{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.09574193507432938,
        "class": 0
      }
    ],
    "prob": 0.095741935,
    "skip": [
      {
        "m": "az/c",
        "why": "uncalibrated"
      }
    ],
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.095741935,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.002644842,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9961138,
      0.99909174
    ],
    "analyzed_at": "2026-05-10T00:44:09Z"
  },
  "path": "throne_tracker.c",
  "raw": {
    "v": "4",
    "fs": [
      {
        "f": "O₂(AsEr)H₂(CrDb)",
        "k": {
          "source.imports[0]": "INIT_LIST_HEAD",
          "source.imports[1]": "IS_ERR",
          "source.imports[2]": "KERNEL_VERSION",
          "source.imports[3]": "LIST_HEAD_INIT",
          "source.imports[4]": "PTR_ERR",
          "source.imports[5]": "container_of",
          "source.imports[6]": "crown_manager",
          "source.imports[7]": "filp_close",
          "source.imports[8]": "filp_open",
          "source.imports[9]": "full_name_hash",
          "source.strings[0]": " failed: %ld",
          "source.strings[1]": " failed: %ld\\n",
          "source.strings[2]": "%s/%.*s",
          "source.strings[3]": "%s: dir: %s got magic! 0x%lx",
          "source.strings[4]": "%s: dir: %s got magic! 0x%lx\\n",
          "source.strings[5]": "%s: open ",
          "source.strings[6]": "%s: open \" SYSTEM_PACKAGES_LIST_PATH \" failed: %ld\\n",
          "source.strings[7]": "%s: skip: %s magic: 0x%lx expected: 0x%lx",
          "source.strings[8]": "%s: skip: %s magic: 0x%lx expected: 0x%lx\\n",
          "source.strings[9]": "/data/app",
          "source.has_imports": true,
          "source.imports[10]": "get_pkg_from_apk_path",
          "source.imports[11]": "is_manager_apk",
          "source.imports[12]": "iterate_dir",
          "source.imports[13]": "kernel_read",
          "source.imports[14]": "kfree",
          "source.imports[15]": "kstrtou32",
          "source.imports[16]": "ksu_get_manager_appid",
          "source.imports[17]": "ksu_invalidate_manager_uid",
          "source.imports[18]": "ksu_is_manager_appid_valid",
          "source.imports[19]": "ksu_prune_allowlist",
          "source.imports[20]": "ksu_set_manager_appid",
          "source.imports[21]": "kzalloc",
          "source.imports[22]": "list_add_tail",
          "source.imports[23]": "list_del",
          "source.imports[24]": "list_for_each_entry",
          "source.imports[25]": "list_for_each_entry_safe",
          "source.imports[26]": "pr_err",
          "source.imports[27]": "pr_info",
          "source.imports[28]": "pr_warn",
          "source.imports[29]": "search_manager",
          "source.imports[30]": "snprintf",
          "source.imports[31]": "strlen",
          "source.imports[32]": "strncmp",
          "source.imports[33]": "strncpy",
          "source.imports[34]": "strscpy",
          "source.imports[35]": "strsep",
          "source.strings[10]": "\u003clinux/err.h\u003e",
          "source.strings[11]": "\u003clinux/fs.h\u003e",
          "source.strings[12]": "\u003clinux/list.h\u003e",
          "source.strings[13]": "\u003clinux/slab.h\u003e",
          "source.strings[14]": "\u003clinux/string.h\u003e",
          "source.strings[15]": "\u003clinux/types.h\u003e",
          "source.strings[16]": "\u003clinux/version.h\u003e",
          "source.strings[17]": "Crowning manager: %s(uid=%d)",
          "source.strings[18]": "Crowning manager: %s(uid=%d)\\n",
          "source.strings[19]": "Failed to allocate apk_path_hash",
          "source.strings[20]": "Failed to allocate apk_path_hash\\n",
          "source.strings[21]": "Failed to allocate memory for %s",
          "source.strings[22]": "Failed to allocate memory for %s\\n",
          "source.strings[23]": "Failed to get package name from apk path: %s",
          "source.strings[24]": "Failed to get package name from apk path: %s\\n",
          "source.strings[25]": "Failed to open directory: %s, err: %ld",
          "source.strings[26]": "Failed to open directory: %s, err: %ld\\n",
          "source.strings[27]": "Found new base.apk at path: %s, is_manager: %d",
          "source.strings[28]": "Found new base.apk at path: %s, is_manager: %d\\n",
          "source.strings[29]": "Invalid context",
          "source.strings[30]": "Invalid context\\n",
          "source.strings[31]": "Path too long: %s/%.*s",
          "source.strings[32]": "Path too long: %s/%.*s\\n",
          "source.strings[33]": "Search manager finished",
          "source.strings[34]": "Search manager finished\\n",
          "source.strings[35]": "Searching manager...",
