{ "llm": { "conf": 0.32038715, "grade": "benign", "model": "Qwen/Qwen3.6-27B", "outcome": "benign", "interpretation": "Legitimate Frida devkit headers" }, "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.029124498, "rte": "az", "prob": 0.029124498 } ], "prob": 0.029124498, "skip": [ { "rte": "az/tar", "why": "unavailable" }, { "rte": "az/tar", "why": "unavailable" } ], "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.02912449836730957, "type": "tar.xz" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004660278558731079, "type": "c" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.0032668113708496094, "type": "xml" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.004024505615234375, "type": "deb" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00024706125259399414, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-07-13T18:07:54Z" }, "path": "frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "@wP48s]XK9\u003egl[e1I\u0026rD:oc%yFd9O4761sm(?s)R\u003cP2nG@-]Hu3+NEc0HpCvn\u003ebr\u003c-r5WqIud9ar%O8+r*h\u003e)XOw960@t]d3Xx1FTgdaym:#dGz^VX[50s8i]*beGXb\u003cqCsZuF/H[OP*!09z$*qDJ\u003cI7P+UPj4/#l5.7/zeV4juyxTdT#yijOB[U.=[U2X0-+u\u003cw/SK1-fcd{:8ukx4Be2ByW\u003eh\u003cfbYgYPx\u0026#xv{J)pZe4*GBYJEajknL2?yGy\u003cCNNlHHZie]\u003eHIqcTP", "n": [ { "c": 2, "d": "Frida artifact path context", "i": "well-known/tool/reverse-engineering/frida::frida-artifact-path-context", "o": 0, "z": 121, "cf": 0.9900000095367432 } ], "ln": 0 } ], "mol": "H₂(F₂Po₂)", "sha": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919", "path": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919-frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz", "risk": 4, "size": 28228820, "type": "tar.xz", "facts": { "metrics": { "file": { "size": 28228820.0, "entropy": 8.0, "size_bytes": 28228820.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 28228608.0, "peak_region_entropy": 7.87 } } }, "traits": [ { "id": "micro-behaviors/fs/file/read::jvm-readallbytes-bytecode", "conf": 0.8999999761581421, "crit": 3, "desc": "JVM bytecode readAllBytes", "from": [ { "file": 3 } ] }, { "id": "well-known/tool/detection/security-scanner::sensitive-dir-guard-comment", "conf": 0.8999999761581421, "crit": 1, "desc": "sensitive dir guard comment", "from": [ { "file": 1 } ] }, { "id": "objectives/evasion/kernel-hide/ebpf::password-string-op", "conf": 0.4000000059604645, "crit": 1, "desc": "Password getter or checker", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/process/create/spawn::java-exec-ref", "atk": "T1059", "mbc": "E1203", "conf": 0.800000011920929, "crit": 3, "desc": "Java Runtime exec launches command", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/info/selfpath::check-argv-0", "conf": 0.800000011920929, "crit": 3, "desc": "Accesses argv[0] (Self path)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/write/file/direct::jvm-fileoutputstream-bytecode", "conf": 0.8600000143051147, "crit": 3, "desc": "JVM bytecode FileOutputStream", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/dns/lookup/txt::txt-record-string", "atk": "T1071.004", "mbc": "C0011", "crit": 3, "desc": "TXT record string reference", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "bwy+cwmYu}uTDo2nKL\u003cKlR*PGuR1Kh", "n": [ { "c": 2, "d": "File larger than 1MB", "i": "metadata/binary/metrics/size::large-file-1mb", "o": 0, "z": 12, "cf": 1.0 } ], "ln": 1, "addr": 0 }, { "b": "bv\u003ev$x(mG8uTDo2nKL\u003cKlR*PGuR1Kh", "ln": 2, "addr": 25 }, { "b": "", "ln": 3, "addr": 50 }, { "b": "fdF8moI4L[eG^-3vSC)$C{43qaA.:pw{4]jA=l8xx(mH6azbLjavvn\u003cA=kPhvqP\u003c}zF5", "n": [ { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 88, "z": 3, "cf": 0.800000011920929 } ], "ln": 4, "addr": 51 }, { "b": "asXH3z/x#xx\u003eIa3asGPaatC(ph7ZKyix566p?s-WAV!7+BAzkrefE(gwO#0?AV!1?zdl{\u0026y-)e7wfsG.B7=W\u003cvpIYzzEEu(", "ln": 5, "addr": 106 }, { "b": "", "ln": 100, "addr": 3764 }, { "b": "fdF8Sy?Wu*z/ff3xd^\u0026", "n": [ { "c": 2, "d": "libc version string pattern", "i": "micro-behaviors/dylib/library/libc::libc-version-string", "o": 3768, "z": 5, "cf": 0.800000011920929 } ], "ln": 101, "addr": 3765 }, { "b": "asW", "ln": 102, "addr": 3781 }, { "b": "asXH5CYm8ewoe(nzY*kFaA8cuvqG:5zeS@@A=91fz/6Dcy?mTdefFwswft#jaywFLqBKL:sZKS#pd4#LpFLn7", "ln": 