{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000014215708, "rte": "az", "prob": 0.000014215708 }, { "cls": 0, "raw": 0.81545705, "rte": "az/source", "prob": 0.81545705 }, { "cls": 0, "raw": 0.8175206, "rte": "az/c", "prob": 0.8175206 } ], "prob": 0.000014215708, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000014215707778930664, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:02:32Z" }, "path": "hooker.hpp", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 61, "b": "asW*", "l": 5 }, { "a": 65, "b": "asXHgwPzT4B8#5lzxJUmazttbwNY{cxl4A#By!#lazbU9wGU]6ay/7[A+w@maARJAvqZukAaK6hz/cXovSV3)zFs03ayMy5z/x$h", "l": 6 }, { "a": 146, "b": "asXHLw/#hex(+zrz!s9nvrb{4vqYP#vrlHdv}/v[wN(]]z!0{bwO#P#BzkVhazbt7wPF$xBzbkdb2-z(BA.elwG\u0026MOaARJAwmYg=4f", "l": 7, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 152, "z": 4 } ] }, { "a": 228, "b": "asXHFzxK4mwGT]\u0026w]@l9A+cwqx([3bB-X:DwPI%lx\u003e8m0z/d9Gx(mA%B.2i7xcqzjBzbPnBrCylze192BzkVhaARpdaAzgexMOq8", "l": 8 }, { "a": 309, "b": "asXHQzY\u003cgzwH[%lz/x$Maz(4cx\u003ezSwaz\u003eXgxjSRpAckSax(^@say]hcBAh88B-.gCaAIWmy?Wx\u003czGxwuayPd#fk\u003e\u003eNB7Gf74f", "l": 9 }, { "a": 1786, "b": "arR^HarR^HB98CBv@@?:wO=r%AV/YKEld(", "l": 54 }, { "a": 1814, "b": "4f", "l": 55 }, { "a": 1816, "b": "arR^HarR^Hfe1Cnz/f-fA=-BqwQ2tcxKL{\u0026v@#p5aARJAvixDgzdm6%e!4", "l": 56, "n": [ { "c": 1, "d": "Validation vocabulary number", "i": "metadata/file/text/format::vocab-number", "o": 1854, "z": 6 } ] }, { "a": 1863, "b": "arR^HarR^Hv@DmaBy/YoAV/HszGE\u003cBBrC7bvrbZ%z^M$0By=\u003egxKL{7v\u003c}\u0026", "l": 57 }, { "a": 1911, "b": "arR^HarR^HDKP", "l": 58 }, { "a": 2998, "b": "arR^HarR^HEgl", "l": 86 }, { "a": 3009, "b": "4f", "l": 87 }, { "a": 3011, "b": "arR^HarR^Hfe1Cnz/f-fA=-Bjay/7[A:-E1wPw]4A=LPlaARJAvRGZ*A^n^JwPz\u003caz/cXazE:(lx(4r\u0026vrb)3vrcx%C}GK", "l": 88, "n": [ { "c": 1, "d": "Validation vocabulary array", "i": "metadata/file/text/format::vocab-array", "o": 3042, "z": 5 } ] }, { "a": 3087, "b": "arR^HarR^HBy/rdy*?A%auTZVDsZD9awKEgB7]@iuVW[Me*9-bj}d", "l": 89 }, { "a": 3130, "b": "arR^HarR^Hv@DmaBy/YoAV/sfBAz8mzAI#ODs.2be?O+8nPMsAay]4[z!9A^B98CpzF9r}vruQ5A=9pnz/fSray/7[AWSnQdo/LMefG1Qwi8+=zE^s6uVP^#B.bD2wJSL9e?O+udgD", "l": 90 }, { "a": 3400, "b": "arR^HEgl", "l": 97 }, { "a": 3407, "b": "4f", "l": 98 }, { "a": 3409, "b": "arR^Hfe1CnA+eW3wGUz7vRGZ*A^n^DvruQ5A=91iA=k!qA::emB98CpzF78dx([DdA:-=bx(k59z/PY6BugJ*k%=XYkoJfUau@7me!4", "l": 99, "n": [ { "c": 1, "d": "Validation vocabulary string", "i": "metadata/file/text/format::vocab-string", "o": 3449, "z": 6 } ] }, { "a": 3492, "b": "arR^HBy/rdy*?A%auTZVDsZD9awL9f", "l": 100 }, { "a": 3517, "b": "arR^Hv@DmaBy/YoAV!