{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.000010420878425065894 } ], "prob": 0.000010420878, "models": [ { "m": "az", "raw": 0.000010420878, "prob": 0.000010420878, "class": 0 }, { "m": "az/source", "raw": 0.00004091859, "prob": 0.00004091859, "class": 0 }, { "m": "az/rust", "raw": 0.000000029802322, "prob": 0.000000029802322, "class": 0 } ], "version": "v18.18", "analyzed_at": "2026-06-09T10:54:56Z" }, "path": "syscall.rs", "raw": { "v": "6", "fs": [ { "f": "H(Mg)", "x": 2, "ff": { "i": [ [ "", "string.bytes" ], [ "", "get_ntdll_address" ], [ "", "get_export_ntdll.expect" ], [ "", "get_export_ntdll" ], [ "", "ssn.expect" ], [ "", "ssn" ], [ "", "NtCurrentPeb" ], [ "", "cfg" ], [ "", "Err" ], [ "", "dll_base.wrapping_add" ], [ "", "Err" ], [ "", "dll_base.wrapping_add" ], [ "", "Ok" ], [ "", "read" ], [ "", "from_raw_parts" ], [ "", "from_raw_parts" ], [ "", "from_raw_parts" ], [ "", "dbj2" ], [ "", "read" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "Ok" ], [ "", "read" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "Ok" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "read" ], [ "", "address.offset" ], [ "", "Ok" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "read" ], [ "", "address.add" ], [ "", "address.add" ], [ "", "address.add" ], [ "", "address.add" ], [ "", "Ok" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "address.offset" ], [ "", "Ok" ], [ "", "Err" ], [ "", "readgsqword" ], [ "", "readfsdword" ] ], "m": { "ast": { "op.eq": 33.0, "op.ne": 2.0, "op.add": 35.0, "op.bor": 5.0, "op.mul": 32.0, "op.shl": 6.0, "op.sub": 2.0, "op.land": 25.0, "max_depth": 33.0, "bind_count": 1.0, "call_count": 116.0, "node_count": 2864.0, "member_count": 11.0, "op_density.eq": 0.01, "op_density.ne": 0.0, "op_density.add": 0.01, "op_density.bor": 0.0, "op_density.mul": 0.01, "op_density.shl": 0.0, "op_density.sub": 0.0, "op_density.land": 0.01, "identifier_count": 104.0, "member_depth_max": 2.0, "string_literal_count": 12.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 10684.0, "entropy": 4.54, "size_bytes": 10684.0 }, "text": { "digit_ratio": 0.05, "space_count": 3641.0, "total_lines": 293.0, "char_entropy": 4.54, "unique_chars": 86.0, "string_density": 0.04, "avg_line_length": 35.47, "max_line_length": 123.0, "empty_line_ratio": 0.07, "last_line_length": 1.0, "whitespace_ratio": 0.37, "most_common_ratio": 0.05, "identifier_density": 1.53, "line_length_stddev": 28.75, "normalized_string_count": 0.7, "repeated_char_sequences": 95.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.02, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 50.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 12.69 }, "binds": { "count": 1.0 }, "calls": { "count": 116.0 }, "binary": { "overall_entropy": 4.54 }, "source": { "function_count": 8.0 }, "members": { "count": 11.0 }, "strings": { "total": 12.0, "avg_length": 13.67, "max_length": 32.0, "avg_entropy": 2.98, "empty_count": 1.0, "total_bytes": 164.0, "entropy_stddev": 0.95 }, "comments": { "chars": 2097.0, "lines": 88.0, "total": 88.0, "to_code_ratio": 0.43, "high_entropy_comments": 2.0 }, "functions": { "count": 8.0, "avg_params": 1.0, "max_params": 