{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9326819777488708, "class": 0 } ], "prob": 0.932682, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T09:25:52Z" }, "path": "private.so", "raw": { "v": "4", "fs": [ { "f": "Md₂(Si)", "x": 4, "id": 0, "is": [ "addwrapper", "bin_typeset", "builtintab", "deletehashtable", "deletewrapper", "endparamscope", "featuresarray", "gethashnode2", "handlefeatures", "hcalloc", "locallevel", "newparamtable", "opts", "paramtab", "printparamnode", "queue_front", "queue_rear", "queueing_enabled", "realparamtab", "removehashnode", "reswdtab", "runshfunc", "scanhashtable", "setfeatureenables", "signal_mask_queue", "signal_queue", "signal_setmask", "startparamscope", "zerr", "zhalloc", "zhandler", "zwarn", "zwarnnam", "builtintab", "locallevel", "opts", "paramtab", "queue_front", "queue_rear", "queueing_enabled", "realparamtab", "reswdtab", "signal_mask_queue", "signal_queue", "dyld_stub_binder", "addwrapper", "bin_typeset", "deletehashtable", "deletewrapper", "endparamscope", "featuresarray", "gethashnode2", "handlefeatures", "hcalloc", "newparamtable", "printparamnode", "removehashnode", "runshfunc", "scanhashtable", "setfeatureenables", "signal_setmask", "startparamscope", "zerr", "zhalloc", "zhandler", "zwarn", "zwarnnam" ], "ms": { "macho": { "flags": 4.0, "cpu_type": 16777228.0, "file_type": 8.0, "sdk_major": 26.0, "sdk_minor": 4.0, "class_bits": 64.0, "cpu_subtype": 2147483650.0, "slice_count": 2.0, "is_universal": true, "min_os_major": 26.0, "min_os_minor": 4.0, "uuid_present": true, "little_endian": true, "build_platform": 1.0, "signature_type": "platform", "source_version": 129742372077568.0, "build_tool_count": 1.0, "has_code_signature": true, "load_command_count": 18.0, "load_commands_size": 1488.0, "code_signature_size": 18736.0, "build_version_present": true, "source_version_present": true }, "binary": { "code_size": 3996.0, "file_size": 73904.0, "code_entropy": 6.02, "data_entropy": 2.01, "export_count": 6.0, "import_count": 33.0, "string_count": 175.0, "has_signature": true, "section_count": 9.0, "segment_count": 4.0, "avg_complexity": 3.14, "function_count": 51.0, "import_density": 8.46, "string_density": 44.84, "overall_entropy": 3.07, "avg_section_size": 602.89, "entropy_variance": 1.44, "function_density": 13.07, "avg_function_size": 150.12, "avg_string_length": 18.51, "max_string_length": 200.0, "avg_string_entropy": 3.17, "code_to_data_ratio": 2.79, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.05, "provenance_id_length": 16.0, "string_length_stddev": 24.75, "largest_section_ratio": 0.05, "provenance_id_present": true, "sentence_string_count": 13.0, "sentence_string_ratio": 0.07, "nonstandard_section_name_count": 9.0 } }, "ss": [ [ 16424, "__TEXT" ], [ 16488, "__text" ], [ 16568, "__stubs" ], [ 16648, "__stub_helper" ], [ 16728, "__cstring" ], [ 16808, "__unwind_info" ], [ 16896, "__DATA_CONST" ], [ 16960, "__got" ], [ 17040, "__const" ], [ 17128, "__DATA" ], [ 17192, "__la_symbol_ptr" ], [ 17272, "__data" ], [ 17352, "__bss" ], [ 17440, "__LINKEDIT" ], [ 17752, "/usr/lib/libpcre.0.dylib" ], [ 17808, "/usr/lib/libiconv.2.dylib" ], [ 17864, "/usr/lib/libSystem.B.dylib" ], [ 17920, "/usr/lib/libncurses.5.4.dylib" ], [ 18240, "AWAVATS" ], [ 18475, "AWAVATSH" ], [ 19064, "AWAVSPA" ], [ 19419, "AWAVAUATSPD" ], [ 21446, "local" ], [ 21452, "private" ], [ 21460, "%s: attempt to assign private in nested scope" ], [ 21506, "AE:%F:%HL:%PR:%TUZ:%ahi:%lmprtux" ], [ 21541, "bad option: -T" ], [ 21556, "invalid local scope, using globals" ], [ 21591, "can't change scope of existing param: %s" ], [ 32792, "\u003e@_builtintab" ], [ 32810, "@_locallevel" ], [ 32844, "@_queue_front" ], [ 