{
  "ml": {
    "v": "7",
    "eng": "2.2.0-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00004498164,
        "rte": "az",
        "prob": 0.00004498164
      }
    ],
    "prob": 0.00006368756,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006368756294250488,
        "type": "zst"
      },
      {
        "id": 1,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00006368756294250488,
        "type": "elf"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-28T00:18:29Z"
  },
  "path": "snd-hda-scodec-cs35l41.ko.zst",
  "raw": {
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "b": "d77-bQ+PvX00Cv:SUSYwp9rJMzIRpI:2I7#CW*XjR2",
            "n": [
              {
                "c": 2,
                "d": "Binary is not digitally signed",
                "i": "metadata/unsigned",
                "o": 0,
                "z": 1,
                "cf": 1.0
              }
            ],
            "ln": 0
          }
        ],
        "mol": "O₂(AsC)",
        "sha": "ac273c4679264b9d109192c7afefe4ec103f71b8d48a3227666d09aa88db5de0",
        "path": "snd-hda-scodec-cs35l41.ko.zst",
        "risk": 3,
        "size": 37208,
        "type": "zst",
        "facts": {
          "metrics": {
            "file": {
              "size": 37208.0,
              "entropy": 7.99,
              "size_bytes": 37208.0
            },
            "binary": {
              "overall_entropy": 7.99,
              "peak_region_bytes": 37208.0,
              "peak_region_entropy": 7.83
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "from": [
              {
                "file": 1
              }
            ]
          }
        ]
      },
      {
        "ctx": [
          {
            "b": "E))420S-r400000000000rtp-0rr9100000000000000000000PS4$)0000000000kMy=:002m:f90Q800000000",
            "n": [
              {
                "c": 3,
                "d": "Patterns associated with legitimate injectors to reduce FPs",
                "i": "objectives/evasion/process/injection/toolkit::legitimate-injector-patterns",
                "o": 0,
                "z": 22,
                "cf": 1.0
              }
            ],
            "ln": 0
          },
          {
            "b": "00000000000000000000KDtM=KDtM=KDtM=KDtM=\u003eL$O.098NFm%ENY\u003c+4!G1AT#9Z*eX{\u003e(pX-0j.K#%nMvV%lfH-003Qwa4c8eKDtM=KDtM=KDtM=KDtL",
            "n": [
              {
                "c": 3,
                "d": "Repeated NOP-run pattern in executable section",
                "i": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
                "o": 1264,
                "z": 47,
                "cf": 0.6499999761581421
              }
            ],
            "ln": 1248
          },
          {
            "b": "002YH)$\u003cG*\u003eL$O.0e\u003cq3t3Bo$l0V=.t}%+Z:UAGz%lfH-002p}W!ihi-@D8t0o:y.008l-00",
            "n": [
              {
                "c": 3,
                "d": "Dotted-quad PE version metadata marker",
                "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-marker",
                "o": 22528,
                "z": 9,
                "cf": 0.9399999976158142
              }
            ],
            "ln": 22512
          },
          {
            "b": "uQE+0l@M[Zy?Wx\u003czGxwLm]h\u003eVvrDW9z/O0mBZ[\u003c3axh=!B-I4Aavx\u003c-A=(BCoMaL",
            "n": [
              {
                "c": 3,
                "d": "Terminal socket exec helper context",
                "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context",
                "o": 43101,
                "z": 3,
                "cf": 0.949999988079071
              }
            ],
            "ln": 43085
          },
          {
            "b": "0af8uA::63y?W:2Bo2VPB97\u00262yHpN+yHpWZx(0=*B-Z#3wP?=$wDlW^uVHpbBzkP6uUaa-vR/PQB94",
            "n": [
              {
                "c": 3,
                "d": "Stack protector/canary enabled",
                "i": "metadata/hardening/build::stack-protector",
                "o": 51280,
                "z": 14,
                "cf": 0.8999999761581421
              }
            ],
            "ln": 51264
          }
        ],
        "depth": 1,
        "facts": {
          "exp": [
            [
              "pfx_cs35l41_get_speaker_id"
            ],
            [
              "cs35l41_hda_probe"
            ],
            [
              "this_module"
            ],
            [
              "pfx_cs35l41_hda_remove"
            ],
            [
              "pfx_cs35l41_hda_parse_acpi"
            ],
            [
              "cs35l41_hda_remove"
            ],
            [
              "cs35l41_hda_pm_ops"
            ],
            [
              "cs35l41_get_speaker_id"
            ],
            [
              "pfx_cs35l41_add_dsd_properties"
            ],
            [
              "cs35l41_hda_parse_acpi"
            ],
            [
              "pfx_cs35l41_hda_probe"
            ],
            [
              "cs35l41_add_dsd_properties"
            ]
          ],
          "imp": [
            [
              "",
              "acpi_dev_get_first_match_dev"
