{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000097960234, "rte": "az", "prob": 0.000097960234 } ], "prob": 0.000097960234, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00009796023368835449, "type": "xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.0000054836273193359375, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-09-12T01:19:24Z" }, "path": "aegis128.ko.xz", "raw": { "files": [ { "id": 0, "mol": "Md₂(BiHe)", "sha": "38d71c10d96ba7a81e30115e0a097cd4aed8f593dd3cb76d47bcc80b2c8b8dda", "path": "aegis128.ko.xz", "risk": 3, "size": 12000, "type": "xz", "facts": { "metrics": { "file": { "size": 12000, "entropy": 7.99 }, "binary": { "peak_region_bytes": 12000, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "metadata/hardening/missing::static-linked-heuristic", "conf": 0.75, "crit": 3, "desc": "ELF lacks dynamic linker sections", "from": [ { "file": 1 } ], "uses": [ 7 ] }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "References the GPL license", "from": [ { "file": 1 } ] }, { "id": "metadata/binary/linking/static::elf-needed-libs-zero", "conf": 0.9, "crit": 2, "desc": "ELF imports zero needed libraries", "from": [ { "file": 1 } ] }, { "id": "metadata/file/extension/identity::linux-kernel-module-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel module basename", "from": [ { "file": 1 } ] }, { "id": "metadata/hardening/mitigation::no-pie-struct", "conf": 0.6, "crit": 3, "desc": "Binary not position-independent (no ASLR)" }, { "id": "metadata/binary/linking/static::static-linked-heuristic", "conf": 0.75, "crit": 3, "desc": "ELF lacks dynamic linker sections", "from": [ { "file": 1 } ], "uses": [ 7 ] }, { "id": "metadata/binary/linking/static::static-linked", "conf": 0.8, "crit": 3, "desc": "Statically linked binary", "from": [ { "file": 1 } ], "uses": [ 2, 5 ] }, { "id": "metadata/binary/layout::binary-format-checked", "conf": 1.0, "crit": 2, "desc": "Binary format is identified", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000rtp-0rr91000000000000000000000i2}#0000000000kMy=:002m:dGy)$1onA4fAq7M1POJ5m]04:0SSko1onA40rr91000000rreo1onA40rr91000000SSnp1onA40rr91000001onA46Awak0@@r3m]04:4NvA\u003c8Fic\u003e?V", "ln": 0 }, { "b": "000001][S60rr9100961oLFx!CMmZz00000@-}p]sr2*MeubF=tCXhy(A*EnKDtM=KDtM=KDtM=KDtM=\u003eL$O.06%WLr.neEk#*Tspb1$krz#Cv((V?Em)EP[z:u=4WQhuiWOGm3WS+bc54l%RH^SH154j#0l\u003eu.smH#}em[0@%zC7IGE[q{pWQ8T-l)Jvg54j@1mgV?co*]P3mOX+cbOAxNWNK4TH?[sJH^SH4m2k7[6]kJ", "ln": 184 }, { "b": "ZyZCC0o:y.006+C0002.00000ZyHqA0o:y.000000000000000000000000000000000000000000000009940%F@t6^tOtKM?41*DuxNznE%@aq3s{Bg0BL000000000", "ln": 5352 }, { "b": "AY)iowo8l@awD=}zEE3^yAL-TzeTGkvpJ\u003e:kXB}xx(2ziz/4Vry?Wx\u003czGxwLm]h\u003eVwmYZ\u003ezE^/K0bls)A+e/BsPAtFzdL\u003eswOkZ#f!$Y*A+fuiz!%c9wJ:e@C4CYhvp%p:jVj]Ei4=%eq+Z7hAb]J3ze:OtzeS@(B-82lvpQFX00000000000000", "ln": 5691 } ], "depth": 1, "facts": { "sec": [ [ ".note.gnu.property", 64, 64, 1.77, "alloc" ], [ ".note.gnu.build-id", 128, 36, 4.19, "alloc" ], [ ".note.Linux", 164, 48, 1.97, "alloc" ], [ ".orc_header", 212, 20, 4.12, "alloc" ], [ ".text", 232, 5027, 5.9, "alloc,executable" ], [ ".rela.text", 37416, 2016, 2.24, "info_link" ], [ ".init.text", 5264, 37, 2.26, "alloc,executable" ], [ ".rela.init.text", 39432, 72, 1.75, "info_link" ], [ ".exit.text", 5304, 32, 2.19, "alloc,executable" ], [ ".rela.exit.text", 39504, 48, 1.57, "info_link" ], [ ".text.unlikely", 5336, 46, 2.12, "alloc,executable" ], [ ".rela.text.unlikely", 39552, 96, 1.85, "info_link" ], [ ".rodata", 5384, 64, 3.37, "alloc" ], [ "__mcount_loc", 5448, 64, 0.0, "alloc" ], [ ".rela__mcount_loc", 39648, 192, 1.33, "info_link" ], [ ".modinfo", 5512, 315, 4.81, "alloc" ], [ ".return_sites", 5827, 36, 0.0, "alloc" ], [ ".rela.return_sites", 39840, 216, 1.49, "info_link" ], [ ".call_sites", 5863, 196, 0.0, "alloc" ], [ ".rela.call_sites", 40056, 