          "source.strings[36]": "Searching manager...\\n",
          "source.strings[37]": "Skipping directory: %.*s",
          "source.strings[38]": "Skipping directory: %.*s\\n",
          "source.strings[39]": "Stop searching",
          "source.strings[40]": "Stop searching\\n",
          "source.strings[41]": "allowlist.h",
          "source.strings[42]": "apk_sign.h",
          "source.strings[43]": "base.apk",
          "source.strings[44]": "klog.h",
          "source.strings[45]": "manager is uninstalled, invalidate it!",
          "source.strings[46]": "manager is uninstalled, invalidate it!\\n",
          "source.strings[47]": "manager pkg: %s",
          "source.strings[48]": "manager pkg: %s\\n",
          "source.strings[49]": "manager.h",
          "source.strings[50]": "throne_tracker.h",
          "source.strings[51]": "update_uid: package or uid is NULL!",
          "source.strings[52]": "update_uid: package or uid is NULL!\\n",
          "source.strings[53]": "update_uid: uid parse err",
          "source.strings[54]": "update_uid: uid parse err\\n",
          "source.functions[0]": "crown_manager(const char *apk, struct list_head *uid_data)",
          "source.functions[1]": "is_uid_exist(uid_t uid, char *package, void *data)",
          "source.functions[2]": "ksu_throne_tracker_exit()",
          "source.functions[3]": "ksu_throne_tracker_init()",
          "source.functions[4]": "my_actor(struct dir_context *ctx, const char *name,\n                             int namelen, loff_t off, u64 ino,\n                             unsigned int d_type)",
          "source.functions[5]": "search_manager(const char *path, int depth, struct list_head *uid_data)",
          "source.functions[6]": "track_throne(bool prune_only)"
        },
        "x": 1,
        "id": 0,
        "is": [
          "get_pkg_from_apk_path",
          "pr_err",
          "pr_info",
          "list_for_each_entry",
          "strncmp",
          "pr_info",
          "ksu_set_manager_appid",
          "LIST_HEAD_INIT",
          "KERNEL_VERSION",
          "container_of",
          "pr_err",
          "pr_info",
          "strncmp",
          "strncmp",
          "strncmp",
          "strncmp",
          "pr_info",
          "snprintf",
          "pr_err",
          "kzalloc",
          "pr_err",
          "strscpy",
          "list_add_tail",
          "strncmp",
          "full_name_hash",
          "strlen",
          "list_for_each_entry",
          "is_manager_apk",
          "pr_info",
          "crown_manager",
          "list_for_each_entry_safe",
          "list_del",
          "kfree",
          "kzalloc",
          "pr_warn",
          "list_add_tail",
          "INIT_LIST_HEAD",
          "list_for_each_entry",
          "strscpy",
          "list_add_tail",
          "list_for_each_entry_safe",
          "filp_open",
          "IS_ERR",
          "pr_err",
          "PTR_ERR",
          "pr_info",
          "filp_close",
          "pr_info",
          "filp_close",
          "iterate_dir",
          "filp_close",
          "list_del",
          "kfree",
          "list_for_each_entry_safe",
          "list_del",
          "kfree",
          "list_for_each_entry",
          "strncmp",
          "filp_open",
          "IS_ERR",
          "pr_err",
          "PTR_ERR",
          "INIT_LIST_HEAD",
          "kernel_read",
          "kernel_read",
          "kzalloc",
          "filp_close",
          "strsep",
          "strsep",
          "kfree",
          "pr_err",
          "kstrtou32",
          "kfree",
          "pr_err",
          "strncpy",
          "list_add_tail",
          "filp_close",
          "list_for_each_entry",
          "ksu_get_manager_appid",
          "ksu_is_manager_appid_valid",
          "pr_info",
          "ksu_invalidate_manager_uid",
          "pr_info",
          "search_manager",
          "pr_info",
          "ksu_prune_allowlist",
          "list_for_each_entry_safe",
          "list_del",
          "kfree"
        ],
        "ms": {
          "file": {
            "size": 11534.0
          },
          "text": {
            "digit_ratio": 0.01,
            "space_count": 3383.0,
            "total_lines": 365.0,
            "char_entropy": 4.67,
            "unique_chars": 85.0,
            "import_density": 24.38,
            "lines_over_200": 1.0,
            "string_density": 0.2,
            "avg_line_length": 30.6,
            "high_byte_ratio": 0.0,
            "max_line_length": 383.0,
            "non_ascii_ratio": 0.0,
            "empty_line_ratio": 0.13,
            "last_line_length": 1.0,
            "most_common_char": "t",
