{
  "ml": {
    "l": -1,
    "v": "6",
    "fs": [
      {
        "l": -1,
        "id": 0,
        "prob": 0.000018904605894931592
      }
    ],
    "prob": 0.000018904606,
    "models": [
      {
        "m": "az",
        "raw": 0.000018904606,
        "prob": 0.000018904606,
        "class": 0
      },
      {
        "m": "az/source",
        "raw": 0.00006726384,
        "prob": 0.00006726384,
        "class": 0
      },
      {
        "m": "az/rust",
        "raw": 0.000000029802322,
        "prob": 0.000000029802322,
        "class": 0
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-09T08:16:02Z"
  },
  "path": "rusty_cronos.rs",
  "raw": {
    "v": "6",
    "fs": [
      {
        "f": "H(Mg)",
        "x": 2,
        "ff": {
          "i": [
            [
              "",
              "STACK_XOR_KEY.to_vec"
            ],
            [
              "",
              "key.to_vec"
            ],
            [
              "",
              "rusty_cronos_sleep_windows"
            ],
            [
              "",
              "rusty_cronos_sleep_linux_partial"
            ],
            [
              "",
              "compute_stack_region"
            ],
            [
              "",
              "region.size.min"
            ],
            [
              "",
              "region.size"
            ],
            [
              "",
              "vec"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "heap_shadow.iter"
            ],
            [
              "",
              "Some"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "read_rsp"
            ],
            [
              "",
              "asm"
            ],
            [
              "",
              "compute_stack_region"
            ],
            [
              "",
              "region.page_aligned"
            ],
            [
              "",
              "aligned.size"
            ],
            [
              "",
              "Some"
            ],
            [
              "",
              "\"Stack region could not be determined\".to_string"
            ],
            [
              "",
              "aligned.size"
            ],
            [
              "",
              "VirtualProtect"
            ],
            [
              "",
              "aligned.size"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "duration.as_millis"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "VirtualProtect"
            ],
            [
              "",
              "aligned.size"
            ],
            [
              "",
              "Some"
            ],
            [
              "",
              "format"
            ],
            [
              "",
              "key.is_empty"
            ],
            [
              "",
              "data.iter_mut.enumerate"
            ],
            [
              "",
              "data.iter_mut"
            ],
            [
              "",
              "key.len"
            ],
            [
              "",
              "b\"RustyCronos stack data\".to_vec"
            ],
            [
              "",
              "original.clone"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "assert_ne"
            ],
            [
              "",
              "xor_encrypt_region"
            ],
            [
              "",
              "assert_eq"
            ],
            [
              "",
              "s.obfuscated_sleep"
            ],
            [
              "",
              "assert_eq"
            ],
            [
              "",
              "assert_eq"
            ],
            [
              "",
              "s.obfuscated_sleep"
            ],
            [
              "",
              "assert_eq"
            ]
          ],
          "m": {
            "ast": {
              "op.eq": 2.0,
              "op.lor": 1.0,
              "op.mod": 1.0,
              "op.mul": 1.0,
              "op.xor": 1.0,
              "max_depth": 19.0,
              "call_count": 47.0,
              "node_count": 1577.0,
              "member_count": 16.0,
              "op_density.eq": 0.0,
              "op_density.lor": 0.0,
              "op_density.mod": 0.0,
              "op_density.mul": 0.0,
              "op_density.xor": 0.0,
              "identifier_count": 93.0,
              "member_depth_max": 3.0,
              "xor_mod_loop_count": 1.0,
              "string_literal_count": 12.0
            },
            "file": {
              "size": 8441.0,
              "entropy": 4.97,
              "size_bytes": 8441.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 1754.0,