3.0, "length_stddev": 35.57, "over_100_lines": 1.0, "avg_name_length": 10.63, "no_params_count": 2.0, "avg_length_lines": 23.25, "max_length_lines": 117.0, "min_length_lines": 5.0, "numeric_suffix_names": 1.0, "avg_param_name_length": 8.13, "density_per_100_lines": 2.73, "code_in_functions_ratio": 0.63 }, "identifiers": { "count": 104.0, "total": 448.0, "avg_length": 8.07, "max_length": 23.0, "min_length": 1.0, "avg_entropy": 2.43, "reuse_ratio": 0.23, "unique_count": 104.0, "length_stddev": 5.24, "has_digit_ratio": 0.03, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.02, "high_entropy_count": 8.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.66, "all_uppercase_ratio": 0.09, "numeric_suffix_count": 3.0, "underscore_prefix_count": 2.0 } }, "s": [ [ 379, "10", "255" ], [ 403, "10", "32" ], [ 427, "10", "32" ], [ 651, "10", "5381" ], [ 713, "10", "5" ], [ 1117, "u8", "[!] Error exporting DLL" ], [ 1118, "u8", "[!] Error exporting DLL" ], [ 1187, "u8", "[!] Error getting syscall number" ], [ 1188, "u8", "[!] Error getting syscall number" ], [ 1749, "u8", "x86_64" ], [ 1750, "u8", "x86_64" ], [ 1762, "16", "16" ], [ 1777, "16", "8" ], [ 2410, "u8", "[!] INVALID DOS SIGNATURE" ], [ 2411, "u8", "[!] INVALID DOS SIGNATURE" ], [ 2659, "u8", "[!] INVALID NT SIGNATURE" ], [ 2660, "u8", "[!] INVALID NT SIGNATURE" ], [ 2799, "10", "0" ], [ 4297, "10", "0" ], [ 4831, "16", "76" ], [ 4876, "10", "1" ], [ 4883, "16", "139" ], [ 4928, "10", "2" ], [ 4935, "16", "209" ], [ 4980, "10", "3" ], [ 4987, "16", "184" ], [ 5032, "10", "6" ], [ 5039, "16", "0" ], [ 5084, "10", "7" ], [ 5091, "16", "0" ], [ 5163, "10", "5" ], [ 5222, "10", "4" ], [ 5273, "10", "8" ], [ 5408, "16", "233" ], [ 5446, "10", "1" ], [ 5575, "16", "76" ], [ 5628, "10", "1" ], [ 5648, "16", "139" ], [ 5701, "10", "2" ], [ 5721, "16", "209" ], [ 5774, "10", "3" ], [ 5794, "16", "184" ], [ 5847, "10", "6" ], [ 5867, "16", "0" ], [ 5920, "10", "7" ], [ 5940, "16", "0" ], [ 6036, "10", "5" ], [ 6120, "10", "4" ], [ 6196, "10", "8" ], [ 6425, "16", "76" ], [ 6481, "10", "1" ], [ 6508, "16", "139" ], [ 6564, "10", "2" ], [ 6591, "16", "209" ], [ 6647, "10", "3" ], [ 6674, "16", "184" ], [ 6730, "10", "6" ], [ 6757, "16", "0" ], [ 6813, "10", "7" ], [ 6840, "16", "0" ], [ 6939, "10", "5" ], [ 7033, "10", "4" ], [ 7116, "10", "8" ], [ 7333, "10", "3" ], [ 7340, "16", "233" ], [ 7378, "10", "1" ], [ 7507, "16", "76" ], [ 7560, "10", "1" ], [ 7580, "16", "139" ], [ 7633, "10", "2" ], [ 7653, "16", "209" ], [ 7706, "10", "3" ], [ 7726, "16", "184" ], [ 7779, "10", "6" ], [ 7799, "16", "0" ], [ 7852, "10", "7" ], [ 7872, "16", "0" ], [ 7968, "10", "5" ], [ 8052, "10", "4" ], [ 8128, "10", "8" ], [ 8357, "16", "76" ], [ 8413, "10", "1" ], [ 8440, "16", "139" ], [ 8496, "10", "2" ], [ 8523, "16", "209" ], [ 8579, "10", "3" ], [ 8606, "16", "184" ], [ 8662, "10", "6" ], [ 8689, "16", "0" ], [ 8745, "10", "7" ], [ 8772, "16", "0" ], [ 8871, "10", "5" ], [ 8965, "10", "4" ], [ 9048, "10", "8" ], [ 9506, "u8", "x86_64" ], [ 9507, "u8", "x86_64" ], [ 9546, "16", "96" ], [ 9596, "u8", "x86" ], [ 9597, "u8", "x86" ], [ 9633, "16", "48" ], [ 9935, "u8", "x86_64" ], [ 9936, "u8", "x86_64" ], [ 10044, "u8", "mov {}, gs:[{:e}]" ], [ 10045, "u8", "mov {}, gs:[{:e}]" ], [ 10447, "u8", "x86" ], [ 10448, "u8", "x86" ], [ 10553, "u8", "mov {:e}, fs:[{:e}]" ], [ 10554, "u8", "mov {:e}, fs:[{:e}]" ] ], "v": { "file.stem": "syscall", "file.basename": "syscall.rs", "source.language": "rust", "source.imports[0]": "Err", "source.imports[1]": "NtCurrentPeb", "source.imports[2]": "Ok", "source.imports[3]": "address.add", "source.imports[4]": "address.offset", "source.imports[5]": "cfg", "source.imports[6]": "dbj2", "source.imports[7]": "dll_base.wrapping_add", "source.imports[8]": "from_raw_parts", "source.imports[9]": "get_export_ntdll", "source.strings[0]": "[!] Error exporting DLL", "source.strings[1]": "[!] Error getting syscall number", "source.strings[2]": "[!] INVALID DOS SIGNATURE", "source.strings[3]": "[!] INVALID NT SIGNATURE", "source.strings[4]": "mov {:e}, fs:[{:e}]", "source.strings[5]": "mov {}, gs:[{:e}]", "source.strings[6]": "x86_64", "source.has_imports": true, "source.imports[10]": "get_export_ntdll.expect", "source.imports[11]": "get_ntdll_address", "source.imports[12]": "read", "source.imports[13]": "readfsdword", "source.imports[14]": "readgsqword", "source.imports[15]": "ssn", "source.imports[16]": "ssn.expect", "source.imports[17]": "string.bytes", "source.functions[0]": "NtCurrentPeb", "source.functions[1]": "__readfsdword", "source.functions[2]": "__readgsqword", "source.functions[3]": "dbj2", "source.functions[4]": "get_export_ntdll", "source.functions[5]": "get_ntdll_address", "source.functions[6]": "get_ssn", "source.functions[7]": "ssn" }, "ct": [ "Err", "NtCurrentPeb", "Ok", "__readfsdword", "__readgsqword", "address.add", "address.offset", "dbj2", "dll_base.wrapping_add", "from_raw_parts", "get_export_ntdll", "get_export_ntdll().expect", "get_ntdll_address", "read", "ssn", "ssn().expect", "string.bytes" ], "id": "rust", "mc": [ "address.add", "address.offset", "dll_base.wrapping_add", "export_directory.AddressOfFunctions", "export_directory.AddressOfNameOrdinals", "export_directory.AddressOfNames", "export_directory.NumberOfFunctions", "export_directory.NumberOfNames", "get_export_ntdll().expect", "ssn().expect", "string.bytes" ] }, "id": 0, "sz": 10684, "ts": [ { "c": 1.0, "d": "Inline assembly macro", "e": [ "asm!(" ], "i": "micro-behaviors/mem/inline-asm/arch::macro", "l": 3 }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "Result" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary number", "e": [ "number" ], "i": "metadata/file/text/format::vocab-number", "l": 1 }, { "c": 0.8600000143051147, "d": "Permission-grant action verb keyword", "e": [ "allow" ], "i": "micro-behaviors/data/text/keywords/media-permission::permission-grant-verb", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary invalid", "e": [ "invalid" ], "i": "metadata/file/text/format::vocab-invalid", "l": 1 }, { "c": 0.9700000286102295, "d": "Form-validation vocabulary in dense non-ASCII file", "e": [ "invalid", "number", "string" ], "i": "metadata/file/text/format::i18n-validation-vocab", "l": 1 } ], "sha": "a7d636cda2afd1cfaba0c00713e5199ed52bc3f856feb6c698df23908abaa79a", "path": "syscall.rs", "type": "rust" } ], "tv": "35641" } }