{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.000012079874977644067 } ], "prob": 0.000012079875, "models": [ { "m": "az", "raw": 0.000012079875, "prob": 0.000012079875, "class": 0 }, { "m": "az/source", "raw": 0.000009208918, "prob": 0.000009208918, "class": 0 }, { "m": "az/c", "raw": 0.00009417534, "prob": 0.00009417534, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T02:17:04Z" }, "path": "UnwindInspector.cpp", "raw": { "v": "6", "fs": [ { "f": "H(Ds)", "x": 2, "ff": { "i": [ [ "", "RTFindFunctionByIndex" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "GetSymbolNameByOffset" ], [ "", "printf" ], [ "", "printf" ], [ "", "PrintUnwindInfo" ], [ "", "printf" ], [ "", "Version" ], [ "", "printf" ], [ "", "BYTE_TO_BINARY" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "GetOpInfo" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "free" ], [ "", "BitChainInfo" ], [ "", "printf" ], [ "", "GetChainedFunctionEntry" ], [ "", "BitUHandler" ], [ "", "BitEHandler" ], [ "", "GetExceptionDataPtr" ], [ "", "GetExceptionHandler" ], [ "", "printf" ], [ "", "GetExceptionHandler" ], [ "", "printf" ], [ "", "GetExceptionDirectoryAddress" ], [ "", "printf" ], [ "", "printf" ], [ "", "PrintUnwindInfo" ], [ "", "GetExceptionDirectoryAddress" ], [ "", "GetExportDirectoryAddress" ], [ "", "GetExceptionDirectoryAddress" ], [ "", "GetExportDirectoryAddress" ], [ "", "GetExceptionDirectoryAddress" ], [ "", "wcslen" ], [ "", "usage" ], [ "", "wcslen" ], [ "", "usage" ], [ "", "wcstoll" ], [ "", "wcslen" ], [ "", "usage" ], [ "", "usage" ], [ "", "usage" ], [ "", "usage" ], [ "", "LoadLibraryW" ], [ "", "wcstombs_s" ], [ "", "GetProcAddress" ], [ "", "RTFindFunctionByAddress" ], [ "", "PrintUnwindInfo" ], [ "", "include/Common.h" ], [ "", "include/Functions.h" ] ], "m": { "ast": { "op.eq": 15.0, "op.gt": 1.0, "op.le": 2.0, "op.lt": 3.0, "op.ne": 1.0, "op.add": 6.0, "op.lor": 1.0, "op.mul": 2.0, "op.sub": 2.0, "op.band": 5.0, "op.land": 2.0, "max_depth": 18.0, "op.concat": 37.0, "bind_count": 16.0, "call_count": 91.0, "node_count": 2777.0, "member_count": 15.0, "op_density.eq": 0.01, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "identifier_count": 107.0, "member_depth_max": 2.0, "op_density.concat": 0.01, "string_literal_count": 52.0, "array_literal_max_length": 1.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 11509.0, "entropy": 5.03, "size_bytes": 11509.0 }, "text": { "digit_ratio": 0.03, "space_count": 2990.0, "total_lines": 333.0, "char_entropy": 5.03, "unique_chars": 85.0, "string_density": 0.16, "avg_line_length": 33.56, "max_line_length": 168.0, "empty_line_ratio": 0.23, "last_line_length": 1.0, "whitespace_ratio": 0.29, "most_common_ratio": 0.05, "identifier_density": 1.64, "line_length_stddev": 36.46, "normalized_string_count": 2.85, "repeated_char_sequences": 88.0, "suspicious_string_ratio": 0.23, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.21, "max_inline_whitespace_run": 40.0, "trailing_whitespace_lines": 5.0, "most_common_char_codepoint": 110.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.77 }, "binds": { "count": 16.0 }, "calls": { "count": 91.0 }, "binary": { "overall_entropy": 5.03 }, "source": { "function_count": 8.0 }, "imports": { "count": 2.0, "unique_modules": 2.