              "total_lines": 235.0,
              "char_entropy": 4.97,
              "unique_chars": 89.0,
              "string_density": 0.05,
              "avg_line_length": 34.92,
              "high_byte_ratio": 0.06,
              "max_line_length": 200.0,
              "non_ascii_ratio": 0.06,
              "empty_line_ratio": 0.14,
              "last_line_length": 1.0,
              "long_token_count": 3.0,
              "whitespace_ratio": 0.24,
              "most_common_ratio": 0.07,
              "identifier_density": 1.14,
              "line_length_stddev": 32.42,
              "normalized_string_count": 0.78,
              "repeated_char_sequences": 31.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.1,
              "max_inline_whitespace_run": 4.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.03,
              "normalized_unique_identifiers": 11.81
            },
            "calls": {
              "count": 47.0
            },
            "binary": {
              "overall_entropy": 4.97
            },
            "source": {
              "class_count": 1.0,
              "function_count": 11.0
            },
            "members": {
              "count": 16.0
            },
            "strings": {
              "total": 12.0,
              "avg_length": 30.0,
              "max_length": 177.0,
              "avg_entropy": 3.26,
              "total_bytes": 360.0,
              "entropy_stddev": 0.79
            },
            "comments": {
              "chars": 3387.0,
              "lines": 61.0,
              "total": 61.0,
              "to_code_ratio": 0.35,
              "base64_in_comments": 1.0,
              "high_entropy_comments": 5.0
            },
            "functions": {
              "count": 12.0,
              "avg_params": 0.82,
              "max_params": 2.0,
              "length_stddev": 20.31,
              "avg_name_length": 17.27,
              "no_params_count": 6.0,
              "avg_length_lines": 13.82,
              "max_length_lines": 74.0,
              "min_length_lines": 3.0,
              "high_entropy_names": 6.0,
              "avg_param_name_length": 5.0,
              "density_per_100_lines": 4.68,
              "code_in_functions_ratio": 0.65
            },
            "identifiers": {
              "count": 93.0,
              "total": 269.0,
              "avg_length": 8.3,
              "max_length": 32.0,
              "min_length": 1.0,
              "avg_entropy": 2.45,
              "reuse_ratio": 0.35,
              "unique_count": 93.0,
              "length_stddev": 6.05,
              "has_digit_ratio": 0.01,
              "sequential_names": 3.0,
              "single_char_count": 4.0,
              "single_char_ratio": 0.04,
              "high_entropy_count": 9.0,
              "high_entropy_ratio": 0.1,
              "all_lowercase_ratio": 0.8,
              "all_uppercase_ratio": 0.04,
              "numeric_suffix_count": 1.0,
              "underscore_prefix_count": 1.0
            }
          },
          "s": [
            [
              1757,
              "u8",
              "b\"RustyCronosKey2025Lab"
            ],
            [
              1759,
              "u8",
              "RustyCronosKey2025Lab"
            ],
            [
              2507,
              "u8",
              "windows"
            ],
            [
              2508,
              "u8",
              "windows"
            ],
            [
              2629,
              "u8",
              "windows"
            ],
            [
              2630,
              "u8",
              "windows"
            ],
            [
              2961,
              "u8",
              "windows"
            ],
            [
              2962,
              "u8",
              "windows"
            ],
            [
              3205,
              "10",
              "512"
            ],
            [
              3211,
              "10",
              "1024"
            ],
            [
              3278,
              "10",
              "0"
            ],
            [
              3924,
              "u8",
              "Linux partial path: encrypted {size} bytes of heap shadow (not real stack). \\\n             Full stack encryption requires mprote"
            ],
            [
              3925,
              "u8",
              "Linux partial path: encrypted {size} bytes of heap shadow (not real stack). "
            ],
            [
              4003,
              "u8",
              "             Full stack encryption requires mprotect + frame pointer walk under EXPLOIT_LAB_ACTIVE."
