{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.00004766384881804697 } ], "prob": 0.00004766385, "models": [ { "m": "az", "raw": 0.00004766385, "prob": 0.00004766385, "class": 0 }, { "m": "az/source", "raw": 0.0007199347, "prob": 0.0007199347, "class": 0 }, { "m": "az/c", "raw": 0.0063271224, "prob": 0.0063271224, "class": 0 } ], "version": "v18.18", "analyzed_at": "2026-06-09T08:11:04Z" }, "path": "ioctl_handler.c", "raw": { "v": "6", "fs": [ { "f": "O(Erâ‚‚)", "x": 2, "ff": { "i": [ [ "", "sock_create" ], [ "", "sock_release" ], [ "", "copy_from_user" ], [ "", "root_me" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "hide_proc" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "unhide_proc" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "hide_tcp4_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "unhide_tcp4_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "hide_tcp6_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "unhide_tcp6_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "hide_udp4_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "unhide_udp4_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "hide_udp6_port" ], [ "", "copy_from_user" ], [ "", "printk" ], [ "", "unhide_udp6_port" ], [ "", "copy_from_user" ], [ "", "kmalloc" ], [ "", "copy_from_user" ], [ "", "kfree" ], [ "", "printk" ], [ "", "hide_file" ], [ "", "copy_from_user" ], [ "", "kmalloc" ], [ "", "copy_from_user" ], [ "", "kfree" ], [ "", "printk" ], [ "", "unhide_file" ], [ "", "kfree" ], [ "", "printk" ], [ "", "hijack_pause" ], [ "", "inet_ioctl" ], [ "", "hijack_resume" ], [ "", "../common/rooty_uapi.h" ], [ "", "../include/ioctl_handler.h" ], [ "", "../include/proc_fs_hide.h" ], [ "", "../include/socket_hide.h" ], [ "", "../include/syscall_table.h" ], [ "", "../include/vnc.h" ], [ "", "\u003casm/uaccess.h\u003e" ], [ "", "\u003clinux/kernel.h\u003e" ], [ "", "\u003clinux/limits.h\u003e" ], [ "", "\u003clinux/module.h\u003e" ], [ "", "\u003clinux/net.h\u003e" ], [ "", "\u003clinux/slab.h\u003e" ] ], "m": { "ast": { "op.eq": 1.0, "op.gt": 2.0, "op.add": 2.0, "op.sub": 19.0, "op.band": 14.0, "op.lnot": 2.0, "max_depth": 15.0, "op.concat": 43.0, "bind_count": 19.0, "call_count": 51.0, "node_count": 1544.0, "member_count": 8.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.add": 0.0, "op_density.sub": 0.01, "op_density.band": 0.01, "op_density.lnot": 0.0, "identifier_count": 53.0, "member_depth_max": 3.0, "op_density.concat": 0.03, "string_literal_count": 19.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 6269.0, "entropy": 4.38, "size_bytes": 6269.0 }, "text": { "digit_ratio": 0.01, "space_count": 2086.0, "total_lines": 216.0, "char_entropy": 4.38, "unique_chars": 80.0, "string_density": 0.09, "avg_line_length": 28.02, "max_line_length": 78.0, "empty_line_ratio": 0.12, "last_line_length": 1.0, "whitespace_ratio": 0.37, "most_common_ratio": 0.06, "identifier_density": 1.36, "line_length_stddev": 22.6, "normalized_string_count": 1.29, "repeated_char_sequences": 102.