{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.01145939901471138, "class": 0 } ], "prob": 0.011459399, "class": 0, "models": [ { "m": "az", "prob": 0.008847506, "class": 0 }, { "m": "az/source", "prob": 0.0027769182, "class": 0 }, { "m": "az/kotlin", "prob": 0.011459399, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-08T23:04:42Z" }, "path": "KsuCli.kt", "raw": { "v": "4", "fs": [ { "f": "O(I)Hâ‚‚(PoDb)", "k": { "source.imports[0]": "ArrayList", "source.imports[1]": "File", "source.imports[2]": "FlashResult", "source.imports[3]": "JSONArray", "source.imports[4]": "createRootShell", "source.imports[5]": "execKsud", "source.imports[6]": "flashWithIO", "source.imports[7]": "forceStopApp", "source.imports[8]": "getKsuDaemonPath", "source.imports[9]": "getRootShell", "source.strings[0]": " --kmi ", "source.strings[1]": " --kmi ${lkm.value}", "source.strings[2]": " --partition ", "source.strings[3]": " --partition $part", "source.strings[4]": " -b ${bootFile.absolutePath}", "source.strings[5]": " -m ${lkmFile.absolutePath}", "source.strings[6]": " -o $downloadsDir", "source.strings[7]": " boot-restore -f --magiskboot ", "source.strings[8]": " feature check ", "source.strings[9]": " feature get --config ", "source.has_imports": true, "source.imports[10]": "install", "source.imports[11]": "launchApp", "source.imports[12]": "listModules", "source.imports[13]": "newJob", "source.imports[14]": "onStderr", "source.imports[15]": "onStdout", "source.imports[16]": "runCatching", "source.imports[17]": "with", "source.imports[18]": "withContext", "source.imports[19]": "withNewRootShell", "source.strings[10]": " module action ", "source.strings[11]": " module list", "source.strings[12]": " profile delete-template ", "source.strings[13]": " profile get-sepolicy ", "source.strings[14]": " profile get-template ", "source.strings[15]": " profile list-templates", "source.strings[16]": " profile set-sepolicy ", "source.strings[17]": " profile set-template ", "source.strings[18]": " result: ", "source.strings[19]": " sepolicy check ", "source.strings[20]": " uninstall --magiskboot ", "source.strings[21]": " | tail -n 1 | xargs cmd activity start-activity -n", "source.strings[22]": " || /system/bin/reboot ", "source.strings[23]": "$cmd result: $result", "source.strings[24]": "${getKsuDaemonPath()} $args", "source.strings[25]": "${getKsuDaemonPath()} $cmd", "source.strings[26]": "${getKsuDaemonPath()} boot-restore -f --magiskboot $magiskboot", "source.strings[27]": "${getKsuDaemonPath()} feature check $feature", "source.strings[28]": "${getKsuDaemonPath()} feature get --config $feature", "source.strings[29]": "${getKsuDaemonPath()} module action $moduleId", "source.strings[30]": "${getKsuDaemonPath()} module list", "source.strings[31]": "${getKsuDaemonPath()} profile delete-template '${id}", "source.strings[32]": "${getKsuDaemonPath()} profile get-sepolicy $pkg", "source.strings[33]": "${getKsuDaemonPath()} profile get-template '${id}", "source.strings[34]": "${getKsuDaemonPath()} profile list-templates", "source.strings[35]": "${getKsuDaemonPath()} profile set-sepolicy $pkg '$rules", "source.strings[36]": "${getKsuDaemonPath()} profile set-template \"$id\" \"$escapedTemplate", "source.strings[37]": "${getKsuDaemonPath()} sepolicy check '$rules", "source.strings[38]": "${getKsuDaemonPath()} uninstall --magiskboot $magiskboot", "source.strings[39]": ", cost: ", "source.strings[40]": ", err: ", "source.strings[41]": ", out: ", "source.strings[42]": "/system/bin/input keyevent 26", "source.strings[43]": "/system/bin/svc power reboot ", "source.strings[44]": "/system/bin/svc power reboot $reason || /system/bin/reboot $reason", "source.strings[45]": "ApexSU", "source.strings[46]": "KsuCli", "source.strings[47]": "Module runAction result: ", "source.strings[48]": "Module runAction result: $result", "source.strings[49]": "Value:", "source.strings[50]": "am force-stop ", "source.strings[51]": "am force-stop $packageName", "source.strings[52]": "android12-", "source.strings[53]": "boot-info available-partitions", "source.strings[54]": "boot-info current-kmi", "source.strings[55]": "boot-info default-partition", "source.strings[56]": "boot-info is-ab-device", "source.strings[57]": "boot-info slot-suffix", "source.strings[58]": "boot-info slot-suffix --ota", "source.strings[59]": "boot-info supported-kmis", "source.strings[60]": "boot-patch --magiskboot ", "source.strings[61]": "boot-patch --magiskboot ${magiskboot.absolutePath}", "source.strings[62]": "boot.img", "source.strings[63]": "cmd package resolve-activity --brief ", "source.strings[64]": "cmd package resolve-activity --brief $packageName | tail -n 1 | xargs cmd activity start-activity -n", "source.strings[65]": "code: ", "source.strings[66]": "code: ${result.code}, out: ${result.out}, err: ${result.err}", "source.strings[67]": "force stop ", "source.strings[68]": "force stop $packageName result: $result", "source.strings[69]": "has magisk: ", "source.strings[70]": "has magisk: ${result.isSuccess}", "source.strings[71]": "init_boot", "source.strings[72]": "install --magiskboot ", "source.strings[73]": "install --magiskboot $magiskboot", "source.strings[74]": "install boot result: ", "source.strings[75]": "install boot result: ${result.isSuccess}", "source.strings[76]": "install module ", "source.strings[77]": "install module $uri result: $result", "source.strings[78]": "install result: ", "source.strings[79]": "install result: $result, cost: ${SystemClock.elapsedRealtime() - start}ms", "source.strings[80]": "kernelsu-tmp-lkm.ko", "source.strings[81]": "ksu failed: ", "source.strings[82]": "launch ", "source.strings[83]": "launch $packageName result: $result", "source.strings[84]": "libksud.so", "source.strings[85]": "libmagiskboot.so", "source.strings[86]": "module disable ", "source.strings[87]": "module disable $id", "source.strings[88]": "module enable ", "source.strings[89]": "module enable $id", "source.strings[90]": "module install ", "source.strings[91]": "module install ${file.absolutePath}", "source.strings[92]": "module undo-uninstall ", "source.strings[93]": "module undo-uninstall $id", "source.strings[94]": "module uninstall ", "source.strings[95]": "module uninstall $id", "source.strings[96]": "module.zip", "source.strings[97]": "recovery", "source.strings[98]": "set sepolicy result: ", "source.strings[99]": "set sepolicy result: ${result.code}", "source.functions[0]": "anonymous", "source.strings[100]": "su failed: ", "source.strings[101]": "undo uninstall module ", "source.strings[102]": "undo uninstall module $id result: $result", "source.strings[103]": "uninstall module ", "source.strings[104]": "uninstall module $id result: $result", "source.strings[105]": "which magisk" }, "x": 1, "id": 0, "is": [ "createRootShell", "createRootShell", "createRootShell", "getKsuDaemonPath", "getKsuDaemonPath", "withNewRootShell", "getKsuDaemonPath", "getRootShell", "getKsuDaemonPath", "withContext", "getRootShell", "getKsuDaemonPath", "ArrayList", "withContext", "getRootShell", "getKsuDaemonPath", "ArrayList", "File", "execKsud", "getRootShell", "getKsuDaemonPath", "ArrayList", "listModules", "runCatching", "JSONArray", "execKsud", "execKsud", "execKsud", "onStdout", "onStderr", "withNewRootShell", "newJob", "with", "File", "flashWithIO", "getKsuDaemonPath", "FlashResult", "createRootShell", "onStdout", "onStderr", "getKsuDaemonPath", "File", "flashWithIO", "getKsuDaemonPath", "FlashResult", "File", "flashWithIO", "getKsuDaemonPath", "FlashResult", "with", "File", "File", "with", "File", "flashWithIO", "getKsuDaemonPath", "install", "FlashResult", "getRootShell", "getRootShell", "withContext", "getRootShell", "getKsuDaemonPath", "withContext", "getRootShell", "getKsuDaemonPath", "ArrayList", "withContext", "getRootShell", "getKsuDaemonPath", "withContext", "getRootShell", "getKsuDaemonPath", "withContext", "getRootShell", "getKsuDaemonPath", "withContext", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getKsuDaemonPath", "ArrayList", "getRootShell", "getRootShell", "forceStopApp", "launchApp" ], "ms": { "file": { "size": 15126.0 }, "text": { "digit_ratio": 0.0, "space_count": 2833.0, "total_lines": 486.0, "char_entropy": 4.89, "unique_chars": 82.0, "import_density": 21.81, "string_density": 0.43, "avg_line_length": 30.12, "max_line_length": 123.0, "empty_line_ratio": 0.14, "last_line_length": 1.0, "most_common_char": "e", "whitespace_ratio": 0.22, "most_common_ratio": 0.06, "identifier_density": 0.05, "line_length_stddev": 27.72, "normalized_import_count": 4.81, "normalized_string_count": 9.39, "repeated_char_sequences": 35.0, "anonymous_function_ratio": 1.0, "suspicious_comment_ratio": 0.11, "max_inline_whitespace_run": 1.0, "normalized_function_count": 2.0, "imports_to_functions_ratio": 2.41, "strings_to_functions_ratio": 4.7, "normalized_unique_identifiers": 2.47, "identifiers_to_functions_ratio": 0.5 }, "imports": { "total": 106.0, "unique_modules": 20.0, "third_party_count": 106.0, "third_party_ratio": 1.0 }, "strings": { "total": 207.0, "avg_length": 17.63, "max_length": 100.0, "path_count": 5.0, "avg_entropy": 2.82, "total_bytes": 3650.0, "entropy_stddev": 1.29 }, "comments": { "chars": 388.0, "lines": 12.0, "total": 9.0, "to_code_ratio": 0.03, "high_entropy_comments": 1.0 }, "functions": { "total": 44.0, "anonymous": 44.0, "length_stddev": 11.88, "no_params_count": 44.0, "avg_length_lines": 9.27, "max_length_lines": 80.0, "min_length_lines": 3.0, "avg_nesting_depth": 0.09, "max_nesting_depth": 1.0, "density_per_100_lines": 9.05, "code_in_functions_ratio": 0.84 }, "identifiers": { "total": 22.0, "avg_length": 24.05, "max_length": 36.0, "min_length": 12.0, "avg_entropy": 3.72, "reuse_ratio": 1.0, "unique_count": 22.0, "length_stddev": 6.31, "high_entropy_count": 18.0, "high_entropy_ratio": 0.82 } }, "ss": [ [ 778, "KsuCli" ], [ 779, "KsuCli" ], [ 899, "libksud.so" ], [ 900, "libksud.so" ], [ 1100, "\\n" ], [ 1101, "\\n" ], [ 2244, "debug" ], [ 2245, "debug" ], [ 2253, "su" ], [ 2254, "su" ], [ 2259, "-g" ], [ 2260, "-g" ], [ 2328, "debug" ], [ 2329, "debug" ], [ 2337, "su" ], [ 2338, "su" ], [ 2401, "ksu failed: " ], [ 2402, "ksu failed: " ], [ 2493, "su" ], [ 2494, "su" ], [ 2499, "-mm" ], [ 2500, "-mm" ], [ 2557, "su" ], [ 2558, "su" ], [ 2633, "su failed: " ], [ 