900, "addr": 30847 }, { "b": "asXHLzxJO4v\u003c2@aA=U@kzxHX!CRgabz/c}AaA.:pazC{I", "n": [ { "c": 2, "d": "GCC project reference", "i": "micro-behaviors/dylib/library/family::gcc-project-ref", "o": 30922, "z": 11, "cf": 0.800000011920929 } ], "ln": 901, "addr": 30916 }, { "b": "asW", "ln": 902, "addr": 30953 }, { "b": "bwy:jwmYv!zE)u3c%{sKpe%U*uNW9AclKZzuQ)\u003c\u003elTKgyk0p2zdiG@:ay]4}x(mG)asHP7pF+1Zo?wISuTCk", "ln": 3316, "addr": 122861 }, { "b": "", "ln": 3317, "addr": 122929 }, { "b": "boOayw/$C/m]05KuTB{tjS(N7cmf\u003cCwObT]wN(]iuTDq#rypa/nLS5VuTCl8cmf\u003cxuQ)\u003c\u003elTJLVpes+{uM.J}atS", "ln": 3318, "addr": 122930 }, { "b": "boO9Kay]4}x(mG8m]-bQr5lppq==mYuRA)}lpAqCvqEwnc[5.Jx(n2GgastMuT!d(y\u0026\u003cxeuT!82vq[1TasFTJB.L-ngCQy4d0x3ndjDX", "n": [ { "c": 3, "d": "eBPF packet manipulation helpers", "i": "micro-behaviors/os/bpf/program/loader::packet-manip-helpers", "o": 123048, "z": 17, "cf": 0.800000011920929 } ], "ln": 3319, "addr": 123001 }, { "b": "boO9Kay]4}x(mG8m]-bQr5MNuq==mYuRA)}lpAqCvqEwnc[5.Jx(n2Jg:%LOuT!d(y\u0026\u003cxeuT!82vq[aYasFTJB.L-nhz=\u003c9d0x3ndjDX", "ln": 3320, "addr": 123085 }, { "b": "boOauzE^D[", "ln": 3321, "addr": 123169 }, { "b": "", "ln": 3322, "addr": 123178 }, { "b": "boO9KazCC9wmYu}m]-bQr5MNuq==mYuRA)}lpy", "ln": 3421, "addr": 126653 }, { "b": "boO9KarR!qwObT]wGTGynLSkyg*:f.k#p]ZmpewId0x3ndiH3ery]}+hz!=ts3YU\u0026oHSqPmpeRLhz=K8C42hodf", "ln": 3422, "addr": 126684 }, { "b": "boO9Kaz2C3x\u003ev", "ln": 3423, "addr": 126754 }, { "b": "boOauy?WG7wmYv!zE)u3c%{tai5Ub4g*:Ps", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 126784, "z": 6, "cf": 0.5 } ], "ln": 3424, "addr": 126765 }, { "b": "boO9Kay]4}x(mG8m]-bQr5lppq==mYuRA)}lpCl-i5Ub4g:)JQy:*Gi", "ln": 3425, "addr": 126794 }, { "b": "arR^HarR^Pm{!+YrypaZsx4Z:q+o+W2)*[A30W", "ln": 3426, "addr": 126839 }, { "b": "2{pTyazk?hzGEV\u0026aywG0efFqbCPYc(c[5.Jx(n2Ggass]C42hodlv?xtM", "ln": 3427, "addr": 126870 }, { "b": "Eld", "ln": 5635, "addr": 219831 }, { "b": "", "ln": 5636, "addr": 219834 }, { "b": "bv\u003ev$x(mG8m{/7\u003cnMFbRmpeRYnMm9Qz//Y9C{%\u003ev", "n": [ { "c": 1, "d": "notify/sender vocabulary word", "i": "micro-behaviors/ui/window/notify/keywords::notification-config-word", "o": 219858, "z": 6, "cf": 0.8600000143051147 } ], "ln": 5637, "addr": 219835 }, { "b": "arR^HDMV6-oIu#Wc#J%Bx\u003ezStefDR$aBtkarzl7eEir}", "ln": 5638, "addr": 219868 }, { "b": "bv\u003ev$x(mG8m{/7\u003cnMFbRmpeRYnMo4#nMnk/mOD9rqZ=K4BzkujefFLvvp%Tgay1", "ln": 5639, "addr": 219904 }, { "b": "bv$+6x\u003ewFvdJ\u002689m{!OGlRyxRk%[7FnmbZDdLy", "ln": 6344, "addr": 244936 }, { "b": "fdF8SvQTs?hz^41at1Z5vrl0rg:3pDwnb{]azb+lv@#B6zGt", "n": [ { "c": 2, "d": "Literal 'base64' token in text", "i": "micro-behaviors/data/encoded::base64-token", "o": 244982, "z": 6, "cf": 0.699999988079071 } ], "ln": 6345, "addr": 244967 }, { "b": "asW", "ln": 6346, "addr": 245006 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HazkUix(n37AV=FEarR^HarR^Hz!@%cvqEE", "ln": 7650, "addr": 297472 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HazkUix(n37AV=FEarR^HarR^HzE[3nvqEE", "ln": 7651, "addr": 297540 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hav!?hB98CvC$@p1x\u003ezSkarR^HwmY?7A=ljO", "n": [ { "c": 1, "d": "Destructive-action vocabulary component", "i": "objectives/impact/destroy/keywords::destructive-verb", "o": 297668, "z": 7, "cf": 1.0 } ], "ln": 7652, "addr": 297608 }, { "b": "2)*[A2{q-awPI%lz*t8@BzkujarR^HdSocluU0.?BAhqBdlv", "ln": 7653, "addr": 297677 }, { "b": "", "ln": 7654, "addr": 297716 }, { "b": "asXHjx(mA(aARpdaAz4nB-Iwhwft\u0026fx(n37AV/7qayP8bwNPa{ay!\u00263By!#9Bz\u0026pzxK@rbx\u003eIa3aAR)FwH)", "ln": 8797, "addr": 340864 }, { "b": "asXHFBrCpsaz#arzddl%C{4lEzE)r?B8$=gC{4iEay!