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 114.0, "normalized_unique_identifiers": 6.83 }, "binds": { "count": 19.0 }, "calls": { "count": 51.0 }, "binary": { "overall_entropy": 4.38 }, "source": { "class_count": 5.0, "function_count": 2.0 }, "imports": { "count": 12.0, "relative_ratio": 0.5, "unique_modules": 12.0, "relative_imports": 6.0, "third_party_count": 12.0, "third_party_ratio": 1.0 }, "members": { "count": 8.0 }, "strings": { "total": 19.0, "avg_length": 31.68, "max_length": 39.0, "path_count": 6.0, "avg_entropy": 4.25, "total_bytes": 602.0, "entropy_stddev": 0.39 }, "functions": { "count": 7.0 }, "identifiers": { "count": 53.0, "total": 294.0, "avg_length": 9.08, "max_length": 16.0, "min_length": 3.0, "avg_entropy": 2.72, "reuse_ratio": 0.18, "unique_count": 53.0, "length_stddev": 4.24, "has_digit_ratio": 0.15, "high_entropy_count": 4.0, "high_entropy_ratio": 0.08, "all_lowercase_ratio": 0.74, "all_uppercase_ratio": 0.11 } }, "s": [ [ 9, "u8", "\u003clinux/module.h\u003e" ], [ 35, "u8", "\u003clinux/kernel.h\u003e" ], [ 61, "u8", "\u003clinux/slab.h\u003e" ], [ 85, "u8", "\u003clinux/net.h\u003e" ], [ 108, "u8", "\u003clinux/limits.h\u003e" ], [ 134, "u8", "\u003casm/uaccess.h\u003e" ], [ 160, "u8", "../include/ioctl_handler.h" ], [ 161, "u8", "../include/ioctl_handler.h" ], [ 198, "u8", "../include/syscall_table.h" ], [ 199, "u8", "../include/syscall_table.h" ], [ 236, "u8", "../include/proc_fs_hide.h" ], [ 237, "u8", "../include/proc_fs_hide.h" ], [ 273, "u8", "../include/socket_hide.h" ], [ 274, "u8", "../include/socket_hide.h" ], [ 309, "u8", "../include/vnc.h" ], [ 310, "u8", "../include/vnc.h" ], [ 337, "u8", "../common/rooty_uapi.h" ], [ 338, "u8", "../common/rooty_uapi.h" ], [ 983, "10", "0" ], [ 1042, "10", "1" ], [ 1248, "u8", "rooty: IOCTL-\u003eHiding PID %d\\n" ], [ 1249, "u8", "rooty: IOCTL-\u003eHiding PID %d" ], [ 1374, "10", "2" ], [ 1580, "u8", "rooty: IOCTL-\u003eUnhiding PID %d\\n" ], [ 1581, "u8", "rooty: IOCTL-\u003eUnhiding PID %d" ], [ 1710, "10", "3" ], [ 1916, "u8", "rooty: IOCTL-\u003eHiding TCPv4 port %hu\\n" ], [ 1917, "u8", "rooty: IOCTL-\u003eHiding TCPv4 port %hu" ], [ 2057, "10", "4" ], [ 2263, "u8", "rooty: IOCTL-\u003eUnhiding TCPv4 port %hu\\n" ], [ 2264, "u8", "rooty: IOCTL-\u003eUnhiding TCPv4 port %hu" ], [ 2408, "10", "5" ], [ 2614, "u8", "rooty: IOCTL-\u003eHiding TCPv6 port %hu\\n" ], [ 2615, "u8", "rooty: IOCTL-\u003eHiding TCPv6 port %hu" ], [ 2755, "10", "6" ], [ 2961, "u8", "rooty: IOCTL-\u003eUnhiding TCPv6 port %hu\\n" ], [ 2962, "u8", "rooty: IOCTL-\u003eUnhiding TCPv6 port %hu" ], [ 3106, "10", "7" ], [ 3312, "u8", "rooty: IOCTL-\u003eHiding UDPv4 port %hu\\n" ], [ 3313, "u8", "rooty: IOCTL-\u003eHiding UDPv4 port %hu" ], [ 3453, "10", "8" ], [ 3659, "u8", "rooty: IOCTL-\u003eUnhiding UDPv4 port %hu\\n" ], [ 3660, "u8", "rooty: IOCTL-\u003eUnhiding UDPv4 port %hu" ], [ 3804, "10", "9" ], [ 4010, "u8", "rooty: IOCTL-\u003eHiding UDPv6 port %hu\\n" ], [ 4011, "u8", "rooty: IOCTL-\u003eHiding UDPv6 port %hu" ], [ 4151, "10", "10" ], [ 4358, "u8", "rooty: IOCTL-\u003eUnhiding UDPv6 port %hu\\n" ], [ 4359, "u8", "rooty: IOCTL-\u003eUnhiding UDPv6 port %hu" ], [ 4503, "10", "11" ], [ 4840, "10", "1" ], [ 5122, "10", "0" ], [ 5144, "u8", "rooty: IOCTL-\u003eHiding file/dir %s\\n" ], [ 5145, "u8", "rooty: IOCTL-\u003eHiding file/dir %s" ], [ 5257, "10", "12" ], [ 5594, "10", "1" ], [ 5876, "10", "0" ], [ 5898, "u8", "rooty: IOCTL-\u003eUnhiding file/dir %s\\n" ], [ 5899, "u8", "rooty: IOCTL-\u003eUnhiding file/dir %s" ], [ 6063, "u8", "rooty: IOCTL-\u003eUnknown command" ], [ 6064, "u8", "rooty: IOCTL-\u003eUnknown command" ], [ 