            ],
            [
              4337,
              "u8",
              "windows"
            ],
            [
              4338,
              "u8",
              "windows"
            ],
            [
              4779,
              "u8",
              "mov {}, rbp"
            ],
            [
              4780,
              "u8",
              "mov {}, rbp"
            ],
            [
              4955,
              "10",
              "0"
            ],
            [
              4976,
              "10",
              "0"
            ],
            [
              5198,
              "u8",
              "Stack region could not be determined"
            ],
            [
              5199,
              "u8",
              "Stack region could not be determined"
            ],
            [
              5520,
              "10",
              "0"
            ],
            [
              6467,
              "10",
              "0"
            ],
            [
              6797,
              "u8",
              "Encrypted {} bytes of stack (base=0x{:x}, end=0x{:x})"
            ],
            [
              6798,
              "u8",
              "Encrypted {} bytes of stack (base=0x{:x}, end=0x{:x})"
            ],
            [
              7600,
              "u8",
              "b\"RustyCronos stack data"
            ],
            [
              7602,
              "u8",
              "RustyCronos stack data"
            ],
            [
              8019,
              "10",
              "0"
            ],
            [
              8180,
              "u8",
              "b\"custom"
            ],
            [
              8182,
              "u8",
              "custom"
            ],
            [
              8218,
              "u8",
              "b\"custom"
            ],
            [
              8220,
              "u8",
              "custom"
            ],
            [
              8379,
              "10",
              "13"
            ],
            [
              8428,
              "10",
              "13"
            ]
          ],
          "v": {
            "file.stem": "rusty_cronos",
            "file.basename": "rusty_cronos.rs",
            "source.language": "rust",
            "source.imports[0]": "\"Stack region could not be determined\".to_string",
            "source.imports[1]": "STACK_XOR_KEY.to_vec",
            "source.imports[2]": "Some",
            "source.imports[3]": "VirtualProtect",
            "source.imports[4]": "aligned.size",
            "source.imports[5]": "asm",
            "source.imports[6]": "assert_eq",
            "source.imports[7]": "assert_ne",
            "source.imports[8]": "b\"RustyCronos stack data\".to_vec",
            "source.imports[9]": "compute_stack_region",
            "source.strings[0]": "             Full stack encryption requires mprotect + frame pointer walk under EXPLOIT_LAB_ACTIVE.",
            "source.strings[1]": "Encrypted {} bytes of stack (base=0x{:x}, end=0x{:x})",
            "source.strings[2]": "Linux partial path: encrypted {size} bytes of heap shadow (not real stack). ",
            "source.strings[3]": "Linux partial path: encrypted {size} bytes of heap shadow (not real stack). \\\n             Full stack encryption requires mprotect + frame pointer walk under EXPLOIT_LAB_ACTIVE.",
            "source.strings[4]": "RustyCronos stack data",
            "source.strings[5]": "RustyCronosKey2025Lab",
            "source.strings[6]": "Stack region could not be determined",
            "source.strings[7]": "b\"RustyCronos stack data",
            "source.strings[8]": "b\"RustyCronosKey2025Lab",
            "source.strings[9]": "b\"custom",
            "source.has_imports": true,
            "source.imports[10]": "data.iter_mut",
            "source.imports[11]": "data.iter_mut.enumerate",
            "source.imports[12]": "duration.as_millis",
            "source.imports[13]": "format",
            "source.imports[14]": "heap_shadow.iter",
            "source.imports[15]": "key.is_empty",
            "source.imports[16]": "key.len",
            "source.imports[17]": "key.to_vec",
            "source.imports[18]": "original.clone",
            "source.imports[19]": "read_rsp",
            "source.imports[20]": "region.page_aligned",
            "source.imports[21]": "region.size",
            "source.imports[22]": "region.size.min",
            "source.imports[23]": "rusty_cronos_sleep_linux_partial",
            "source.imports[24]": "rusty_cronos_sleep_windows",
            "source.imports[25]": "s.obfuscated_sleep",
            "source.imports[26]": "vec",
            "source.imports[27]": "xor_encrypt_region",