2634, "su failed: " ], [ 2677, "sh" ], [ 2678, "sh" ], [ 2864, "${getKsuDaemonPath()} $args" ], [ 2886, " " ], [ 2967, "${getKsuDaemonPath()} $args" ], [ 2989, " " ], [ 3166, "${getKsuDaemonPath()} feature check $feature" ], [ 3188, " feature check " ], [ 3462, "${getKsuDaemonPath()} feature get --config $feature" ], [ 3484, " feature get --config " ], [ 3617, "Value:" ], [ 3618, "Value:" ], [ 3685, "Value:" ], [ 3686, "Value:" ], [ 3849, "libmagiskboot.so" ], [ 3850, "libmagiskboot.so" ], [ 3908, "install --magiskboot $magiskboot" ], [ 3909, "install --magiskboot " ], [ 3965, "install result: $result, cost: ${SystemClock.elapsedRealtime() - start}ms" ], [ 3966, "install result: " ], [ 3989, ", cost: " ], [ 4037, "ms" ], [ 4147, "${getKsuDaemonPath()} module list" ], [ 4169, " module list" ], [ 4245, "\\n" ], [ 4246, "\\n" ], [ 4261, "[]" ], [ 4262, "[]" ], [ 4614, "module enable $id" ], [ 4615, "module enable " ], [ 4655, "module disable $id" ], [ 4656, "module disable " ], [ 4734, "$cmd result: $result" ], [ 4739, " result: " ], [ 4840, "module undo-uninstall $id" ], [ 4841, "module undo-uninstall " ], [ 4920, "undo uninstall module $id result: $result" ], [ 4921, "undo uninstall module " ], [ 4946, " result: " ], [ 5043, "module uninstall $id" ], [ 5044, "module uninstall " ], [ 5118, "uninstall module $id result: $result" ], [ 5119, "uninstall module " ], [ 5139, " result: " ], [ 6002, "module.zip" ], [ 6003, "module.zip" ], [ 6121, "module install ${file.absolutePath}" ], [ 6122, "module install " ], [ 6192, "${getKsuDaemonPath()} $cmd" ], [ 6214, " " ], [ 6256, "ApexSU" ], [ 6257, "ApexSU" ], [ 6266, "install module $uri result: $result" ], [ 6267, "install module " ], [ 6286, " result: " ], [ 6915, "${getKsuDaemonPath()} module action $moduleId" ], [ 6937, " module action " ], [ 7025, "ApexSU" ], [ 7026, "ApexSU" ], [ 7035, "Module runAction result: $result" ], [ 7036, "Module runAction result: " ], [ 7263, "libmagiskboot.so" ], [ 7264, "libmagiskboot.so" ], [ 7312, "${getKsuDaemonPath()} boot-restore -f --magiskboot $magiskboot" ], [ 7334, " boot-restore -f --magiskboot " ], [ 7601, "libmagiskboot.so" ], [ 7602, "libmagiskboot.so" ], [ 7650, "${getKsuDaemonPath()} uninstall --magiskboot $magiskboot" ], [ 7672, " uninstall --magiskboot " ], [ 8380, "boot.img" ], [ 8381, "boot.img" ], [ 8601, "libmagiskboot.so" ], [ 8602, "libmagiskboot.so" ], [ 8635, "boot-patch --magiskboot ${magiskboot.absolutePath}" ], [ 8636, "boot-patch --magiskboot " ], [ 8780, " -f" ], [ 8781, " -f" ], [ 8807, " -b ${bootFile.absolutePath}" ], [ 8808, " -b " ], [ 8875, " -u" ], [ 8876, " -u" ], [ 9084, "kernelsu-tmp-lkm.ko" ], [ 9085, "kernelsu-tmp-lkm.ko" ], [ 9273, " -m ${lkmFile.absolutePath}" ], [ 9274, " -m " ], [ 9372, " --kmi ${lkm.value}" ], [ 9373, " --kmi " ], [ 9621, " -o $downloadsDir" ], [ 9622, " -o " ], [ 9686, " --partition $part" ], [ 9687, " --partition " ], [ 9743, "${getKsuDaemonPath()} $cmd" ], [ 9765, " " ], [ 9803, "ApexSU" ], [ 9804, "ApexSU" ], [ 9813, "install boot result: ${result.isSuccess}" ], [ 9814, "install boot result: " ], [ 10377, "recovery" ], [ 10378, "recovery" ], [ 10500, "/system/bin/input keyevent 26" ], [ 10501, "/system/bin/input keyevent 26" ], [ 10569, "/system/bin/svc power reboot $reason || /system/bin/reboot $reason" ], [ 10570, "/system/bin/svc power reboot " ], [ 10606, " || /system/bin/reboot " ], [ 10844, "boot-info current-kmi" ], [ 10845, "boot-info