            ],
            [
              "",
              "gpiod_get_value_cansleep"
            ],
            [
              "",
              "cs35l41_global_enable"
            ],
            [
              "",
              "release_firmware"
            ],
            [
              "",
              "regcache_cache_only"
            ],
            [
              "",
              "is_acpi_device_node"
            ],
            [
              "",
              "gpiod_put"
            ],
            [
              "",
              "regcache_sync"
            ],
            [
              "",
              "regmap_write"
            ],
            [
              "",
              "devm_request_threaded_irq"
            ],
            [
              "",
              "devm_kmalloc"
            ],
            [
              "",
              "cs_amp_get_efi_calibration_data"
            ],
            [
              "",
              "firmware_request_nowarn"
            ],
            [
              "",
              "regmap_irq_get_virq"
            ],
            [
              "",
              "snd_ctl_add"
            ],
            [
              "",
              "ktime_get_mono_fast_ns"
            ],
            [
              "",
              "cs_dsp_coeff_read_ctrl"
            ],
            [
              "",
              "gpiod_count"
            ],
            [
              "",
              "queue_work_on"
            ],
            [
              "",
              "cs_dsp_stop"
            ],
            [
              "",
              "pm_runtime_set_autosuspend_delay"
            ],
            [
              "",
              "cs35l41_register_errata_patch"
            ],
            [
              "",
              "gpiod_set_value_cansleep"
            ],
            [
              "",
              "scnprintf"
            ],
            [
              "",
              "gpiod_get_index"
            ],
            [
              "",
              "component_del"
            ],
            [
              "",
              "kfree"
            ],
            [
              "",
              "regcache_mark_dirty"
            ],
            [
              "",
              "usleep_range_state"
            ],
            [
              "",
              "cs35l41_init_boost"
            ],
            [
              "",
              "cs35l41_enter_hibernate"
            ],
            [
              "",
              "get_device"
            ],
            [
              "",
              "dynamic_dev_dbg"
            ],
            [
              "",
              "fentry__"
            ],
            [
              "",
              "x86_indirect_thunk_rax"
            ],
            [
              "",
              "pm_runtime_set_status"
            ],
            [
              "",
              "dump_stack"
            ],
            [
              "",
              "snd_ctl_new1"
            ],
            [
              "",
              "ref_stack_chk_guard"
            ],
            [
              "",
              "ratelimit"
            ],
            [
              "",
              "stack_chk_fail"
            ],
            [
              "",
              "put_device"
            ],
            [
              "",
              "pm_runtime_enable"
            ],
            [
              "",
              "strnlen"
            ],
            [
              "",
              "fwnode_gpiod_get_index"
            ],
            [
              "",
              "cs_dsp_get_ctl"
            ],
            [
              "",
              "device_property_read_u32_array"
            ],
            [
              "",
              "dev_info"
            ],
            [
              "",
              "ubsan_handle_out_of_bounds"
            ],
            [
              "",
              "sized_strscpy"
            ],
            [
              "",
              "snd_ctl_enum_info"
            ],
            [
              "",
              "lock_system_sleep"
            ],
            [
              "",
              "unlock_system_sleep"
            ],
            [
              "",
              "snd_ctl_boolean_mono_info"
            ],
            [
              "",
              "acpi_evaluate_dsm"
            ],
            [
              "",
              "devm_acpi_dev_add_driver_gpios"
            ],
            [
              "",
              "devm_kfree"
            ],
            [
              "",
              "dev_err"
            ],
            [
              "",
              "system_percpu_wq"
            ],
            [
              "",
              "mutex_lock"
            ],
            [
              "",
              "cs_dsp_halo_init"
            ],
            [
              "",
              "cs_dsp_power_down"
            ],
            [
              "",
              "strcasecmp"
            ],
            [
              "",
              "device_link_remove"
            ],
            [
