{ "ml": { "v": "7", "eng": "2.9.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00013390183, "rte": "az", "prob": 0.00013390183 }, { "cls": 0, "raw": 0.0026310782, "rte": "az/whl", "prob": 0.0026310782 } ], "prob": 0.00013390183, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00013390183448791504, "type": "whl" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000008771817192609888, "type": "python" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010927517905656714, "type": "python" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000012715657248918433, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.00001913309097290039, "type": "python" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000009864568710327148, "type": "text" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000013192494407121558, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-12T20:36:49Z" }, "path": "cortex_crash-1.0.2-py3-none-any.whl", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MNC7el#?Up([=V003j6000\u0026o003IEA=+(quT[a+B7^jluUKy(ByexcAcV/BD+U-bqGvj-nOS@%A-3p=HlU8sus)wMykNQMKGTl(m8\u0026rAbE5VoeWmdgm4{z8gCI3)P%#}=bVLwNNjyFnevzAogE0JRuCPU", "ln": 0 } ], "mol": "H₂(DbPo₂)Md(Pa)", "sha": "9f5777093d07fb2dadae0124faa0a88bbcf06d51354fc81dc47a01c951474781", "path": "cortex_crash-1.0.2-py3-none-any.whl", "risk": 3, "size": 8026, "type": "whl", "facts": { "metrics": { "whl": { "native_extension_count": 0 }, "file": { "size": 8026, "entropy": 7.79 }, "binary": { "peak_region_bytes": 7168, "peak_region_entropy": 7.81 }, "archive": { "file_count": 11, "member_count": 11, "script_count": 5, "zip_bomb_ratio": 2.83, "compressed_size": 6476, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.42, "hidden_file_count": 0, "uncompressed_size": 15377, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 45, "rtlo_filename_count": 0, "format.regular_count": 11, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "timing.mtime_unique_count": 3, "timing.mtime_unique_ratio": 0.27, "misplaced_executable_count": 0, "timing.mtime_outlier_count": 5, "timing.mtime_dominant_count": 6, "timing.mtime_spread_seconds": 12322, "timing.sentinel_mtime_count": 0, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 0.55, "compression.method_counts.deflate": 11 }, "consistency": { "cloned_summary": 0, "name_typosquat": 0, "metadata_identity_mismatch": 0 } } }, "ident": { "name": { "value": "cortex_crash", "source": "whl.distribution", "verified": false }, "trust": "unsigned", "emails": [ "contact@trustandthread.com" ], "authors": [ { "name": "Trust \u0026 Thread", "role": "author", "email": "contact@trustandthread.com", "source": "whl.author" } ], "version": { "value": "1.0.2", "source": "whl.version", "verified": false } }, "traits": [ { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "file": 5 } ], "uses": [ 5 ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "from": [ { "file": 5 } ], "uses": [ 1 ] }, { "id": "micro-behaviors/data/decode/hex::hex-decode-int-16", "conf": 0.7, "crit": 3, "desc": "Hex decoding via int(x, 16)", "from": [ { "file": 3 } ] }, { "id": "metadata/package/scripts/entrypoint::wheel-console-entrypoint", "conf": 0.9, "crit": 3, "desc": "Package declares a console-script entry point", "from": [ { "file": 8 } ], "uses": [ 6, 7 ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "from": [ { "file": 5 } ] }, { "id": "metadata/package/scripts/entrypoint::console-scripts-entry", "conf": 0.88, "crit": 1, "desc": "Declares Python console-script entry points", "from": [ { "file": 8 } ] }, { "id": "metadata/package/scripts/entrypoint::entry-points-file", "conf": 0.95, "crit": 1, "desc": "Python package contains an entry_points.txt file", "from": [ { "file": 8 } ] } ] }, { "depth": 1, "facts": { "metrics": { "ast": { "max_depth": 4, "call_count": 0, "node_count": 14 }, "file": { "size": 91, "entropy": 4.85 }, "text": { "lines": 2, "top_char": 34, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 8, "char_entropy": 4.85, "unique_chars": 38, "top_char_null": 0, "string_density": 1, "top_char_ratio": 0.09, "avg_line_length": 44, "max_line_length": 67, "non_ascii_ratio": 0.03, "last_line_length": 21, "whitespace_ratio": 0.12, "identifier_density": 0.5, "line_length_stddev": 23, "normalized_string_count": 1.41, "normalized_unique_identifiers": 1 }, "binds": { "count": 1 }, "binary": { "peak_region_bytes": 91, "peak_region_entropy": 4.85 }, "strings": { "bytes": 67, "count": 2, "avg_length": 33.5, "max_length": 62, "avg_entropy": 3.01, "entropy_stddev": 1.49 }, "identifiers": { "count": 1, "unique": 1, "avg_length": 11, "max_length": 11, "min_length": 11, "avg_entropy": 2.73, "reuse_ratio": 1, "all_lowercase_ratio": 1, "double_underscore_count": 1, "underscore_prefix_count": 1 } } }, "id": 1, "path": "cortex_crash-1.0.2-py3-none-any.whl!!cortex_crash/__init__.py", "pid": 0, "risk": 1, "sha": "6bf439191bff1e042f617dd48977ab02fa11ba493658dcec2eec2555ef995f6c", "size": 91, "traits": [ { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "File uses a Python artifact extension", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/file/extension/token-shape::bare-alphanumeric-script-basename", "conf": 0.9, "crit": 2, "desc": "Script filename is a bare alphanumeric token", "spans": [ [ 0, 0 ] ] }, { "id": "objectives/impact/degrade/edr/teardown::safeboot-edr-vendor--rx-4", "atk": "T1562.001", "conf": 0.9, "crit": 1, "desc": "SafeBoot cleanup targets major EDR vendor", "spans": [ [ 6, 0 ] ] } ], "type": "python" }, { "depth": 1, "facts": { "imp": [ [ "", "FAULT_STATUS_BITS.items" ], [ "", "active.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "classify_address" ], [ "", "lines.append" ], [ "", "classify_address" ] ], "mbr": [ "FAULT_STATUS_BITS.items", "active.append", "lines.append" ], "tgt": [ "FAULT_STATUS_BITS.items", "active.append", "classify_address", "lines.append" ], "funcs": [ [ "classify_address", 1941 ], [ "decode_cfsr", 2406 ] ], "metrics": { "ast": { "op.shl": 21, "op.band": 3, "op.land": 2, "max_depth": 14, "call_count": 8, "node_count": 836, "member_count": 3, "max_array_len": 3, "op_density.shl": 0.03, "op_density.band": 