\u003egzGx[xAa9\u003cgwPzVJp9qhjgD({#yJ9Z7c$vgkB95KmxKL{fcuyRupf/pT", "l": 101 }, { "a": 7484, "b": "arR^HEgl", "l": 185 }, { "a": 7491, "b": "4f", "l": 186 }, { "a": 7493, "b": "arR^Hfe1$3qE%@)A=91rvRPE:BrCHlaAIHkv}/K?wN(]\u003erc-B]u)6Vbx\u003e7*0x(+zkz!0i$wN(](BrB$2vrl05d\u003ce+xw]?K9u[I(", "l": 187, "n": [ { "c": 1, "d": "Validation vocabulary object", "i": "metadata/file/text/format::vocab-object", "o": 7508, "z": 6 } ] }, { "a": 7573, "b": "arR^HBy/rdy*?A%jAL\u003c/wO${[wGT@$AaHNyBA}?pzEEx[avoHTwJ*L", "l": 188 }, { "a": 7617, "b": "arR^Hrc-B]ayPw0z!rQ5wPPs!vrl05vQTs?efG7MB7]o8wN({4w[D9}BsvU", "l": 189 }, { "a": 14357, "b": "arR^Hfe1$3tYKy$B-IwvaARTDwGU]eaAIWnv}x.5aA8oyw)]H%wGU]eazb4@y\u0026%=fe!4", "l": 281 }, { "a": 14412, "b": "arR^HBy/rdy*?A%jAL\u003c/wO${[wGT@$AaHNyBA}?pzEEx[avfKGAY%{", "l": 282 }, { "a": 14456, "b": "arR^HvScg3aA}\u003cuBy=\u003c^wmPZ6vpS[?wPI]zay/tcB95K7D2NsqC42ifwHO:GaAz4nB-IvxwmY\u003c\u003ex(2*\u003exM4*8wPzd4A+PSbc$D[hvqfKsi:(]KuVZi[C5I89A42d9wo8m5B15T.d0xJywgx2PC42ifwH[%Bx)Kuew*??hy\u0026%qrdiH=pav]p7ogq-=q=MgLmn)bDaBKX", "l": 283, "n": [ { "c": 2, "d": "Write files", "i": "micro-behaviors/fs/file/write/direct::write", "o": 14465, "z": 5 } ] }, { "a": 14616, "b": "4f", "l": 284 }, { "a": 14618, "b": "arR^Hfe1$3s8@1%wGUA0ayPqhvr\u0026#qzY\u003cauwN/B^x\u003ep/$zdNN5A^n^owmPZ(B8@@y", "l": 285 }, { "a": 15273, "b": "arR^HvScg3aA}\u003cuBy=\u003c^wmPZ6vpS[?wPI]zay/tcB95KFz!S-iay[]5vjSKxx)Kt$BrCTsDsXJFDMWuuBAIRway]59vqfKsi+SCIyH}J[CxdztwHI82Byw)1iYZX!D0+ViuV{v4wn\u0026@9wmPZ(B8@=Yay[]5vjSKxx)Kttau.\u003egnkA2Omn^F\u003eryobxq=t+2Egl", "l": 298 }, { "a": 15428, "b": "4f", "l": 299 }, { "a": 15430, "b": "arR^Hfe1$3q!oxTv}YB{azbLjaAI*BvSc69x(k5mAaJJ[w[+*!az++3A::0le*9@caxJn{wn=WkawuYZwk3YDA::0lc[co.x(4PdvR3V(vqG:\u003ewftO#azC}saz#ataz+$8wmYo]D1z7GaA8vnwPA0eB7DE:wPQT+wozZ1nmuyDy?k1zaA}Koy-)g#aA.:pwg!q", "l": 300, "n": [ { "c": 3, "d": "Dynamic library load in source", "i": "micro-behaviors/dylib/load/source::load-library-source", "o": 15491, "z": 11 }, { "c": 3, "d": "Get module handle", "i": "micro-behaviors/process/info/thread::get-module-handle", "o": 15553, "z": 15 } ] }, { "a": 15586, "b": "arR^Hfe1$3pI}p\u003ex(n6ray]qbAaJ]nqDcsTuRTx+mnccHmjxu/zE:(2y?4p1B7D:GaA}Koy-)e5Cvt=rayX[8v{%g\u0026wN)z5", "l": 301 }, { "a": 15663, "b": "arR^Hfe1$3tYsa(vqNc6x\u003c$B!vqPM#B98CpzF78ox([2hwo\u002663ze0G5y?Wv0vrcSozEEx[e!4", "l": 302 } ], "mol": "Hâ‚‚(DsPo)", "sha": "363f9cf6a98e99559534712dc94dea4c345311033464ad79faa013a63a97d6e3", "fact": { "id": "c", "imp": [ [ "", "runtime_error" ], [ "", "runtime_error" ], [ "", "char_to_byte" ], [ "", "char_to_byte" ], [ "", "get_pattern_byte.get_wildcard_byte" ], [ "", "get_pattern_byte" ], [ "", "mkpat" ], [ "", "char" ], [ "", "decode_string_pattern" ], [ "", "runtime_error" ], [ "", "static_assert" ], [ "", "memcpy" ], [ "", "any_to_voidp" ], [ "", "any_to_voidp" ], [ "", "stdcall" ], [ "", "UniversalCall" ], [ "", "UniversalCall" ], [ "", "ccall" ], [ "", "thiscall" ], [ "", "at_offset" ], [ "", "from_offset" ], [ "", "any_to_voidp" ], [ "", "get_mnemonic_size" ], [ "", "hooker_get_mnemonic_size" ], [ "", "any_to_voidp" ], [ "", "any_to_voidp" ], [ "", "any_to_voidp" ], [ "", "unhook" ], [ "", "any_to_voidp" ], [ "", "any_to_voidp" ], [ "", "get_vmt_address" ], [ "", "hooker_get_vmt_address" ], [ "", "any_to_voidp" ], [ "", "find_pattern" ], [ "", "strlen" ], [ "", "nop" ], [ "", "hooker_nop" ], [ "", "any_to_voidp" ], [ "", "write" ], [ "", "hooker_write" ], [ "", "any_to_voidp" ], [ "", "write" ], [ "", "hooker_write" ], [ "", "any_to_voidp" ], [ "", "write" ], [ "", "hooker_write" ], [ "", "any_to_voidp" ], [ "", "dlsym" ], [ "", "hooker_dlsym" ], [ "", "any_to_voidp" ], [ "", "\u003ccstdint\u003e" ], [ "", "\u003cstdexcept\u003e" ], [ "", "\u003ctype_traits\u003e" ], [ "", "hooker.h" ] ], "mbr": [ "get_pattern_byte().get_wildcard_byte", "thisHelper.UniversalCall" ], "met": { "ast": { "op.eq": 11.0, "op.ge": 8.0, "op.gt": 43.0, "op.le": 3.0, "op.lt": 62.0, "op.ne": 3.0, "op.add": 7.0, "op.bor": 2.0, "op.div": 2.0, "op.mod": 1.0, "op.mul": 18.0, "op.shl": 1.0, "op.sub": 3.0, "op.band": 5.0, "op.land": 4.0, "op.lnot": 1.0, "max_depth": 21.0, "op.concat": 2.0, "call_count": 52.0, "node_count": 3263.0, "member_count": 2.0, "op_density.eq": 0.0, "op_density.ge": 0.0, "op_density.gt": 0.01, "op_density.le": 0.0, "op_density.lt": 0.02, "op_density.ne": 0.0, "op_density.add": 0.0, "op_density.bor": 0.0, "op_density.div": 0.0, "op_density.mod": 0.0, "op_density.mul": 0.01, "op_density.shl": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 140.0, "member_depth_max": 2.0, "op_density.concat": 0.0, "string_literal_count": 9.0, "array_literal_max_length": 24.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 18074.0, "entropy": 4.97, "size_bytes": 18074.0 }, "text": { "digit_ratio": 0.01, "space_count": 3323.0, "total_lines": 342.0, "char_entropy": 4.97, "unique_chars": 88.0, "escape_density": 0.01, "lines_over_200": 8.0, "string_density": 0.03, "avg_line_length": 50.85, "max_line_length": 267.0, "empty_line_ratio": 0.09, "last_line_length": 6.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.07, "identifier_density": 2.16, "line_length_stddev": 50.12, "octal_escape_count": 1.0, "normalized_string_count": 0.49, "repeated_char_sequences": 23.0, "suspicious_string_ratio": 0.11, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.02, "max_inline_whitespace_run": 7.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 16.63 }, "calls": { "count": 52.0 }, "binary": { "overall_entropy": 4.97 }, "source": { "class_count": 1.0, "function_count": 4.0 }, "imports": { "count": 4.0, "unique_modules": 4.0, "third_party_count": 4.0, "third_party_ratio": 1.0 }, "members": { "count": 2.0 }, "strings": { "total": 9.0, "avg_length": 26.67, "max_length": 44.0, "avg_entropy": 3.25, "sql_strings": 1.0, "total_bytes": 240.0, "entropy_stddev": 1.24 }, "comments": { "chars": 7567.0, "lines": 119.0, "total": 97.0, "to_code_ratio": 0.53, "high_entropy_comments": 2.0 }, "functions": { "count": 5.0 }, "identifiers": { "count": 140.0, "total": 739.0, "avg_length": 9.22, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.55, "reuse_ratio": 0.19, "unique_count": 140.0, "length_stddev": 5.55, "has_digit_ratio": 0.02, "sequential_names": 5.0, "single_char_count": 5.0, "single_char_ratio": 0.04, "high_entropy_count": 11.