            "source.strings[10]": "custom",
            "source.strings[11]": "mov {}, rbp",
            "source.strings[12]": "windows",
            "source.functions[0]": "custom_key_variant",
            "source.functions[1]": "default",
            "source.functions[2]": "duration_preserved",
            "source.functions[3]": "new",
            "source.functions[4]": "obfuscated_sleep",
            "source.functions[5]": "rusty_cronos_completes_on_linux",
            "source.functions[6]": "rusty_cronos_sleep_linux_partial",
            "source.functions[7]": "rusty_cronos_sleep_windows",
            "source.functions[8]": "with_key",
            "source.functions[9]": "xor_encrypt_region",
            "source.functions[10]": "xor_roundtrip"
          },
          "ct": [
            "STACK_XOR_KEY.to_vec",
            "Some",
            "VirtualProtect",
            "aligned.size",
            "compute_stack_region",
            "data.iter_mut",
            "data.iter_mut().enumerate",
            "duration.as_millis",
            "heap_shadow.iter",
            "key.is_empty",
            "key.len",
            "key.to_vec",
            "original.clone",
            "read_rsp",
            "region.page_aligned",
            "region.size",
            "region.size().min",
            "rusty_cronos_sleep_linux_partial",
            "rusty_cronos_sleep_windows",
            "s.obfuscated_sleep",
            "xor_encrypt_region"
          ],
          "id": "rust",
          "mc": [
            "STACK_XOR_KEY.to_vec",
            "aligned.base",
            "aligned.size",
            "data.iter_mut",
            "data.iter_mut().enumerate",
            "duration.as_millis",
            "heap_shadow.iter",
            "heap_shadow.iter().sum",
            "key.is_empty",
            "key.len",
            "key.to_vec",
            "original.clone",
            "region.page_aligned",
            "region.size",
            "region.size().min",
            "s.obfuscated_sleep"
          ]
        },
        "id": 0,
        "sz": 8441,
        "ts": [
          {
            "c": 1.0,
            "d": "Inline assembly macro",
            "e": [
              "asm!("
            ],
            "i": "micro-behaviors/mem/inline-asm/arch::macro",
            "l": 3
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (substr, catches imports)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Rust Duration::from_secs/millis constructor",
            "e": [
              "Duration::from_millis"
            ],
            "i": "micro-behaviors/time/sleep/interval::rust-duration-from",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "Destructive delete verb",
            "e": [
              "remove"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::delete-verb",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Codebase deletion target",
            "e": [
              "code"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-codebase",
            "l": 1
          },
          {
            "c": 0.800000011920929,
            "d": "Rust std::thread::sleep delay call",
            "e": [
              "std::thread::sleep"
            ],
            "i": "micro-behaviors/time/sleep/interval::rust-thread-sleep",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "#[cfg(test)] attribute",
            "e": [
              "#[cfg(test)]"
            ],
            "i": "metadata/package/testing/harness/unit::rust-cfg-test",
            "l": 2
          },
          {
            "c": 0.20000000298023224,
            "d": "crypto keyword (word match)",
            "e": [
              "crypto"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word",
            "l": 1
          },
          {
            "c": 0.8799999952316284,
            "d": "Source or test deletion target",
            "e": [
              "tests"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "l": 1
          },
          {
            "a": "T1573",
            "c": 0.8600000143051147,
            "d": "KEM ciphertext term",
            "e": [
              "ciphertext"
            ],
            "i": "micro-behaviors/crypto/asymmetric/kem::ciphertext-term",
            "l": 1,
            "m": "C0027"
          },
          {
            "c": 0.20000000298023224,
            "d": "rust binary crypto module vocabulary",
            "e": [
              "encrypt"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::rust-bin-crypto-vocab",
            "l": 1
          }
        ],
        "sha": "73b07420171ce2bb3c35ab63bf7cd5fcd5cb367c8d9fe8744b36caeb3c36b42c",
        "path": "rusty_cronos.rs",
        "type": "rust"
      }
    ],
    "tv": "35641"
  }
}