0, "op_density.land": 0, "member_depth_max": 2, "self_compare_count": 1 }, "file": { "size": 3138, "entropy": 5.04 }, "text": { "lines": 59, "top_char": 101, "max_ws_run": 8, "digit_ratio": 0.08, "space_count": 654, "char_entropy": 5.04, "unique_chars": 78, "top_char_null": 0, "string_density": 1.17, "top_char_ratio": 0.06, "avg_line_length": 52.17, "max_line_length": 114, "non_ascii_ratio": 0, "empty_line_ratio": 0.15, "last_line_length": 16, "whitespace_ratio": 0.23, "identifier_density": 0.93, "line_length_stddev": 36.92, "normalized_string_count": 8.98, "repeated_char_sequences": 2, "normalized_unique_identifiers": 2.55 }, "binds": { "count": 3 }, "binary": { "peak_region_bytes": 3138, "peak_region_entropy": 5.04 }, "source": { "function_count": 2 }, "strings": { "bytes": 1638, "count": 69, "avg_length": 23.74, "max_length": 67, "avg_entropy": 3.32, "entropy_stddev": 0.78 }, "functions": { "count": 2, "density": 3.39, "avg_params": 2, "code_ratio": 0.54, "max_params": 3, "length_stddev": 4, "avg_name_length": 13.5, "avg_length_lines": 16, "max_length_lines": 20, "min_length_lines": 12, "avg_param_name_length": 4.25 }, "identifiers": { "count": 55, "unique": 15, "avg_length": 7.27, "max_length": 17, "min_length": 4, "avg_entropy": 2.41, "reuse_ratio": 0.27, "length_stddev": 4.2, "all_lowercase_ratio": 0.93, "all_uppercase_ratio": 0.07 } } }, "id": 2, "path": "cortex_crash-1.0.2-py3-none-any.whl!!cortex_crash/cfsr.py", "pid": 0, "risk": 1, "sha": "c49668e3ec381e509c755d0ab2b2bfc1a9d3edf6c8fa05d265213ca413810198", "size": 3138, "traits": [ { "id": "metadata/file/extension/identity::py", "conf": 1.0, "crit": 2, "desc": "File uses a Python artifact extension", "spans": [ [ 0, 0 ] ] } ], "type": "python" }, { "ctx": [ { "b": "a%Fj9vqfQ4wO#QgC{46Ax(n2nw]zYjB-7]9x\u003ep/$lRH67a%Fir3tBu@z/P}xvrc11vrcB23tBu@z/P}xB9R*lw].*batdeoB8\u0026yqze:AlBrCa9v@C)?uT)X?ATDA0z/3QHB-8zqzE:(7ze:AlBrC8", "ln": 0, "col": 1, "line": 1 }, { "b": "A+PAkuVQa0AbYxg3jo*5qD3d.p9qXxa#7Y7e\u00261QT3s)ZWaAg+fB7FY(wQ2RDvqEwN3lQDlaAz4nB-Ivxx(n2vC42htB98CpA40d/y\u0026sJeAWSv?A+fiavpJ\u003c%a#1l=efDbXdk2TLAbn@)wHF-Na$K\u0026Xa$k5=f/yD/3s)ZWaz\u003eL3zyu}{3lQDlaAg+fB7GwmjS[fNxk?p1B7D%\u0026A+xJiwO#P^vrcB2AWRnqarR^HarR!CA=kONb4CLiBy/XGv@=10xD!#marR^HarR^HwmY*(A+PGmx(v(Lb2@I{w[+*!ave[1avy6/By/XGo=#/zvrl98l${7xzF%N", "ln": 153, "col": 23, "line": 7 }, { "b": "B7Gxke[5p3uVoB]B7Gwub5*$hB7DKDaztt5A6kykwN/T?wGV28xk8BewPz\u0026mvqYP#B-8zwB-7.jB97\u00262yANkfvqPN1dgdguarUSgAa9^dwIdz4wm5+=xlw65zGEoJeIgEAB8\u0026DQaAR)FwJ+9RAX5tDwO=rGb11*#qxPT:CP.fry\u0026%qic$L2ze*8?", "ln": 651, "col": 21, "line": 24 }, { "b": "c)y!#asXG(i4kgwarR^Hx\u003ewF@A+xCCv@Dj3vqYP#jV%]ix(mTbeN]$=3lQDlarR^HaAhvnzGGlbzFs6ewPPsH3jm)#arUlix\u003ewF@A+xCCv@Dj3vqYP#jV%]iv}G!5b035NarR^", "ln": 1980, "col": 10, "line": 52 }, { "b": "au.\u003egb6v^Ex(mD9iTM#LarR^HarUopvqPN.C42idauZ\u0026KAa9^dwNxaZCQN!