{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000017742315, "rte": "az", "prob": 0.000017742315 }, { "cls": 0, "raw": 0.000009119511, "rte": "az/scripts", "prob": 0.000009119511 }, { "cls": 0, "raw": 0.00043548146, "rte": "az/shell", "prob": 0.00043548146 } ], "prob": 0.000017742315, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000017742315321811475, "type": "shell" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:00:43Z" }, "path": "sidedoor.init", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "boXZHx(kOBxA", "l": 1, "n": [ { "c": 2, "d": "POSIX shell shebang line", "i": "metadata/lang/shebang::sh", "o": 0, "z": 9 } ] }, { "a": 10, "b": "bo[AQlpByop9rb6nMl*7pdw1", "l": 2, "n": [ { "c": 3, "d": "LSB init script header", "i": "objectives/persistence/system/init/boot::init-script-header", "o": 14, "z": 15 } ] }, { "a": 30, "b": "boP*6z*2\u00269wPG)ParR^HarR^HaAImcwN]Z$AS", "l": 3 }, { "a": 60, "b": "boP(}ADL#owN)w\u003eByxiiiV]K/as7#szeTJcuUjv4bY!lLy\u0026r}", "l": 4 }, { "a": 258, "b": "boPx)awLZiar\u003e(rBrAeDa]", "l": 11 }, { "a": 276, "b": "", "l": 12 }, { "a": 277, "b": "boP/Gr7FcMxM53fwft/dy\u003cvdqzEWH9wmV(pB-RNRdJ\u0026CqazC{uA=(nvayO(7wPw]nxK@r6z/]@tzF0@xB7=Xqv@=p5Bn", "l": 13, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 328, "z": 3 }, { "c": 1, "d": "Direct PATH assignment (PATH= or PATH+=)", "i": "micro-behaviors/os/env/vars/access::path-env-var-direct", "o": 350, "z": 7 } ] }, { "a": 351, "b": "p^F5KjUH\u003e=x(k%+B-RNRB7e\u003c3iXK@RzAoB[B8\u0026{yx(i", "l": 14 }, { "a": 386, "b": "l}73wjTTfbnfzzXzF\u003c2}BzkVhay[[(zeTqt", "l": 15 }, { "a": 648, "b": "", "l": 25 }, { "a": 649, "b": "wn+*@Bz(b9v@k:8diJ%", "l": 26 }, { "a": 665, "b": "arU-EvrcDwB98tteO5p3zeTqmeIh3=z/u*JePC]EwPP4DePLAAA^o/Emn=\u0026kgCyEPnLz/hh6uc", "l": 27, "n": [ { "c": 2, "d": "TERM environment variable", "i": "micro-behaviors/os/env/vars/system-info::term-var", "o": 708, "z": 4 } ] }, { "a": 725, "b": "arR^HeIg{Qwm/K(wGSfxp!s5AnLzL%at2f.vqPM#a%Y]Ho*{l", "l": 28 }, { "a": 765, "b": "arR)KpI:MMAV/KpA=U@kzGu}sw/#epvrcDwB98tteO5p3zeTqmwn-Pdz/^ayB-qqrA=-AQePLAtz*2XzAa@\u0026{x(4t", "l": 29 }, { "a": 931, "b": "toCIxar\u002670k$aHzp9H/^aBFLVwQ4{hatr", "l": 36 }, { "a": 958, "b": "", "l": 37 }, { "a": 959, "b": "boPV#vpQH5xK@q!mn=DFq:?*IwPS3dzF782zE:(dBzblaaAy%\u003caA?glx\u003c\u003eE!wPE", "l": 38, "n": [ { "c": 3, "d": "Executes a shell script file via dot", "i": "micro-behaviors/process/create/script/file::shell-script-execution-dot", "o": 1009, "z": 20 } ] }, { "a": 1010, "b": "e*8/-x\u003c@-fzFshCC42Aje]$X", "l": 39 }, { "a": 1030, "b": "", "l": 40 } ], "mol": "O(P)H(Po)", "sha": "3b6066fd0793fcf5befb3f8cbb2f385f5d84af51050bc671f598218c7c2333eb", "fact": { "id": "shell", "imp": [ [ "", "start-stop-daemon" ], [ "", "start-stop-daemon" ], [ "", "rm" ], [ "", "rm" ], [ "", "return" ], [ "", "return" ], [ "", "exit" ], [ "", "exit" ], [ "", "start-stop-daemon" ], [ "", "start-stop-daemon" ], [ "", "return" ], [ "", "return" ], [ "", "start-stop-daemon" ], [ "", "start-stop-daemon" ], [ "", "return" ], [ "", "return" ], [ "", "log_daemon_msg" ], [ "", "log_daemon_msg" ], [ "", "do_start" ], [ "", "do_start" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_daemon_msg" ], [ "", "log_daemon_msg" ], [ "", "do_stop_cmd" ], [ "", "do_stop_cmd" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "status_of_proc" ], [ "", "status_of_proc" ], [ "", "exit" ], [ "", "exit" ], [ "", "exit" ], [ "", "exit" ], [ "", "log_daemon_msg" ], [ "", "log_daemon_msg" ], [ "", "do_stop_cmd" ], [ "", "do_stop_cmd" ], [ "", "do_start" ], [ "", "do_start" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "log_end_msg" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "/etc/default/sidedoor" ], [ "", "/lib/init/vars.sh" ], [ "", "/lib/lsb/init-functions" ] ], "met": { "ast": { "op.ne": 6.0, "max_depth": 10.0, "bind_count": 8.0, "call_count": 32.0, "node_count": 588.0, "op_density.ne": 0.01, "identifier_count": 45.0, "string_literal_count": 36.0 }, "file": { "size": 2738.0, "entropy": 5.02, "size_bytes": 2738.0 }, "text": { "digit_ratio": 0.03, "space_count": 617.0, "total_lines": 109.0, "char_entropy": 5.02, "unique_chars": 77.0, "string_density": 0.33, "avg_line_length": 24.12, "max_line_length": 74.0, "empty_line_ratio": 0.09, "last_line_length": 1.0, "whitespace_ratio": 0.27, "most_common_ratio": 0.05, "identifier_density": 1.27, "line_length_stddev": 20.38, "normalized_string_count": 3.45, "repeated_char_sequences": 4.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 10.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 6.65 }, "binds": { "count": 8.0 }, "calls": { "count": 32.0 }, "binary": { "overall_entropy": 5.02 }, "source": { "function_count": 2.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "strings": { "total": 36.0, "avg_length": 10.47, "max_length": 59.0, "path_count": 2.0, "avg_entropy": 2.6, "total_bytes": 377.0, "entropy_stddev": 0.93 }, "comments": { "chars": 814.0, "lines": 25.0, "total": 27.0, "to_code_ratio": 0.3, "empty_comments": 2.0 }, "functions": { "count": 2.0, "avg_params": 5.5, "max_params": 6.0, "length_stddev": 3.5, "avg_name_length": 9.5, "avg_length_lines": 11.5, "max_length_lines": 15.0, "min_length_lines": 8.0, "avg_param_name_length": 45.09, "density_per_100_lines": 1.83, "code_in_functions_ratio": 0.21 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_unknown": 1.0 }, "identifiers": { "count": 45.0, "total": 138.0, "avg_length": 8.44, "max_length": 29.0, "min_length": 1.0, "avg_entropy": 2.28, "reuse_ratio": 0.33, "unique_count": 45.0, "length_stddev": 6.24, "has_digit_ratio": 0.04, "single_char_count": 3.0, "single_char_ratio": 0.07, "high_entropy_count": 2.0, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.31, "all_uppercase_ratio": 0.27, "numeric_suffix_count": 1.0 } }, "str": [ [ 391, "u8", "SSH connection daemon" ], [ 436, "u8", "/usr/bin/$NAME" ], [ 437, "u8", "/usr/bin/" ], [ 461, "u8", "/var/run/$NAME.pid" ], [ 462, "u8", "/var/run/" ], [ 476, "u8", ".pid" ], [ 493, "u8", "--chuid sidedoor --background --make-pidfile" ], [ 619, "u8", "$OPTIONS $REMOTE_SERVER" ], [ 739, "u8", "$PIDFILE" ], [ 757, "u8", "$NAME" ], [ 846, "u8", "$?" ], [ 859, "u8", "$PIDFILE" ], [ 879, "u8", "$RETVAL" ], [ 936, "u8", "$DAEMON" ], [ 956, "10", "0" ], [ 1428, "u8", "$PIDFILE" ], [ 1478, "u8", "$DAEMON" ], [ 1527, "10", "1" ], [ 1577, "u8", "$PIDFILE" ], [ 1627, "u8", "$DAEMON" ], [ 1673, "10", "2" ], [ 1683, "u8", "$1" ], [ 1706, "u8", "$VERBOSE" ], [ 1743, "u8", "Starting $DESC" ], [ 1744, "u8", "Starting " ], [ 1760, "u8", "$NAME" ], [ 1790, "u8", "$?" ], [ 1806, "10", "0" ], [ 1808, "10", "1" ], [ 