{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000010867913, "rte": "az", "prob": 0.000010867913 }, { "cls": 0, "raw": 0.31327188, "rte": "az/source", "prob": 0.31327188 }, { "cls": 0, "raw": 0.6106461, "rte": "az/c", "prob": 0.6106461 } ], "prob": 0.000010867913, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.000010867913260881323, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:01:46Z" }, "path": "NetworkHandler.cpp", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 46, "b": "fdD", "l": 4 }, { "a": 49, "b": "asXH4wPIv4x(Ffdz/dP", "l": 5 }, { "a": 65, "b": "asXH8vqYQ(wKyxMzddr)azC)tA+frhz/fSgvR/P#w]zYjxKL^?y?W^1ayMygwPScmA+=!rwO+^%wN(][z/6u1zE+v", "l": 6, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 97, "z": 3 } ] }, { "a": 137, "b": "asW", "l": 7 }, { "a": 140, "b": "asXHgvrb^[wPRH7B2\u003c", "l": 8 }, { "a": 155, "b": "asXH0v@Dj3vqYP#tvf%tuM:Aiwi8+)BAh8kxi=SieG!2awGUG3zeAZ0wft#jayX[8xKL^?y?mcf", "l": 9, "n": [ { "c": 1, "d": "Validation vocabulary string", "i": "metadata/file/text/format::vocab-string", "o": 178, "z": 6 } ] }, { "a": 216, "b": "asW", "l": 10 }, { "a": 219, "b": "asXHiwPS6nzGv\u0026", "l": 11 }, { "a": 1457, "b": "31W{]wGUY0asH-rzeAZ0wklMIwIdFhze-{7wHF:sx(!wudiH=pattk!DJ", "l": 41 }, { "a": 1503, "b": "2)\u003erTasIhqA:-*ae]$-MwHF#IaW3@5diJ%", "l": 42 }, { "a": 1531, "b": "2)*]VByWA[v}xX3auR+eb1VV}vqGT*aA.:lxjSnfjuK:cByWA[wO#3{i@", "l": 43, "n": [ { "c": 1, "d": "Validation vocabulary invalid", "i": "metadata/file/text/format::vocab-invalid", "o": 1548, "z": 7 } ] }, { "a": 1577, "b": "2)*]mA+PAknm=QRc[dj", "l": 44 }, { "a": 1593, "b": "2)*]UwPS6nzAv", "l": 45 }, { "a": 4401, "b": "34h", "l": 158 }, { "a": 4404, "b": "329#]c#-QnvqQ6rvrr[Kdk2gGAccvNdiK1=ar+/Fwi8+Wy\u00260D%w*?RbA:-*ae[5\u0026IfEXR-wOkZ{c[cX\u0026Aa9=}zf4srBsn*(e[F{hc[cX\u0026iYZ$@wnbW\u003cBswTYDJ", "l": 159 }, { "a": 4502, "b": "2)\u003eV{wi8+YwPz/ljuK-gnP5YWy?WA5AbP=saz#ssvR6N7auR+eB97}Ni+rhty=.", "l": 160, "n": [ { "c": 1, "d": "Validation vocabulary number", "i": "metadata/file/text/format::vocab-number", "o": 4531, "z": 6 } ] }, { "a": 4553, "b": "2)\u003eS-BAIRwazb4#B7EA", "l": 161 }, { "a": 4569, "b": "34h", "l": 162 }, { "a": 5101, "b": "Ee", "l": 178 }, { "a": 5103, "b": "", "l": 179 }, { "a": 5104, "b": "fdD", "l": 180, "n": [ { "c": 3, "d": "Derived ast condition", "i": "objectives/evasion/kernel-hide/lkm/hiding::inline__hiding-mention-comment__any_7", "o": 5104, "z": 103 } ] }, { "a": 5107, "b": "asXH4wPIv4x(Ffdz/dP", "l": 181 }, { "a": 5123, "b": "asXH8x\u003eg=$x(+zqwPI*ezGxJ3y?j-3z/M$mB8#FrzF782aw2u@r7{T\u0026nKM0OrzD7Rl}7DVpF$dmBz\u0026pnx\u003eg=$z/M$yzFi-{wGUz7AbP=se=", "l": 182 }, { "a": 5838, "b": "3213-wmYTPz/P}Lrc-B]auZ\u0026^z/P@0D2NsR", "l": 199 }, { "a": 5867, "b": "", "l": 200 }, { "a": 5868, "b": "336Q0B-Ivxl$HKQv}wkIlVl\u003c:A=k+xdRIN\u003ewn2)]xd^?dBsnN?ao", "l": 201, "n": [ { "c": 3, "d": "DeviceIoControl API usage", "i": "micro-behaviors/fs/file/handle::device-io-control-win", "o": 5876, "z": 15 } ] }, { "a": 5910, "b": "2)\u003cg0lSu-^nj=iruSx\u0026(nKM0Op!