op.sub": 1.0, "op.band": 1.0, "op.lnot": 4.0, "max_depth": 13.0, "bind_count": 8.0, "call_count": 51.0, "node_count": 1082.0, "op_density.eq": 0.0, "op_density.lt": 0.01, "op_density.ne": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.lnot": 0.0, "identifier_count": 38.0, "string_literal_count": 25.0, "array_literal_max_length": 1.0 }, "file": { "size": 3581.0, "entropy": 5.26, "size_bytes": 3581.0 }, "text": { "digit_ratio": 0.02, "space_count": 584.0, "total_lines": 151.0, "char_entropy": 5.26, "unique_chars": 79.0, "string_density": 0.17, "avg_line_length": 22.72, "max_line_length": 96.0, "empty_line_ratio": 0.21, "last_line_length": 1.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.05, "identifier_density": 1.17, "line_length_stddev": 22.49, "normalized_string_count": 2.03, "repeated_char_sequences": 2.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 5.25 }, "binds": { "count": 8.0 }, "calls": { "count": 51.0 }, "binary": { "overall_entropy": 5.26 }, "source": { "function_count": 6.0 }, "imports": { "count": 12.0, "relative_ratio": 0.17, "unique_modules": 12.0, "relative_imports": 2.0, "third_party_count": 12.0, "third_party_ratio": 1.0 }, "strings": { "total": 25.0, "avg_length": 11.92, "max_length": 81.0, "path_count": 2.0, "avg_entropy": 2.59, "total_bytes": 298.0, "entropy_stddev": 0.77 }, "comments": { "chars": 414.0, "lines": 10.0, "total": 4.0, "todo_count": 1.0, "to_code_ratio": 0.07 }, "functions": { "count": 6.0 }, "identifiers": { "count": 38.0, "total": 176.0, "avg_length": 8.71, "max_length": 21.0, "min_length": 2.0, "avg_entropy": 2.5, "reuse_ratio": 0.22, "unique_count": 38.0, "length_stddev": 5.02, "high_entropy_count": 1.0, "high_entropy_ratio": 0.03, "all_lowercase_ratio": 0.76, "all_uppercase_ratio": 0.24 } }, "str": [ [ 9, "u8", "\u003cstdio.h\u003e" ], [ 28, "u8", "\u003cstring.h\u003e" ], [ 48, "u8", "\u003csys/errno.h\u003e" ], [ 71, "u8", "\u003cerrno.h\u003e" ], [ 90, "u8", "\u003csys/types.h\u003e" ], [ 113, "u8", "\u003csys/stat.h\u003e" ], [ 135, "u8", "\u003cfcntl.h\u003e" ], [ 154, "u8", "\u003cunistd.h\u003e" ], [ 174, "u8", "\u003cstdlib.h\u003e" ], [ 194, "u8", "\u003cerr.h\u003e" ], [ 211, "u8", "\u003cstring.h\u003e" ], [ 232, "u8", "../krfctl.h" ], [ 233, "u8", "../krfctl.h" ], [ 255, "u8", "../../common/common.h" ], [ 256, "u8", "../../common/common.h" ], [ 984, "u8", "wait4" ], [ 985, "u8", "wait4" ], [ 1014, "u8", "select" ], [ 1015, "u8", "select" ], [ 1057, "u8", "Warning: faulting syscall %s can potentially cause kernel oops on module unload\\n" ], [ 1058, "u8", "Warning: faulting syscall %s can potentially cause kernel oops on module unload" ], [ 1384, "10", "0" ], [ 1404, "u8", "open \" CONTROL_FILE" ], [ 1404, "u8", "open " ], [ 1405, "u8", "open " ], [ 1496, "u8", "WARNING: couldn't find syscall: %s" ], [ 1497, "u8", "WARNING: couldn't find syscall: %s" ], [ 1571, "10", "1" ], [ 1623, "10", "0" ], [ 1733, "u8", "faulting for %s unimplemented" ], [ 1734, "u8", "faulting for %s unimplemented" ], [ 1807, "u8", "write \" CONTROL_FILE" ], [ 1807, "u8", "write " ], [ 1808, "u8", "write " ], [ 1864, "10", "0" ], [ 1957, "10", "0" ], [ 1977, "u8", "open \" CONTROL_FILE" ], [ 1977, "u8", "open " ], [ 1978, "u8", "open " ], [ 2057, "10", "0" ], [ 2077, "u8", "write \" CONTROL_FILE" ], [ 2077, "u8", "write " ], [ 2078, "u8", "write " ], [ 2219, "10", "0" ], [ 2239, "u8", "open \" RNG_STATE_FILE" ], [ 2239, "u8", "open " ], [ 2240, "u8", "open " ], [ 2309, "10", "0" ], [ 2329, "u8", "write \" RNG_STATE_FILE" ], [ 2329, "u8", "write " ], [ 2330, "u8", "write " ], [ 2476, "10", "0" ], [ 2496, "u8", "open \" PROBABILITY_FILE" ], [ 2496, "u8", "open " ], [ 2497, "u8", "open " ], [ 2568, "10", "0" ], [ 2588, "u8", "write \" PROBABILITY_FILE" ], [ 2588, "u8", "write " ], [ 2589, "u8", "write " ], [ 2692, "10", "32" ], [ 2699, "10", "0" ], [ 2771, "10", "0" ], [ 2791, "u8", "open \" LOG_FAULTS_FILE" ], [ 2791, "u8", "open " ], [ 2792, "u8", "open " ], [ 2856, "10", "1" ], [ 2861, "10", "0" ], [ 2881, "u8", "read \" LOG_FAULTS_FILE" ], [ 2881, "u8", "read " ], [ 2882, "u8", "read " ], [ 2930, "u8", "%u" ], [ 2931, "u8", "%u" ], [ 2947, "10", "1" ], [ 2961, "10", "1" ], [ 2964, "u8", "weird logging state: %s" ], [ 2965, "u8", "weird logging state: %s" ], [ 3034, "10", "0" ], [ 