{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.000010679165825422388 } ], "prob": 0.000010679166, "models": [ { "m": "az", "raw": 0.000010679166, "prob": 0.000010679166, "class": 0 }, { "m": "az/source", "raw": 0.000007033348, "prob": 0.000007033348, "class": 0 }, { "m": "az/c", "raw": 0.00000628829, "prob": 0.00000628829, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T04:18:14Z" }, "path": "postmortem.c", "raw": { "v": "6", "fs": [ { "f": "H(Ds)", "x": 2, "ff": { "i": [ [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "ECODE" ], [ "", "GetCurrentProcess" ], [ "", "GetCurrentProcessId" ], [ "", "GetProcAddress" ], [ "", "dprint" ], [ "", "snwprintf" ], [ "", "GetCurrentProcessId" ], [ "", "CreateFileW" ], [ "", "dprint" ], [ "", "GetCurrentThreadId" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "pMiniDumpWriteDump" ], [ "", "CloseHandle" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "snprintf" ], [ "", "dprint" ], [ "", "WriteFile" ], [ "", "snprintf" ], [ "", "dprint" ], [ "", "snprintf" ], [ "", "WriteFile" ], [ "", "RtlLookupFunctionEntry" ], [ "", "PupyGetModuleBase" ], [ "", "MyFindMemoryModuleNameByAddr" ], [ "", "GetModuleHandleExA" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "dprint" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "pSymSetOptions" ], [ "", "pSymInitialize" ], [ "", "GetCurrentProcess" ], [ "", "memset" ], [ "", "GetCurrentProcess" ], [ "", "GetCurrentThread" ], [ "", "pStackWalk" ], [ "", "pSymGetSymFromAddr64" ], [ "", "pStackWalk" ], [ "", "pSymGetSymFromAddr" ], [ "", "snprintf" ], [ "", "MyFindMemoryModuleNameByAddr" ], [ "", "snprintf" ], [ "", "GetModuleHandleExA" ], [ "", "GetModuleFileNameA" ], [ "", "strrchr" ], [ "", "snprintf" ], [ "", "snprintf" ], [ "", "WriteFile" ], [ "", "RtlCaptureContext" ], [ "", "dprint" ], [ "", "RtlLookupFunctionEntry" ], [ "", "dprint" ], [ "", "RtlVirtualUnwind" ], [ "", "GetBackTrace" ], [ "", "CaptureStackBackTrace" ], [ "", "MyFindMemoryModuleNameByAddr" ], [ "", "snprintf" ], [ "", "GetModuleHandleExA" ], [ "", "GetModuleFileNameA" ], [ "", "strrchr" ], [ "", "snprintf" ], [ "", "snprintf" ], [ "", "WriteFile" ], [ "", "WriteFile" ], [ "", "strlen" ], [ "", "GetCurrentProcess" ], [ "", "LoadLibraryA" ], [ "", "GetProcAddress" ], [ "", "dprint" ], [ "", "pEnumProcessModules" ], [ "", "dprint" ], [ "", "memset" ], [ "", "memset" ], [ "", "GetModuleFileNameA" ], [ "", "snprintf" ], [ "", "dprint" ], [ "", "WriteFile" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "dprint" ], [ "", "snwprintf" ], [ "", "GetCurrentProcessId" ], [ "", "dwprint" ], [ "", "CreateFileW" ], [ "", "dprint" ], [ "", "snprintf" ], [ "", "code2str" ], [ "", "WriteFile" ], [ "", "WriteFile" ], [ "", "dprint" ], [ "", "WriteToFile" ], [ "", "MyEnumerateLibraries" ], [ "", "WriteToFile" ], [ "", "MyEnumerateLoadedLibraries" ], [ "", "dprint" ], [ "", "WriteToFile" ], [ "", "SaveContextStack" ], [ "", "WriteToFile" ], [ "", "WriteToFile" ], [ "", "SaveCallingStack" ], [ "", "dprint" ], [ "", "WriteToFile" ], [ "", "Py_GetCurrentThreadStackTrace" ], [ "", "dprint" ], [ "", "CloseHandle" ], [ "", "LoadLibraryA" ], [ "", "LoadLibraryA" ], [ "", "dprint" ], [ "", "code2str" ], [ "", "dprint" ], [ "", "GetProcAddress" ], [ "", "dprint" ], [ "", "GetTempPathW" ], [ "", "dprint" ], [ "", "SUCCEEDED" ], [ "", "pSHGetFolderPathAndSubDirW" ], [ "", "dprint" ], [ "", "dwprint" ], [ "", "dprint" ], [ "", "SaveExceptionInfo" ], [ "", "dprint" ], [ "", "CreateMiniDump" ], [ "", "LoadLibraryA" ], [ "", "GetProcAddress" ], [ "", "GetProcAddress" ], [ "", "pGetPolicy" ], [ "", "pSetPolicy" ], [ "", "\u003cShlobj.h\u003e" ], [ "", "\u003cstdio.h\u003e" ], [ "", "MyLoadLibrary.h" ], [ "", "Python-stacktrace.c" ], [ "", "Python-stacktrace.h" ], [ "", "debug.h" ], [ "", "postmortem.h" ] ], "m": { "ast": { "op.eq": 7.0, "op.gt": 6.0, "op.lt": 6.0, "op.add": 3.0, "op.bor": 6.0, "op.div": 4.0, "op.lor": 2.0, "op.sub": 20.0, "op.band": 34.0, "op.bnot": 1.0, "op.land": 9.0, "op.lnot": 11.0, "max_depth": 23.0, "op.concat": 54.0, "bind_count": 47.0, "call_count": 162.0, "node_count": 5371.0, "member_count": 55.