%$*efB", "l": 202 }, { "a": 5937, "b": "2)?}(x\u003eg:=zCUm(BsXK", "l": 203 } ], "mol": "O(Er)H(F)", "sha": "db481d62346204e8ebe6234d7035970240bd5767c9656d81001b267d165d1c6f", "fact": { "id": "c", "imp": [ [ "", "SplitStringBySpace" ], [ "", "params.at" ], [ "", "params.erase" ], [ "", "params.begin" ], [ "", "commandName.compare" ], [ "", "CheckInput" ], [ "", "PrintHelp" ], [ "", "atoi" ], [ "", "params.at.c_str" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "Hide" ], [ "", "commandName.compare" ], [ "", "commandName.compare" ], [ "", "CheckInput" ], [ "", "PrintHelp" ], [ "", "atoi" ], [ "", "params.at.c_str" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "Hide" ], [ "", "commandName.compare" ], [ "", "params.size" ], [ "", "PrintHelp" ], [ "", "params.at" ], [ "", "portType.compare" ], [ "", "ListHiddenPorts" ], [ "", "e.what" ], [ "", "hiddenPorts.empty" ], [ "", "portType.compare" ], [ "", "ListHiddenPorts" ], [ "", "catch" ], [ "", "e.what" ], [ "", "endl" ], [ "", "hiddenPorts.empty" ], [ "", "endl" ], [ "", "PrintHelp" ], [ "", "PrintHelp" ], [ "", "PrintHelp" ], [ "", "commandName.compare" ], [ "", "params.size" ], [ "", "PrintHelp" ], [ "", "params.at" ], [ "", "portType.compare" ], [ "", "ClearHiddenPorts" ], [ "", "endl" ], [ "", "endl" ], [ "", "portType.compare" ], [ "", "ClearHiddenPorts" ], [ "", "endl" ], [ "", "endl" ], [ "", "portType.compare" ], [ "", "ClearHiddenPorts" ], [ "", "PrintHelp" ], [ "", "PrintHelp" ], [ "", "CheckInput" ], [ "", "CheckInput" ], [ "", "params.size" ], [ "", "PrintHelp" ], [ "", "params.at.empty" ], [ "", "params.at" ], [ "", "all_of" ], [ "", "params.at.begin" ], [ "", "params.at" ], [ "", "params.at.end" ], [ "", "params.at" ], [ "", "atoi" ], [ "", "params.at.c_str" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "params.at" ], [ "", "Hide" ], [ "", "DeviceIoControl" ], [ "", "hNidhogg.get" ], [ "", "ListHiddenPorts" ], [ "", "DeviceIoControl" ], [ "", "hNidhogg.get" ], [ "", "NetworkHandlerException" ], [ "", "NetworkHandlerException" ], [ "", "DeviceIoControl" ], [ "", "hNidhogg.get" ], [ "", "SafeFree" ], [ "", "hiddenPorts.push_back" ], [ "", "SafeFree" ], [ "", "ClearHiddenPorts" ], [ "", "DeviceIoControl" ], [ "", "hNidhogg.get" ], [ "", "NetworkHandler.h" ], [ "", "pch.h" ] ], "mbr": [ "commandName.compare", "e.what", "hNidhogg.get", "hiddenPort.Hide", "hiddenPort.Port", "hiddenPort.Remote", "hiddenPort.Type", "hiddenPorts.empty", "hiddenPorts.push_back", "params.at", "params.at().begin", "params.at().c_str", "params.at().empty", "params.at().end", "params.begin", "params.erase", "params.size", "port.Port", "port.Remote", "portType.compare", "rawHiddenPorts.Count", "rawHiddenPorts.Ports", "rawHiddenPorts.Type" ], "met": { "ast": { "op.eq": 