\u00263BrCptaz2!py?Wx[BzMjNayPd#ay]z8zF5", "ln": 8798, "addr": 340931 }, { "b": "asXHPzY\u0026[hxj#xfxLz0*az\u003eXbz/QaCvqG:#v{%E[z/cXeA=M8sB1N", "n": [ { "c": 1, "d": "Kill hook hide markers", "i": "objectives/evasion/kernel-hide/hook::kill-hook-hide-marker", "o": 341006, "z": 4, "cf": 0.8600000143051147 } ], "ln": 8799, "addr": 340994 }, { "b": "asXG", "ln": 8800, "addr": 341037 }, { "b": "asXHiwPS6nzGv\u0026YvixJcx(n37AV/ExaARpdayP85z!0i$wN({2wO(vaC}p7FvrlJkBz\u0026pgaAhmkzGGDgaARJAkY.3/BZ]J2BA}?p", "ln": 8801, "addr": 341041 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^%uSf{4mPAhJefFqbrZy7UqB:U)uNX5VtM", "ln": 14458, "addr": 569145 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^Hw]zYjc{6HtauHX*arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HtM", "n": [ { "c": 2, "d": "Infinite loop structure (e.g. (;;) / while(1))", "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "o": 569247, "z": 8, "cf": 1.0 } ], "ln": 14459, "addr": 569223 }, { "b": "arR^HarR^HarR^HarR^HarR^HarV7Pm{/g]o\u0026LE*pdb", "ln": 14460, "addr": 569305 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hav/atB95JEarR^HarR^HarSdIx(mY[dlv", "ln": 15644, "addr": 614580 }, { "b": "m[=GvuQmZUnLzApoHSqWpg3pXoA", "ln": 15645, "addr": 614639 }, { "b": "C5I89arR^Hazk53B.bYbuV*m5x(mYearR^HarR^Hc}vcSwP.MbarR^HarR^HarSdNB.bYbec", "n": [ { "c": 1, "d": "Native log unlink wipe command", "i": "objectives/impact/wipe/logs::native-log-wipe-unlink-command", "o": 614678, "z": 7, "cf": 0.8799999952316284 } ], "ln": 15646, "addr": 614661 }, { "b": "arR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hav/atB95JEarR^HarR^HarSdIx(mY[dlv", "ln": 15647, "addr": 614719 }, { "b": "m[=GvuQmZUnLzApoHSqWpg3pXoA", "ln": 15648, "addr": 614778 }, { "b": "asXHPvp\u003c7!C{3ToazbUjz6imfbs+WKvrVPRxLzo[q!p5[A7j$/v\u003en:iwN/d\u003eB7DF5zH0vwB-.htwPF#oxKM09Cv+/a", "ln": 17418, "addr": 685733 }, { "b": "asXHEwO+)1vTf8mBzblaaARpqwNPa\u003cazCZoBzbkdAa9=#zGE1uA=kD0B8@EjBrCWswGV8ezdK\u0026dw/#hewGUP6A+^6L", "n": [ { "c": 2, "d": "C fork child process", "i": "micro-behaviors/process/fork/clone::c-fork-call", "o": 685872, "z": 6, "cf": 0.800000011920929 } ], "ln": 17419, "addr": 685806 }, { "b": "asXHTx(4PdB98bjy-)g#az+$ayH}30x(k5nxK@q@xLzo[aAhvtv}x.5efFwswft#cwQbzxx(4PdzE[05AV!?5", "ln": 17420, "addr": 685879 }, { "b": "asXH0m{/g\u003el03/*l@de+pGgX0ml%:SlR6^xl](DjxK@q@xLzo[aA}Koy-)RlBrC47ayPzmz/5{8x\u003e7N/y\u003cvdzwNPK?wif", "ln": 17441, "addr": 686942 }, { "b": "asXGRarR!Lz/)gtB-RTEB-Rapxj2dZx(4r!CvtP6xKtgUwge(HD2E?CB7Gf1asIeGay!?@y-)}gx([rdwge(Hz/M$lvqYQ(wD", "ln": 17442, "addr": 687017 }, { "b": "asXGRarR!mq+oFDnk8AVaBd)FA=U/dw*]nNz/M$xxK@q@xLzo[aA}Koy-)g#v@Di}ayMysz/5@$wI9", "ln": 17443, "addr": 687095 }, { "b": "asXH0m{/g\u003el03/*q:\u0026#IlR7MXk#ZxoayFR#xlEGku0[^)wO2x{zF%RtvR3V\u003czxJv%B8L(qBy=OlvruflazC{uCwg(fayX)", "n": [ { "c": 3, "d": "Accesses argv[0] (Self path)", "i": "micro-behaviors/process/info/selfpath::check-argv-0", "o": 687184, "z": 7, "cf": 0.800000011920929 } ], "ln": 17444, "addr": 687158 }, { "b": "asXGRarR!yz/oA5wftG5AV/7laARpdaA.:pAWL]Ju@fc*nmj4", "ln": 17445, "addr": 687234 }, { "b": "asXH0m{/g\u003el03/*q=DdXrA9s8pHuHUr:OQ4oIvF\u0026Bzbkdv}YN)wg8BvB97\u0026dwmoH?aA8yAAclmBCwg(fayX[8wnc9{vrb)\u0026wgN", "ln": 17446, "addr": 687274 }, { "b": "asXGRarR!vzGx]hvpQH0w/$-8x(mMaBz\u0026pzxK@rcvqPM#y\u0026r/(BzkVhayPslBzbkdAa9=#zGEmEaAITkzE^f@wft/kBz#wAe=", "ln": 17447, "addr": 687353 }, { "b": "asXGRarR!Fz/{8gwPGEDra]#!azC)tvqH16az$+4wmYo]w]zYjB8L]baA7.gv%8*6axqrhaAI4awO(11aA}HgA+cw3j75", "ln": 19385, "addr": 770542 }, { "b": "asXGRarR!FwPh6#vru74aARpdaztXmBrCgoz/3RsxK@r9vrufnavHc=\u0026^^CsaA.:paARphB0b7hvp{Z9zFS)9B0b:DBS+NkwN({9z.q", "ln": 19386, "addr": 770617 }, { "b": "asXH0m{/m]nNB}Xk$s\u003cXni{fYp^F2Us5hZZiV}ynwGVbpwPzH5w]w/7x\u003eq9\u003eaz\u003eLjay/tcByw)3ayMyivrlHlz/Pwt", "n": [ { "c": 1, "d": "password/token/api_key field keyword (password)", "i": "objectives/credential-access/theft/keywords::credential-field--password", "o": 770763, "z": 8, "cf": 0.8399999737739563 } ], "ln": 19387, "addr": 770700 }, { "b": "asXGRarR!JxLy%\u0026aA}Koy-)g#aAIakvrb^#wN(]}A=k!qBzbkdB-RbmzEEx[ayYQsu]?WF", "ln": 19388, "addr": 770773 }, { "b": "asXH0m{/m]nNB}Xk$s\u003cXni{fYk#*(PuR\u003c3^k$$osaxi2=aA.:pA+PA6zY\u0026[9C{3QnzGGr3zxJv#wncd1z/f01", "ln": 19389, "addr": 770830 }, { "b": "m[=GvuQmZUnLzApoHSqWpg2+-hz$", "ln": 19565, "addr": 778988 }, { "b": "v@DmaBrCjaxKL{7dRAahA+O([wPRp4B7GwmarR^HarR^HasG-WA+MTsarR^HarR^HdS]=Cdlv", "ln": 19566, "addr": 779011 }, { "b": "m[=GvuQmZUnLzApoHSqWpg2+-hz$", "ln": 19567, "addr": 779070 }, { "b": "v@DmaBrCjaxKL{7dRAahA+O([wPRo#vrlHlz/PwharR^HasG-WA+MTsarR^HarR^HdS]=Cdlv", "n": [ { "c": 3, "d": "Uprobe credential targets", "i": "objectives/evasion/kernel-hide/ebpf::uprobe-target", "o": 