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.div": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.band": 0.01, "op_density.bnot": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 292.0, "member_depth_max": 5.0, "op_density.concat": 0.01, "string_literal_count": 95.0, "array_literal_max_length": 20.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 24744.0, "entropy": 5.13, "size_bytes": 24744.0 }, "text": { "digit_ratio": 0.02, "space_count": 5542.0, "total_lines": 898.0, "char_entropy": 5.13, "unique_chars": 89.0, "escape_density": 0.01, "string_density": 0.11, "avg_line_length": 26.55, "max_line_length": 98.0, "empty_line_ratio": 0.16, "last_line_length": 1.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.06, "identifier_density": 1.37, "line_length_stddev": 22.1, "octal_escape_count": 2.0, "encoded_string_ratio": 0.04, "normalized_string_count": 3.17, "repeated_char_sequences": 150.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 19.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 29.76 }, "binds": { "count": 47.0 }, "calls": { "count": 162.0 }, "binary": { "overall_entropy": 5.13 }, "source": { "class_count": 1.0, "function_count": 14.0 }, "imports": { "count": 7.0, "unique_modules": 7.0, "third_party_count": 7.0, "third_party_ratio": 1.0 }, "members": { "count": 55.0 }, "strings": { "total": 95.0, "avg_length": 26.71, "max_length": 64.0, "avg_entropy": 3.65, "total_bytes": 2537.0, "entropy_stddev": 0.6, "url_encoded_strings": 4.0 }, "comments": { "chars": 38.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.0 }, "functions": { "count": 15.0 }, "identifiers": { "count": 292.0, "total": 1226.0, "avg_length": 11.8, "max_length": 38.0, "min_length": 1.0, "avg_entropy": 2.92, "reuse_ratio": 0.24, "unique_count": 292.0, "length_stddev": 6.75, "has_digit_ratio": 0.08, "sequential_names": 4.0, "base64_like_names": 3.0, "single_char_count": 2.0, "single_char_ratio": 0.01, "high_entropy_count": 66.0, "high_entropy_ratio": 0.23, "all_lowercase_ratio": 0.12, "all_uppercase_ratio": 0.27, "numeric_suffix_count": 20.0, "underscore_prefix_count": 3.0 } }, "s": [ [ 9, "u8", "\u003cShlobj.h\u003e" ], [ 29, "u8", "\u003cstdio.h\u003e" ], [ 85, "u8", "postmortem.h" ], [ 86, "u8", "postmortem.h" ], [ 109, "u8", "debug.h" ], [ 110, "u8", "debug.h" ], [ 129, "u8", "MyLoadLibrary.h" ], [ 130, "u8", "MyLoadLibrary.h" ], [ 157, "u8", "Python-stacktrace.h" ], [ 158, "u8", "Python-stacktrace.h" ], [ 188, "u8", "Python-stacktrace.c" ], [ 189, "u8", "Python-stacktrace.c" ], [ 1157, "10", "0" ], [ 1318, "u8", "UNKNOWN" ], [ 1319, "u8", "UNKNOWN" ], [ 3005, "u8", "L\"\\0" ], [ 3154, "u8", "MiniDumpWriteDump" ], [ 3155, "u8", "MiniDumpWriteDump" ], [ 3226, "u8", "Failed to find pMiniDumpWriteDump\\n" ], [ 3227, "u8", "Failed to find pMiniDumpWriteDump" ], [ 3348, "10", "1" ], [ 3357, "u8", "L\"%s\\\\tmp_dump_%d.bin" ], [ 3359, "u8", "%s" ], [ 3363, "u8", "tmp_dump_%d.bin" ], [ 3514, "10", "0" ], [ 3665, "u8", "Failed to create minidump file\\n" ], [ 3666, "u8", "Failed to create minidump file" ], [ 3881, "u8", "HANDLE: %p PID: %08x HFILE: %p TYPE: %d\\n" ], [ 3882, "u8", "HANDLE: %p PID: %08x HFILE: %p TYPE: %d" ], [ 4073, "u8", "Using ExceptionPointers (PTR=%p) MDEI=%p TID=%08x\\n" ], [ 4074, "u8", "Using ExceptionPointers (PTR=%p) MDEI=%p TID=%08x" ], [ 4467, "u8", "Global crash handler completed successfully\\n" ], [ 4468, "u8", "Global crash handler completed successfully" ], [ 4539, "u8", "Global crash handler failed to create dump\\n" ], [ 4540, "u8", "Global crash handler failed to create dump" ], [ 4781, "10", "8192" ], [ 4789, "u8", "\\0" ], [ 4865, "u8", "SaveLibraryInfo called (%p, \\\"%s\\\", %p, %u)\\n" ], [ 4866, "u8", "SaveLibraryInfo called (%p, " ], [ 4896, "u8", "%s" ], [ 4900, "u8", ", %p, %u)" ], [ 5057, "10", "1" ], [ 5060, "u8", "%p - %p\\t%s\\n" ], [ 5061, "u8", "%p - %p" ], [ 5070, "u8", "%s" ], [ 5160, "u8", "+ %s" ], [ 5161, "u8", "+ %s" ], [ 5218, "10", "0" ], [ 5488, "10", "8192" ], [ 5669, "10", "1" ], [ 5678, "u8", "\\n%s [%d]\\n" ], [ 5681, "u8", "%s [%d]" ], [ 5748, "u8", "Python stack: %s %s:%d\\n" ], [ 5749, "u8", "Python stack: %s %s:%d" ], [ 5864, "10", "1" ], [ 5867, "u8", "+ %s\\t%s:%d\\n" ], [ 5868, "u8", "+ %s" ], [ 5874, "u8", "%s:%d" ], [ 5950, "10", "0" ], [ 6734, "10", "0" ], [ 7069, "10", "1024" ], [ 7406, "u8", "SymSetOptions" ], [ 7407, "u8", "SymSetOptions" ], [ 7511, "u8", "SymInitialize" ], [ 7512, "u8", "SymInitialize" ], [ 