current-kmi" ], [ 10898, "${getKsuDaemonPath()} $cmd" ], [ 10920, " " ], [ 11053, "boot-info supported-kmis" ], [ 11054, "boot-info supported-kmis" ], [ 11113, "${getKsuDaemonPath()} $cmd" ], [ 11135, " " ], [ 11343, "boot-info is-ab-device" ], [ 11344, "boot-info is-ab-device" ], [ 11398, "${getKsuDaemonPath()} $cmd" ], [ 11420, " " ], [ 11597, "boot-info default-partition" ], [ 11598, "boot-info default-partition" ], [ 11661, "${getKsuDaemonPath()} $cmd" ], [ 11683, " " ], [ 11752, "android12-" ], [ 11753, "android12-" ], [ 11767, "init_boot" ], [ 11768, "init_boot" ], [ 11784, "boot" ], [ 11785, "boot" ], [ 11944, "boot-info slot-suffix --ota" ], [ 11945, "boot-info slot-suffix --ota" ], [ 11995, "boot-info slot-suffix" ], [ 11996, "boot-info slot-suffix" ], [ 12055, "${getKsuDaemonPath()} $cmd" ], [ 12077, " " ], [ 12223, "boot-info available-partitions" ], [ 12224, "boot-info available-partitions" ], [ 12289, "${getKsuDaemonPath()} $cmd" ], [ 12311, " " ], [ 12506, "which magisk" ], [ 12507, "which magisk" ], [ 12544, "has magisk: ${result.isSuccess}" ], [ 12545, "has magisk: " ], [ 12783, "${getKsuDaemonPath()} sepolicy check '$rules" ], [ 12805, " sepolicy check " ], [ 13019, "${getKsuDaemonPath()} profile get-sepolicy $pkg" ], [ 13041, " profile get-sepolicy " ], [ 13127, "code: ${result.code}, out: ${result.out}, err: ${result.err}" ], [ 13128, "code: " ], [ 13148, ", out: " ], [ 13168, ", err: " ], [ 13226, "\\n" ], [ 13227, "\\n" ], [ 13357, "${getKsuDaemonPath()} profile set-sepolicy $pkg '$rules" ], [ 13379, " profile set-sepolicy " ], [ 13405, " " ], [ 13470, "set sepolicy result: ${result.code}" ], [ 13471, "set sepolicy result: " ], [ 13647, "${getKsuDaemonPath()} profile list-templates" ], [ 13669, " profile list-templates" ], [ 13849, "${getKsuDaemonPath()} profile get-template '${id}" ], [ 13871, " profile get-template " ], [ 13958, "\\n" ], [ 13959, "\\n" ], [ 14108, "\\" ], [ 14109, "\\" ], [ 14114, "\\\\\\" ], [ 14115, "\\\\\\" ], [ 14136, "${getKsuDaemonPath()} profile set-template \"$id\" \"$escapedTemplate" ], [ 14160, " profile set-template " ], [ 14187, " " ], [ 14410, "${getKsuDaemonPath()} profile delete-template '${id}" ], [ 14432, " profile delete-template " ], [ 14625, "am force-stop $packageName" ], [ 14626, "am force-stop " ], [ 14677, "force stop $packageName result: $result" ], [ 14678, "force stop " ], [ 14701, " result: " ], [ 14848, "cmd package resolve-activity --brief $packageName | tail -n 1 | xargs cmd activity start-activity -n" ], [ 14849, "cmd package resolve-activity --brief " ], [ 14898, " | tail -n 1 | xargs cmd activity start-activity -n" ], [ 14987, "launch $packageName result: $result" ], [ 14988, "launch " ], [ 15007, " result: " ] ], "sz": 15126, "ts": [ { "a": "T1059", "c": 0.800000011920929, "d": "Java Runtime exec launches command", "e": [ "exec" ], "i": "micro-behaviors/process/create/spawn::java-exec-ref", "l": 3, "m": "E1203" }, { "c": 0.8999999761581421, "d": "RAR member contains WSH script", "e": [ ".js" ], "i": "micro-behaviors/data/archive/rar::wsh-script-member-extension", "l": 1 }, { "a": "T1485", "c": 0.8600000143051147, "d": "Android file delete method string", "e": [ "delete" ], "i": "objectives/impact/wipe/disk/mass-delete::android-file-delete-method", "l": 1 } ], "sha": "d867290b271f0395c4d13e68504efd967dd5e34ed8c36d4c1a453b26083a14b1", "path": "KsuCli.kt", "type": "kotlin" } ], "tv": "bef72" } }