14.0, "op.gt": 12.0, "op.lt": 11.0, "op.ne": 8.0, "op.lor": 3.0, "op.mul": 5.0, "op.shl": 65.0, "op.band": 13.0, "op.land": 2.0, "op.lnot": 5.0, "max_depth": 12.0, "op.concat": 68.0, "bind_count": 13.0, "call_count": 98.0, "node_count": 2338.0, "member_count": 23.0, "op_density.eq": 0.01, "op_density.gt": 0.01, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.shl": 0.03, "op_density.band": 0.01, "op_density.land": 0.0, "op_density.lnot": 0.0, "identifier_count": 75.0, "member_depth_max": 3.0, "op_density.concat": 0.03, "string_literal_count": 57.0 }, "file": { "size": 8053.0, "entropy": 5.18, "size_bytes": 8053.0 }, "text": { "tab_count": 495.0, "digit_ratio": 0.01, "space_count": 772.0, "total_lines": 287.0, "char_entropy": 5.18, "mixed_indent": 1.0, "unique_chars": 80.0, "string_density": 0.2, "avg_line_length": 27.06, "max_line_length": 112.0, "empty_line_ratio": 0.06, "last_line_length": 1.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.07, "identifier_density": 1.55, "line_length_stddev": 26.44, "normalized_string_count": 3.36, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 1.0, "max_inline_whitespace_run": 7.0, "trailing_whitespace_lines": 26.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 9.19 }, "binds": { "count": 13.0 }, "calls": { "count": 98.0 }, "binary": { "overall_entropy": 5.18 }, "imports": { "count": 2.0, "unique_modules": 2.0, "third_party_count": 2.0, "third_party_ratio": 1.0 }, "members": { "count": 23.0 }, "strings": { "total": 57.0, "avg_length": 14.02, "max_length": 53.0, "avg_entropy": 2.77, "total_bytes": 799.0, "entropy_stddev": 0.99 }, "comments": { "chars": 1444.0, "lines": 51.0, "total": 5.0, "to_code_ratio": 0.22, "high_entropy_comments": 5.0 }, "identifiers": { "count": 75.0, "total": 444.0, "avg_length": 8.0, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 2.44, "reuse_ratio": 0.17, "unique_count": 75.0, "length_stddev": 5.61, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.03, "high_entropy_count": 12.0, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.48, "all_uppercase_ratio": 0.11, "underscore_prefix_count": 1.0 } }, "str": [ [ 9, "u8", "pch.h" ], [ 10, "u8", "pch.h" ], [ 26, "u8", "NetworkHandler.h" ], [ 27, "u8", "NetworkHandler.h" ], [ 428, "10", "0" ], [ 489, "u8", "hide" ], [ 490, "u8", "hide" ], [ 500, "10", "0" ], [ 622, "10", "0" ], [ 669, "10", "1" ], [ 675, "u8", "tcp" ], [ 676, "u8", "tcp" ], [ 741, "10", "2" ], [ 747, "u8", "remote" ], [ 748, "u8", "remote" ], [ 815, "u8", "Port " ], [ 816, "u8", "Port " ], [ 840, "u8", " hidden" ], [ 841, "u8", " hidden" ], [ 