{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.0003721482935361564, "class": 0 } ], "prob": 0.0003721483, "class": 0, "models": [ { "m": "az", "prob": 0.00013137548, "class": 0 }, { "m": "az/native", "prob": 0.0003721483, "class": 0 }, { "m": "az/elf", "prob": 0.000022971979, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-03T11:52:52Z" }, "path": "librumpfs_tmpfs.so.0.0", "raw": { "v": "4", "fs": [ { "f": "O₂(CI)Md₂(HeBi₃)", "x": 3, "id": 0, "is": [ "", "rumpns_genfs_sane_rename", "rumpns_uvm_obj_setlock", "rumpns_spec_bmap", "rumpns_kauth_cred_geteuid", "rumpns_vmem_free", "rumpns_strlcpy", "rumpns_spec_lookup", "rumpns_spec_fsync", "rumpns_set_statvfs_info", "rumpns_atomic_and_32", "rumpns_vn_fifo_bypass", "rumpns_vop_kqfilter_desc", "rumpns_atomic_or_uint", "rumpns_mutex_init", "rumpns_vop_default_desc", "rumpns_rw_write_held", "rumpns_genfs_can_sticky", "rumpns_spec_pathconf", "rumpns_spec_mmap", "rumpns_genfs_pathconf", "rumpns_ubc_zerorange", "rumpns_vop_revoke_desc", "rumpns_spec_node_init", "deregister_frame_info", "rumpns_uiomove", "rumpns_vop_setattr_desc", "rumpns_atomic_or_32", "rumpns_vop_fallocate_desc", "rumpns_genfs_can_access", "rumpns_vop_lookup_desc", "rumpns_vop_islocked_desc", "rumpns_uvmexp", "rumpns_eopnotsupp", "rumpns_vput", "rumpns_rw_exit", "rumpns_memcmp", "rumpns_vrele", "rumpns_atomic_dec_uint", "Jv_RegisterClasses", "rumpns_genfs_mmap", "rumpns_x86_curlwp", "rumpns_vop_mkdir_desc", "rumpns_genfs_badop", "rumpns_vop_inactive_desc", "rumpns_kmem_alloc", "rumpns_genfs_can_chtimes", "rumpns_vop_ioctl_desc", "rumpns_vop_symlink_desc", "rumpns_spec_ioctl", "rumpns_vop_abortop_desc", "rumpns_pool_destroy", "rumpns_vop_create_desc", "rumpns_genfs_enoioctl", "rumpns_panic", "rumpns_genfs_kqfilter", "rumpns_vop_rename_desc", "rumpns_genfs_ufslike_rename_check_possible", "rumpns_vop_seek_desc", "rumpns_mutex_exit", "rumpns_VOP_ISLOCKED", "rumpns_vop_poll_desc", "rumpns_genfs_suspendctl", "rumpns_lf_advlock", "rumpns_genfs_putpages", "rumpns_atomic_inc_32", "rumpns_vop_link_desc", "rumpns_mutex_destroy", "rumpns_genfs_unlock", "rumpns_rw_enter", "rumpns_spec_open", "rumpns_cache_enter_id", "rumpns_genfs_can_chmod", "rumpns_genfs_islocked", "rumpns_pool_get", "rumpns_genfs_seek", "rumpns_vop_getpages_desc", "rumpns_copy_statvfs_info", "rumpns_genfs_insane_rename", "rumpns_vop_remove_desc", "rumpns_spec_kqfilter", "rumpns_vop_mmap_desc", "stack_chk_guard", "rumpns_vop_readlink_desc", "rumpns_VOP_UNLOCK", "rumpns_kern_assert", "rumpns_genfs_fcntl", "rumpns_genfs_ufslike_rename_check_permitted", "cxa_finalize", "register_frame_info", "rumpns_mutex_owned", "rumpns_vop_write_desc", "rumpns_pool_put", "rumpns_vfs_attach", "rumpns_uvm_vnp_setsize", "rumpns_kern_malloc", "rumpns_vn_bwrite", "rumpns_vop_close_desc", "rumpns_vop_readdir_desc", "rumpns_vop_reclaim_desc", "rumpns_vfs_detach", "rumpns_VOP_ACCESS", "rumpns_spec_vnodeop_p", "rumpns_vfs_timestamp", "rumpns_vop_fdiscard_desc", "rumpns_genfs_revoke", "rumpns_genfs_eopnotsupp", "rumpns_rw_lock_held", "rumpns_vmem_destroy", "rumpns_vop_strategy_desc", "rumpns_vn_lock", "rumpns_vop_whiteout_desc", "rumpns_fifo_vnodeop_p", "rumpns_genfs_renamelock_enter", "rumpns_vmem_alloc", "rumpns_vop_parsepath_desc", "rumpns_genfs_can_chflags", "rumpns_vop_fcntl_desc", "rumpns_atomic_dec_32_nv", "rumpns_spec_fdiscard", "rumpns_vop_pathconf_desc", "rumpns_vop_rmdir_desc", "rumpns_atomic_or_32_nv", "rumpns_genfs_rename_cache_purge", "rumpns_ubc_uiomove", "rumpns_atomic_and_uint", "rumpns_strlen", "rumpns_vop_bwrite_desc", "rumpns_mutex_enter", "rumpns_genfs_renamelock_exit", "rumpns_kmem_zalloc", "rumpns_vop_read_desc", "rumpns_vcache_get", "rumpns_genfs_can_chown", "rumpns_cprng_fast32", "rumpns_vtype2dt", "rumpns_vop_lock_desc", "rumpns_cache_lookup", "rumpns_spec_advlock", "rumpns_vop_accessx_desc", "rumpns_uao_detach", "rumpns_vmem_create", "rumpns_uvm_availmem", "rumpns_vop_fsync_desc", "rumpns_rw_obj_hold", "rumpns_uao_create", "rumpns_vop_open_desc", "rumpns_vop_getattr_desc", "rumpns_kauth_accmode_to_action", "rumpns_vop_bmap_desc", "rumpns_memcpy", "rumpns_vcache_new", "rumpns_genfs_abortop", "rumpns_genfs_lock", "rumpns_vop_mknod_desc", "rumpns_vop_access_desc", "rumpns_vref", "rumpns_vattr_null", "rumpns_genfs_nullop", "rumpns_pool_allocator_nointr", "rumpns_vop_advlock_desc", "rumpns_genfs_getpages", "rumpns_kauth_authorize_vnode", "rumpns_vop_print_desc", "rumpns_cache_enter", "rumpns_kmem_free", "rumpns_vflush", "rumpns_vdead_check", "rumpns_vop_unlock_desc", "rumpns_atomic_swap_uint", "rumpns_atomic_inc_uint_nv", "rumpns_cache_purge1", "rumpns_pool_init", "rumpns_genfs_parsepath", "rumpns_genfs_accessx", "rumpns_spec_strategy", "stack_chk_fail", "rumpns_printf", "rumpns_spec_poll", "rumpns_vfs_getnewfsid", "rumpns_genfs_ufslike_remove_check_permitted", "rumpns_vn_default_error", "rumpns_genfs_ufslike_remove_check_possible", "rumpns_genfs_poll", "rumpns_vop_putpages_desc", "rumpns_vfs_stdextattrctl" ], "ms": { "elf": { "relro": "partial", "e_type": 3.0, "needed": [ "libc.so.12" ], "soname": "librumpfs_tmpfs.so.0", "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "has_soname": true, "note_count": 2.0, "entry_point": 29360.0, "needed_libs": 1.0, "dynsym_count": 292.0, "has_eh_frame": true, "stack_canary": true, "symtab_count": 353.0, "dynrela_count": 340.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 127.0, "debuglink_present": true, "program_header_count": 7.0, "section_header_count": 33.0, "load_segment_max_p_memsz": 83464.0, "load_segment_max_p_filesz": 83464.