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "members": { "count": 15.0 }, "strings": { "total": 52.0, "avg_length": 35.44, "max_length": 70.0, "avg_entropy": 3.63, "total_bytes": 1843.0, "entropy_stddev": 0.77, "embedded_code_candidates": 12.0 }, "comments": { "chars": 345.0, "lines": 17.0, "total": 14.0, "todo_count": 1.0, "to_code_ratio": 0.05, "high_entropy_comments": 3.0 }, "functions": { "count": 8.0 }, "identifiers": { "count": 107.0, "total": 546.0, "avg_length": 11.49, "max_length": 29.0, "min_length": 1.0, "avg_entropy": 2.94, "reuse_ratio": 0.2, "unique_count": 107.0, "length_stddev": 6.14, "has_digit_ratio": 0.06, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 21.0, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.16, "all_uppercase_ratio": 0.25, "numeric_suffix_count": 4.0 } }, "s": [ [ 9, "u8", "include/Common.h" ], [ 10, "u8", "include/Common.h" ], [ 37, "u8", "include/Functions.h" ], [ 38, "u8", "include/Functions.h" ], [ 293, "u8", "Function not found\\n" ], [ 294, "u8", "Function not found" ], [ 375, "u8", "Function found: \\n" ], [ 376, "u8", "Function found: " ], [ 425, "u8", " Begin Address 0x%p \\n" ], [ 426, "u8", " Begin Address 0x%p " ], [ 508, "u8", " End Address 0x%p \\n" ], [ 509, "u8", " End Address 0x%p " ], [ 589, "u8", " Unwind Info Address 0x%p \\n" ], [ 590, "u8", " Unwind Info Address 0x%p " ], [ 677, "u8", "Looking up in exports... \\n" ], [ 678, "u8", "Looking up in exports... " ], [ 868, "u8", "Function not found\\n" ], [ 869, "u8", "Function not found" ], [ 937, "u8", "Function %u found: %s\\n" ], [ 938, "u8", "Function %u found: %s" ], [ 1261, "u8", " Version: %d \\n" ], [ 1262, "u8", " Version: %d " ], [ 1330, "u8", " Ver + Flags: \" B2BP \" \\n" ], [ 1330, "u8", " Ver + Flags: " ], [ 1331, "u8", " Ver + Flags: " ], [ 1355, "u8", " \\n" ], [ 1356, "u8", " " ], [ 1406, "u8", " SizeOfProlog: 0x%x \\n" ], [ 1407, "u8", " SizeOfProlog: 0x%x " ], [ 1473, "u8", " CountOfCodes: 0x%x \\n" ], [ 1474, "u8", " CountOfCodes: 0x%x " ], [ 1540, "u8", " FrameRegister: 0x%x \\n" ], [ 1541, "u8", " FrameRegister: 0x%x " ], [ 1608, "u8", " FrameOffset: 0x%x \\n" ], [ 1609, "u8", " FrameOffset: 0x%x " ], [ 1674, "u8", " UnwindCodes: \\n" ], [ 1675, "u8", " UnwindCodes: " ], [ 1754, "10", "0" ], [ 1804, "u8", " [%.2xh] Frame: 0x%.4x - " ], [ 1805, "u8", " [%.2xh] Frame: 0x%.4x - " ], [ 2034, "u8", "0x%.2x - UWOP_PUSH_NONVOL (%3s, 0x%.4x)\\n" ], [ 2035, "u8", "0x%.2x - UWOP_PUSH_NONVOL (%3s, 0x%.4x)" ], [ 2228, "u8", "0x%.2x - UWOP_ALLOC_LARGE (%3s, 0x%.4x)\\n" ], [ 2229, "u8", "0x%.2x - UWOP_ALLOC_LARGE (%3s, 0x%.4x)" ], [ 2422, "u8", "0x%.2x - UWOP_ALLOC_SMALL (%3s, 0x%.4x)\\n" ], [ 2423, "u8", "0x%.2x - UWOP_ALLOC_SMALL (%3s, 0x%.4x)" ], [ 2614, "u8", "0x%.2x - UWOP_SET_FPREG (%3s, 0x%.4x)\\n" ], [ 2615, "u8", "0x%.2x - UWOP_SET_FPREG (%3s, 0x%.4x)" ], [ 2808, "u8", "0x%.2x - UWOP_SAVE_NONVOL (%3s, 0x%.4x)\\n" ], [ 2809, "u8", "0x%.2x - UWOP_SAVE_NONVOL (%3s, 0x%.4x)" ], [ 3006, "u8", "0x%.2x - UWOP_SAVE_NONVOL_BIG (%3s, 0x%.4x)\\n" ], [ 3007, "u8", "0x%.2x - UWOP_SAVE_NONVOL_BIG (%3s, 0x%.4x)" ], [ 3206, "u8", "0x%.2x - UWOP_EPILOG (%3s, 0x%.4x)\\n" ], [ 3207, "u8", "0x%.2x - UWOP_EPILOG (%3s, 0x%.4x)" ], [ 3387, "u8", "0x%.2x - UWOP_SAVE_XMM128 (%3s, 0x%.4x)\\n" ], [ 3388, "u8", "0x%.2x - UWOP_SAVE_XMM128 (%3s, 0x%.4x)" ], [ 3587, "u8", "0x%.2x - UWOP_SPARE_CODE (%3s, 0x%.4x)\\n" ], [ 3588, "u8", "0x%.2x - UWOP_SPARE_CODE (%3s, 0x%.4x)" ], [ 3768, "u8", "0x%.2x - UWOP_SAVE_XMM128BIG (%3s, 0x%.4x)\\n" ], [ 3769, "u8", "0x%.2x - UWOP_SAVE_XMM128BIG (%3s, 0x%.4x)" ], [ 3961, "u8", "0x%.2x - UWOP_PUSH_MACH_FRAME (%3s, 0x%.4x)\\n" ], [ 3962, "u8", "0x%.2x - UWOP_PUSH_MACH_FRAME (%3s, 0x%.4x)" ], [ 4274, "u8", " Function Entry Offset: 0x%p\\n" ], [ 4275, "u8", " Function Entry Offset: 0x%p" ], [ 4660, "u8", " Exception Handler Offset: 0x%p\\n" ], [ 4661, "u8", " Exception Handler Offset: 0x%p" ], [ 4753, "u8", " Exception Data Offset: 0x%x\\n" ], [ 4754, "u8", " Exception Data Offset: 0x%x" ], [ 5122, "10", "0" ], [ 5130, "10", "5038" ], [ 5270, "u8", "Runtime Function %u \\n" ], [ 5271, "u8", "Runtime Function %u " ], [ 5315, "u8", " Begin Address 0x%p\\n End Address 0x%p\\n Unwind Info Address 0x%p\\n" ], [ 5316, "u8", " Begin Address 0x%p" ], [ 5338, "u8", " End Address 0x%p" ], [ 5358, "u8", " Unwind Info Address 0x%p" ], [ 6257, "10", "0" ], [ 6499, "u8", "\\n Runtime Function (0x%p, 0x%p)\\n Unwind Info Address: 0x%p\\n" ], [ 6502, "u8", " Runtime Function (0x%p, 0x%p)" ], [ 6535, "u8", " Unwind Info Address: 0x%p" ], [ 7721, "10", "0" ], [ 7729, "10", "5038" ], [ 7870, "10", "0" ], [ 8020, "u8", "Found frame offset with Runtime Function: %u, unwindCode: %u \\n" ], [ 8021, "u8", "Found frame offset with Runtime Function: %u, unwindCode: %u " ], [ 8093, "10", "1" ], [ 8123, "u8", "Found: 0x%x - Expected: 0x%x \\n" ], [ 8124, "u8", "Found: 0x%x - Expected: 0x%x " ], [ 8281, "u8", "Address in module: 0x%p \\n" ], [ 8282, "u8", "Address in module: 0x%p " ], [ 8545, "u8", "Function not found\\n" ], [ 8546, "u8", "Function not found" ], [ 8582, "10", "0" ], [ 8615, "u8", "\\n Unwind Inspector v%f \\n" ], [ 8618, "u8", " Unwind Inspector v%f " ], [ 8666, "u8", "\\n Made with \u003c3 by %s \\n\\n" ], [ 8669, "u8", " Made with \u003c3 by %s " ], [ 8717, "u8", " Mandatory args: \\n\"\n \" -m \u003cmodule\u003e: Target DLL\\n\"\n \" -f \u003cfunction\u003e: Target Function\\n\"\n \" -a \u003cfuncti" ], [ 8717, "u8", " Mandatory args: \\n" ], [ 8718, "u8", " Mandatory args: " ], [ 8747, "u8", " -m \u003cmodule\u003e: Target DLL\\n" ], [ 8748, "u8", " -m \u003cmodule\u003e: Target DLL" ], [ 8786, "u8", " -f \u003cfunction\u003e: Target Function\\n" ], [ 8787, "u8", " -f \u003cfunction\u003e: Target Function" ], [ 8832, "u8", " -a \u003cfunction-address\u003e: Target Function Address\\n" ], [ 8833, "u8", " -a \u003cfunction-address\u003e: Target Function Address" ], [ 8905, "u8", "\\n\\n" ], [ 9142, "10", "0" ], [ 9312, "10", "1" ], [ 9324, "10", "1" ], [ 9327, "10", "0" ], [ 9366, "10", "1" ], [ 9369, "10", "1" ], [ 9473, "10", "1" ], [ 9505, "10", "1" ], [ 9512, "10", "0" ], [ 9689, "10", "1" ], [ 9696, "10", "0" ], [ 9818, "10", "1" ], [ 9828, "10", "16" ], [ 9939, "10", "1" ], [ 9946, "10", "0" ], [ 10047, "10", "1" ], [ 10189, "u8", "[-] Wrong Argument: %ls\\n" ], [ 10190, "u8", "[-] Wrong Argument: %ls" ], [ 10223, "10", "1" ], [ 10541, "u8", "[-] Module %ws