881, "u8", "Failed to hide port " ], [ 882, "u8", "Failed to hide port " ], [ 965, "u8", "unhide" ], [ 966, "u8", "unhide" ], [ 978, "10", "0" ], [ 1003, "u8", "restore" ], [ 1004, "u8", "restore" ], [ 1017, "10", "0" ], [ 1139, "10", "0" ], [ 1186, "10", "1" ], [ 1192, "u8", "tcp" ], [ 1193, "u8", "tcp" ], [ 1258, "10", "2" ], [ 1264, "u8", "remote" ], [ 1265, "u8", "remote" ], [ 1333, "u8", "Port " ], [ 1334, "u8", "Port " ], [ 1358, "u8", " unhidden" ], [ 1359, "u8", " unhidden" ], [ 1401, "u8", "Failed to unhide port " ], [ 1402, "u8", "Failed to unhide port " ], [ 1487, "u8", "list" ], [ 1488, "u8", "list" ], [ 1498, "10", "0" ], [ 1526, "10", "1" ], [ 1547, "u8", "Invalid usage" ], [ 1548, "u8", "Invalid usage" ], [ 1643, "10", "0" ], [ 1671, "u8", "tcp" ], [ 1672, "u8", "tcp" ], [ 1681, "10", "0" ], [ 1864, "u8", "Error: " ], [ 1865, "u8", "Error: " ], [ 1965, "u8", "No hidden TCP ports found." ], [ 1966, "u8", "No hidden TCP ports found." ], [ 2084, "u8", "[+] Port: " ], [ 2085, "u8", "[+] Port: " ], [ 2118, "u8", ", Remote: " ], [ 2119, "u8", ", Remote: " ], [ 2154, "u8", "Yes" ], [ 2155, "u8", "Yes" ], [ 2162, "u8", "No" ], [ 2163, "u8", "No" ], [ 2230, "u8", "udp" ], [ 2231, "u8", "udp" ], [ 2240, "10", "0" ], [ 2423, "u8", "Error: " ], [ 2424, "u8", "Error: " ], [ 2524, "u8", "No hidden UDP ports found." ], [ 2525, "u8", "No hidden UDP ports found." ], [ 2643, "u8", "[+] Port: " ], [ 2644, "u8", "[+] Port: " ], [ 2677, "u8", ", Remote: " ], [ 2678, "u8", ", Remote: " ], [ 2713, "u8", "Yes" ], [ 2714, "u8", "Yes" ], [ 2721, "u8", "No" ], [ 2722, "u8", "No" ], [ 2786, "u8", "Invalid option!" ], [ 2787, "u8", "Invalid option!" ], [ 2882, "u8", "clear" ], [ 2883, "u8", "clear" ], [ 2894, "10", "0" ], [ 2922, "10", "1" ], [ 2943, "u8", "Invalid usage" ], [ 2944, "u8", "Invalid usage" ], [ 3039, "10", "0" ], [ 3067, "u8", "tcp" ], [ 3068, "u8", "tcp" ], [ 3077, "10", "0" ], [ 3141, "u8", "All hidden TCP ports cleared." ], [ 3142, "u8", "All hidden TCP ports cleared." ], [ 3216, "u8", "Failed to clear hidden TCP ports." ], [ 3217, "u8", "Failed to clear hidden TCP ports." ], [ 3314, "u8", "udp" ], [ 3315, "u8", "udp" ], [ 3324, "10", "0" ], [ 3388, "u8", "All hidden UDP ports cleared." ], [ 3389, "u8", "All hidden UDP ports cleared." ], [ 3463, "u8", "Failed to clear hidden UDP ports." ], [ 3464, "u8", "Failed to clear hidden UDP ports." ], [ 3561, "u8", "all" ], [ 3562, "u8", "all" ], [ 3571, "10", "0" ], [ 3635, "u8", "All hidden ports cleared." ], [ 3636, "u8", "All hidden ports cleared." ], [ 3709, "u8", "Failed to clear hidden TCP ports." ], [ 3710, "u8", "Failed to clear hidden TCP ports." ], [ 3793, "u8", "Invalid option!" ], [ 3794, "u8", "Invalid option!" ], [ 3882, "u8", "Invalid option!" ], [ 3883, "u8", "Invalid option!" ], [ 