            "whitespace_ratio": 0.32,
            "most_common_ratio": 0.05,
            "identifier_density": 1.11,
            "line_length_stddev": 29.64,
            "normalized_import_count": 4.66,
            "normalized_string_count": 3.87,
            "repeated_char_sequences": 99.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.37,
            "imports_to_functions_ratio": 12.71,
            "strings_to_functions_ratio": 10.57,
            "suspicious_identifier_ratio": 0.02,
            "normalized_unique_identifiers": 11.63,
            "identifiers_to_functions_ratio": 14.14
          },
          "imports": {
            "total": 89.0,
            "unique_modules": 36.0,
            "third_party_count": 89.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 74.0,
            "avg_length": 19.58,
            "max_length": 52.0,
            "path_count": 2.0,
            "avg_entropy": 3.17,
            "total_bytes": 1449.0,
            "entropy_stddev": 1.13
          },
          "comments": {
            "chars": 982.0,
            "lines": 21.0,
            "total": 21.0,
            "to_code_ratio": 0.06,
            "url_in_comments": 1.0
          },
          "functions": {
            "total": 7.0,
            "length_stddev": 37.09,
            "avg_name_length": 60.29,
            "no_params_count": 7.0,
            "avg_length_lines": 42.57,
            "max_length_lines": 92.0,
            "min_length_lines": 4.0,
            "high_entropy_names": 7.0,
            "density_per_100_lines": 1.92,
            "code_in_functions_ratio": 0.82
          },
          "identifiers": {
            "total": 404.0,
            "avg_length": 10.09,
            "max_length": 26.0,
            "min_length": 1.0,
            "avg_entropy": 2.61,
            "reuse_ratio": 0.25,
            "unique_count": 99.0,
            "length_stddev": 6.42,
            "has_digit_ratio": 0.01,
            "sequential_names": 2.0,
            "single_char_count": 2.0,
            "single_char_ratio": 0.02,
            "high_entropy_count": 15.0,
            "high_entropy_ratio": 0.15,
            "all_lowercase_ratio": 0.81,
            "all_uppercase_ratio": 0.18,
            "numeric_suffix_count": 1.0,
            "double_underscore_count": 1.0,
            "underscore_prefix_count": 1.0
          }
        },
        "ss": [
          [
            45,
            "\u003clinux/err.h\u003e"
          ],
          [
            68,
            "\u003clinux/fs.h\u003e"
          ],
          [
            90,
            "\u003clinux/list.h\u003e"
          ],
          [
            114,
            "\u003clinux/slab.h\u003e"
          ],
          [
            138,
            "\u003clinux/string.h\u003e"
          ],
          [
            164,
            "\u003clinux/types.h\u003e"
          ],
          [
            189,
            "\u003clinux/version.h\u003e"
          ],
          [
            217,
            "allowlist.h"
          ],
          [
            218,
            "allowlist.h"
          ],
          [
            240,
            "apk_sign.h"
          ],
          [
            241,
            "apk_sign.h"
          ],
          [
            262,
            "klog.h"
          ],
          [
            263,
            "klog.h"
          ],
          [
            301,
            "manager.h"
          ],
          [
            302,
            "manager.h"
          ],
          [
            322,
            "throne_tracker.h"
          ],
          [
            323,
            "throne_tracker.h"
          ],
          [
            725,
            "Failed to get package name from apk path: %s\\n"
          ],
          [
            726,
            "Failed to get package name from apk path: %s"
          ],
          [
            816,
            "manager pkg: %s\\n"
          ],
          [
            817,
            "manager pkg: %s"
          ],
          [
            1060,
            "Crowning manager: %s(uid=%d)\\n"
          ],
          [
            1061,
            "Crowning manager: %s(uid=%d)"
          ],
          [
            2797,
            "Invalid context\\n"
          ],
          [
            2798,
            "Invalid context"
          ],
          [
            2917,
            "Stop searching\\n"
          ],
          [
            2918,
            "Stop searching"
          ],
          [
            3003,
            ".."
          ],
          [
            3004,
            ".."
          ],
          [
            3036,
            "."
          ],
          [
            3037,
            "."