not found. Aborting\\n" ], [ 10542, "u8", "[-] Module %ws not found. Aborting" ], [ 10792, "10", "1" ], [ 10931, "u8", "[-] Function %s not found. Aborting\\n" ], [ 10932, "u8", "[-] Function %s not found. Aborting" ], [ 11061, "u8", "[*] Using function address 0x%I64x\\n" ], [ 11062, "u8", "[*] Using function address 0x%I64x" ], [ 11326, "u8", "[-] Function %s not found in Runtime Function Table. Aborting\\n" ], [ 11327, "u8", "[-] Function %s not found in Runtime Function Table. Aborting" ] ], "v": { "file.stem": "UnwindInspector", "file.basename": "UnwindInspector.cpp", "source.language": "c", "source.imports[0]": "BYTE_TO_BINARY", "source.imports[1]": "BitChainInfo", "source.imports[2]": "BitEHandler", "source.imports[3]": "BitUHandler", "source.imports[4]": "GetChainedFunctionEntry", "source.imports[5]": "GetExceptionDataPtr", "source.imports[6]": "GetExceptionDirectoryAddress", "source.imports[7]": "GetExceptionHandler", "source.imports[8]": "GetExportDirectoryAddress", "source.imports[9]": "GetOpInfo", "source.strings[0]": " CountOfCodes: 0x%x ", "source.strings[1]": " CountOfCodes: 0x%x \\n", "source.strings[2]": " Exception Data Offset: 0x%x", "source.strings[3]": " Exception Data Offset: 0x%x\\n", "source.strings[4]": " Exception Handler Offset: 0x%p", "source.strings[5]": " Exception Handler Offset: 0x%p\\n", "source.strings[6]": " FrameOffset: 0x%x ", "source.strings[7]": " FrameOffset: 0x%x \\n", "source.strings[8]": " FrameRegister: 0x%x ", "source.strings[9]": " FrameRegister: 0x%x \\n", "source.has_imports": true, "source.imports[10]": "GetProcAddress", "source.imports[11]": "GetSymbolNameByOffset", "source.imports[12]": "LoadLibraryW", "source.imports[13]": "PrintUnwindInfo", "source.imports[14]": "RTFindFunctionByAddress", "source.imports[15]": "RTFindFunctionByIndex", "source.imports[16]": "Version", "source.imports[17]": "free", "source.imports[18]": "include/Common.h", "source.imports[19]": "include/Functions.h", "source.imports[20]": "printf", "source.imports[21]": "usage", "source.imports[22]": "wcslen", "source.imports[23]": "wcstoll", "source.imports[24]": "wcstombs_s", "source.strings[10]": " Function Entry Offset: 0x%p", "source.strings[11]": " Function Entry Offset: 0x%p\\n", "source.strings[12]": " SizeOfProlog: 0x%x ", "source.strings[13]": " SizeOfProlog: 0x%x \\n", "source.strings[14]": " UnwindCodes: ", "source.strings[15]": " UnwindCodes: \\n", "source.strings[16]": " Ver + Flags: ", "source.strings[17]": " Ver + Flags: \" B2BP \" \\n", "source.strings[18]": " Version: %d ", "source.strings[19]": " Version: %d \\n", "source.strings[20]": " [%.2xh] Frame: 0x%.4x - ", "source.strings[21]": " -a \u003cfunction-address\u003e: Target Function Address", "source.strings[22]": " -a \u003cfunction-address\u003e: Target Function Address\\n", "source.strings[23]": " -f \u003cfunction\u003e: Target Function", "source.strings[24]": " -f \u003cfunction\u003e: Target Function\\n", "source.strings[25]": " -m \u003cmodule\u003e: Target DLL", "source.strings[26]": " -m \u003cmodule\u003e: Target DLL\\n", "source.strings[27]": " Begin Address 0x%p", "source.strings[28]": " Begin Address 0x%p ", "source.strings[29]": " Begin Address 0x%p \\n", "source.strings[30]": " Begin Address 0x%p\\n End Address 0x%p\\n Unwind Info Address 0x%p\\n", "source.strings[31]": " End Address 0x%p", "source.strings[32]": " End Address 0x%p ", "source.strings[33]": " End Address 0x%p \\n", "source.strings[34]": " Runtime Function (0x%p, 0x%p)", "source.strings[35]": " Unwind Info Address 0x%p", "source.strings[36]": " Unwind Info Address 0x%p ", "source.strings[37]": " Unwind Info Address 0x%p \\n", "source.strings[38]": " Unwind Info Address: 0x%p", "source.strings[39]": " Made with \u003c3 by %s ", "source.strings[40]": " Mandatory args: ", "source.strings[41]": " Mandatory args: \\n", "source.strings[42]": " Mandatory args: \\n\"\n \" -m \u003cmodule\u003e: Target DLL\\n\"\n \" -f \u003cfunction\u003e: Target Function\\n\"\n \" -a \u003cfunction-address\u003e: Target Function Address\\n", "source.strings[43]": " Unwind Inspector v%f ", "source.strings[44]": "0x%.2x - UWOP_ALLOC_LARGE (%3s, 0x%.4x)", "source.strings[45]": "0x%.2x - UWOP_ALLOC_LARGE (%3s, 0x%.4x)\\n", "source.strings[46]": "0x%.2x - UWOP_ALLOC_SMALL (%3s, 0x%.4x)", "source.strings[47]": "0x%.2x - UWOP_ALLOC_SMALL (%3s, 0x%.4x)\\n", "source.strings[48]": "0x%.2x - UWOP_EPILOG (%3s, 0x%.4x)", "source.strings[49]": "0x%.2x - UWOP_EPILOG (%3s, 0x%.4x)\\n", "source.strings[50]": "0x%.2x - UWOP_PUSH_MACH_FRAME (%3s, 0x%.4x)", "source.strings[51]": "0x%.2x - UWOP_PUSH_MACH_FRAME (%3s, 0x%.4x)\\n", "source.strings[52]": "0x%.2x - UWOP_PUSH_NONVOL (%3s, 0x%.4x)", "source.strings[53]": "0x%.2x - UWOP_PUSH_NONVOL (%3s, 0x%.4x)\\n", "source.strings[54]": "0x%.2x - UWOP_SAVE_NONVOL (%3s, 0x%.4x)", "source.strings[55]": "0x%.2x - UWOP_SAVE_NONVOL (%3s, 0x%.4x)\\n", "source.strings[56]": "0x%.2x - UWOP_SAVE_NONVOL_BIG (%3s, 0x%.4x)", "source.strings[57]": "0x%.2x - UWOP_SAVE_NONVOL_BIG (%3s, 0x%.4x)\\n", "source.strings[58]": "0x%.2x - UWOP_SAVE_XMM128 (%3s, 0x%.4x)", "source.strings[59]": "0x%.2x - UWOP_SAVE_XMM128 (%3s, 0x%.4x)\\n", "source.strings[60]": "0x%.2x - UWOP_SAVE_XMM128BIG (%3s, 0x%.4x)", "source.strings[61]": "0x%.2x - UWOP_SAVE_XMM128BIG (%3s, 0x%.4x)\\n", "source.strings[62]": "0x%.2x - UWOP_SET_FPREG (%3s, 0x%.4x)", "source.strings[63]": "0x%.2x - UWOP_SET_FPREG (%3s, 0x%.4x)\\n", "source.strings[64]": "0x%.2x - UWOP_SPARE_CODE (%3s, 0x%.4x)", "source.strings[65]": "0x%.2x - UWOP_SPARE_CODE (%3s, 0x%.4x)\\n", "source.strings[66]": "Address in module: 0x%p ", "source.strings[67]": "Address in module: 0x%p \\n", "source.strings[68]": "Found frame offset with Runtime Function: %u, unwindCode: %u ", "source.strings[69]": "Found frame offset with Runtime Function: %u, unwindCode: %u \\n", "source.strings[70]": "Found: 0x%x - Expected: 0x%x ", "source.strings[71]": "Found: 0x%x - Expected: 0x%x \\n", "source.strings[72]": "Function %u found: %s", "source.strings[73]": "Function %u found: %s\\n", "source.strings[74]": "Function found: ", "source.strings[75]": "Function found: \\n", "source.strings[76]": "Function not found", "source.strings[77]": "Function not found\\n", "source.strings[78]": "Looking up in exports... ", "source.strings[79]": "Looking up in exports... \\n", "source.strings[80]": "Runtime Function %u ", "source.strings[81]": "Runtime Function %u \\n", "source.strings[82]": "[*] Using function address 0x%I64x", "source.strings[83]": "[*] Using function address 0x%I64x\\n", "source.strings[84]": "[-] Function %s not found in Runtime Function Table. Aborting", "source.strings[85]": "[-] Function %s not found in Runtime Function Table. Aborting\\n", "source.strings[86]": "[-] Function %s not found. Aborting", "source.strings[87]": "[-] Function %s not found. Aborting\\n", "source.strings[88]": "[-] Module %ws not found. Aborting", "source.strings[89]": "[-] Module %ws not found. Aborting\\n", "source.strings[90]": "[-] Wrong Argument: %ls", "source.strings[91]": "[-] Wrong Argument: %ls\\n", "source.strings[92]": "\\n Runtime Function (0x%p, 0x%p)\\n Unwind Info Address: 0x%p\\n", "source.strings[93]": "\\n Made with \u003c3 by %s \\n\\n", "source.strings[94]": "\\n Unwind Inspector v%f \\n", "source.strings[95]": "include/Common.h", "source.strings[96]": "include/Functions.h", "source.functions[0]": "EnumAllRTFunctions(HMODULE moduleBase)", "source.functions[1]": "FindRTFunctionsUnwind(HMODULE moduleBase, PVOID tUnwindCodeAddress)", "source.functions[2]": "LookupSymbolFromRTIndex(HMODULE dllBase, int rtFuntionIndex, bool verbose)", "source.functions[3]": "PrintUnwindInfo(HMODULE dllBase, PVOID unwindDataAddress)", "source.functions[4]": "RTFindFunctionByAddress(UINT64 moduleBase, DWORD64 functionOffset)", "source.functions[5]": "RTFindFunctionByIndex(UINT64 kernelBase, DWORD index)", "source.functions[6]": "usage()", "source.functions[7]": "wmain(int argc, wchar_t** argv)" }, "ct": [ "BYTE_TO_BINARY", "BitChainInfo", "BitEHandler", "BitUHandler", "GetChainedFunctionEntry", "GetExceptionDataPtr", "GetExceptionDirectoryAddress", "GetExceptionHandler", "GetExportDirectoryAddress", "GetOpInfo", "GetProcAddress", "GetSymbolNameByOffset", "LoadLibraryW", "PrintUnwindInfo", "RTFindFunctionByAddress", "RTFindFunctionByIndex", "Version", "free", "printf", "usage", "wcslen", "wcstoll", "wcstombs_s" ], "id": "c", "mc": [ "pImageExportDirectory.NumberOfFunctions", "rtFunction.BeginAddress", "rtFunction.EndAddress", "rtFunction.UnwindData", "rtFunction.UnwindInfoAddress", "tInfo.CountOfCodes", "tInfo.Flags", "tInfo.FrameOffset", "tInfo.FrameRegister", "tInfo.SizeOfProlog", "tInfo.UnwindCode", "tUnwindCode.FrameOffset", "targetFp.UnwindData", "unwindInfo.CountOfCodes", "unwindInfo.UnwindCode" ] }, "id": 0, "sz": 11509, "ts": [ { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryW" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "28e1" ] }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Windows GetProcAddress in source", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-source", "l": 2 }, { "c": 0.9700000286102295, "d": "Validation vocabulary expected", "e": [ "Expected" ], "i": "metadata/file/text/format::vocab-expected", "l": 1 }, { "a": "T1129", "c": 0.8799999952316284, "d": "Dynamic library loading via LoadLibraryW", "e": [ "LoadLibraryW" ], "i": "micro-behaviors/dylib/load/runtime::load-library-w", "l": 3, "el": [ "28e1" ] } ], "sha": "21aa959df60bb1b0b843382c76427c558496253e9fa6fec16b67e1ed75fbfa4c", "path": "/data/samples/bad/projects/SilentMoonwalk/UnwindInspector/UnwindInspector.cpp", "type": "c" } ], "tv": "8e9ac" } }