1176, 1.76, "info_link" ], [ ".orc_unwind", 6059, 294, 2.68, "alloc" ], [ ".orc_unwind_ip", 6353, 196, 0.0, "alloc" ], [ ".rela.orc_unwind_ip", 41232, 1176, 1.63, "info_link" ], [ "__patchable_function_entries", 6552, 72, 0.0, "write,alloc" ], [ ".rela__patchable_function_entries", 42408, 216, 1.23, "info_link" ], [ ".data", 6624, 456, 0.59, "write,alloc" ], [ ".rela.data", 42624, 120, 1.22, "info_link" ], [ ".exit.data", 7080, 8, 0.0, "write,alloc" ], [ ".rela.exit.data", 42744, 24, 0.5, "info_link" ], [ ".init.data", 7088, 8, 0.0, "write,alloc" ], [ ".rela.init.data", 42768, 24, 0.5, "info_link" ], [ ".gnu.linkonce.this_module", 7096, 1280, 0.07, "write,alloc" ], [ ".rela.gnu.linkonce.this_module", 42792, 48, 1.01, "info_link" ], [ ".comment", 8376, 57, 3.72, "merge,strings" ], [ ".BTF", 8433, 25963, 3.56, "" ], [ ".symtab", 34400, 1776, 1.73, "" ], [ ".strtab", 36176, 1238, 4.75, "" ], [ ".shstrtab", 42840, 418, 4.31, "" ] ], "metrics": { "elf": { "bits": 64, "entry": 0, "has_got": 0, "has_plt": 0, "has_note": 1, "has_symtab": 1, "note_count": 3, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 0, "has_eh_frame": 0, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 74, "dynrela_count": 0, "little_endian": 1, "pltreloc_count": 0, "executable_stack": 0, "wx_segment_count": 0, "comment_entry_count": 3, "program_header_count": 0, "stripped_with_symtab": 1, "comment_distinct_count": 1, "load_segment_max_file_size": 0, "load_segment_max_memory_size": 0, "section_relocation_group_count": 13, "stripped_metadata_section_count": 5 }, "file": { "size": 45952, "entropy": 3.81 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 0, "code_entropy": 5.82, "data_entropy": 0.2, "overlay_size": 2694, "string_count": 117, "overlay_ratio": 0.06, "overlay_entropy": 1.26, "entropy_variance": 2.49, "avg_string_length": 18.9, "max_string_length": 44, "peak_region_bytes": 3072, "code_to_data_ratio": 0.74, "peak_region_entropy": 5.81, "string_length_stddev": 9.75, "largest_section_ratio": 0.57, "sentence_string_count": 4, "sentence_string_ratio": 0.03, "high_entropy_string_count": 0 }, "sections": { "count": 42, "code_size": 5142, "entropy_max": 5.9, "entropy_mean": 1.9, "name_entropy": 4.22, "writable_count": 7, "executable_count": 4, "nonstandard_count": 34, "executable_writable_count": 0 }, "dependencies": { "count": 0 } } }, "id": 1, "mol": "Md₂(BiHe)", "path": "aegis128.ko.xz!!aegis128.ko", "pid": 0, "risk": 3, "sha": "92743e00dd287ffe249a607858b85d7b8a47cdb87a8c90c08b47d744f045823c", "size": 45952, "traits": [ { "id": "metadata/binary/layout::binary-format-checked", "conf": 1.0, "crit": 2, "desc": "Binary format is identified", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/binary/linking/static::elf-needed-libs-zero", "conf": 0.9, "crit": 2, "desc": "ELF imports zero needed libraries", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/extension/identity::linux-kernel-module-basename", "conf": 0.95, "crit": 2, "desc": "Linux kernel module basename", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/hardening/mitigation::no-pie-struct", "conf": 0.6, "crit": 3, "desc": "Binary not position-independent (no ASLR)" }, { "id": "metadata/package/license::gpl-word", "conf": 0.7, "crit": 2, "desc": "References the GPL license", "spans": [ [ 5739, 0 ] ] }, { "id": "metadata/binary/linking/static::static-linked-heuristic", "conf": 0.75, "crit": 3, "desc": "ELF lacks dynamic linker sections", "uses": [ 0 ], "spans": [ [ 0, 16 ] ] }, { "id": "metadata/hardening/missing::static-linked-heuristic", "conf": 0.75, "crit": 3, "desc": "ELF lacks dynamic linker sections", "uses": [ 0 ], "spans": [ [ 0, 16 ] ] }, { "id": "metadata/binary/linking/static::static-linked", "conf": 0.8, "crit": 3, "desc": "Statically linked binary", "uses": [ 1, 5 ], "spans": [ [ 0, 25 ] ] } ], "type": "elf" } ], "rev": "b3dc8", "v": "8" } }