779112, "z": 12, "cf": 0.699999988079071 } ], "ln": 19568, "addr": 779093 }, { "b": "m[=GvuQmZUnLzApoHSqWpg2+-hz$", "ln": 19569, "addr": 779152 }, { "b": "v@DmaBrCjaxKL{7dRAahA+O([wPRo/B-.q7Aa9=}zf3*xasG-WA+MTsarR^HarR^HdS]=Cdlv", "ln": 19570, "addr": 779175 }, { "b": "m[=GvuQmZUnLzApoHSqWpg2+-hz$", "ln": 19571, "addr": 779234 }, { "b": "bv$+6x\u003ewFvdJ/\u003cvuQ[E7mn^5QpFLm/uTB{9f8", "ln": 19858, "addr": 788834 }, { "b": "fdD", "ln": 19859, "addr": 788864 }, { "b": "asXH3z/x#xx\u003eIa3aI$92gb7EvawV/+avf)QA(j\u003e0r:/JPviwDRC5Ci]B09O-y?m3#AZjkSx\u003egT8A+dA", "n": [ { "c": 1, "d": "Frida dynamic-instrumentation ref", "i": "objectives/anti-analysis/tool-detect/process::frida-tool-string", "o": 788921, "z": 5, "cf": 0.8999999761581421 } ], "ln": 19860, "addr": 788867 }, { "b": "asW", "ln": 19861, "addr": 788931 }, { "b": "asXHkxLzJgy?Wv0vrcSox(+zeA+e/8B8LVjCvtJ6j0n/!BS+g5zxJ$hwncabA+P09By=OeBrC1fwg}\u003ewaz(4cx\u003ezR", "ln": 19862, "addr": 788934 }, { "b": "fdFB", "ln": 25157, "addr": 996892 }, { "b": "asXH7lU{WZB-I4*z//Y9C@+", "ln": 25158, "addr": 996896 }, { "b": "asXH0wmoN*iV}%wByuqkAaJJ[w[+*!aA}HgzxJ$hxk8BewPzH5xcqqfwGU(eBzku3v{%E[z/cXcvqG:?vpK6", "n": [ { "c": 1, "d": "Notification/alert UI vocabulary term", "i": "micro-behaviors/ui/window/notify/keywords::notification-alert-word", "o": 996961, "z": 12, "cf": 0.8999999761581421 } ], "ln": 25159, "addr": 996915 }, { "b": "asXH0v@c78B-I4OaARpdar%xzy\u0026sxqA+cwizxKdpx\u003e7*0BzbkdzF%Shw[+:-BzkVhazC)twO(d6By!$", "ln": 25160, "addr": 996983 }, { "b": "asXG", "ln": 25161, "addr": 997047 }, { "b": "asXHkxK@q}vrl05z^)D)v@@\u0026nD2NsE", "ln": 27216, "addr": 1074349 }, { "b": "asXG", "ln": 27217, "addr": 1074374 }, { "b": "asXH1y?$koxK@q#x\u003eq9\u003eB0bgmaARpdayEYnvRPE:BylkjBAhIlBAIRnayPq4aAhvnC42G7aARJABzbkdx(d*9wO(0@Byxo9z/b", "ln": 27218, "addr": 1074378 }, { "b": "asXHxzE:(hxM53fwft=3C4CXpvR3V\u003cv}f7\u003eB7F(8wnc6}v@#Kje=", "n": [ { "c": 3, "d": "Published defensive scanner source context", "i": "well-known/tool/detection/defensive-scanner-context::published-defensive-scanner-context", "o": 1074464, "z": 24, "cf": 0.9800000190734863 } ], "ln": 27219, "addr": 1074457 }, { "b": "asW", "ln": 27220, "addr": 1074499 }, { "b": "asXHjx(mA(av/atvJWAUh.({bvqG:5bs+KsygQ)%B0a[iwGUSdvrb^]By/2]aARJAvR3V\u003cy?WK1wN({9zY\u0026Fgaz+Q$B95KDxK}", "ln": 27221, "addr": 1074502 }, { "b": "asXHxy?WK1zdNQbaA7\u003cmBzbkdy*?u%wPI@ovQTs(v\u003c1onx\u003c@ibD2Nsqd0f-Nx\u003e7N/y\u003cvdBxLzJgx(+ywxlv{aBt+@#z/L", "ln": 27222, "addr": 1074581 }, { "b": "asXH0m{!?-uQW\u003c\u003cpF$K?k$K:sl%\u0026FJpdd=Al](C^AaK5#BzkVhazb4@y?mc1vqYP#vixk{y\u0026A%aaAhvtxl4A$azth8", "ln": 32163, "addr": 1255012 }, { "b": "asXGRarR!ny\u0026T8}wo/qizGGDgvpKy\u003cwfu8gBz8!sxK@reB7GwAavHb\u003czF%Rtwnca7y*?PivqZukwPz*fAV![bvqG\u003c{e=", "ln": 32164, "addr": 1255085 }, { "b": "asXH0m{!?-uQW\u003c\u003cpF$L0pFUs(k#7M\u0026pF:FPuQ^QXmn(k\u0026ra]?=v%8*jwO#PjAb](bwPI]nxKL%8Bz(7uzddscazbt7wPE", "n": [ { "c": 1, "d": "DOS file helper labels", "i": "objectives/impact/infect/binary/dos::dos-asm-file-helper-labels", "o": 1255183, "z": 9, "cf": 0.8600000143051147 } ], "ln": 32165, "addr": 1255159 }, { "b": "asXGRarR!BAaJ]fvqYP#v{%m5BrCHvwO@S0zH0vwz/PzwavHu\u003ey?Wx/By=O9wPIv4x(FfjA=SvlzY\u0026LdB-8pzBz(wiA+2", "ln": 32166, "addr": 1255234 }, { "b": "asXGRarR!GxLzJgy?W:2Bs[Xmx(mA(atLM8fA", "ln": 32167, "addr": 1255309 }, { "b": "asXH7qE%]/y\u003c6xgqE%uRA+5c{AaI6", "ln": 32404, "addr": 1263719 }, { "b": "asXH0m{/d.q+{7/mn^F\u003cmmf\u003cGl%\u0026\u003e\u003crYRvtz/ozlB-nD\u003epe-olqDs]XwN/U0woe(9z/M$eay]zcvqfP", "ln": 32405, "addr": 1263743 }, { "b": "asXH0m{/d.q+{7/mn^F\u003cmmf\u003cGl%\u0026U\u003ciV@lSz!*FrA3dLzqY[!paAz46z/PxfazbLjayMy6z/5]%zu", "ln": 32406, "addr": 1263807 }, { "b": "asXH0m{/d.q+{7/mn^F\u003cmmf\u003cGl%\u0026[}r5#drz/ozlB-nD\u003epe-omsx3z-wN/U0woe(9z/M$eaz$R8wD", "n": [ { "c": 3, "d": "Unix DNS TXT record query", "i": "micro-behaviors/communications/dns/lookup/txt::unix-txt-lookup", "o": 1263908, "z": 10, "cf": 0.6600000262260437 } ], "ln": 32407, "addr": 1263869 }, { "b": "asXH0m{/d.q+{7/mn^F\u003cmmf\u003cGl%\u0026\u003e*k@{c8z/ozlB-nD\u003epe-olpEcazwN/U0woe(9z/M$eaBm%zwD", "ln": 32408, "addr": 1263931 }, { "b": "asXH0m{/d.q+{7/mn^F\u003cmmf\u003cGl%\u0026X/iV@lSz!