              "",
              "cs35l41_test_key_unlock"
            ],
            [
              "",
              "cs35l41_test_key_lock"
            ],
            [
              "",
              "fortify_panic"
            ],
            [
              "",
              "cs_dsp_remove"
            ],
            [
              "",
              "ctype"
            ],
            [
              "",
              "cs35l41_safe_reset"
            ],
            [
              "",
              "dev_warn"
            ],
            [
              "",
              "acpi_get_first_physical_node"
            ],
            [
              "",
              "x86_return_thunk"
            ],
            [
              "",
              "cs_dsp_power_up"
            ],
            [
              "",
              "acpi_get_subsystem_id"
            ],
            [
              "",
              "kasprintf"
            ],
            [
              "",
              "cs35l41_otp_unpack"
            ],
            [
              "",
              "strcmp"
            ],
            [
              "",
              "devm_kasprintf"
            ],
            [
              "",
              "devm_regmap_add_irq_chip"
            ],
            [
              "",
              "cs35l41_exit_hibernate"
            ],
            [
              "",
              "ubsan_handle_shift_out_of_bounds"
            ],
            [
              "",
              "spi_setup"
            ],
            [
              "",
              "regmap_read"
            ],
            [
              "",
              "cs_dsp_run"
            ],
            [
              "",
              "pm_runtime_resume"
            ],
            [
              "",
              "mutex_unlock"
            ],
            [
              "",
              "cs_amp_write_cal_coeffs"
            ],
            [
              "",
              "cs35l41_set_cspl_mbox_cmd"
            ],
            [
              "",
              "param_ops_bool"
            ],
            [
              "",
              "guid_parse"
            ],
            [
              "",
              "cs35l41_write_fs_errata"
            ],
            [
              "",
              "pm_runtime_force_resume"
            ],
            [
              "",
              "ktime_get"
            ],
            [
              "",
              "cancel_work_sync"
            ],
            [
              "",
              "cs35l41_configure_cs_dsp"
            ],
            [
              "",
              "dev_crit"
            ],
            [
              "",
              "regmap_update_bits_base"
            ],
            [
              "",
              "dev_err_probe"
            ],
            [
              "",
              "regmap_multi_reg_write"
            ],
            [
              "",
              "acpi_check_dsm"
            ],
            [
              "",
              "pm_runtime_suspend"
            ],
            [
              "",
              "component_add"
            ],
            [
              "",
              "ubsan_handle_load_invalid_value"
            ],
            [
              "",
              "pm_runtime_use_autosuspend"
            ],
            [
              "",
              "cs35l41_set_channels"
            ],
            [
              "",
              "pm_runtime_disable"
            ],
            [
              "",
              "device_link_add"
            ],
            [
              "",
              "pm_runtime_force_suspend"
            ],
            [
              "",
              "SCT__might_resched"
            ],
            [
              "",
              "mutex_init_generic"
            ],
            [
              "",
              "cs35l41_gpio_config"
            ]
          ],
          "sec": [
            [
              "__ksymtab_gpl",
              64,
              36,
              0.0,
              "alloc"
            ],
            [
              ".rela__ksymtab_gpl",
              98976,
              216,
              1.06,
              "info_link"
            ],
            [
              "__kcrctab_gpl",
              100,
              12,
              3.58,
              "alloc"
            ],
            [
              "__jump_table",
              112,
              720,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__jump_table",
              99192,
              3240,
              2.03,
              "info_link"
            ],
            [
              "__patchable_function_entries",
              832,
              432,
              0.0,
              "write,alloc"
            ],
            [
              ".rela__patchable_function_entries",
              102432,
              1296,
              1.62,
              "info_link"
            ],
            [
              ".text",
              1264,
              23061,
              5.16,
              "alloc,executable"
            ],
            [
              ".rela.text",