7634, "u8", "SymGetSymFromAddr64" ], [ 7635, "u8", "SymGetSymFromAddr64" ], [ 7733, "u8", "StackWalk64" ], [ 7734, "u8", "StackWalk64" ], [ 7813, "u8", "Not all functions find at dbghelp\\n" ], [ 7814, "u8", "Not all functions find at dbghelp" ], [ 8151, "u8", "SymSetOptions" ], [ 8152, "u8", "SymSetOptions" ], [ 8256, "u8", "SymInitialize" ], [ 8257, "u8", "SymInitialize" ], [ 8388, "u8", "SymFunctionTableAccess" ], [ 8389, "u8", "SymFunctionTableAccess" ], [ 8514, "u8", "SymGetSymFromAddr" ], [ 8515, "u8", "SymGetSymFromAddr" ], [ 8611, "u8", "StackWalk" ], [ 8612, "u8", "StackWalk" ], [ 8714, "u8", "Not all functions find at dbghelp\\n" ], [ 8715, "u8", "Not all functions find at dbghelp" ], [ 8816, "u8", "pContext is NULL\\n" ], [ 8817, "u8", "pContext is NULL" ], [ 9118, "10", "0" ], [ 9266, "10", "0" ], [ 9708, "10", "0" ], [ 9719, "10", "64" ], [ 10902, "10", "1" ], [ 10919, "u8", "+ %lu:\\tSYS:%s\\t(PC %p)\\n" ], [ 10920, "u8", "+ %lu:" ], [ 10928, "u8", "SYS:%s" ], [ 10936, "u8", "(PC %p)" ], [ 11351, "10", "1" ], [ 11370, "u8", "+ %lu:\\t[PC %p]\\tMEM:%s+0x%x\\n" ], [ 11371, "u8", "+ %lu:" ], [ 11379, "u8", "[PC %p]" ], [ 11388, "u8", "MEM:%s+0x%x" ], [ 12143, "10", "1" ], [ 12245, "10", "1" ], [ 12266, "u8", "+ %lu:\\t[PC %p]\\tSYS:%s+0x%x\\n" ], [ 12267, "u8", "+ %lu:" ], [ 12275, "u8", "[PC %p]" ], [ 12284, "u8", "SYS:%s+0x%x" ], [ 12589, "10", "1" ], [ 12610, "u8", "+ %lu:\\t[PC %p]\\t?\\t\\t\\n" ], [ 12611, "u8", "+ %lu:" ], [ 12619, "u8", "[PC %p]" ], [ 12628, "u8", "?" ], [ 12780, "10", "0" ], [ 13089, "u8", "GetBackTrace: Start for %p\\n" ], [ 13090, "u8", "GetBackTrace: Start for %p" ], [ 13161, "10", "0" ], [ 13472, "u8", "GetBackTrace: Break on %p\\n" ], [ 13473, "u8", "GetBackTrace: Break on %p" ], [ 13589, "10", "0" ], [ 14033, "10", "0" ], [ 14094, "10", "1024" ], [ 14255, "10", "0" ], [ 14324, "10", "0" ], [ 14554, "10", "1" ], [ 14569, "u8", "+ %u:\\t[PC %p]\\tMEM:%s+0x%x\\n" ], [ 14570, "u8", "+ %u:" ], [ 14577, "u8", "[PC %p]" ], [ 14586, "u8", "MEM:%s+0x%x" ], [ 15263, "10", "1" ], [ 15353, "10", "1" ], [ 15370, "u8", "+ %lu:\\t[PC %p]\\tSYS:%s+0x%x\\n" ], [ 15371, "u8", "+ %lu:" ], [ 15379, "u8", "[PC %p]" ], [ 15388, "u8", "SYS:%s+0x%x" ], [ 15659, "10", "1" ], [ 15676, "u8", "+ %lu:\\t[PC %p]\\t?\\t\\t\\n" ], [ 15677, "u8", "+ %lu:" ], [ 15685, "u8", "[PC %p]" ], [ 15694, "u8", "?" ], [ 15814, "10", "0" ], [ 16126, "10", "1024" ], [ 16267, "u8", "PSAPI.DLL" ], [ 16268, "u8", "PSAPI.DLL" ], [ 16376, "u8", "EnumProcessModules" ], [ 16377, "u8", "EnumProcessModules" ], [ 16441, "u8", "Couldn't find pEnumProcessModules\\n" ], [ 16442, "u8", "Couldn't find pEnumProcessModules" ], [ 16589, "u8", "EnumProcessModules failed\\n" ], [ 16590, "u8", "EnumProcessModules failed" ], [ 16649, "10", "0" ], [ 16804, "16", "0" ], [ 16852, "16", "0" ], [ 17035, "10", "1" ], [ 17046, "u8", "+ %p\\t%s\\n" ], [ 17047, "u8", "+ %p" ], [ 17053, "u8", "%s" ], [ 17140, "10", "0" ], [ 17238, "u8", "DLLs enumeration completed\\n" ], [ 17239, "u8", "DLLs enumeration completed" ], [ 17500, "10", "8192" ], [ 17588, "u8", "SaveExceptionInfo start..\\n" ], [ 17589, "u8", "SaveExceptionInfo start.." ], [ 17755, "u8", "No exception info!\\n" ], [ 17756, "u8", "No exception info!" ], [ 17843, "10", "2" ], [ 17848, "10", "1" ], [ 17857, "u8", "L\"%s\\\\tmp_dump_%d.einfo" ], [ 17859, "u8", "%s" ], [ 17863, "u8", "tmp_dump_%d.einfo" ], [ 17936, "u8", "L\"File with exception info: %s\\n" ], [ 17938, "u8", "File with exception info: %s" ], [ 18071, "10", "0" ], [ 18238, "u8", "Failed to create exception info file\\n" ], [ 18239, "u8", "Failed to create exception info file" ], [ 18404, "10", "1" ], [ 18415, "u8", "\\nCatch fatal exception: Code: %08x (%s)\\n\"\n \"Flags: %08x Address: %p\\n\"\n \"Registers:\\n\"\n\n#ifdef _WIN64\n \"R" ], [ 18415, "u8", "\\nCatch fatal exception: Code: %08x (%s)\\n" ], [ 18418, "u8", "Catch fatal exception: Code: %08x (%s)" ], [ 18468, "u8", "Flags: %08x Address: %p\\n" ], [ 18469, "u8", "Flags: %08x Address: %p" ], [ 18504, "u8", "Registers:\\n" ], [ 18505, "u8", "Registers:" ], [ 18542, "u8", "RSP: %016x RBP: %016x RIP: %016x\\n" ], [ 18543, "u8", "RSP: %016x RBP: %016x RIP: %016x" ], [ 18587, "u8", "RAX: %016x RBX: %016x RCX: %016x RDX: %016x\\n" ], [ 18588, "u8", "RAX: %016x RBX: %016x RCX: %016x RDX: %016x" ], [ 18643, "u8", "RSI: %016x RDI: %016x R8: %016x R9: %016x\\n" ], [ 18644, "u8", "RSI: %016x RDI: %016x R8: %016x R9: %016x" ], [ 18699, "u8", "R10: %016x R11: %016x R12: %016x R13: %016x\\n" ], [ 18700, "u8", "R10: %016x R11: %016x R12: %016x R13: %016x" ], [ 18755, "u8", "R14: %016x R15: %016x\\n" ], [ 18756, "u8", "R14: %016x R15: %016x" ], [ 18796, "u8", "ESP: %08x EBP: %08x EIP: %08x\\n\"\n \"EAX: %08x EBX: %08x ECX: %08x EDX: %08x\\n\"\n \"ESI: %08x EDI: %08x\\n" ], [ 18796, "u8", "ESP: %08x EBP: %08x EIP: %08x\\n" ], [ 18797, "u8", "ESP: %08x EBP: %08x EIP: %08x" ], [ 18838, "u8", "EAX: %08x EBX: %08x ECX: %08x EDX: %08x\\n" ], [ 18839, "u8", "EAX: %08x EBX: %08x ECX: %08x EDX: %08x" ], [ 18890, "u8", "ESI: %08x EDI: %08x\\n" ], [ 18891, "u8", "ESI: %08x EDI: %08x" ], [ 20486, "10", "0" ], [ 20656, "u8", "\\nNon-exception crash report\\n" ], [ 20659, "u8", "Non-exception crash report" ], [ 20716, "10", "0" ], [ 20818, "10", "1" ], [ 20877, "u8", "Enumerating libraries..\\n" ], [ 20878, "u8", "Enumerating libraries.." ], [ 20943, "u8", "\\nMemory modules:\\n" ], [ 20946, "u8", "Memory modules:" ], [ 21075, "u8", "\\nNormal modules:\\n" ], [ 21078, "u8", "Normal modules:" ], [ 21163, "u8", "Generating stack trace ..\\n" ], [ 21164, "u8", "Generating stack trace .." ], [ 21288, "u8", "\\nException Stack trace:\\n" ], [ 21291, "u8", "Exception Stack trace:" ], [ 21506, "u8", "\\nFailed to save Exception Stack trace: DBGHELP not found\\n" ], [ 21509, "u8", "Failed to save Exception Stack trace: DBGHELP not found" ], [ 21638, "u8", "\\nCurrent stack trace:\\n" ], [ 21641, "u8", "Current stack trace:" ], [ 21729, "u8", "Try to save python stack\\n" ], [ 21730, "u8", "Try to save python stack" ], [ 21796, "u8", "\\nCurrent Python stacks (if any):\\n" ], [ 21799, "u8", "Current Python stacks (if any):" ], [ 21962, "u8", "Exception info saved (python=%d)\\n" ], [ 21963, "u8", "Exception info saved (python=%d)" ], [ 22188, "u8", "SHELL32.DLL" ], [ 22189, "u8", "SHELL32.DLL" ], [ 22238, "u8", "DBGHELP.DLL" ], [ 22239, "u8", "DBGHELP.DLL" ], [ 22406, "u8", "Catch fatal exception: Code: %08x (%s) Flags: %08x Address: %p\\n" ], [ 22407, "u8", "Catch fatal exception: Code: %08x (%s) Flags: %08x Address: %p" ], [ 22750, "u8", "Non-exception postmortem call\\n" ], [ 22751, "u8", "Non-exception postmortem call" ], [ 22937, "u8", "SHGetFolderPathAndSubDirW" ], [ 22938, "u8", "SHGetFolderPathAndSubDirW" ], [ 23016, "u8", "Failed to find SHGetFolderPathAndSubDirW (SHELL32.DLL AT %p)\\n" ], [ 23017, "u8", "Failed to find SHGetFolderPathAndSubDirW (SHELL32.DLL AT %p)" ], [ 23168, "10", "1" ], [ 23225, "u8", "Creating folder for exception info\\n" ], [ 23226, "u8", "Creating folder for exception info" ], [ 23385, "10", "0" ], [ 23446, "u8", "Failed to create exception info folder\\n" ], [ 23447, "u8", "Failed to create exception info folder" ], [ 23546, "u8", "L\"Folder created: %s\\n" ], [ 23548, "u8", "Folder created: %s" ], [ 23597, "u8", "Generating crash context info..\\n" ], [ 23598, "u8", "Generating crash context info.." ], [ 23710, "u8", "Crash context saved\\n" ], [ 23711, "u8", "Crash context saved" ], [ 23811, "u8", "Generating minidump...\\n" ], [ 23812, "u8", "Generating minidump..." ], [ 23933, "u8", "Failed to load DBGHELP\\n" ], [ 23934, "u8", "Failed to load DBGHELP" ], [ 23989, "u8", "Postmortem exception filter completed\\n" ], [ 23990, "u8", "Postmortem exception filter completed" ], [ 24149, "16", "1" ], [ 24195, "u8", "kernel32.dll" ], [ 24196, "u8", "kernel32.dll" ], [ 24288, "u8", "GetProcessUserModeExceptionPolicy" ] ], "v": { "file.stem": "postmortem", "file.basename": "postmortem.c", "source.language": "c", "source.imports[0]": "\u003cShlobj.h\u003e", "source.imports[1]": "\u003cstdio.h\u003e", "source.imports[2]": "CaptureStackBackTrace", "source.imports[3]": "CloseHandle", "source.imports[4]": "CreateFileW", "source.imports[5]": "CreateMiniDump", "source.imports[6]": "ECODE", "source.imports[7]": "GetBackTrace", "source.imports[8]": "GetCurrentProcess", "source.imports[9]": "GetCurrentProcessId", "source.strings[0]": "\"EAX: \bx EBX: \bx ECX: \bx EDX: \bx\\n\"", "source.strings[1]": "\"ESP: \bx EBP: \bx EIP: \bx\\n\"", "source.strings[2]": "\"R10: \u00016x R11: \u00016x R12: \u00016x R13: \u00016x\\n\"", "source.strings[3]": "\"RAX: \u00016x RBX: \u00016x RCX: \u00016x RDX: \u00016x\\n\"", "source.strings[4]": "\"RSI: \u00016x RDI: \u00016x R8: \u00016x R9: \u00016x\\n\"", "source.strings[5]": "\"RSP: \u00016x RBP: \u00016x RIP: \u00016x\\n\"", "source.strings[6]": "%p - %p", "source.strings[7]": "%p - %p\\t%s\\n", "source.strings[8]": "%s [%d]", "source.strings[9]": "(PC %p)", "source.has_imports": true, "source.imports[10]": "GetCurrentThread", "source.imports[11]": "GetCurrentThreadId", "source.imports[12]": "GetModuleFileNameA", "source.imports[13]": "GetModuleHandleExA", "source.imports[14]": "GetProcAddress", "source.imports[15]": "GetTempPathW", "source.imports[16]": "LoadLibraryA", "source.imports[17]": "MyEnumerateLibraries", "source.imports[18]": "MyEnumerateLoadedLibraries", "source.imports[19]": "MyFindMemoryModuleNameByAddr", "source.imports[20]": "MyLoadLibrary.h", "source.imports[21]": "PupyGetModuleBase", "source.imports[22]": "Py_GetCurrentThreadStackTrace", "source.imports[23]": "Python-stacktrace.c", "source.imports[24]": "Python-stacktrace.h", "source.imports[25]": "RtlCaptureContext", "source.imports[26]": "RtlLookupFunctionEntry", "source.imports[27]": "RtlVirtualUnwind", "source.imports[28]": "SUCCEEDED", "source.imports[29]": "SaveCallingStack", "source.imports[30]": "SaveContextStack", "source.imports[31]": "SaveExceptionInfo", "source.imports[32]": "WriteFile", "source.imports[33]": "WriteToFile", "source.imports[34]": "code2str", "source.imports[35]": "debug.h", "source.imports[36]": "dprint", "source.imports[37]": "dwprint", "source.imports[38]": "memset", "source.imports[39]": "pEnumProcessModules", "source.imports[40]": "pGetPolicy", "source.imports[41]": "pMiniDumpWriteDump", "source.imports[42]": "pSHGetFolderPathAndSubDirW", "source.imports[43]": "pSetPolicy", "source.imports[44]": "pStackWalk", "source.imports[45]": "pSymGetSymFromAddr", "source.imports[46]": "pSymGetSymFromAddr64", "source.imports[47]": "pSymInitialize", "source.imports[48]": "pSymSetOptions", "source.imports[49]": "postmortem.h", "source.imports[50]": "snprintf", "source.imports[51]": "snwprintf", "source.imports[52]": "strlen", "source.imports[53]": "strrchr", "source.strings[10]": "+ %lu:", "source.strings[11]": "+ %lu:\\tSYS:%s\\t(PC %p)\\n", "source.strings[12]": "+ %lu:\\t[PC %p]\\t?\\t\\t\\n", "source.strings[13]": "+ %lu:\\t[PC %p]\\tMEM:%s+0x%x\\n", "source.strings[14]": "+ %lu:\\t[PC %p]\\tSYS:%s+0x%x\\n", "source.strings[15]": "+ %p\\t%s\\n", "source.strings[16]": "+ %s\\t%s:%d\\n", "source.strings[17]": "+ %u:\\t[PC %p]\\tMEM:%s+0x%x\\n", "source.strings[18]": ", %p, %u)", "source.strings[19]": "\u003cShlobj.h\u003e", "source.strings[20]": "\u003cstdio.h\u003e", "source.strings[21]": "Catch fatal exception: Code: %08x (%s)", "source.strings[22]": "Catch fatal exception: Code: %08x (%s) Flags: %08x Address: %p", "source.strings[23]": "Catch fatal exception: Code: %08x (%s) Flags: %08x Address: %p\\n", "source.strings[24]": "Couldn't find pEnumProcessModules", "source.strings[25]": "Couldn't find pEnumProcessModules\\n", "source.strings[26]": "Crash context saved", "source.strings[27]": "Crash context saved\\n", "source.strings[28]": "Creating folder for exception info", "source.strings[29]": "Creating folder for exception info\\n", "source.strings[30]": "Current Python stacks (if any):", "source.strings[31]": "Current stack trace:", "source.strings[32]": "DBGHELP.DLL", "source.strings[33]": "DLLs enumeration completed", "source.strings[34]": "DLLs enumeration completed\\n", "source.strings[35]": "EAX: %08x EBX: %08x ECX: %08x EDX: %08x", "source.strings[36]": "EAX: %08x EBX: %08x ECX: %08x EDX: %08x\\n", "source.strings[37]": "ESI: %08x EDI: %08x", "source.strings[38]": "ESI: %08x EDI: %08x\\n", "source.strings[39]": "ESP: %08x EBP: %08x EIP: %08x", "source.strings[40]": "ESP: %08x EBP: %08x EIP: %08x\\n", "source.strings[41]": "ESP: %08x EBP: %08x EIP: %08x\\n\"\n \"EAX: %08x EBX: %08x ECX: %08x EDX: %08x\\n\"\n \"ESI: %08x EDI: %08x\\n", "source.strings[42]": "EnableCrashingOnCrashes: ProcessUserModeExceptionPolicy found", "source.strings[43]": "EnableCrashingOnCrashes: ProcessUserModeExceptionPolicy found\\n", "source.strings[44]": "EnableCrashingOnCrashes: default policy: %08x", "source.strings[45]": "EnableCrashingOnCrashes: default policy: %08x\\n", "source.strings[46]": "EnumProcessModules", "source.strings[47]": "EnumProcessModules failed", "source.strings[48]": "EnumProcessModules failed\\n", "source.strings[49]": "Enumerating libraries..", "source.strings[50]": "Enumerating libraries..