=azbLjaB22yzxJwdxlbXCwOl6\u00263lQDlarR^HaAhvnzGEoJtY7-ryhW*7c$D[0z!9A^w].r%wHIehvqPN.C42idefFwwxlbXpy?taBdgcz8arR!ry?WG7vrc14e[n*pzddr)auY", "ln": 2266, "col": 22, "line": 62 }, { "b": "nmuKHmQZBQBrA[^vpK7Zz*iy7z/oDcx(\u003eECbS4IgiWc0WarR^HAb]VgBsnsQxMOunB2\u003e%czdNl(wmo7^vrb{ixlw6iz^^fev@Diqy+GWzv}Zgba$i\u003cwarR!CA+PAkc)x^6A+e/8mRM)WCvtJ6avx*Nv@2){B96C=xMOunB2\u003e%cCxXl-BAhIBByx5$BzbYavpR02z/4dtx(X6mvrb{hv}YB-yIWZaBt1*!3lQDlaAhvnzGEoJjT80#at#hd3lQDlaAz4nB-IvxfBwe3w/$C/zEEx[uTB{sjS\u003e}QuU%j=zEl-{iTM#LarU-JB1R3Gx(\u003e+uvqfQcdjCYk", "ln": 3056, "col": 28, "line": 80 } ], "depth": 1, "facts": { "imp": [ [ "", "int" ], [ "", "val.strip().lower().replace(\"0x\", \"\").replace" ], [ "", "val.strip().lower().replace" ], [ "", "val.strip().lower" ], [ "", "val.strip" ], [ "", "argparse.ArgumentParser" ], [ "", "parser.add_argument" ], [ "", "parser.add_subparsers" ], [ "", "subparsers.add_parser" ], [ "", "p_parse.add_argument" ], [ "", "p_parse.add_argument" ], [ "", "p_parse.add_argument" ], [ "", "p_parse.add_argument" ], [ "", "p_parse.add_argument" ], [ "", "subparsers.add_parser" ], [ "", "p_cfsr.add_argument" ], [ "", "p_cfsr.add_argument" ], [ "", "subparsers.add_parser" ], [ "", "p_unwind.add_argument" ], [ "", "p_unwind.add_argument" ], [ "", "subparsers.add_parser" ], [ "", "parser.parse_args" ], [ "", "parser.print_help" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "print_snippet" ], [ "", "parse_hex" ], [ "", "parse_hex" ], [ "", "print" ], [ "", "\"\\n\".join" ], [ "", "decode_cfsr" ], [ "", "parse_hex" ], [ "", "print" ], [ "", "\"\\n\".join" ], [ "", "decode_frame" ], [ "", "parse_hex" ], [ "", "parse_hex" ], [ "", "parse_hex" ], [ "", "print" ], [ "", "print" ], [ "", "\"\\n\".join" ], [ "", "decode_cfsr" ], [ "", "parse_hex" ], [ "", "print" ], [ "", "print" ], [ "", "\"\\n\".join" ], [ "", "decode_frame" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "print" ], [ "", "sys.exit" ], [ "", "main" ], [ "", ".cfsr" ], [ "", ".cfsr.decode_cfsr" ], [ "", ".snippet" ], [ "", ".snippet.print_snippet" ], [ "", ".unwind" ], [ "", ".unwind.decode_frame" ], [ "", "argparse" ], [ "", "sys" ] ], "mbr": [ "argparse.ArgumentParser", "args.bfar", "args.cfsr", "args.command", "args.elf", "args.frame", "args.mmfar", "args.regs", "p_cfsr.add_argument", "p_parse.add_argument", "p_unwind.add_argument", "parser.add_argument", "parser.add_subparsers", "parser.parse_args", "parser.print_help", "subparsers.add_parser", "sys.exit", "val.strip", "val.strip().lower", "val.strip().lower().replace", "val.strip().lower().replace().replace" ], "tgt": [ "argparse.ArgumentParser", "decode_cfsr", "decode_frame", "int", "main", "p_cfsr.add_argument", "p_parse.add_argument", "p_unwind.add_argument", "parse_hex", "parser.add_argument", "parser.add_subparsers", "parser.parse_args", "parser.print_help", "print", "print_snippet", "subparsers.add_parser", "sys.exit", "val.strip", "val.strip().lower", "val.strip().lower().replace", "val.strip().lower().replace().replace" ], "funcs": [ [ "parse_hex", 186 ], [ "main", 282 ] ], "metrics": { "ast": { "op.add": 1, "op.mul": 4, "max_depth": 16, "call_count": 56, "node_count": 1070, "member_count": 21, "op_density.add": 0, "op_density.mul": 0, "max_concat_chain": 