              103728,
              32928,
              2.89,
              "info_link"
            ],
            [
              ".data",
              24328,
              2616,
              1.32,
              "write,alloc"
            ],
            [
              ".rela.data",
              136656,
              3912,
              1.77,
              "info_link"
            ],
            [
              ".rodata",
              26944,
              15452,
              3.6,
              "alloc"
            ],
            [
              ".rela.rodata",
              140568,
              10872,
              2.01,
              "info_link"
            ],
            [
              ".comment",
              42396,
              156,
              4.05,
              "merge,strings"
            ],
            [
              "__mcount_loc",
              42552,
              424,
              0.0,
              "alloc"
            ],
            [
              ".rela__mcount_loc",
              151440,
              1272,
              1.64,
              "info_link"
            ],
            [
              ".smp_locks",
              42976,
              36,
              0.0,
              "alloc"
            ],
            [
              ".rela.smp_locks",
              152712,
              216,
              1.52,
              "info_link"
            ],
            [
              ".modinfo",
              43012,
              563,
              5.28,
              "alloc"
            ],
            [
              "__dyndbg",
              43576,
              2520,
              0.51,
              "write,alloc"
            ],
            [
              ".rela__dyndbg",
              152928,
              4320,
              1.88,
              "info_link"
            ],
            [
              ".data..read_mostly",
              46096,
              3,
              0.0,
              "write,alloc"
            ],
            [
              "__param",
              46104,
              40,
              0.5,
              "alloc"
            ],
            [
              ".rela__param",
              157248,
              96,
              1.22,
              "info_link"
            ],
            [
              ".note.package",
              46144,
              216,
              4.73,
              "alloc"
            ],
            [
              ".static_call_sites",
              46360,
              16,
              0.0,
              "write,alloc"
            ],
            [
              ".rela.static_call_sites",
              157344,
              96,
              1.19,
              "info_link"
            ],
            [
              ".retpoline_sites",
              46376,
              4,
              0.0,
              "alloc"
            ],
            [
              ".rela.retpoline_sites",
              157440,
              24,
              0.98,
              "info_link"
            ],
            [
              ".return_sites",
              46380,
              320,
              0.0,
              "alloc"
            ],
            [
              ".rela.return_sites",
              157464,
              1920,
              1.9,
              "info_link"
            ],
            [
              ".call_sites",
              46700,
              2436,
              0.0,
              "alloc"
            ],
            [
              ".rela.call_sites",
              159384,
              14616,
              2.21,
              "info_link"
            ],
            [
              ".note.gnu.build-id",
              49136,
              36,
              4.14,
              "alloc"
            ],
            [
              "__ksymtab_strings",
              49172,
              125,
              4.52,
              "alloc,merge,strings"
            ],
            [
              "__version_ext_names",
              49304,
              2081,
              4.45,
              "alloc"
            ],
            [
              "__version_ext_crcs",
              51392,
              452,
              7.33,
              "alloc"
            ],
            [
              "__versions",
              51848,
              7232,
              2.76,
              "alloc"
            ],
            [
              ".gnu.linkonce.this_module",
              59080,
              1280,
              0.19,
              "write,alloc"
            ],
            [
              ".note.Linux",
              60360,
              48,
              1.97,
              "alloc"
            ],
            [
              ".BTF",
              60408,
              21291,
              5.21,
              ""
            ],
            [
              ".symtab",
              81704,
              9720,
              2.23,
              ""
            ],
            [
              ".strtab",
              91424,
              7551,
              4.82,
              ""
            ],
            [
              ".shstrtab",
              174000,
              492,
              4.37,