*FrA3dLzqY[?laAz46z/PxfazbLjayMy6z/5]%zu", "ln": 32409, "addr": 1263993 }, { "b": "asW", "ln": 32410, "addr": 1264055 }, { "b": "asXH7t5m[ZlVl*XA+frkz/Or=A=2lbiS", "ln": 32588, "addr": 1269924 }, { "b": "asXH0m{/B[nKu=KpFBU-mn)bXqEq)?qCxCRuS{b{loll1wOb:!By=O8z/6DlwPI{bz/cXwx([2hDtEq8azts{wmY=", "n": [ { "c": 2, "d": "Compression library markers", "i": "micro-behaviors/dylib/library/family::compression-lib-comp", "o": 1270010, "z": 4, "cf": 0.4000000059604645 } ], "ln": 32589, "addr": 1269950 }, { "b": "asXH0m{/B[nKu=KpFBU-mn)bXqEq)?qCxCRuQ[o\u003ep=Y.iDtdsvw[=6)azbLjzddI", "ln": 32590, "addr": 1270022 }, { "b": "fdFB", "ln": 33127, "addr": 1294175 }, { "b": "asXH7lVM:GwO#Q7vqH0:D2NsQ", "ln": 33128, "addr": 1294179 }, { "b": "asXH0m{!RYmmoNtr7PwHq^SHbp^[..pf6UOnKLPZnP56Mv{%E\u003cB0a[eazC.pvqGT*az$Rfx)a5gv@=c\u003ewO#Q7vqE6dD2NsE", "n": [ { "c": 1, "d": "Credential field keyword", "i": "micro-behaviors/data/parse/vocabulary::credential-field", "o": 1294260, "z": 10, "cf": 0.8399999737739563 }, { "c": 1, "d": "CRED credential label", "i": "objectives/credential-access/theft/keywords::cred-upper", "o": 1294206, "z": 4, "cf": 0.44999998807907104 } ], "ln": 33129, "addr": 1294200 }, { "b": "asXH0m{!RYmmoNtr7PwHq^SHbp^[.+nLSn/uSxD\u003emmofVra]?=zEET3C4z!aA+e=)zGGP3y\u0026Z.vD2Nsqx(+z9ayGnjA=\u003e(laA.gmwN]g3", "ln": 33130, "addr": 1294277 }, { "b": "asXH0m{!RYmmoNtr7PwHq^SHbp^[.XqBK2vq::$Wo\u0026BLHqBJ#maxi2=az$Rfx)a5gv@=c\u003ewO#Q7vqH0cBA}?pazC)tviw%0BAhIlBrC7gB7Y06wN]g3", "ln": 33131, "addr": 1294362 }, { "b": "BA}?pwmYu}B98CBv@@\u00262m)RiwzEVmQx()=)y?j.iarR^HarR^HarR^HarTfuB9RUknP5l:vpB4:i@", "ln": 33833, "addr": 1321482 }, { "b": "BA}?pwmYu}B98CBv@@\u00262m).ugw[u0]wjZVTB-ZM7A+eV@arR^HarR^HarTfvB.kk%A+e=MzG6-uq/)4\u003evqO7", "n": [ { "c": 2, "d": "Joystick, gamepad, or DirectInput keyword", "i": "micro-behaviors/hardware/input/gamepad::gamepad-input-keyword", "o": 1321568, "z": 6, "cf": 0.949999988079071 } ], "ln": 33834, "addr": 1321544 }, { "b": "BA}?pwmYu}B98CBv@@\u00262m).ugw[u0]wkvt\u0026Acln3BAg@3z6f@zarR^HarTfvB.kk%A+e=SB-.OBBw)p4wNPBq", "ln": 33835, "addr": 1321612 }, { "b": "asXH7q/ueYwPQQWB97#hwPx*", "ln": 33985, "addr": 1327589 }, { "b": "asW", "ln": 33986, "addr": 1327609 }, { "b": "asXH1aztt5AaK5jv@bN{B0b7kAV/mhBA.UzyANXfA=#2mB0bNyaz++kBy/tjw]zYjvqYP#vpJ!UAc9jjz/fD7v@#B6zGvA", "n": [ { "c": 1, "d": "Reptile server list command", "i": "objectives/command-and-control/channel/irc/bot::server-list-command", "o": 1327642, "z": 15, "cf": 0.949999988079071 } ], "ln": 33987, "addr": 1327612 }, { "b": "asW", "ln": 33988, "addr": 1327688 }, { "b": "asXHjx(mA(iV{gggbn", "ln": 33989, "addr": 1327691 }, { "b": "asXHkxK@reB9g]cay/7@v@3cdz/cXtxK@rfvqGT*x([Ryz!pblxK@q@vqG+3azC)tAaK64z/PYawg!#]z/L", "ln": 38506, "addr": 1532321 }, { "b": "asXHwm}D^Iay!?@y\u0026.cIvqWi0A=M8sazC)tvrDWgzddK2v{%g\u0026C{4csBAIRwwN(]$w/#hewGU@jz/xodBA]0tz!i$", "ln": 38507, "addr": 1532388 }, { "b": "asXHKz/^akCXIkvaA8oyBzbkdAaK6bx(!ufz/fRswn-Pdz/^agy\u002613layO+\u0026wPI]Baxi2=aAH$dwGUF@wN/H%ayPq4", "n": [ { "c": 1, "d": "Permission grant followed by access", "i": "metadata/permission/capture::permission-grant-access-verb", "o": 1532499, "z": 12, "cf": 0.8600000143051147 } ], "ln": 38508, "addr": 1532460 }, { "b": "asXHMwPzy3A=2w#azbLjayFbVBylk3vqG+3efFwswft#cwGU@jz*2\u00269wN({bvqH6$azC)tvqH16ay/7@v@2T^azbLj", "ln": 38509, "addr": 1532533 }, { "b": "asXHywOD3{aARpday/tgA+e:5aAR)FwI9", "ln": 38510, "addr": 1532606 }, { "b": "asXH0A+fiavpJ\u003eQvrlZiv(+.#B9RUkxMw3ez/{bqC{4csAbn@)wPF#oxK@q@z/fVdzGG}xz!pb2azbt7wI9", "ln": 42192, "addr": 1700538 }, { "b": "asXH0A+fiavpJ\u003eQw[=c%B7^PSmRM:OB7/caayPtpzEWv2z/fGoB8laAA+fiavpK1?xcpR9w[=6)e=", "ln": 42193, "addr": 1700605 }, { "b": "asXH0wmYN*By!/\u003ex(4uwavG^SwPRH8ayMy8x(4uk", "n": [ { "c": 1, "d": "Darkcomp delete file command", "i": "objectives/command-and-control/backdoor/dispatch/shell::darkcomp-delete-file-command", "o": 1700671, "z": 11, "cf": 0.9399999976158142 } ], "ln": 42194, "addr": 1700667 }, { "b": "asXH0wmYN*By!/\u003ex(4u/vrlZiv(+.#B9RUkxMw3ez/{bqC{3Tey?mZ1B0a)lw[=6)e=", "ln": 42195, "addr": 1700700 }, { "b": "asXH0wmYN*By!