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 45902.0, "file_size": 110208.0, "entry_point": 29360.0, "has_overlay": true, "code_entropy": 3.98, "data_entropy": 1.95, "export_count": 107.0, "import_count": 186.0, "overlay_size": 2118.0, "string_count": 501.0, "overlay_ratio": 0.02, "section_count": 32.0, "avg_complexity": 8.12, "function_count": 146.0, "import_density": 4.15, "max_complexity": 93.0, "string_density": 11.18, "aliased_exports": 7.0, "overall_entropy": 2.82, "overlay_entropy": 1.52, "avg_basic_blocks": 11.36, "avg_section_size": 3274.84, "dependency_count": 1.0, "entropy_variance": 1.77, "function_density": 3.26, "avg_function_size": 783.64, "avg_string_length": 22.63, "complexity_per_kb": 0.18, "max_string_length": 89.0, "avg_string_entropy": 3.55, "code_to_data_ratio": 0.78, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.4, "total_basic_blocks": 1659.0, "string_length_stddev": 11.98, "debug_reference_count": 1.0, "largest_section_ratio": 0.4, "sentence_string_count": 40.0, "sentence_string_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "nonstandard_section_name_count": 7.0 } }, "ss": [ [ 9703, "__cxa_finalize" ], [ 9718, "__deregister_frame_info" ], [ 9742, "__register_frame_info" ], [ 9764, "_Jv_RegisterClasses" ], [ 9784, "rumpns_tmpfs_start" ], [ 9803, "rumpns_tmpfs_vget" ], [ 9821, "rumpns_tmpfs_sync" ], [ 9839, "rumpns_tmpfs_snapshot" ], [ 9861, "rumpns_tmpfs_init" ], [ 9879, "rumpns_pool_allocator_nointr" ], [ 9908, "rumpns_tmpfs_dirent_pool" ], [ 9933, "rumpns_pool_init" ], [ 9950, "rumpns_tmpfs_node_pool" ], [ 9973, "rumpns_tmpfs_done" ], [ 9991, "rumpns_pool_destroy" ], [ 10011, "rumpns_tmpfs_vfsops" ], [ 10031, "rumpns_vfs_attach" ], [ 10049, "rumpns_vfs_detach" ], [ 10067, "rumpns_tmpfs_mount" ], [ 10086, "rumpns_tmpfs_mem_info" ], [ 10108, "rumpns_uvmexp" ], [ 10122, "rumpns_vflush" ], [ 10136, "rumpns_tmpfs_mntmem_set" ], [ 10160, "rumpns_vfs_getnewfsid" ], [ 10182, "rumpns_kmem_zalloc" ], [ 10201, "rumpns_mutex_init" ], [ 10219, "rumpns_tmpfs_mntmem_init" ], [ 10244, "rumpns_x86_curlwp" ], [ 10262, "rumpns_set_statvfs_info" ], [ 10286, "rumpns_vattr_null" ], [ 10304, "rumpns_vcache_new" ], [ 10322, "rumpns_vrele" ], [ 10335, "rumpns_tmpfs_mntmem_destroy" ], [ 10363, "rumpns_mutex_destroy" ], [ 10384, "rumpns_kmem_free" ], [ 10401, "rumpns_kern_assert" ], [ 10420, "rumpns_tmpfs_vptofh" ], [ 10440, "rumpns_tmpfs_root" ], [ 10458, "rumpns_vcache_get" ], [ 10476, "rumpns_vn_lock" ], [ 10491, "rumpns_tmpfs_statvfs" ], [ 10512, "rumpns_mutex_enter" ], [ 10531, "rumpns_tmpfs_pages_avail" ], [ 10556, "rumpns_tmpfs_bytes_max" ], [ 10579, "rumpns_mutex_exit" ], [ 10597, "rumpns_copy_statvfs_info" ], [ 10622, "rumpns_tmpfs_unmount" ], [ 10643, "rumpns_tmpfs_free_node" ], [ 10666, "rumpns_tmpfs_dir_detach" ], [ 10690, "rumpns_tmpfs_free_dirent" ], [ 10715, "rumpns_tmpfs_fhtovp" ], [ 10735, "rumpns_atomic_inc_32" ], [ 10756, "rumpns_atomic_dec_32_nv" ], [ 10780, "rumpns_vput" ], [ 10792, "rumpns_eopnotsupp" ], [ 10810, "rumpns_tmpfs_loadvnode" ], [ 10833, "rumpns_tmpfs_newvnode" ], [ 10855, "rumpns_vfs_stdextattrctl" ], [ 10880, "rumpns_genfs_suspendctl" ], [ 