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.79, "all_uppercase_ratio": 0.04, "numeric_suffix_count": 2.0, "underscore_prefix_count": 2.0 } }, "str": [ [ 1186, "u8", "\u003ctype_traits\u003e" ], [ 1210, "u8", "\u003cstdexcept\u003e" ], [ 1232, "u8", "\u003ccstdint\u003e" ], [ 1310, "u8", "C" ], [ 1311, "u8", "C" ], [ 1347, "u8", "hooker.h" ], [ 1348, "u8", "hooker.h" ], [ 1396, "10", "201402" ], [ 2061, "16", "10" ], [ 2145, "16", "10" ], [ 2217, "10", "0" ], [ 2280, "u8", "Not a hex character." ], [ 2281, "u8", "Not a hex character." ], [ 2512, "10", "3" ], [ 2516, "10", "2" ], [ 2537, "10", "3" ], [ 2541, "10", "2" ], [ 2595, "u8", "Improperly formatted pattern." ], [ 2596, "u8", "Improperly formatted pattern." ], [ 2693, "10", "3" ], [ 2700, "10", "4" ], [ 2726, "10", "3" ], [ 2730, "10", "1" ], [ 2943, "10", "3" ], [ 2955, "10", "2" ], [ 2959, "10", "0" ], [ 2973, "10", "3" ], [ 2977, "10", "1" ], [ 2989, "10", "1" ], [ 2993, "10", "0" ], [ 3549, "10", "3" ], [ 3602, "10", "3" ], [ 3608, "10", "0" ], [ 3693, "10", "3" ], [ 3752, "u8", "Improperly formatted pattern." ], [ 3753, "u8", "Improperly formatted pattern." ], [ 3852, "10", "201703" ], [ 3966, "10", "201703" ], [ 4051, "10", "201402" ], [ 4267, "u8", "From type must be trivially copable." ], [ 4268, "u8", "From type must be trivially copable." ], [ 4439, "u8", "To type must be trivially copiable." ], [ 4440, "u8", "To type must be trivially copiable." ], [ 4530, "u8", "Sizes of From and To types must be the same." ], [ 4531, "u8", "Sizes of From and To types must be the same." ], [ 4644, "u8", "To type must be default constructible." ], [ 4645, "u8", "To type must be default constructible." ], [ 4707, "10", "201402" ], [ 10675, "10", "0" ], [ 12483, "10", "201402" ] ], "tgt": [ "UniversalCall", "UniversalCall()", "any_to_voidp", "at_offset", "ccall", "char", "char_to_byte", "decode_string_pattern", "dlsym", "find_pattern", "from_offset", "get_mnemonic_size", "get_pattern_byte", "get_pattern_byte().get_wildcard_byte", "get_vmt_address", "hooker_dlsym", "hooker_get_mnemonic_size", "hooker_get_vmt_address", "hooker_nop", "hooker_write", "memcpy", "mkpat", "nop", "runtime_error", "static_assert", "stdcall", "strlen", "thiscall", "unhook", "write" ], "val": { "file.stem": "hooker", "file.basename": "hooker.hpp", "source.language": "c", "source.imports[0]": "\u003ccstdint\u003e", "source.imports[1]": "\u003cstdexcept\u003e", "source.imports[2]": "\u003ctype_traits\u003e", "source.imports[3]": "UniversalCall", "source.imports[4]": "any_to_voidp", "source.imports[5]": "at_offset", "source.imports[6]": "ccall", "source.imports[7]": "char", "source.imports[8]": "char_to_byte", "source.imports[9]": "decode_string_pattern", "source.strings[0]": "201402", "source.strings[1]": "201703", "source.strings[2]": "\u003ccstdint\u003e", "source.strings[3]": "\u003cstdexcept\u003e", "source.strings[4]": "\u003ctype_traits\u003e", "source.strings[5]": "From