6141, "10", "0" ] ], "v": { "file.stem": "ioctl_handler", "file.basename": "ioctl_handler.c", "source.language": "c", "source.imports[0]": "../common/rooty_uapi.h", "source.imports[1]": "../include/ioctl_handler.h", "source.imports[2]": "../include/proc_fs_hide.h", "source.imports[3]": "../include/socket_hide.h", "source.imports[4]": "../include/syscall_table.h", "source.imports[5]": "../include/vnc.h", "source.imports[6]": "\u003casm/uaccess.h\u003e", "source.imports[7]": "\u003clinux/kernel.h\u003e", "source.imports[8]": "\u003clinux/limits.h\u003e", "source.imports[9]": "\u003clinux/module.h\u003e", "source.strings[0]": "../common/rooty_uapi.h", "source.strings[1]": "../include/ioctl_handler.h", "source.strings[2]": "../include/proc_fs_hide.h", "source.strings[3]": "../include/socket_hide.h", "source.strings[4]": "../include/syscall_table.h", "source.strings[5]": "../include/vnc.h", "source.strings[6]": "\u003casm/uaccess.h\u003e", "source.strings[7]": "\u003clinux/kernel.h\u003e", "source.strings[8]": "\u003clinux/limits.h\u003e", "source.strings[9]": "\u003clinux/module.h\u003e", "source.has_imports": true, "source.imports[10]": "\u003clinux/net.h\u003e", "source.imports[11]": "\u003clinux/slab.h\u003e", "source.imports[12]": "copy_from_user", "source.imports[13]": "hide_file", "source.imports[14]": "hide_proc", "source.imports[15]": "hide_tcp4_port", "source.imports[16]": "hide_tcp6_port", "source.imports[17]": "hide_udp4_port", "source.imports[18]": "hide_udp6_port", "source.imports[19]": "hijack_pause", "source.imports[20]": "hijack_resume", "source.imports[21]": "inet_ioctl", "source.imports[22]": "kfree", "source.imports[23]": "kmalloc", "source.imports[24]": "printk", "source.imports[25]": "root_me", "source.imports[26]": "sock_create", "source.imports[27]": "sock_release", "source.imports[28]": "unhide_file", "source.imports[29]": "unhide_proc", "source.imports[30]": "unhide_tcp4_port", "source.imports[31]": "unhide_tcp6_port", "source.imports[32]": "unhide_udp4_port", "source.imports[33]": "unhide_udp6_port", "source.strings[10]": "\u003clinux/net.h\u003e", "source.strings[11]": "\u003clinux/slab.h\u003e", "source.strings[12]": "rooty: IOCTL-\u003eHiding PID %d", "source.strings[13]": "rooty: IOCTL-\u003eHiding PID %d\\n", "source.strings[14]": "rooty: IOCTL-\u003eHiding TCPv4 port %hu", "source.strings[15]": "rooty: IOCTL-\u003eHiding TCPv4 port %hu\\n", "source.strings[16]": "rooty: IOCTL-\u003eHiding TCPv6 port %hu", "source.strings[17]": "rooty: IOCTL-\u003eHiding TCPv6 port %hu\\n", "source.strings[18]": "rooty: IOCTL-\u003eHiding UDPv4 port %hu", "source.strings[19]": "rooty: IOCTL-\u003eHiding UDPv4 port %hu\\n", "source.strings[20]": "rooty: IOCTL-\u003eHiding UDPv6 port %hu", "source.strings[21]": "rooty: IOCTL-\u003eHiding UDPv6 port %hu\\n", "source.strings[22]": "rooty: IOCTL-\u003eHiding file/dir %s", "source.strings[23]": "rooty: IOCTL-\u003eHiding file/dir %s\\n", "source.strings[24]": "rooty: IOCTL-\u003eUnhiding PID %d", "source.strings[25]": "rooty: IOCTL-\u003eUnhiding PID %d\\n", "source.strings[26]": "rooty: IOCTL-\u003eUnhiding TCPv4 port %hu", "source.strings[27]": "rooty: IOCTL-\u003eUnhiding TCPv4 port %hu\\n", "source.strings[28]": "rooty: IOCTL-\u003eUnhiding TCPv6 port %hu", "source.strings[29]": "rooty: IOCTL-\u003eUnhiding TCPv6 port %hu\\n", "source.strings[30]": "rooty: IOCTL-\u003eUnhiding UDPv4 port %hu", "source.strings[31]": "rooty: IOCTL-\u003eUnhiding UDPv4 port %hu\\n", "source.strings[32]": "rooty: IOCTL-\u003eUnhiding UDPv6 port %hu", "source.strings[33]": "rooty: IOCTL-\u003eUnhiding UDPv6 port %hu\\n", "source.strings[34]": "rooty: IOCTL-\u003eUnhiding file/dir %s", "source.strings[35]": "rooty: IOCTL-\u003eUnhiding file/dir %s\\n", "source.strings[36]": "rooty: IOCTL-\u003eUnknown command", "source.functions[0]": "*get_inet_ioctl(int family, int type, int protocol)", "source.functions[1]": "n_inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)" }, "ct": [ "copy_from_user", "hide_file", "hide_proc", "hide_tcp4_port", "hide_tcp6_port", "hide_udp4_port", "hide_udp6_port", "hijack_pause", "hijack_resume", "inet_ioctl", "kfree", "kmalloc", "printk", "root_me", "sock_create", "sock_release", "unhide_file", "unhide_proc", "unhide_tcp4_port", "unhide_tcp6_port", "unhide_udp4_port", "unhide_udp6_port" ], "id": "c", "mc": [ "args.cmd", "args.ptr", "file_args.name", "file_args.namelen", "port_args.port", "proc_args.pid", "sock.ops", "sock.ops.ioctl" ] }, "id": 0, "sz": 6269, "ts": [ { "c": 0.8600000143051147, "d": "Kill hook hide markers", "e": [ "hide" ], "i": "objectives/evasion/kernel-hide/hook::kill-hook-hide-context", "l": 1 }, { "c": 0.4000000059604645, "d": "cmd/command/result vocabulary word", "e": [ "cmd" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-result-word", "l": 1 }, { "c": 0.6000000238418579, "d": "Kernel error code return", "e": [ "return -EFAULT" ], "i": "objectives/evasion/kernel-hide/lkm/internals::error-code-return", "l": 1 }, { "c": 0.44999998807907104, "d": "TOKEN credential label", "e": [ "TOKEN" ], "i": "micro-behaviors/data/text/keywords/credential::token-upper", "l": 1 }, { "c": 0.699999988079071, "d": "Kernel memory free (often used", "e": [ "kfree" ], "i": "objectives/evasion/kernel-hide/lkm/hiding::kfree-call", "l": 2, "el": [ "13a1" ] }, { "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hide_proc(proc_args.pid" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-6", "l": 1 }, { "c": 0.8999999761581421, "d": "copy_from_user kernel userspace copy", "e": [ "copy_from_user" ], "i": "micro-behaviors/os/kernel/routines::copy-from-user", "l": 2, "el": [ "34e" ] }, { "c": 0.8500000238418579, "d": "Inline assembly with direct syscall", "e": [ "syscall" ], "i": "objectives/evasion/kernel-hide/lkm/internals::asm-syscall-invocation", "l": 3 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "hide_file" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-hidden-object-names--rx-3", "l": 1 }, { "a": "T1106", "c": 0.9900000095367432, "d": "Linux kernel module header include (linux/module.h)", "e": [ "linux/module.h" ], "i": "micro-behaviors/os/syscall/invoke::kernel-module-include-detect", "l": 1 }, { "c": 0.9900000095367432, "d": "Linux kernel module header detection", "e": [ "\u003clinux/module.h\u003e" ], "i": "objectives/evasion/kernel-hide/lkm/headers::kernel-module-header-detect", "l": 2, "el": [ "9" ] }, { "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hide_tcp4_port(port_args.port" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-7", "l": 1 }, { "c": 0.699999988079071, "d": "printk kernel logging function", "e": [ "printk" ], "i": "objectives/evasion/kernel-hide/module::printk-sym", "l": 3, "el": [ "4d9" ] } ], "sha": "bae040f157d757a7a432144051f0565ac2a8801998c5f7e98a61786989f4f9a0", "path": "ioctl_handler.c", "type": "c" } ], "tv": "35641" } }