10904, "rumpns_genfs_renamelock_enter" ], [ 10934, "rumpns_genfs_renamelock_exit" ], [ 10963, "rumpns_tmpfs_vnodeopv_descs" ], [ 10991, "rumpns_tmpfs_fifoop_opv_desc" ], [ 11020, "rumpns_tmpfs_specop_opv_desc" ], [ 11049, "rumpns_tmpfs_vnodeop_opv_desc" ], [ 11079, "rumpns_tmpfs_spec_close" ], [ 11103, "rumpns_vop_close_desc" ], [ 11125, "rumpns_spec_vnodeop_p" ], [ 11147, "rumpns_tmpfs_spec_read" ], [ 11170, "rumpns_tmpfs_update" ], [ 11190, "rumpns_vop_read_desc" ], [ 11211, "rumpns_tmpfs_spec_write" ], [ 11235, "rumpns_vop_write_desc" ], [ 11257, "rumpns_tmpfs_specop_p" ], [ 11279, "rumpns_tmpfs_specop_entries" ], [ 11307, "rumpns_vop_default_desc" ], [ 11331, "rumpns_vn_default_error" ], [ 11355, "rumpns_vop_parsepath_desc" ], [ 11381, "rumpns_genfs_badop" ], [ 11400, "rumpns_vop_lookup_desc" ], [ 11423, "rumpns_spec_lookup" ], [ 11442, "rumpns_vop_create_desc" ], [ 11465, "rumpns_vop_whiteout_desc" ], [ 11490, "rumpns_vop_mknod_desc" ], [ 11512, "rumpns_vop_open_desc" ], [ 11533, "rumpns_spec_open" ], [ 11550, "rumpns_vop_fallocate_desc" ], [ 11576, "rumpns_genfs_eopnotsupp" ], [ 11600, "rumpns_vop_fdiscard_desc" ], [ 11625, "rumpns_spec_fdiscard" ], [ 11646, "rumpns_vop_ioctl_desc" ], [ 11668, "rumpns_spec_ioctl" ], [ 11686, "rumpns_vop_poll_desc" ], [ 11707, "rumpns_spec_poll" ], [ 11724, "rumpns_vop_kqfilter_desc" ], [ 11749, "rumpns_spec_kqfilter" ], [ 11770, "rumpns_vop_revoke_desc" ], [ 11793, "rumpns_genfs_revoke" ], [ 11813, "rumpns_vop_mmap_desc" ], [ 11834, "rumpns_spec_mmap" ], [ 11851, "rumpns_vop_seek_desc" ], [ 11872, "rumpns_genfs_nullop" ], [ 11892, "rumpns_vop_remove_desc" ], [ 11915, "rumpns_vop_link_desc" ], [ 11936, "rumpns_vop_rename_desc" ], [ 11959, "rumpns_vop_mkdir_desc" ], [ 11981, "rumpns_vop_rmdir_desc" ], [ 12003, "rumpns_vop_symlink_desc" ], [ 12027, "rumpns_vop_readdir_desc" ], [ 12051, "rumpns_vop_readlink_desc" ], [ 12076, "rumpns_vop_abortop_desc" ], [ 12100, "rumpns_vop_bmap_desc" ], [ 12121, "rumpns_spec_bmap" ], [ 12138, "rumpns_vop_strategy_desc" ], [ 12163, "rumpns_spec_strategy" ], [ 12184, "rumpns_vop_pathconf_desc" ], [ 12209, "rumpns_spec_pathconf" ], [ 12230, "rumpns_vop_advlock_desc" ], [ 12254, "rumpns_spec_advlock" ], [ 12274, "rumpns_vop_getpages_desc" ], [ 12299, "rumpns_genfs_getpages" ], [ 12321, "rumpns_vop_putpages_desc" ], [ 12346, "rumpns_genfs_putpages" ], [ 12368, "rumpns_vop_access_desc" ], [ 12391, "rumpns_tmpfs_access" ], [ 12411, "rumpns_vop_accessx_desc" ], [ 12435, "rumpns_genfs_accessx" ], [ 12456, "rumpns_vop_getattr_desc" ], [ 12480, "rumpns_tmpfs_getattr" ], [ 12501, "rumpns_vop_setattr_desc" ], [ 12525, "rumpns_tmpfs_setattr" ], [ 12546, "rumpns_vop_fcntl_desc" ], [ 12568, "rumpns_genfs_fcntl" ], [ 12587, "rumpns_vop_fsync_desc" ], [ 12609, "rumpns_spec_fsync" ], [ 12627, "rumpns_vop_inactive_desc" ], [ 12652, "rumpns_tmpfs_inactive" ], [ 12674, "rumpns_vop_reclaim_desc" ], [ 