/\u003ex(4u/w[=c%B7^PSmRM:OB7/caayPdgvrlZiv}Y[3zF%Vsay]51wPRGo", "ln": 42196, "addr": 1700754 }, { "b": "asXH7p\u0026ZG0C@+", "ln": 50462, "addr": 2070924 }, { "b": "asW", "ln": 50463, "addr": 2070935 }, { "b": "asXH9zGGDgw)]gXaARp9BrCm9zE^M{B0bBxz*lKIv@Dm5wN/*@z/cXazE:(evr(WcvpQ$", "n": [ { "c": 1, "d": "Generic payload word present", "i": "metadata/file/string/artifact::payload-word-token", "o": 2070985, "z": 7, "cf": 0.6000000238418579 } ], "ln": 50464, "addr": 2070938 }, { "b": "asW", "ln": 50465, "addr": 2070994 }, { "b": "asXHjx(mA(iV{gggbY", "ln": 50466, "addr": 2070997 }, { "b": "bv\u003ev$x(mG8mP8/Cl0)wMpetj$mn^5QpFJ2^", "ln": 58802, "addr": 2441093 }, { "b": "", "ln": 58803, "addr": 2441122 }, { "b": "bv\u003ev$x(mG8mP8/Cl0(#ImmfZPrZ/[+nL-8fzddfgaz\u003e?gefF!zv\u003c@K9", "n": [ { "c": 1, "d": "Camera or microphone term", "i": "metadata/permission/capture::capture-device-term", "o": 2441161, "z": 3, "cf": 0.8600000143051147 } ], "ln": 58804, "addr": 2441123 }, { "b": "arR^Hc}m9al{UfErz(Z-pe\u003eO3mn^5QpFJ2@jS)i(nKL\u003cKrZ/[+nL-8*mnuiCl}5jDc#Aycdj=O\u0026ze0(pefDuTx\u003e5Ovdf", "ln": 58805, "addr": 2441168 }, { "b": "", "ln": 58806, "addr": 2441242 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2547143.0, "entropy": 4.92, "size_bytes": 2547143.0 }, "text": { "tab_count": 17627.0, "digit_ratio": 0.02, "space_count": 674058.0, "total_lines": 60555.0, "char_entropy": 4.92, "mixed_indent": 1.0, "unique_chars": 107.0, "escape_density": 0.0, "lines_over_200": 29.0, "lines_over_500": 1.0, "ascii_art_lines": 17.0, "avg_line_length": 41.06, "high_byte_ratio": 0.0, "max_line_length": 521.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.1, "last_line_length": 6.0, "long_token_count": 24.0, "whitespace_ratio": 0.3, "most_common_ratio": 0.05, "line_length_stddev": 32.55, "octal_escape_count": 63.0, "unicode_escape_count": 1.0, "repeated_char_sequences": 15601.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 83.0, "trailing_whitespace_lines": 646.0, "most_common_char_codepoint": 101.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 4.92, "peak_region_bytes": 742855.0, "peak_region_entropy": 5.49 }, "source": { "ast_unavailable": 1.0, "ast_unavailable.tree_sitter_guard": 1.0 } } }, "id": 1, "mol": "H(Po)", "path": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919-frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz!!frida-core.h", "pid": 0, "risk": 2, "sha": "44cd8dfd5ad7b3e90462461c7e5f4b29b32154f24cba52bd8c79342e74418ca4", "size": 2547143, "traits": [ { "id": "micro-behaviors/communications/dns/lookup/txt::txt-record-string", "atk": "T1071.004", "mbc": "C0011", "crit": 3, "desc": "TXT record string reference", "spans": [ [ 1263908, 10 ] ] }, { "id": "well-known/tool/detection/security-scanner::sensitive-dir-guard-comment", "conf": 0.8999999761581421, "crit": 1, "desc": "sensitive dir guard comment", "spans": [ [ 1074464, 24 ] ] }, { "id": "micro-behaviors/process/info/selfpath::check-argv-0", "conf": 0.800000011920929, "crit": 3, "desc": "Accesses argv[0] (Self path)", "spans": [ [ 687184, 7 ] ] }, { "id": "objectives/evasion/kernel-hide/ebpf::password-string-op", "conf": 0.4000000059604645, "crit": 1, "desc": "Password getter or checker", "spans": [ [ 779112, 12 ] ] } ], "type": "c" }, { "ctx": [ { "b": "r8M1UuRJ*Nnmbg?qDd16pdFqIqBzYKC42ifwJ.j?g+{l$ffPZ=arR^HauTHLzdm6%az$R8wJ.kOvpJ$TxjU%(A::63uTWC^x)aijD0+n@a%pwRx\u003eg^)Bzku3wPx{TmP8/Cl0).?rBnD^lR7M-qBab^o*IcquQ)KWmn=AJmpetFr7QaZr9rN1l)r:%vqH6$jT8EmgA)}{j{\u0026zParR^Hjz!UDvR6N5zEEx[jTa#RB8bc2vqPN.w]zY%Aa@\u0026bay^DDwmYU2x\u003ez6\u003cAY\u003eQoqB%nxuSZ66uRJ*Nnmbs]k#p]/k#QA-pc?PyuQ^*?uR\u003crZa%q5qy\u0026%qLa$USd", "ln": 545822, "col": 69, "line": 9337 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 629047, "entropy": 4.76 }, "binary": { "peak_region_bytes": 74752, "peak_region_entropy": 5.37 }, "consistency": { "extension_content_mismatch": 1, "extension_content_mismatch.config_as_unknown": 1 } } }, "id": 2, "mol": "H(Hf)", "path": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919-frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz!!frida-core.gir", "pid": 0, "risk": 1, "sha": "2b2cc7d461efb93d97dcb8294990b3eee5e2e4b452f6987918e893f5ba1df4d4", "size": 629047, "traits": [ { "id": "micro-behaviors/hardware/smartcard/access::android-emv-transaction-marker", "conf": 0.96, "crit": 3, "desc": "EMV payment transaction APDU marker", "spans": [ [ 545886, 11 ], [ 545947, 11 ] ] } ], "type": "xml" }, { "depth": 1, "facts": { "metrics": { "file": { "size": 120371000.0, "entropy": 5.5, "size_bytes": 120371000.0 }, "binary": { "overall_entropy": 5.5, "peak_region_bytes": 715776.0, "peak_region_entropy": 8.