\\n", "source.strings[51]": "Exception Stack trace:", "source.strings[52]": "Exception info saved (python=%d)", "source.strings[53]": "Exception info saved (python=%d)\\n", "source.strings[54]": "Failed to create exception info file", "source.strings[55]": "Failed to create exception info file\\n", "source.strings[56]": "Failed to create exception info folder", "source.strings[57]": "Failed to create exception info folder\\n", "source.strings[58]": "Failed to create minidump file", "source.strings[59]": "Failed to create minidump file\\n", "source.strings[60]": "Failed to find SHGetFolderPathAndSubDirW (SHELL32.DLL AT %p)", "source.strings[61]": "Failed to find SHGetFolderPathAndSubDirW (SHELL32.DLL AT %p)\\n", "source.strings[62]": "Failed to find pMiniDumpWriteDump", "source.strings[63]": "Failed to find pMiniDumpWriteDump\\n", "source.strings[64]": "Failed to load DBGHELP", "source.strings[65]": "Failed to load DBGHELP\\n", "source.strings[66]": "Failed to save Exception Stack trace: DBGHELP not found", "source.strings[67]": "File with exception info: %s", "source.strings[68]": "Flags: %08x Address: %p", "source.strings[69]": "Flags: %08x Address: %p\\n", "source.strings[70]": "Folder created: %s", "source.strings[71]": "Generating crash context info..", "source.strings[72]": "Generating crash context info..\\n", "source.strings[73]": "Generating minidump...", "source.strings[74]": "Generating minidump...\\n", "source.strings[75]": "Generating stack trace ..", "source.strings[76]": "Generating stack trace ..\\n", "source.strings[77]": "GetBackTrace: Break on %p", "source.strings[78]": "GetBackTrace: Break on %p\\n", "source.strings[79]": "GetBackTrace: Start for %p", "source.strings[80]": "GetBackTrace: Start for %p\\n", "source.strings[81]": "GetProcessUserModeExceptionPolicy", "source.strings[82]": "Global crash handler completed successfully", "source.strings[83]": "Global crash handler completed successfully\\n", "source.strings[84]": "Global crash handler failed to create dump", "source.strings[85]": "Global crash handler failed to create dump\\n", "source.strings[86]": "HANDLE: %p PID: %08x HFILE: %p TYPE: %d", "source.strings[87]": "HANDLE: %p PID: %08x HFILE: %p TYPE: %d\\n", "source.strings[88]": "L\"%s\\\\tmp_dump_%d.bin", "source.strings[89]": "L\"%s\\\\tmp_dump_%d.einfo", "source.strings[90]": "L\"File with exception info: %s\\n", "source.strings[91]": "L\"Folder created: %s\\n", "source.strings[92]": "MEM:%s+0x%x", "source.strings[93]": "Memory modules:", "source.strings[94]": "MiniDumpWriteDump", "source.strings[95]": "MyLoadLibrary.h", "source.strings[96]": "No exception info!", "source.strings[97]": "No exception info!\\n", "source.strings[98]": "Non-exception crash report", "source.strings[99]": "Non-exception postmortem call", "source.functions[0]": "CreateMiniDump(HMODULE hDbgHelp, LPCWSTR pwzFolder, EXCEPTION_POINTERS* pExceptionPointers)", "source.functions[1]": "EnableCrashingOnCrashes()", "source.functions[2]": "GetBackTrace(USHORT usFrames, PVOID* BackTrace)", "source.functions[3]": "MyEnumerateLoadedLibraries(HANDLE hExceptionInfoFile)", "source.functions[4]": "Postmortem(PEXCEPTION_POINTERS pExceptionPointers)", "source.functions[5]": "PupyFunctionTableAccess(HANDLE hProcess, DWORD64 AddrBase)", "source.functions[6]": "PupyGetModuleBase(HANDLE hProcess, DWORD64 pvAddr)\n#else\nDWORD WINAPI PupyGetModuleBase(HANDLE hProcess, DWORD pvAddr)", "source.functions[7]": "SaveCallingStack(HANDLE hExceptionInfoFile)", "source.functions[8]": "SaveContextStack(HMODULE hDbgHelp, HANDLE hExceptionInfoFile, PCONTEXT pContext)", "source.functions[9]": "SaveExceptionInfo(\n HMODULE hDbgHelp, LPCWSTR pwzFolder,\n EXCEPTION_POINTERS* pExceptionPointers)", "source.strings[100]": "Non-exception postmortem call\\n", "source.strings[101]": "Normal modules:", "source.strings[102]": "Not all functions find at dbghelp", "source.strings[103]": "Not all functions find at