12698, "rumpns_tmpfs_reclaim" ], [ 12719, "rumpns_vop_lock_desc" ], [ 12740, "rumpns_genfs_lock" ], [ 12758, "rumpns_vop_unlock_desc" ], [ 12781, "rumpns_genfs_unlock" ], [ 12801, "rumpns_vop_print_desc" ], [ 12823, "rumpns_tmpfs_print" ], [ 12842, "rumpns_vop_islocked_desc" ], [ 12867, "rumpns_genfs_islocked" ], [ 12889, "rumpns_vop_bwrite_desc" ], [ 12912, "rumpns_vn_bwrite" ], [ 12929, "rumpns_tmpfs_fifo_close" ], [ 12953, "rumpns_fifo_vnodeop_p" ], [ 12975, "rumpns_tmpfs_fifo_read" ], [ 12998, "rumpns_tmpfs_fifo_write" ], [ 13022, "rumpns_tmpfs_fifoop_p" ], [ 13044, "rumpns_tmpfs_fifoop_entries" ], [ 13072, "rumpns_vn_fifo_bypass" ], [ 13094, "rumpns_tmpfs_create" ], [ 13114, "rumpns_VOP_ISLOCKED" ], [ 13134, "rumpns_tmpfs_construct_node" ], [ 13162, "rumpns_tmpfs_mknod" ], [ 13181, "rumpns_tmpfs_mkdir" ], [ 13200, "rumpns_tmpfs_symlink" ], [ 13221, "rumpns_tmpfs_chflags" ], [ 13242, "rumpns_tmpfs_chtimes" ], [ 13263, "rumpns_tmpfs_chsize" ], [ 13283, "rumpns_tmpfs_chown" ], [ 13302, "rumpns_tmpfs_chmod" ], [ 13321, "rumpns_tmpfs_pathconf" ], [ 13343, "rumpns_genfs_pathconf" ], [ 13365, "rumpns_tmpfs_read" ], [ 13383, "rumpns_ubc_uiomove" ], [ 13402, "rumpns_tmpfs_close" ], [ 13421, "rumpns_tmpfs_fsync" ], [ 13440, "rumpns_tmpfs_readdir" ], [ 13461, "rumpns_kern_malloc" ], [ 13480, "rumpns_tmpfs_dir_getseq" ], [ 13504, "rumpns_tmpfs_dir_getdents" ], [ 13530, "rumpns_tmpfs_dir_lookupbyseq" ], [ 13559, "rumpns_tmpfs_advlock" ], [ 13580, "rumpns_lf_advlock" ], [ 13598, "rumpns_tmpfs_open" ], [ 13616, "rumpns_VOP_UNLOCK" ], [ 13634, "rumpns_printf" ], [ 13648, "rumpns_atomic_and_32" ], [ 13669, "rumpns_tmpfs_reg_resize" ], [ 13693, "rumpns_tmpfs_readlink" ], [ 13715, "rumpns_uiomove" ], [ 13730, "rumpns_tmpfs_update_locked" ], [ 13757, "rumpns_genfs_can_access" ], [ 13781, "rumpns_kauth_accmode_to_action" ], [ 13812, "rumpns_kauth_authorize_vnode" ], [ 13841, "rumpns_tmpfs_putpages" ], [ 13863, "rumpns_rw_write_held" ], [ 13884, "rumpns_rw_exit" ], [ 13899, "rumpns_tmpfs_write" ], [ 13918, "rumpns_tmpfs_getpages" ], [ 13940, "rumpns_rw_lock_held" ], [ 13960, "rumpns_tmpfs_update_lazily" ], [ 13987, "rumpns_vdead_check" ], [ 14006, "rumpns_tmpfs_whiteout" ], [ 14028, "rumpns_tmpfs_dir_lookup" ], [ 14052, "rumpns_tmpfs_alloc_dirent" ], [ 14078, "rumpns_tmpfs_dir_attach" ], [ 14102, "rumpns_tmpfs_link" ], [ 14120, "rumpns_tmpfs_remove" ], [ 14140, "rumpns_tmpfs_dir_cached" ], [ 14164, "rumpns_tmpfs_rmdir" ], [ 14183, "rumpns_cache_purge1" ], [ 14203, "rumpns_tmpfs_lookup" ], [ 14223, "rumpns_VOP_ACCESS" ], [ 14241, "rumpns_cache_lookup" ], [ 14261, "rumpns_cache_enter" ], [ 14280, "rumpns_genfs_can_sticky" ], [ 14304, "rumpns_vref" ], [ 14316, "rumpns_tmpfs_vnodeop_p" ], [ 14339, "rumpns_tmpfs_vnodeop_entries" ], [ 14368, "rumpns_genfs_parsepath" ], [ 14391, "rumpns_genfs_enoioctl" ], [ 14413, "rumpns_genfs_poll" ], [ 14431, "rumpns_genfs_kqfilter" ], [ 