32859, "@_queue_rear" ], [ 32873, "@_queueing_enabled" ], [ 32893, "@_realparamtab" ], [ 32921, "@_signal_mask_queue" ], [ 32942, "@_signal_queue" ], [ 32958, "@dyld_stub_binder" ], [ 32994, "\u003e@_addwrapper" ], [ 33012, "\u003e@_bin_typeset" ], [ 33031, "\u003e@_deletehashtable" ], [ 33054, "\u003e@_deletewrapper" ], [ 33073, "r \u003e@_endparamscope" ], [ 33094, "r(\u003e@_featuresarray" ], [ 33115, "r0\u003e@_gethashnode2" ], [ 33135, "r8\u003e@_handlefeatures" ], [ 33157, "r@\u003e@_hcalloc" ], [ 33172, "rH\u003e@_newparamtable" ], [ 33193, "rP\u003e@_printparamnode" ], [ 33215, "rX\u003e@_removehashnode" ], [ 33237, "r`\u003e@_runshfunc" ], [ 33254, "rh\u003e@_scanhashtable" ], [ 33275, "rp\u003e@_setfeatureenables" ], [ 33300, "rx\u003e@_signal_setmask" ], [ 33325, "\u003e@_startparamscope" ], [ 33378, "\u003e@_zhandler" ], [ 33409, "\u003e@_zwarnnam" ], [ 33460, "eatures_" ], [ 33470, "inish_" ], [ 33491, "cleanup_" ], [ 33502, "enables_" ], [ 37346, "_boot_" ], [ 37353, "_cleanup_" ], [ 37363, "_enables_" ], [ 37373, "_features_" ], [ 37384, "_finish_" ], [ 37393, "_setup_" ], [ 37401, "_addwrapper" ], [ 37413, "_bin_typeset" ], [ 37426, "_builtintab" ], [ 37438, "_deletehashtable" ], [ 37455, "_deletewrapper" ], [ 37470, "_endparamscope" ], [ 37485, "_featuresarray" ], [ 37500, "_gethashnode2" ], [ 37514, "_handlefeatures" ], [ 37530, "_hcalloc" ], [ 37539, "_locallevel" ], [ 37551, "_newparamtable" ], [ 37572, "_paramtab" ], [ 37582, "_printparamnode" ], [ 37598, "_queue_front" ], [ 37611, "_queue_rear" ], [ 37623, "_queueing_enabled" ], [ 37641, "_realparamtab" ], [ 37655, "_removehashnode" ], [ 37671, "_reswdtab" ], [ 37681, "_runshfunc" ], [ 37692, "_scanhashtable" ], [ 37707, "_setfeatureenables" ], [ 37726, "_signal_mask_queue" ], [ 37745, "_signal_queue" ], [ 37759, "_signal_setmask" ], [ 37775, "_startparamscope" ], [ 37798, "_zhalloc" ], [ 37807, "_zhandler" ], [ 37817, "_zwarn" ], [ 37824, "_zwarnnam" ], [ 37834, "dyld_stub_binder" ], [ 37851, "_getprivatenode" ], [ 37867, "_getprivatenode2" ], [ 37884, "_printprivatenode" ], [ 37902, "_is_private" ], [ 37914, "_pps_unsetfn" ], [ 37927, "_ppi_unsetfn" ], [ 37940, "_ppf_unsetfn" ], [ 37953, "_ppa_unsetfn" ], [ 37966, "_pph_unsetfn" ], [ 37979, "_bin_private" ], [ 37992, "_makeprivate" ], [ 38005, "_pps_getfn" ], [ 38016, "_pps_setfn" ], [ 38027, "_ppi_getfn" ], [ 38038, "_ppi_setfn" ], [ 38049, "_ppf_getfn" ], [ 38060, "_ppf_setfn" ], [ 38071, "_ppa_getfn" ], [ 38082, "_ppa_setfn" ], [ 38093, "_pph_getfn" ], [ 38104, "_pph_setfn" ], [ 38115, "_wrap_private" ], [ 38129, "_scopeprivate" ], [ 38143, "_scalar_private_gsu" ], [ 38163, "_integer_private_gsu" ], [ 38184, "_float_private_gsu" ], [ 38203, "_array_private_gsu" ], [ 38222, "_hash_private_gsu" ], [ 38240, "_bintab" ], [ 38248, "_reswd_private" ], [ 38263, "_module_features" ], [ 38280, "_wrapper" ], [ 38289, "__dyld_private" ], [ 38304, "_getparamnode" ], [ 38318, "_save_getnode2" ], [ 38333, "_save_printnode" ], [ 38349, "_save_local" ], [ 38361, "_emptytable" ], [ 38373, "_fakelevel" ], [ 38384, "_makeprivate_error" ], [ 38403, "_ppa_getfn.nullarray" ], [ 38424, "_wrap_private.wraplevel" ], [ 38448, "/AppleInternal/Library/BuildRoots/4~CI7vugAQpAp309F1pv3DHUQhKyMRjIXwWXiT19A/Library/Caches/com.apple.xbs/TemporaryDirectory.xXtx" ], [ 38608, "param_private.c" ], [ 38624, "/AppleInternal/Library/BuildRoots/4~CI7vugAQpAp309F1pv3DHUQhKyMRjIXwWXiT19A/Library/Caches/com.apple.xbs/TemporaryDirectory.xXtx" ], [ 38972, "com.apple.private" ], [ 39435, "Apple Inc.1\u00260$" ], [ 39456, "Apple Certification Authority1" ], [ 39496, "Apple Root CA0" ], [ 39588, "Apple Certification Authority1301" ], [ 