{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8242424130439758,
        "class": 0
      }
    ],
    "prob": 0.8242424,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8242424,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.14864865,
        "class": 0
      },
      {
        "m": "az/c",
        "prob": 0.11965812,
        "class": 0
      }
    ],
    "version": "v16.16",
    "thresholds": [
      0.9979839,
      1.0
    ],
    "analyzed_at": "2026-05-11T16:27:00Z"
  },
  "path": "hook.c",
  "raw": {
    "v": "4",
    "fs": [
      {
        "k": {
          "source.imports[0]": "LIST_HEAD",
          "source.imports[1]": "get_instruction_length",
          "source.imports[2]": "list_add",
          "source.imports[3]": "list_del",
          "source.imports[4]": "list_for_each_entry",
          "source.imports[5]": "list_for_each_entry_safe",
          "source.imports[6]": "lookup_address",
          "source.imports[7]": "make_exec",
          "source.imports[8]": "make_ro",
          "source.imports[9]": "make_rw",
          "source.strings[0]": "\"H¸PÃ\", HOOK_SIZE);",
          "source.strings[1]": "H\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc3",
          "source.strings[2]": "hook.h",
          "source.strings[3]": "memcpy(new_hook-\u003eevil_code, \"H¸PÃ\",",
          "source.has_imports": true,
          "source.imports[10]": "memcpy",
          "source.imports[11]": "strcmp",
          "source.imports[12]": "strncpy",
          "source.imports[13]": "vfree",
          "source.imports[14]": "vmalloc",
          "source.functions[0]": "*find_hook_by_addr(unsigned long addr)",
          "source.functions[1]": "*find_hook_by_name(const char *name)",
          "source.functions[2]": "hook_release(void)",
          "source.functions[3]": "hook_start(unsigned long org_func,\n                unsigned long evil_func,\n                const char *name,\n                int need_org_func)",
          "source.functions[4]": "make_exec(unsigned long addr)",
          "source.functions[5]": "make_ro(unsigned long addr)",
          "source.functions[6]": "make_rw(unsigned long addr)"
        },
        "x": 1,
        "id": 0,
        "is": [
          "LIST_HEAD",
          "lookup_address",
          "lookup_address",
          "lookup_address",
          "vmalloc",
          "get_instruction_length",
          "vmalloc",
          "memcpy",
          "memcpy",
          "make_ro",
          "make_exec",
          "memcpy",
          "make_rw",
          "memcpy",
          "make_ro",
          "strncpy",
          "list_add",
          "list_for_each_entry_safe",
          "make_rw",
          "memcpy",
          "make_ro",
          "list_del",
          "vfree",
          "vfree",
          "list_for_each_entry",
          "strcmp",
          "list_for_each_entry"
        ],
        "ms": {
          "file": {
            "size": 2732.0
          },
          "text": {
            "digit_ratio": 0.03,
            "space_count": 551.0,
            "total_lines": 94.0,
            "char_entropy": 4.91,
            "unique_chars": 73.0,
            "escape_density": 0.73,
            "import_density": 28.72,
            "string_density": 0.09,
            "avg_line_length": 28.06,
            "max_line_length": 77.0,
            "empty_line_ratio": 0.12,
            "hex_escape_count": 20.0,
            "last_line_length": 1.0,
            "most_common_char": "e",
            "whitespace_ratio": 0.24,
            "most_common_ratio": 0.06,
            "identifier_density": 1.51,
            "line_length_stddev": 21.94,
            "normalized_import_count": 2.78,
            "normalized_string_count": 0.83,
            "repeated_char_sequences": 11.0,
            "max_inline_whitespace_run": 1.0,
            "normalized_function_count": 0.72,
            "imports_to_functions_ratio": 3.86,
            "strings_to_functions_ratio": 1.14,
            "normalized_unique_identifiers": 5.49,
            "identifiers_to_functions_ratio": 5.14
          },
          "imports": {
            "total": 27.0,
            "unique_modules": 15.0,
            "third_party_count": 27.0,
            "third_party_ratio": 1.0
          },
          "strings": {
            "total": 8.0,
            "avg_length": 12.5,
            "max_length": 42.0,
            "avg_entropy": 1.05,
            "total_bytes": 100.0,
            "entropy_stddev": 1.06,
            "unicode_heavy_strings": 2.0
          },
          "comments": {},
          "functions": {
            "total": 7.0,
            "length_stddev": 10.8,
            "avg_name_length": 45.57,
            "no_params_count": 7.0,
            "avg_length_lines": 12.0,
            "max_length_lines": 38.0,
            "min_length_lines": 6.0,
            "high_entropy_names": 7.0,
            "density_per_100_lines": 7.45,
            "code_in_functions_ratio": 0.89
          },
          "identifiers": {
            "total": 142.0,
            "avg_length": 9.0,
            "max_length": 24.0,
            "min_length": 3.0,
            "avg_entropy": 2.67,
            "reuse_ratio": 0.25,
            "unique_count": 36.0,
            "length_stddev": 5.15,
            "high_entropy_count": 4.0,
            "high_entropy_ratio": 0.11,
            "all_lowercase_ratio": 0.86,
            "all_uppercase_ratio": 0.14,
            "underscore_prefix_count": 2.0
          }
        },
        "ss": [
          [
            9,
            "hook.h"
          ],
          [
            10,
            "hook.h"
          ],
          [
            1244,
            "H\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc3"
          ],
          [
            1245,
            "H"
          ],
          [
            1282,
            "P"
          ],
          [
            1623,
            "H\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xc3"
          ],
          [
            1624,
            "H"
          ],
          [
            1661,
            "P"
          ],
          [
            1233,
            "unicode-escape",
            "\"H¸PÃ\", HOOK_SIZE);"
          ],
          [
            1591,
            "unicode-escape",
            "memcpy(new_hook-\u003eevil_code, \"H¸PÃ\","
          ]
        ],
        "sz": 2732,
        "ts": [
          {
            "a": "T1055",
            "c": 0.8999999761581421,
            "d": "Memory copy in source code",
            "e": [
              "memcpy"
            ],
            "i": "objectives/evasion/process/injection/shellcode::memcpy-raw",
            "l": 1,
            "m": "B0033"
          },
          {
            "c": 0.8999999761581421,
            "d": "Decoded unicode-escape content",
            "e": [
              "\u003cbinary data\u003e \u003cunicode-escape\u003e"
            ],
            "i": "metadata/encoded-payload/unicode-escape",
            "l": 2
          }
        ],
        "sha": "b74c86238aeefb7486a13637400f8394016799f653892f6a5cea1fcf770890bb",
        "path": "hook.c",
        "type": "c"
      }
    ],
    "tv": "46790"
  }
}