3, "member_depth_max": 5 }, "file": { "size": 3320, "entropy": 4.95 }, "text": { "lines": 87, "top_char": 114, "max_ws_run": 1, "digit_ratio": 0.02, "space_count": 586, "char_entropy": 4.95, "unique_chars": 80, "top_char_null": 0, "string_density": 0.72, "top_char_ratio": 0.07, "avg_line_length": 37.15, "max_line_length": 100, "empty_line_ratio": 0.21, "last_line_length": 20, "whitespace_ratio": 0.2, "identifier_density": 2.14, "line_length_stddev": 30.3, "normalized_string_count": 6.75, "repeated_char_sequences": 8, "trailing_whitespace_lines": 1, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 8.07 }, "binds": { "count": 14 }, "binary": { "peak_region_bytes": 3320, "peak_region_entropy": 4.96 }, "source": { "function_count": 2 }, "imports": { "count": 8, "relative": 6, "stdlib_count": 2, "stdlib_ratio": 0.25, "relative_ratio": 0.75, "third_party_count": 6, "third_party_ratio": 0.75 }, "strings": { "bytes": 965, "count": 63, "avg_length": 15.32, "max_length": 76, "avg_entropy": 2.38, "empty_count": 2, "entropy_stddev": 1.53 }, "comments": { "chars": 61, "count": 4, "lines": 4, "to_code_ratio": 0.05 }, "functions": { "count": 2, "density": 2.3, "avg_params": 0.5, "code_ratio": 0.84, "max_params": 1, "length_stddev": 34.5, "avg_name_length": 6.5, "no_params_count": 1, "avg_length_lines": 36.5, "max_length_lines": 71, "min_length_lines": 2, "avg_param_name_length": 3 }, "identifiers": { "count": 186, "unique": 52, "avg_length": 6.75, "max_length": 14, "min_length": 1, "avg_entropy": 2.36, "reuse_ratio": 0.28, "length_stddev": 3.14, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.02, "all_lowercase_ratio": 0.96, "all_uppercase_ratio": 0.02, "double_underscore_count": 1, "underscore_prefix_count": 1 } } }, "id": 3, "mol": "H(Db)", "path": "cortex_crash-1.0.2-py3-none-any.whl!!cortex_crash/cli.py", "pid": 0, "risk": 1, "sha": "44adfe6eb3125fa1c0b3e134599b90c163fcf84d9439c1171cb25a55df468b54", "size": 3320, "traits": [ { "id": "micro-behaviors/data/decode/hex::hex-decode-int-16", "conf": 0.7, "crit": 3, "desc": "Hex decoding via int(x, 16)", "spans": [ [ 217, 3 ] ] } ], "type": "python" }, { "ctx": [ { "b": "[4lsUa%G%cvpK6}B-8zqzE^s0ayPd#aAI*BvSc69A+frgy\u0026%\u0026lz/cXlz!A=]e*qF-3jpG:AbP=saAIjsBzkK#x(d*cA=-BBBZ/rgz!0v1A%-mzqBa2CuS6r.qY[jCtoX8wa$K\u0026XAXO:?ar\u003e?Ya$K\u0026XAX!)\u003car\u003e?Xg9Om(b5zozefDcQv\u003ciDDb6X6FAW1=@3pO5:uS6r(rz(O0og.(DauZ\u0026]3lQDlatw3]f/*B9b1McWwnC*$az(4cwH[@#q=21/zF{T!p:dCkmG", "ln": 0, "col": 1, "line": 1 }, { "b": "wmYo]w].r%wG\u0026VFrc0a)dj+*O3jmbJwO967x\u003e7{=vpS[?ghHVxwHF#*3lQDlazbLjaAO-uzxHtKvrcipzF%A7eOev1x!r+7wo6Cwx(mGaefDcBwmPZoy?W=#a$kLWarR^HarR^Hx\u003ewGexMXAhy+x{Bx\u003e7*8BsxlTarR^HarR^HarR^HA+funA=91w3lQDlaAz4nB-Ivxph+2Y3jmbJwO95[wmPZoy?W=#d0fxCy+cYuy?tjvvpS[?dlm!UarR!vw/$#fBrCWzz!