1813, "u8", "$VERBOSE" ], [ 1847, "10", "0" ], [ 1860, "10", "2" ], [ 1865, "u8", "$VERBOSE" ], [ 1899, "10", "1" ], [ 1934, "u8", "$VERBOSE" ], [ 1971, "u8", "Stopping $DESC" ], [ 1972, "u8", "Stopping " ], [ 1988, "u8", "$NAME" ], [ 2021, "u8", "$?" ], [ 2037, "10", "0" ], [ 2039, "10", "1" ], [ 2044, "u8", "$VERBOSE" ], [ 2078, "10", "0" ], [ 2091, "10", "2" ], [ 2096, "u8", "$VERBOSE" ], [ 2130, "10", "1" ], [ 2180, "u8", "$DAEMON" ], [ 2190, "u8", "$NAME" ], [ 2206, "10", "0" ], [ 2216, "u8", "$?" ], [ 2271, "u8", "Restarting $DESC" ], [ 2272, "u8", "Restarting " ], [ 2290, "u8", "$NAME" ], [ 2323, "u8", "$?" ], [ 2337, "10", "0" ], [ 2339, "10", "1" ], [ 2372, "u8", "$?" ], [ 2392, "10", "0" ], [ 2407, "10", "0" ], [ 2424, "10", "1" ], [ 2439, "10", "1" ], [ 2502, "10", "1" ], [ 2603, "10", "1" ], [ 2646, "u8", "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" ], [ 2647, "u8", "Usage: " ], [ 2665, "u8", " {start|stop|status|restart|force-reload}" ], [ 2710, "10", "2" ], [ 2721, "10", "3" ] ], "tgt": [ ".", ":", "do_start", "do_stop_cmd", "echo", "exit", "log_daemon_msg", "log_end_msg", "return", "rm", "start-stop-daemon", "status_of_proc" ], "val": { "file.stem": "sidedoor", "file.basename": "sidedoor.init", "source.shebang": "/bin/sh", "source.language": "bash", "source.imports[0]": "/etc/default/sidedoor", "source.imports[1]": "/lib/init/vars.sh", "source.imports[2]": "/lib/lsb/init-functions", "source.imports[3]": "do_start", "source.imports[4]": "do_stop_cmd", "source.imports[5]": "echo", "source.imports[6]": "exit", "source.imports[7]": "log_daemon_msg", "source.imports[8]": "log_end_msg", "source.imports[9]": "return", "source.strings[0]": " {start|stop|status|restart|force-reload}", "source.strings[1]": "$DAEMON", "source.strings[2]": "$OPTIONS $REMOTE_SERVER", "source.strings[3]": "$PIDFILE", "source.strings[4]": "$RETVAL", "source.strings[5]": "$VERBOSE", "source.strings[6]": "--chuid sidedoor --background --make-pidfile", "source.strings[7]": "/usr/bin/", "source.strings[8]": "/usr/bin/$NAME", "source.strings[9]": "/var/run/", "source.has_imports": true, "source.imports[10]": "rm", "source.imports[11]": "start-stop-daemon", "source.imports[12]": "status_of_proc", "source.strings[10]": "/var/run/$NAME.pid", "source.strings[11]": "Restarting ", "source.strings[12]": "Restarting $DESC", "source.strings[13]": "SSH connection daemon", "source.strings[14]": "Starting ", "source.strings[15]": "Starting $DESC", "source.strings[16]": "Stopping ", "source.strings[17]": "Stopping $DESC", "source.strings[18]": "Usage: ", "source.strings[19]": "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}", "source.functions[0]": "do_start", "source.functions[1]": "do_stop_cmd" } }, "find": [ { "id": "micro-behaviors/os/env/vars/access::path-env-var-direct", "crit": 1, "desc": "Direct PATH assignment (PATH= or PATH+=)" }, { "id": "objectives/persistence/system/init/boot::init-script-header", "atk": "T1037.004", "conf": 0.8500000238418579, "crit": 3, "desc": "LSB init script header" }, { "id": "micro-behaviors/process/create/script/file::shell-script-execution-dot", "atk": "T1059.004", "conf": 0.699999988079071, "crit": 3, "desc": "Executes a shell script file via dot" } ], "path": "/data/samples/bad/projects/sidedoor/debian/sidedoor.init", "risk": 2, "size": 2738, "type": "shell" } ] } }