type must be trivially copable.", "source.strings[6]": "Improperly formatted pattern.", "source.strings[7]": "Not a hex character.", "source.strings[8]": "Sizes of From and To types must be the same.", "source.strings[9]": "To type must be default constructible.", "source.has_imports": true, "source.imports[10]": "dlsym", "source.imports[11]": "find_pattern", "source.imports[12]": "from_offset", "source.imports[13]": "get_mnemonic_size", "source.imports[14]": "get_pattern_byte", "source.imports[15]": "get_pattern_byte.get_wildcard_byte", "source.imports[16]": "get_vmt_address", "source.imports[17]": "hooker.h", "source.imports[18]": "hooker_dlsym", "source.imports[19]": "hooker_get_mnemonic_size", "source.imports[20]": "hooker_get_vmt_address", "source.imports[21]": "hooker_nop", "source.imports[22]": "hooker_write", "source.imports[23]": "memcpy", "source.imports[24]": "mkpat", "source.imports[25]": "nop", "source.imports[26]": "runtime_error", "source.imports[27]": "static_assert", "source.imports[28]": "stdcall", "source.imports[29]": "strlen", "source.imports[30]": "thiscall", "source.imports[31]": "unhook", "source.imports[32]": "write", "source.strings[10]": "To type must be trivially copiable.", "source.strings[11]": "hooker.h", "source.functions[0]": "CPP14(=void*)\u003e\r\n Proc dlsym(const char* lib_name, const char* sym_name)", "source.functions[1]": "char_to_byte(char c)", "source.functions[2]": "detail", "source.functions[3]": "get_pattern_byte(const char(\u0026s)[N], size_t idx)", "source.functions[4]": "get_wildcard_byte(const char(\u0026s)[N], size_t idx)", "source.functions[5]": "hooker", "source.functions[6]": "result" } }, "find": [ { "id": "metadata/file/text/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string" }, { "id": "metadata/file/text/format::vocab-array", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary array" }, { "id": "metadata/file/text/format::vocab-object", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary object" }, { "id": "micro-behaviors/process/info/thread::get-module-handle", "conf": 0.8999999761581421, "crit": 3, "desc": "Get module handle" }, { "id": "metadata/file/text/format::vocab-number", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary number" }, { "id": "micro-behaviors/dylib/load/source::load-library-source", "atk": "T1574.002", "conf": 0.9200000166893005, "crit": 3, "desc": "Dynamic library load in source" } ], "path": "/data/samples/bad/projects/virtual-reality/dep/hooker/hooker.hpp", "risk": 2, "size": 18074, "type": "c" } ] } }