          ],
          [
            3171,
            "vmdl"
          ],
          [
            3172,
            "vmdl"
          ],
          [
            3222,
            ".tmp"
          ],
          [
            3223,
            ".tmp"
          ],
          [
            3252,
            "Skipping directory: %.*s\\n"
          ],
          [
            3253,
            "Skipping directory: %.*s"
          ],
          [
            3409,
            "%s/%.*s"
          ],
          [
            3410,
            "%s/%.*s"
          ],
          [
            3507,
            "Path too long: %s/%.*s\\n"
          ],
          [
            3508,
            "Path too long: %s/%.*s"
          ],
          [
            3831,
            "Failed to allocate memory for %s\\n"
          ],
          [
            3832,
            "Failed to allocate memory for %s"
          ],
          [
            4148,
            "base.apk"
          ],
          [
            4149,
            "base.apk"
          ],
          [
            4607,
            "Found new base.apk at path: %s, is_manager: %d\\n"
          ],
          [
            4608,
            "Found new base.apk at path: %s, is_manager: %d"
          ],
          [
            5358,
            "Failed to allocate apk_path_hash\\n"
          ],
          [
            5359,
            "Failed to allocate apk_path_hash"
          ],
          [
            7043,
            "Failed to open directory: %s, err: %ld\\n"
          ],
          [
            7044,
            "Failed to open directory: %s, err: %ld"
          ],
          [
            7466,
            "%s: dir: %s got magic! 0x%lx\\n"
          ],
          [
            7467,
            "%s: dir: %s got magic! 0x%lx"
          ],
          [
            7832,
            "%s: skip: %s magic: 0x%lx expected: 0x%lx\\n"
          ],
          [
            7833,
            "%s: skip: %s magic: 0x%lx expected: 0x%lx"
          ],
          [
            9110,
            "%s: open \" SYSTEM_PACKAGES_LIST_PATH \" failed: %ld\\n"
          ],
          [
            9110,
            "%s: open "
          ],
          [
            9111,
            "%s: open "
          ],
          [
            9148,
            " failed: %ld\\n"
          ],
          [
            9149,
            " failed: %ld"
          ],
          [
            9855,
            " "
          ],
          [
            9856,
            " "
          ],
          [
            10022,
            "update_uid: package or uid is NULL!\\n"
          ],
          [
            10023,
            "update_uid: package or uid is NULL!"
          ],
          [
            10195,
            "update_uid: uid parse err\\n"
          ],
          [
            10196,
            "update_uid: uid parse err"
          ],
          [
            10925,
            "manager is uninstalled, invalidate it!\\n"
          ],
          [
            10926,
            "manager is uninstalled, invalidate it!"
          ],
          [
            11062,
            "Searching manager...\\n"
          ],
          [
            11063,
            "Searching manager..."
          ],
          [
            11112,
            "/data/app"
          ],
          [
            11113,
            "/data/app"
          ],
          [
            11156,
            "Search manager finished\\n"
          ],
          [
            11157,
            "Search manager finished"
          ]
        ],
        "sz": 11534,
        "ts": [
          {
            "a": "T1573",
            "c": 0.800000011920929,
            "d": "Regex component marker",
            "e": [
              "magic"
            ],
            "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-7",
            "l": 1,
            "m": "C0027"
          },
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel SPDX header",
            "e": [
              "SPDX-License-Identifier: GPL-2.0"
            ],
            "i": "micro-behaviors/os/syscall/invoke::kernel-spdx-gpl2",
            "l": 2
          },
          {
            "a": "T1106",
            "c": 0.949999988079071,
            "d": "Linux dir_context struct",
            "e": [
              "struct dir_context"
            ],
            "i": "micro-behaviors/os/syscall/invoke::dir-context-struct",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "Infinite loop structure (e.g. for(;;) or while(1))",
            "e": [
              "for (;;)"
            ],
            "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header",
            "l": 2
          },
          {
            "a": "T1027",
            "c": 0.9399999976158142,
            "d": "Regex component marker",
            "e": [
              "linux"
            ],
            "i": "objectives/anti-static/obfuscation/payload/config::arch-keyed-hex-blob-dict--rx-20",
            "l": 1,
            "m": "B0032"
          },
          {
            "c": 0.699999988079071,
            "d": "\"directory\" path-target noun",
            "e": [
              "directory"
            ],
            "i": "micro-behaviors/data/text/llm/action::llm-path-noun-directory",
            "l": 1
          },
          {
            "c": 0.9599999785423279,
            "d": "Regex component marker",
            "e": [
              "(char"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/hiding::dirent-memmove-record-removal--rx-3",
            "l": 1
          },
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel source context",
            "e": [
              "SPDX-License-Identifier: GPL-2.0",
              "struct dir_context"
            ],
            "i": "micro-behaviors/os/syscall/invoke::linux-kernel-source-context",
            "l": 2
          }
        ],
        "sha": "57a01455f13a9dcbc6e9ca6beb16dfd0f077f91c827bfe7a83e392893a266fbc",
        "path": "/data/samples/bad/projects/android/ApexSU/kernel/throne_tracker.c",
        "type": "c"
      }
    ],
    "tv": "87c42"
  }
}