3080, "u8", "%u" ], [ 3081, "u8", "%u" ], [ 3131, "10", "0" ], [ 3151, "u8", "write \" LOG_FAULTS_FILE" ], [ 3151, "u8", "write " ], [ 3152, "u8", "write " ], [ 3278, "10", "32" ], [ 3285, "10", "0" ], [ 3335, "10", "0" ], [ 3355, "u8", "open \" TARGETING_FILE" ], [ 3355, "u8", "open " ], [ 3356, "u8", "open " ], [ 3418, "u8", "%u %s" ], [ 3419, "u8", "%u %s" ], [ 3441, "10", "0" ], [ 3461, "u8", "snprintf" ], [ 3462, "u8", "snprintf" ], [ 3515, "10", "0" ], [ 3535, "u8", "write \" TARGETING_FILE" ], [ 3535, "u8", "write " ], [ 3536, "u8", "write " ] ], "tgt": [ "close", "err", "errx", "fprintf", "lookup_syscall_number", "memset", "open", "read", "snprintf", "sscanf", "strcmp", "strlen", "warnx", "write" ], "val": { "file.stem": "linux", "file.basename": "linux.c", "source.language": "c", "source.imports[0]": "../../common/common.h", "source.imports[1]": "../krfctl.h", "source.imports[2]": "\u003cerr.h\u003e", "source.imports[3]": "\u003cerrno.h\u003e", "source.imports[4]": "\u003cfcntl.h\u003e", "source.imports[5]": "\u003cstdio.h\u003e", "source.imports[6]": "\u003cstdlib.h\u003e", "source.imports[7]": "\u003cstring.h\u003e", "source.imports[8]": "\u003csys/errno.h\u003e", "source.imports[9]": "\u003csys/stat.h\u003e", "source.strings[0]": "../../common/common.h", "source.strings[1]": "../krfctl.h", "source.strings[2]": "\u003cerr.h\u003e", "source.strings[3]": "\u003cerrno.h\u003e", "source.strings[4]": "\u003cfcntl.h\u003e", "source.strings[5]": "\u003cstdio.h\u003e", "source.strings[6]": "\u003cstdlib.h\u003e", "source.strings[7]": "\u003cstring.h\u003e", "source.strings[8]": "\u003csys/errno.h\u003e", "source.strings[9]": "\u003csys/stat.h\u003e", "source.has_imports": true, "source.imports[10]": "\u003csys/types.h\u003e", "source.imports[11]": "\u003cunistd.h\u003e", "source.imports[12]": "close", "source.imports[13]": "err", "source.imports[14]": "errx", "source.imports[15]": "fprintf", "source.imports[16]": "lookup_syscall_number", "source.imports[17]": "memset", "source.imports[18]": "open", "source.imports[19]": "read", "source.imports[20]": "snprintf", "source.imports[21]": "sscanf", "source.imports[22]": "strcmp", "source.imports[23]": "strlen", "source.imports[24]": "warnx", "source.imports[25]": "write", "source.strings[10]": "\u003csys/types.h\u003e", "source.strings[11]": "\u003cunistd.h\u003e", "source.strings[12]": "WARNING: couldn't find syscall: %s", "source.strings[13]": "Warning: faulting syscall %s can potentially cause kernel oops on module unload", "source.strings[14]": "Warning: faulting syscall %s can potentially cause kernel oops on module unload\\n", "source.strings[15]": "faulting for %s unimplemented", "source.strings[16]": "open \" CONTROL_FILE", "source.strings[17]": "open \" LOG_FAULTS_FILE", "source.strings[18]": "open \" PROBABILITY_FILE", "source.strings[19]": "open \" RNG_STATE_FILE", "source.strings[20]": "open \" TARGETING_FILE", "source.strings[21]": "read \" LOG_FAULTS_FILE", "source.strings[22]": "select", "source.strings[23]": "snprintf", "source.strings[24]": "weird logging state: %s", "source.strings[25]": "write ", "source.strings[26]": "write \" CONTROL_FILE", "source.strings[27]": "write \" LOG_FAULTS_FILE", "source.strings[28]": "write \" PROBABILITY_FILE", "source.strings[29]": "write \" RNG_STATE_FILE", "source.strings[30]": "write \" TARGETING_FILE", "source.functions[0]": "clear_faulty_calls(void)", "source.functions[1]": "fault_syscall(const char *sys_name)", "source.functions[2]": "set_prob_state(const char *state)", "source.functions[3]": "set_rng_state(const char *state)", "source.functions[4]": "set_targeting(unsigned int mode, const char *data)", "source.functions[5]": "toggle_fault_logging(void)" } }, "find": [ { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)" }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files" }, { "id": "objectives/evasion/kernel-hide/lkm/internals::asm-syscall-invocation", "conf": 0.8500000238418579, "crit": 3, "desc": "Inline assembly with direct syscall" }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation" }, { "id": "micro-behaviors/fs/file/binary::file-manipulation", "atk": "T1005", "conf": 0.75, "crit": 3, "desc": "File content manipulation (read/write/seek)" } ], "path": "linux.c", "risk": 2, "size": 3581, "type": "c" } ] } }