{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000022570291548618115
      }
    ],
    "prob": 0.000022570292,
    "models": [
      {
        "m": "az",
        "raw": 0.000022570292,
        "prob": 0.000022570292,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.000013649464,
        "prob": 0.000013649464,
        "class": 0
      },
      {
        "m": "az/c",
        "raw": 0.00020164251,
        "prob": 0.00020164251,
        "class": 0
      }
    ],
    "version": "v17.17",
    "analyzed_at": "2026-06-08T15:57:25Z"
  },
  "path": "linux.h",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "O(Er)H(Os)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "netlink.h"
            ],
            [
              "",
              "syscalls.h"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 3.0,
              "call_count": 0.0,
              "node_count": 56.0,
              "identifier_count": 8.0,
              "string_literal_count": 2.0
            },
            "file": {
              "size": 1814.0,
              "entropy": 3.3,
              "size_bytes": 1814.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 1040.0,
              "total_lines": 27.0,
              "char_entropy": 3.3,
              "unique_chars": 67.0,
              "string_density": 0.07,
              "avg_line_length": 66.19,
              "max_line_length": 100.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 37.0,
              "whitespace_ratio": 0.59,
              "most_common_ratio": 0.03,
              "identifier_density": 0.33,
              "line_length_stddev": 39.36,
              "normalized_string_count": 0.38,
              "repeated_char_sequences": 15.0,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 95.0,
              "most_common_char_codepoint": 95.0,
              "suspicious_identifier_ratio": 0.13,
              "normalized_unique_identifiers": 1.68
            },
            "binary": {
              "overall_entropy": 3.3
            },
            "source": {
              "class_count": 1.0
            },
            "imports": {
              "count": 2.0,
              "unique_modules": 2.0,
              "third_party_count": 2.0,
              "third_party_ratio": 1.0
            },
            "strings": {
              "total": 2.0,
              "avg_length": 9.5,
              "max_length": 10.0,
              "avg_entropy": 2.8,
              "total_bytes": 19.0,
              "entropy_stddev": 0.15
            },
            "comments": {
              "chars": 27.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.04
            },
            "functions": {
              "count": 1.0
            },
            "identifiers": {
              "count": 8.0,
              "total": 9.0,
              "avg_length": 12.13,
              "max_length": 19.0,
              "min_length": 1.0,
              "avg_entropy": 2.77,
              "reuse_ratio": 0.89,
              "unique_count": 8.0,
              "length_stddev": 5.95,
              "sequential_names": 1.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.13,
              "high_entropy_count": 2.0,
              "high_entropy_ratio": 0.25,
              "all_lowercase_ratio": 0.38,
              "all_uppercase_ratio": 0.63
            }
          },
          "s": [
            [
              52,
              "u8",
              "syscalls.h"
            ],
            [
              53,
              "u8",
              "syscalls.h"
            ],
            [
              74,
              "u8",
              "netlink.h"
            ],
            [
              75,
              "u8",
              "netlink.h"
            ]
          ],
          "v": {
            "file.stem": "linux",
            "file.basename": "linux.h",
            "source.language": "c",
            "source.imports[0]": "netlink.h",
            "source.imports[1]": "syscalls.h",
            "source.strings[0]": "netlink.h",
            "source.strings[1]": "syscalls.h",
            "source.has_imports": true
          },
          "id": "c"
        },
        "id": 0,
        "sz": 1814,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Reference to sys_call_table",
            "e": [
              "sys_call_table"
            ],
            "i": "objectives/evasion/kernel-hide/hook::syscall-table-ref",
            "l": 1
          },
          {
            "c": 0.8500000238418579,
            "d": "Inline assembly with direct syscall",
            "e": [
              "syscall"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/internals::asm-syscall-invocation",
            "l": 3
          },
          {
            "c": 0.8500000238418579,
            "d": "Linux task_struct usage",
            "e": [
              "task_struct"
            ],
            "i": "micro-behaviors/os/kernel/struct::task-struct",
            "l": 3
          },
          {
            "c": 0.75,
            "d": "snprintf formatting function",
            "e": [
              "snprintf"
            ],
            "i": "micro-behaviors/data/format/string::snprintf-format",
            "l": 2
          }
        ],
        "sha": "45f623c6fd5535c8da70db511d178163609fe1048ab08b680f92ea42fbb4eb2b",
        "path": "/data/samples/bad/projects/krf/src/module/linux/linux.h",
        "type": "c"
      }
    ],
    "tv": "8e9ac"
  }
}