39627, "*Apple Code Signing Certification Authority0" ], [ 40106, "%http://www.apple.com/appleca/root.crl0" ], [ 40645, "Apple Inc.1" ], [ 40666, "Apple Software1" ], [ 40691, "Software Signing0" ], [ 41101, "kThis certificate is to be used exclusively for functions internal to Apple Products and/or Apple processes.0" ], [ 41251, "$http://crl.apple.com/codesigning.crl0" ], [ 42339, "https://www.apple.com/appleca/0" ], [ 42388, "Reliance on this certificate by any party assumes acceptance of the then applicable standard terms and conditions of use, certif" ], [ 42943, "*Apple Code Signing Certification Authority" ], [ 43205, "\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e" ], [ 43244, "\u003c!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"\u003e" ], [ 43347, "\u003cplist version=\"1.0\"\u003e" ], [ 43369, "\u003cdict\u003e" ], [ 43376, "\u003ckey\u003ecdhashes\u003c/key\u003e" ], [ 43397, "\u003carray\u003e" ], [ 43406, "\u003cdata\u003e" ], [ 43415, "e9T7HcaNM66Y7FJ9LgV5YZyHDn4=" ], [ 43446, "\u003c/data\u003e" ], [ 43456, "\u003c/array\u003e" ], [ 43466, "\u003c/dict\u003e" ], [ 43474, "\u003c/plist\u003e" ], [ 43722, "2I7T" ], [ 65720, "__auth_stubs" ], [ 66032, "__auth_got" ], [ 125527, "G+z7mRZxh34eWfAaFwqd570s1og=" ] ], "sz": 73904, "ts": [ { "c": 1.0, "d": "Mach-O UUID present", "e": [ "2bfee27bbebb35bab034c0a6468c67c9" ], "i": "metadata/build/reproducible::macho-uuid", "l": 2 }, { "c": 1.0, "d": "Mach-O linked dylib", "e": [ "/usr/lib/libpcre.0.dylib", "/usr/lib/libiconv.2.dylib", "/usr/lib/libSystem.B.dylib", "/usr/lib/libncurses.5.4.dylib" ], "i": "metadata/binary/linking::macho-dylib", "l": 2 }, { "c": 1.0, "d": "macOS Platform Binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/platform::apple", "l": 3 }, { "c": 1.0, "d": "Identifier", "e": [ "e.private" ], "i": "metadata/signed/id::e.private", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 51.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.6000000238418579, "d": "/Library/Caches directory reference", "e": [ "…1pv3DHUQhKyMRjIXwWXiT19A/Library/Caches/com.apple.xbs/TemporaryD…" ], "i": "micro-behaviors/fs/path/library::library-caches-path", "l": 2 }, { "c": 0.949999988079071, "d": "Mach-O uses .so extension", "e": [ "private.so" ], "i": "metadata/file/extension::macho-so-extension", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.07" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 33.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 51.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "ARM64 Mach-O binary", "e": [ "macho.cpu_type = 16777228.00" ], "i": "metadata/arch::arm64-macho", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 3.14" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Universal Mach-O with two slices", "e": [ "macho.slice_count = 2.00" ], "i": "metadata/binary/framework::dual-arch-macho", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 51.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 73904.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Mach-O linked dylib metadata", "e": [ "/usr/lib/libpcre.0.dylib", "/usr/lib/libiconv.2.dylib", "/usr/lib/libSystem.B.dylib", "/usr/lib/libncurses.5.4.dylib" ], "i": "metadata/binary/linking/runtime::dylib", "l": 2 }, { "c": 1.0, "d": "Apple platform binary", "e": [ "platform::Apple Root CA" ], "i": "metadata/signed/trust-level::platform", "l": 2 }, { "c": 0.949999988079071, "d": "links self (builtintab, locallevel, opts, paramtab, queue_front, ... +29 more)", "e": [ "self" ], "i": "metadata/dylib::self", "l": 2 } ], "sha": "d0ffaa445906721498410b4c2a42509ef6d7ac4023b628151cda1ebf8046d034", "path": "private.so", "type": "macho" } ], "tv": "f6eaa" } }