14453, "rumpns_genfs_mmap" ], [ 14471, "rumpns_genfs_seek" ], [ 14489, "rumpns_tmpfs_rename" ], [ 14509, "rumpns_genfs_abortop" ], [ 14530, "rumpns_genfs_sane_rename" ], [ 14555, "rumpns_genfs_ufslike_remove_check_possible" ], [ 14598, "rumpns_genfs_ufslike_remove_check_permitted" ], [ 14642, "rumpns_genfs_ufslike_rename_check_possible" ], [ 14685, "rumpns_genfs_ufslike_rename_check_permitted" ], [ 14729, "rumpns_tmpfs_strname_neqlen" ], [ 14757, "rumpns_tmpfs_strname_alloc" ], [ 14784, "rumpns_tmpfs_strname_free" ], [ 14810, "rumpns_memcpy" ], [ 14824, "rumpns_genfs_rename_cache_purge" ], [ 14856, "rumpns_genfs_insane_rename" ], [ 14883, "rumpns_uvm_vnp_setsize" ], [ 14906, "rumpns_cache_enter_id" ], [ 14928, "rumpns_spec_node_init" ], [ 14950, "rumpns_rw_obj_hold" ], [ 14969, "rumpns_uvm_obj_setlock" ], [ 14992, "rumpns_panic" ], [ 15005, "rumpns_tmpfs_node_get" ], [ 15027, "rumpns_cprng_fast32" ], [ 15047, "rumpns_vfs_timestamp" ], [ 15068, "rumpns_kauth_cred_geteuid" ], [ 15094, "rumpns_uao_create" ], [ 15112, "rumpns_atomic_or_32_nv" ], [ 15135, "rumpns_tmpfs_node_put" ], [ 15157, "rumpns_uao_detach" ], [ 15175, "rumpns_tmpfs_mem_decr" ], [ 15197, "rumpns_tmpfs_dirent_get" ], [ 15221, "rumpns_tmpfs_dirent_put" ], [ 15245, "rumpns_vmem_free" ], [ 15262, "rumpns_vmem_destroy" ], [ 15282, "rumpns_memcmp" ], [ 15296, "rumpns_vmem_alloc" ] ], "sz": 110208, "ts": [ { "c": 1.0, "d": ".gnu_debuglink reference present", "e": [ "librumpfs_tmpfs.so.0.0.debug" ], "i": "metadata/build/debug::elf-debuglink", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1659.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "d": ".so extension reference", "e": [ ".so", ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "libc.so.1" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 107.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.55" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 146.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 110208.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 107.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libc.so.12] (size: 1 (array))" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.82" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "ELF SONAME metadata", "e": [ "librumpfs_tmpfs.so.0" ], "i": "metadata/binary/linking/runtime::soname", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.8999999761581421, "d": "NetBSD RCS ident keyword", "e": [ "$NetBSD: tmpfs_subr.c,v 1.114.4.1 2023/08/01 15:29:23 martin Exp $", "$NetBSD: crtbegin.S,v 1.2 2010/11/30 18:37:59 joerg Exp $", "$NetBSD: tmpfs_vfsops.c,v 1.78 2022/11/10 10:54:14 hannken Exp $", "$NetBSD: tmpfs_specops.c,v 1.16 2021/07/19 01:30:25 dholland Exp $", "$NetBSD: tmpfs_rename.c,v 1.12 2021/10/20 14:28:21 thorpej Exp $", "$NetBSD: crti.S,v 1.1 2010/08/07 18:01:35 joerg Exp $", "$NetBSD: tmpfs_fifoops.c,v 1.15 2021/07/19 01:30:25 