              ""
            ]
          ],
          "metrics": {
            "elf": {
              "bits": 64.0,
              "entry": 0.0,
              "has_got": 0.0,
              "has_plt": 0.0,
              "has_note": 1.0,
              "has_symtab": 1.0,
              "note_count": 3.0,
              "nx_enabled": 1.0,
              "dynrel_count": 0.0,
              "dynsym_count": 0.0,
              "has_eh_frame": 0.0,
              "stack_canary": 1.0,
              "symtab_count": 405.0,
              "dynrela_count": 0.0,
              "little_endian": 1.0,
              "pltreloc_count": 0.0,
              "executable_stack": 0.0,
              "wx_segment_count": 0.0,
              "comment_entry_count": 4.0,
              "program_header_count": 0.0,
              "comment_distinct_count": 1.0,
              "gnu_stack_section_absent": 0.0,
              "load_segment_max_file_size": 0.0,
              "stripped_but_symtab_present": 1.0,
              "load_segment_max_memory_size": 0.0,
              "section_relocation_group_count": 14.0,
              "stripped_metadata_section_count": 5.0
            },
            "file": {
              "size": 178225.0,
              "entropy": 3.92,
              "size_bytes": 178225.0
            },
            "binary": {
              "is_pie": 0.0,
              "has_overlay": 1.0,
              "is_stripped": 0.0,
              "code_entropy": 5.16,
              "data_entropy": 0.66,
              "overlay_size": 3733.0,
              "string_count": 1146.0,
              "overlay_ratio": 0.02,
              "avg_complexity": 3.16,
              "max_complexity": 30.0,
              "huge_func_count": 0.0,
              "leaf_func_count": 52.0,
              "overall_entropy": 3.92,
              "overlay_entropy": 3.08,
              "tiny_func_count": 79.0,
              "avg_basic_blocks": 5.89,
              "entropy_variance": 3.62,
              "avg_string_length": 18.19,
              "max_string_length": 99.0,
              "peak_region_bytes": 2048.0,
              "code_to_data_ratio": 0.75,
              "total_basic_blocks": 877.0,
              "peak_region_entropy": 6.05,
              "string_length_stddev": 10.65,
              "largest_section_ratio": 0.18,
              "sentence_string_count": 104.0,
              "sentence_string_ratio": 0.09,
              "high_entropy_string_count": 0.0
            },
            "exports": {
              "count": 12.0
            },
            "imports": {
              "count": 112.0
            },
            "sections": {
              "count": 47.0,
              "code_size": 23061.0,
              "entropy_max": 7.33,
              "entropy_mean": 2.15,
              "name_entropy": 4.29,
              "writable_count": 8.0,
              "executable_count": 1.0,
              "nonstandard_count": 39.0,
              "executable_writable_count": 0.0
            },
            "functions": {
              "count": 149.0
            },
            "dependencies": {
              "count": 0.0
            }
          }
        },
        "id": 1,
        "mol": "O₂(AsC)",
        "path": "snd-hda-scodec-cs35l41.ko.zst!!snd-hda-scodec-cs35l41.ko",
        "risk": 3,
        "sha": "02af439a77783c7359efbbfe1bc2f64957a4010805b4e8a46a37d546489c4028",
        "size": 178225,
        "traits": [
          {
            "id": "metadata/build/artifact::elf-stripped-but-symtab-present",
            "conf": 0.6000000238418579,
            "crit": 3,
            "desc": "ELF stripped with .symtab present",
            "spans": [
              [
                0,
                38
              ]
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/payload/code-in-data::nop-sled-in-data",
            "conf": 0.6499999761581421,
            "crit": 3,
            "desc": "Repeated NOP-run pattern in executable section",
            "spans": [
              [
                1264,
                47
              ]
            ]
          },
          {
            "id": "metadata/package/license::gpl-word",
            "conf": 0.699999988079071,
            "crit": 2,
            "desc": "GPL license reference",
            "spans": [
              [
                43101,
                3
              ]
            ]
          },
          {
            "id": "micro-behaviors/communications/ip/literal::external-ipv4-binary",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Hardcoded external IPv4 address",
            "spans": [
              [
                22528,
                9
              ]
            ]
          },
          {
            "id": "objectives/command-and-control/channel/redundancy::multi-channel-diversity",
            "atk": "T1071",
            "mbc": "B0030",
            "conf": 0.8500000238418579,
            "crit": 3,
            "desc": "C2 infrastructure using multiple communication methods",
            "spans": [
              [
                22528,
                9
              ]
            ]
          }
        ],
        "type": "elf"
      }
    ],
    "v": "8"
  }
}