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "id": 3, "mol": "H(F₂)", "path": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919-frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz!!libfrida-core.a", "pid": 0, "risk": 2, "sha": "f9ffb877eed690ff33952ccb92ab90f6161422a8bd9be8c3e11a8f4a54a2ffe6", "size": 120371000, "traits": [ { "id": "micro-behaviors/fs/file/read::jvm-readallbytes-bytecode", "conf": 0.8999999761581421, "crit": 3, "desc": "JVM bytecode readAllBytes", "spans": [ [ 19384759, 35 ] ] }, { "id": "micro-behaviors/fs/write/file/direct::jvm-fileoutputstream-bytecode", "conf": 0.8600000143051147, "crit": 3, "desc": "JVM bytecode FileOutputStream", "spans": [ [ 3174352, 47 ] ] } ], "type": "deb" }, { "ctx": [ { "b": "fdEqKdJ?8%ze:i9wGVhhBz9YxasWZvdJ\u0026kqvqYZ2azbUdwmm61z/PzvwQ4T2Abo8rv\u003c0vwazbUdwmm61z/PzvwQ4T2Abo8deLE=teO]3tx\u003egT7v@Dy0at4zsB8r3Ky?du8eO]nDeO]DsB8I", "ln": 0, "col": 1, "line": 1 }, { "b": "xMOunB2\u003e%cw].P@vj(OiaARJAy?m3}zxJ!mA+cw4vScyhavZx=wmm7$asY2K3l%n5v@co#wGSgeA+P5)eN@ZtwIdTu3jn1(zEWH9wmV(CB97@ex\u003c@Ydj{\u0026JGzEWH9wmV(CB98CpzF7Onj{?TrByxo9v\u003c2@kx\u003eeu8zEl{=BywV)wN(]imSJiNvn*-UB7]MgasXHPwPI{bz/d9GmSJiNvn*-UB7]Mgl$HEGv}X+Kvrlv8aAz44B8L}EavZx=wmm\u0026Cvrl98dG", "ln": 181, "col": 10, "line": 6 }, { "b": "ayPwgx=[*jA+xM1f\u003cMjSau.\u003egfEWtKaBsCrarR!tuVp41zGGDgAV=+OrDzOYwJy}WB09O:x\u003efzjzxZROvrc17tqftii%)8MarUYoBAIRwatC}+arV7t3lQEcz/oOqjS[xAzddc@uU\u003cU0A9)G]Cowqerzl7qaxhlsmjyq93lQEjx\u003eIr(y-\u003ec8nK(uEr4GegzEmE0xkRc]dlv\u003eVaAImfzEEu7c@SYcr7fXVefF\u003eGuVP{]zEEugi%(rqaz\u003eJ", "ln": 915, "col": 33, "line": 35 }, { "b": "zc{*+C4\u003eC$B09Q*w].P@vp9LRC4\u003eC$uU\u003cB$Byf96DsXiEwmY{#v}xZgi%)8Mw]zYjc$%!!att(1x=[MZaz#ssuU0.\u003ex\u003e7Z}j0nk/d\u003e7/FaBsCrarR^@A+P5)l$HKQv}u=jay]5bx\u003e7Y%jS[uSx\u003egTVwmY{#v}x1-x(!x6xjVfcc$D[jx\u003e7Z}efFT", "ln": 1289, "col": 5, "line": 52 }, { "b": "i%(rqaAR)FwGTbUyiarhuVfy*wN/*?xjVf(B98CpzF9r[wO\u003e)/AV==Jz/o.Gar\u003e]MAaHjxi%)8Mx\u003ewFoB98CjzeZQCBA}?pefDcMz!ymyau.\u003egfEWtKaBsCrarR!pz/fSrazkg$vr9Fuaz+$euU%v}B75Y)i%(rqarR!yz!AA]wPI{3xjShGazL$ozEmr\u003eygQ)%uUr}(uVQsfx(mM\u003czdNM[wPw[wA=k(refDcQvr(WcvpQMhi%)8MarQ", "ln": 4421, "col": 62, "line": 166 } ], "depth": 1, "facts": { "imp": [ [ "", "frida_init" ], [ "", "atoi" ], [ "", "g_printerr" ], [ "", "g_main_loop_new" ], [ "", "signal" ], [ "", "signal" ], [ "", "frida_device_manager_new" ], [ "", "frida_device_manager_enumerate_devices_sync" ], [ "", "g_assert" ], [ "", "frida_device_list_size" ], [ "", "frida_device_list_get" ], [ "", "g_print" ], [ "", "frida_device_get_name" ], [ "", "frida_device_get_dtype" ], [ "", "g_object_ref" ], [ "", "g_object_unref" ], [ "", "g_assert" ], [ "", "frida_unref" ], [ "", "frida_device_attach_sync" ], [ "", "g_signal_connect" ], [ "", "G_CALLBACK" ], [ "", "frida_session_is_detached" ], [ "", "g_print" ], [ "", "frida_script_options_new" ], [ "", "frida_script_options_set_name" ], [ "", "frida_script_options_set_runtime" ], [ "", "frida_session_create_script_sync" ], [ "", "g_assert" ], [ "", "g_clear_object" ], [ "", "g_signal_connect" ], [ "", "G_CALLBACK" ], [ "", "frida_script_load_sync" ], [ "", "g_assert" ], [ "", "g_print" ], [ "", "g_main_loop_is_running" ], [ "", "g_main_loop_run" ], [ "", "g_print" ], [ "", "frida_script_unload_sync" ], [ "", "frida_unref" ], [ "", "g_print" ], [ "", "frida_session_detach_sync" ], [ "", "frida_unref" ], [ "", "g_print" ], [ "", "g_printerr" ], [ "", "g_error_free" ], [ "", "frida_unref" ], [ "", "frida_device_manager_close_sync" ], [ "", "frida_unref" ], [ "", "g_print" ], [ "", "g_main_loop_unref" ], [ "", "g_enum_to_string" ], [ "", "g_print" ], [ "", "g_free" ], [ "", "g_idle_add" ], [ "", "json_parser_new" ], [ "", "json_parser_load_from_data" ], [ "", "json_node_get_object" ], [ "", "json_parser_get_root" ], [ "", "json_object_get_string_member" ], [ "", "strcmp" ], [ "", "json_object_get_string_member" ], [ "", "g_print" ], [ "", "g_print" ], [ "", "g_object_unref" ], [ "", "g_idle_add" ], [ "", "g_main_loop_quit" ], [ "", "\u003cstdlib.h\u003e" ], [ "", "\u003cstring.h\u003e" ], [ "", "frida-core.h" ] ], "mbr": [ "error.message" ], "tgt": [ "G_CALLBACK", "atoi", "frida_device_attach_sync", "frida_device_get_dtype", "frida_device_get_name", "frida_device_list_get", "frida_device_list_size", "frida_device_manager_close_sync", "frida_device_manager_enumerate_devices_sync", "frida_device_manager_new", "frida_init", "frida_script_load_sync", "frida_script_options_new", "frida_script_options_set_name", "frida_script_options_set_runtime", "frida_script_unload_sync", "frida_session_create_script_sync", "frida_session_detach_sync", "frida_session_is_detached", "frida_unref", "g_assert", "g_clear_object", "g_enum_to_string", "g_error_free", "g_free", "g_idle_add", "g_main_loop_is_running", "g_main_loop_new", "g_main_loop_quit", "g_main_loop_run", "g_main_loop_unref", "g_object_ref", "g_object_unref", "g_print", "g_printerr", "g_signal_connect", "json_node_get_object", "json_object_get_string_member", "json_parser_get_root", "json_parser_load_from_data", "json_parser_new", "signal", "strcmp" ], "funcs": [ [ "main", 636 ], [ "on_detached", 3678 ], [ "on_message", 4062 ], [ "on_signal", 4743 ], [ "stop", 4809 ] ], "metrics": { "ast": { "op.eq": 7, "op.ne": 3, "op.lor": 1, "op.band": 5, "max_depth": 12, "call_count": 66, "node_count": 1265, "member_count": 1, "op_density.eq": 0.01, "op_density.ne": 0, "op_density.lor": 0, "op_density.band": 0, "max_member_depth": 2 }, "file": { "size": 4899, "entropy": 4.94 }, "text": { "lines": 196, "top_char": 101, "digit_ratio": 0, "space_count": 800, "char_entropy": 4.94, "unique_chars": 85, "top_char_null": 0, "import_density": 1.53, "string_density": 0.15, "top_char_ratio": 0.06, "avg_line_length": 23.99, "max_line_length": 145, "empty_line_ratio": 0.22, "last_line_length": 1, "whitespace_ratio": 0.2, "identifier_density": 1.22, "line_length_stddev": 25.08, "max_whitespace_run": 4, "normalized_import_count": 0.21, "normalized_string_count": 2.07, "repeated_char_sequences": 6, "suspicious_string_ratio": 0.07, "suspicious_comment_ratio": 1, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 12.61 }, "binds": { "count": 17 }, "binary": { "peak_region_bytes": 4899, "peak_region_entropy": 4.89 }, "source": { "function_count": 5 }, "imports": { "count": 3, "third_party_count": 3, "third_party_ratio": 1 }, "strings": { "bytes": 520, "count": 29, "shell": 2, "avg_length": 17.93, "max_length": 60, "avg_entropy": 3.15, "entropy_stddev": 1.03 }, "comments": { "chars": 224, "count": 1, "lines": 7, "url_count": 1, "high_entropy": 1, "to_code_ratio": 0.04 }, "functions": { "count": 5 }, "identifiers": { "count": 240, "unique": 96, "avg_length": 13.23, "max_length": 43, "min_length": 1, "avg_entropy": 2.9, "reuse_ratio": 0.4, "length_stddev": 8.55, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.01, "high_entropy_count": 21, "high_entropy_ratio": 0.22, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.06 } } }, "id": 4, "mol": "H₂(DbPo)", "path": "5369192a543be713b7d9c2fd885ae612e3b5ddcda390adad8854edc5b6fe7919-frida-core-devkit-17.15.5-watchos-arm64-simulator.tar.xz!!frida-core-example.c", "pid": 0, "risk": 2, "sha": "8d6dccba9317b05bd5a3c5b0348da27ff0dbb4d275b4ff534095b6a59f37da6b", "size": 4899, "traits": [ { "id": "micro-behaviors/data/string/search::native-buffer-cmp-call", "conf": 0.9, "crit": 3, "desc": "Calls native buffer or string comparison API", "spans": [ [ 4485, 6 ] ] }, { "id": "micro-behaviors/process/info/selfpath::check-argv-0", "conf": 0.8, "crit": 3, "desc": "Indexes argv[0] array element", "spans": [ [ 979, 7 ] ] }, { "id": "metadata/import/c/frida-core/h::frida-core/h", "conf": 0.95, "crit": 2, "desc": "imports frida-core.h", "spans": [ [ 239, 0 ] ] }, { "id": "metadata/import/c/stdlib/h::stdlib/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cstdlib.h\u003e", "spans": [ [ 264, 0 ] ] }, { "id": "metadata/import/c/string/h::string/h", "conf": 0.95, "crit": 2, "desc": "imports \u003cstring.h\u003e", "spans": [ [ 284, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 1337, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 14, 0 ] ] } ], "type": "c" } ], "v": "8" } }