dholland Exp $", "$NetBSD: tmpfs_vnops.c,v 1.150 2022/06/01 08:42:38 hannken Exp $", "$NetBSD: tmpfs_mem.c,v 1.13 2020/06/11 19:20:46 ad Exp $", "$NetBSD: crtend.S,v 1.1 2010/08/07 18:01:34 joerg Exp $", "$NetBSD: crtn.S,v 1.1 2010/08/07 18:01:35 joerg Exp $" ], "i": "metadata/binary/provenance::netbsd-rcs-id", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Query or modify kernel state via sysctl", "e": [ "stop_link_set_sysctl_funcs", "start_link_set_sysctl_funcs" ], "i": "micro-behaviors/os/sysinfo/config::sysctl", "l": 2, "m": "E1082" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 146.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 107.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.949999988079071, "d": "Compact C type format section", "e": [ ".SUNW_ctf" ], "i": "metadata/binary/section/content::sunw-ctf-section", "l": 1 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be c6 f4 ff ff", "ba 5e f6 ff ff", "be 47 ee ff ff", "be b2 ed ff ff", "b8 3f c4 ff ff", "be ff be ff ff", "be 3a 83 ff ff", "be ce 65 ff ff", "be 13 62 ff ff", "be d7 51 ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 107.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 146.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1071.001", "d": "Port 23 (telnet)", "e": [ ":23" ], "i": "objectives/command-and-control/infrastructure/ip::port-23", "l": 1, "m": "C0002" }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 186.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 32.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 8.12" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1106", "d": "d_name field access", "e": [ "d_name" ], "i": "micro-behaviors/os/syscall/invoke::d-name-field", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "NetBSD-style /usr/src source path", "e": [ "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs.h", "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_rename.c", "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_subr.c", "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_mem.c", "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_vnops.c", "/usr/src/sys/rump/fs/lib/libtmpfs/../../../../fs/tmpfs/tmpfs_vfsops.c" ], "i": "metadata/binary/provenance::netbsd-source-tree-path", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 107.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "NX/DEP disabled (stack is executable)", "e": [ "elf.nx_enabled = 0.00" ], "i": "metadata/hardening::nx-disabled", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "ELF external debug artifact reference", "e": [ "librumpfs_tmpfs.so.0.0.debug" ], "i": "metadata/build/debug::external-debug-reference", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 } ], "sha": "9e29cdd4d32cd26e2bfa232c096dd7f63155b887d9fe58aa003c6f96b903b6d4", "path": "librumpfs_tmpfs.so.0.0", "type": "elf" } ], "tv": "6e0da" } }