{LmAV/mrBrCdhw\u0026ZnwarR^HarR!EwPS6nzxIX)zE\u003cd$arR!GA^oXMarR^HarR^HAV^H/B9g@hA=kD0B8@%OB-5QiBz(8lefDb*w*e=Ga$VeaefDb*wG\u0026VFwO+%faz8/KCZA\u003efwo6Z+i9pOMt}us9arR^HarR^HarR^HarR^HarR^HarR^HarUf5AcckywNxv#Bz#wAjYDDAwH[%CwQ5qWrc0a)efG4GzdNTdBuIujdgdguarR^HarUGmzE)(ijS)%Be]#bPx(CEHazbLjaz-fmzxJ%LB97@hB-YlSBAh8mc[c=\u0026Abolgy?W=#B0@EWx\u003ewG7e]#bPx(CEHt).X%arR^HarUxgaz+Rbc#rQnwPGpyk0p2zayL", "ln": 465, "col": 39, "line": 14 }, { "b": "B6yt7iTM#LarR^HarR^HarUYoBAIRwaz++fwPI6ft}vamx(mH6tqoy\u003carR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhiTM#LarR^HarUSiB8}WharR!EwPS6nzxIX)zE\u003cdZ3s)ZWay]4[z!9A^CYm.Ad0PYLAW:3RarR^Hy?W=#B09Q*tu}NUarR!vAc34xjS[#*B8\u0026xIatw3{mN^.c", "ln": 994, "col": 48, "line": 32 }, { "b": "az2w6w/$#1zdK\u00267zxHtKAap7yar\u003eSxa$jTyzE:\u003erC42hfclL2(iTM#LarR^HarR^HarUMuBy=NTar\u0026jkxMXf3ayY5baAIaodiY9warR^HarR!ry\u0026:eG3lQDlarR^HarR^", "ln": 2308, "col": 8, "line": 75 }, { "b": "nLRVaxjVfkzy=[Uw*gn:A+O%1BrAnZDU^.fC42hfclL0!mN/BvEiHi+zF%RtvScg3c#r{hC42hfclKY\u003eauR+eg:%\u003e5dgdguarR^HarUGmzE)(wvq{f%zE+ecb3Y1\u0026mox", "ln": 2690, "col": 32, "line": 88 } ], "depth": 1, "facts": { "imp": [ [ "", "shutil.which" ], [ "", "subprocess.run" ], [ "", "l.strip" ], [ "", "r.stdout.strip().splitlines" ], [ "", "r.stdout.strip" ], [ "", "l.strip" ], [ "", "len" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "pick_addr2line" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "zip" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "decode_xpsr" ], [ "", "lines.append" ], [ "", "EXC_RETURN_KIND.get" ], [ "", "bool" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "addr2line" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "addr2line" ], [ "", "lines.append" ], [ "", "lines.append" ], [ "", "shutil" ], [ "", "subprocess" ] ], "mbr": [ "EXC_RETURN_KIND.get", "l.strip", "lines.append", "r.stdout", "r.stdout.strip", "r.stdout.strip().splitlines", "shutil.which", "subprocess.run" ], "tgt": [ "EXC_RETURN_KIND.get", "addr2line", "bool", "decode_xpsr", "l.strip", "len", "lines.append", "pick_addr2line", "r.stdout.strip", "r.stdout.strip().splitlines", "shutil.which", "subprocess.run", "zip" ], "funcs": [ [ "pick_addr2line", 488 ], [ "addr2line", 632 ], [ "decode_xpsr", 1091 ], [ "decode_frame", 1949 ] ], "metrics": { "ast": { "op.add": 1, "op.lor": 1, "op.mul": 2, "op.shl": 2, "op.sub": 1, "op.band": 9, "op.bnot": 2, "op.land": 4, "max_depth": 16, "call_count": 39, "node_count": 1238, "member_count": 8, "max_array_len": 8, "op_density.add": 0, "op_density.lor": 0, "op_density.mul": 0, "op_density.shl": 0, "op_density.sub": 0, "op_density.band": 0.01, "op_density.bnot": 0, "op_density.land": 0, "max_concat_chain": 2, "member_depth_max": 4 }, "file": { "size": 3552, "entropy": 4.8 }, "text": { "lines": 111, "top_char": 101, "max_ws_run": 6, "digit_ratio": 0.05, "space_count": 893, "char_entropy": 4.8, "unique_chars": 88, "top_char_null": 0, "string_density": 0.49, "top_char_ratio": 0.07, "avg_line_length": 30.99, "max_line_length": 104, "non_ascii_ratio": 0, "empty_line_ratio": 0.15, "last_line_length": 16, "whitespace_ratio": 0.28, "identifier_density": 1.59, "line_length_stddev": 23.64, "normalized_string_count": 5.13, "repeated_char_sequences": 9, "suspicious_identifier_ratio": 0.09, "normalized_unique_identifiers": 6.48 }, "binds": { "count": 