dbghelp\\n", "source.strings[104]": "PSAPI.DLL", "source.strings[105]": "Postmortem exception filter completed", "source.strings[106]": "Postmortem exception filter completed\\n", "source.strings[107]": "Python stack: %s %s:%d", "source.strings[108]": "Python stack: %s %s:%d\\n", "source.strings[109]": "Python-stacktrace.c", "source.strings[110]": "Python-stacktrace.h", "source.strings[111]": "R10: %016x R11: %016x R12: %016x R13: %016x", "source.strings[112]": "R10: %016x R11: %016x R12: %016x R13: %016x\\n", "source.strings[113]": "R14: %016x R15: %016x", "source.strings[114]": "R14: %016x R15: %016x\\n", "source.strings[115]": "RAX: %016x RBX: %016x RCX: %016x RDX: %016x", "source.strings[116]": "RAX: %016x RBX: %016x RCX: %016x RDX: %016x\\n", "source.strings[117]": "RSI: %016x RDI: %016x R8: %016x R9: %016x", "source.strings[118]": "RSI: %016x RDI: %016x R8: %016x R9: %016x\\n", "source.strings[119]": "RSP: %016x RBP: %016x RIP: %016x", "source.strings[120]": "RSP: %016x RBP: %016x RIP: %016x\\n", "source.strings[121]": "Registers:", "source.strings[122]": "Registers:\\n", "source.strings[123]": "SHELL32.DLL", "source.strings[124]": "SHGetFolderPathAndSubDirW", "source.strings[125]": "SYS:%s", "source.strings[126]": "SYS:%s+0x%x", "source.strings[127]": "SaveExceptionInfo start..", "source.strings[128]": "SaveExceptionInfo start..\\n", "source.strings[129]": "SaveLibraryInfo called (%p, ", "source.strings[130]": "SaveLibraryInfo called (%p, \\\"%s\\\", %p, %u)\\n", "source.strings[131]": "SetProcessUserModeExceptionPolicy", "source.strings[132]": "StackWalk", "source.strings[133]": "StackWalk64", "source.strings[134]": "SymFunctionTableAccess", "source.strings[135]": "SymGetSymFromAddr", "source.strings[136]": "SymGetSymFromAddr64", "source.strings[137]": "SymInitialize", "source.strings[138]": "SymSetOptions", "source.strings[139]": "Try to save python stack", "source.strings[140]": "Try to save python stack\\n", "source.strings[141]": "UNKNOWN", "source.strings[142]": "Using ExceptionPointers (PTR=%p) MDEI=%p TID=%08x", "source.strings[143]": "Using ExceptionPointers (PTR=%p) MDEI=%p TID=%08x\\n", "source.strings[144]": "[PC %p]", "source.strings[145]": "\\n%s [%d]\\n", "source.strings[146]": "\\nCatch fatal exception: Code: %08x (%s)\\n", "source.strings[147]": "\\nCatch fatal exception: Code: %08x (%s)\\n\"\n \"Flags: %08x Address: %p\\n\"\n \"Registers:\\n\"\n\n#ifdef _WIN64\n \"RSP: %016x RBP: %016x RIP: %016x\\n\"\n \"RAX: %016x RBX: %016x RCX: %016x RDX: %016x\\n\"\n \"RSI: %016x RDI: %016x R8: %016x R9: %016x\\n\"\n \"R10: %016x R11: %016x R12: %016x R13: %016x\\n\"\n \"R14: %016x R15: %016x\\n", "source.strings[148]": "\\nCurrent Python stacks (if any):\\n", "source.strings[149]": "\\nCurrent stack trace:\\n", "source.strings[150]": "\\nException Stack trace:\\n", "source.strings[151]": "\\nFailed to save Exception Stack trace: DBGHELP not found\\n", "source.strings[152]": "\\nMemory modules:\\n", "source.strings[153]": "\\nNon-exception crash report\\n", "source.strings[154]": "\\nNormal modules:\\n", "source.strings[155]": "debug.h", "source.strings[156]": "kernel32.dll", "source.strings[157]": "pContext is NULL", "source.strings[158]": "pContext is NULL\\n", "source.strings[159]": "postmortem.h", "source.strings[160]": "tmp_dump_%d.bin", "source.strings[161]": "tmp_dump_%d.einfo", "source.functions[10]": "SaveLibraryInfo(PVOID pvCallbackData, LPCSTR pszName, PVOID pvBaseImage, ULONG ulSize)", "source.functions[11]": "SavePythonStackTrace(\n PVOID pvCallbackData, LPCSTR pszFunction, LPCSTR pszFile, DWORD dwLine)", "source.functions[12]": "WriteToFile(HANDLE hFile, LPCSTR lpcstr)", "source.functions[13]": "code2str(DWORD dwExceptionCode)" }, "ct": [ "CaptureStackBackTrace", "CloseHandle", "CreateFileW", "CreateMiniDump", "ECODE", "GetBackTrace", "GetCurrentProcess", "GetCurrentProcessId", "GetCurrentThread", "GetCurrentThreadId", "GetModuleFileNameA", "GetModuleHandleExA", "GetProcAddress", "GetTempPathW", "LoadLibraryA", "MyEnumerateLibraries", "MyEnumerateLoadedLibraries", "MyFindMemoryModuleNameByAddr", "PupyGetModuleBase", "Py_GetCurrentThreadStackTrace", "RtlCaptureContext", "RtlLookupFunctionEntry", "RtlVirtualUnwind", "SUCCEEDED", "SaveCallingStack", "SaveContextStack", "SaveExceptionInfo", "WriteFile", "WriteToFile", "_snwprintf", "code2str", "dprint", "dwprint", "memset", "pEnumProcessModules", "pGetPolicy", "pMiniDumpWriteDump", "pSHGetFolderPathAndSubDirW", "pSetPolicy", "pStackWalk", "pSymGetSymFromAddr", "pSymGetSymFromAddr64", "pSymInitialize", "pSymSetOptions", "snprintf", "strlen", "strrchr" ], "id": "c", "mc": [ "ContextRecord.Rip", "mdei.ClientPointers", "mdei.ExceptionPointers", "mdei.ThreadId", "pContext.Ebp", "pContext.Eip", "pContext.Esp", "pContext.Rbp", "pContext.Rip", "pContext.Rsp", "pExceptionPointers.ContextRecord", "pExceptionPointers.ContextRecord.Eax", "pExceptionPointers.ContextRecord.Ebp", "pExceptionPointers.ContextRecord.Ebx", "pExceptionPointers.ContextRecord.Ecx", "pExceptionPointers.ContextRecord.Edi", "pExceptionPointers.ContextRecord.Edx", "pExceptionPointers.ContextRecord.Eip", "pExceptionPointers.ContextRecord.Esi", "pExceptionPointers.ContextRecord.R10", "pExceptionPointers.ContextRecord.R11", "pExceptionPointers.ContextRecord.R12", "pExceptionPointers.ContextRecord.R13", "pExceptionPointers.ContextRecord.R14", "pExceptionPointers.ContextRecord.R15", "pExceptionPointers.ContextRecord.R15.ContextRecord", "pExceptionPointers.ContextRecord.R15.ContextRecord.Esp", "pExceptionPointers.ContextRecord.R8", "pExceptionPointers.ContextRecord.R9", "pExceptionPointers.ContextRecord.Rax", "pExceptionPointers.ContextRecord.Rbp", "pExceptionPointers.ContextRecord.Rbx", "pExceptionPointers.ContextRecord.Rcx", "pExceptionPointers.ContextRecord.Rdi", "pExceptionPointers.ContextRecord.Rdx", "pExceptionPointers.ContextRecord.Rip", "pExceptionPointers.ContextRecord.Rsi", "pExceptionPointers.ContextRecord.Rsp", "pExceptionPointers.ExceptionRecord", "pExceptionPointers.ExceptionRecord.ExceptionAddress", "pExceptionPointers.ExceptionRecord.ExceptionCode", "pExceptionPointers.ExceptionRecord.ExceptionFlags", "stack.AddrFrame", "stack.AddrFrame.Mode", "stack.AddrFrame.Offset", "stack.AddrPC", "stack.AddrPC.Mode", "stack.AddrPC.Offset", "stack.AddrStack", "stack.AddrStack.Mode", "stack.AddrStack.Offset", "symbol.MaxNameLength", "symbol.Name", "symbol.SizeOfStruct", "symbol_storage.symbol" ] }, "id": 0, "sz": 24744, "ts": [ { "c": 0.7200000286102295, "d": "LLM instruction context", "e": [ "INSTRUCTION" ], "i": "micro-behaviors/data/text/llm/override::llm-instruction-context", "l": 1 }, { "c": 1.0, "d": "PE machine type display labels", "e": [ "IMAGE_FILE_MACHINE_I386" ], "i": "micro-behaviors/fs/file/section::pe-viewer-machine-types", "l": 1 }, { "c": 0.8799999952316284, "d": "WriteFile API in source code", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write/direct::write-file-source", "l": 2, "el": [ "1472" ] }, { "c": 0.75, "d": "snprintf formatting function", "e": [ "snprintf" ], "i": "micro-behaviors/data/format/string::snprintf-format", "l": 2 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Windows GetProcAddress in source", "e": [ "GetProcAddress" ], "i": "micro-behaviors/dylib/lookup::get-proc-address-source", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileW" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2, "el": [ "d6e" ] }, { "c": 0.8799999952316284, "d": "Codebase deletion target", "e": [ "Code" ], "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase", "l": 1 }, { "c": 0.20000000298023224, "d": "Bare token: UNKNOWN", "e": [ "UNKNOWN" ], "i": "micro-behaviors/data/text/keywords/lexicon::unknown-token", "l": 1, "el": [ "526" ] }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1, "el": [ "3f7e" ] }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "result" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "LoadLibraryA call in source", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load/source::load-library-a-source", "l": 3 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "c": 0.8999999761581421, "d": "EnumProcessModules reference in source", "e": [ "EnumProcessModules" ], "i": "objectives/evasion/process/injection/toolkit::enum-process-modules-source", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "RtlCaptureContext call syntax", "e": [ "RtlCaptureContext(" ], "i": "objectives/evasion/process/callstack-spoof::rtl-capture-context-call", "l": 1 } ], "sha": "22f493a8ac4859f5b0195f4db24dfb6d3a74727d83c7c28a6810c2b93de1131d", "path": "postmortem.c", "type": "c" } ], "tv": "8e9ac" } }