18 }, "binary": { "peak_region_bytes": 3552, "peak_region_entropy": 4.77 }, "source": { "function_count": 4 }, "imports": { "count": 2, "stdlib_count": 2, "stdlib_ratio": 1 }, "strings": { "bytes": 1075, "count": 54, "avg_length": 19.91, "max_length": 74, "avg_entropy": 2.84, "empty_count": 1, "entropy_stddev": 1.48 }, "functions": { "count": 4, "density": 3.6, "avg_params": 1.5, "code_ratio": 0.79, "max_params": 3, "length_stddev": 15.95, "avg_name_length": 11.5, "no_params_count": 1, "avg_length_lines": 22, "max_length_lines": 47, "min_length_lines": 5, "high_entropy_names": 1, "avg_param_name_length": 3.83 }, "identifiers": { "count": 176, "unique": 44, "avg_length": 5.7, "max_length": 15, "min_length": 1, "avg_entropy": 1.99, "reuse_ratio": 0.25, "length_stddev": 3.67, "has_digit_ratio": 0.05, "sequential_names": 4, "single_char_count": 4, "single_char_ratio": 0.09, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.89, "all_uppercase_ratio": 0.05 } } }, "id": 5, "mol": "H(Po₂)", "path": "cortex_crash-1.0.2-py3-none-any.whl!!cortex_crash/unwind.py", "pid": 0, "risk": 1, "sha": "05c2674f41444216ba0682dd7cbf31b09ea276882a648cf6b091191f08796cec", "size": 3552, "traits": [ { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 75, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::run-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Calls subprocess.run to launch a process", "spans": [ [ 733, 14 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 1 ], "spans": [ [ 721, 27 ], [ 733, 14 ] ] }, { "id": "micro-behaviors/process/create/direct::process-launch-call-text", "conf": 0.92, "crit": 3, "desc": "Child-process launch capability", "uses": [ 2 ], "spans": [ [ 721, 27 ], [ 733, 14 ] ] } ], "type": "python" }, { "ctx": [ { "b": "tvRO?B8L(auVPZ$x(Ffnt)+7WA=+(qeN@*fB7=WVay/tgBy/Y7v@=10xF9!hx/Z9tx(jm", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 55, "entropy": 4.26 }, "binary": { "peak_region_bytes": 55, "peak_region_entropy": 4.26 } } }, "id": 8, "mol": "Md(Pa)", "path": "cortex_crash-1.0.2-py3-none-any.whl!!cortex_crash-1.0.2.dist-info/entry_points.txt", "pid": 0, "risk": 1, "sha": "2cd83d406f9dfbeed4761d4a9691303e910032e1934f4aec82d949900235bc23", "size": 55, "traits": [ { "id": "metadata/package/scripts/entrypoint::console-scripts-entry", "conf": 0.88, "crit": 1, "desc": "Declares Python console-script entry points", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/scripts/entrypoint::entry-points-file", "conf": 0.95, "crit": 1, "desc": "Python package contains an entry_points.txt file", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/scripts/entrypoint::wheel-console-entrypoint", "conf": 0.9, "crit": 3, "desc": "Package declares a console-script entry point", "uses": [ 0, 1 ], "spans": [ [ 0, 16 ] ] } ], "type": "text" }, { "id": 10, "mol": "Md(Re)", "sha": "a0e8cfdf37223c24a0a44cb300c6d18d255a2cd077cffa698a6e9c70850b5036", "path": "cortex-crash@1.0.2.registry.json", "risk": 1, "size": 855, "type": "registry", "depth": 1 } ], "omitted_files": 1, "rev": "c7f7e", "v": "8" } }