4320, "10", "3" ], [ 4340, "u8", "Invalid usage" ], [ 4341, "u8", "Invalid usage" ], [ 4419, "10", "0" ], [ 4456, "10", "0" ], [ 4478, "10", "0" ], [ 4517, "u8", "Invalid port number" ], [ 4518, "u8", "Invalid port number" ], [ 4628, "10", "0" ], [ 4662, "10", "0" ], [ 4680, "10", "65535" ], [ 4704, "u8", "Port number must be between 1 and 65535" ], [ 4705, "u8", "Port number must be between 1 and 65535" ], [ 4794, "10", "1" ], [ 4800, "u8", "tcp" ], [ 4801, "u8", "tcp" ], [ 4819, "10", "1" ], [ 4825, "u8", "udp" ], [ 4826, "u8", "udp" ], [ 4849, "u8", "Invalid port type. Use 'tcp' or 'udp'." ], [ 4850, "u8", "Invalid port type. Use 'tcp' or 'udp'." ], [ 4938, "10", "2" ], [ 4944, "u8", "remote" ], [ 4945, "u8", "remote" ], [ 4966, "10", "2" ], [ 4972, "u8", "local" ], [ 4973, "u8", "local" ], [ 4998, "u8", "Invalid remote/local option. Use 'remote' or 'local'." ], [ 4999, "u8", "Invalid remote/local option. Use 'remote' or 'local'." ], [ 5990, "10", "0" ], [ 6734, "u8", "Failed to list hidden ports." ], [ 6735, "u8", "Failed to list hidden ports." ], [ 6799, "10", "0" ], [ 6995, "u8", "Failed to allocate memory for hidden ports list" ], [ 6996, "u8", "Failed to allocate memory for hidden ports list" ], [ 7316, "u8", "Failed to list hidden ports." ], [ 7317, "u8", "Failed to list hidden ports." ], [ 7370, "10", "0" ], [ 8021, "10", "0" ] ], "tgt": [ "CheckInput", "CheckInput()", "ClearHiddenPorts", "DeviceIoControl", "Hide", "ListHiddenPorts", "NetworkHandlerException", "NetworkHandlerException()", "PrintHelp", "PrintHelp()", "PrintHelp()()", "SafeFree", "SplitStringBySpace", "all_of", "atoi", "catch", "commandName.compare", "e.what", "endl", "endl()", "hNidhogg.get", "hiddenPorts.empty", "hiddenPorts.push_back", "params.at", "params.at().begin", "params.at().c_str", "params.at().empty", "params.at().end", "params.begin", "params.erase", "params.size", "portType.compare" ], "val": { "file.stem": "NetworkHandler", "file.basename": "NetworkHandler.cpp", "source.language": "c", "source.imports[0]": "CheckInput", "source.imports[1]": "ClearHiddenPorts", "source.imports[2]": "DeviceIoControl", "source.imports[3]": "Hide", "source.imports[4]": "ListHiddenPorts", "source.imports[5]": "NetworkHandler.h", "source.imports[6]": "NetworkHandlerException", "source.imports[7]": "PrintHelp", "source.imports[8]": "SafeFree", "source.imports[9]": "SplitStringBySpace", "source.strings[0]": " hidden", "source.strings[1]": " unhidden", "source.strings[2]": ", Remote: ", "source.strings[3]": "All hidden TCP ports cleared.", "source.strings[4]": "All hidden UDP ports cleared.", "source.strings[5]": "All hidden ports cleared.", "source.strings[6]": "Error: ", "source.strings[7]": "Failed to allocate memory for hidden ports list", "source.strings[8]": "Failed to clear hidden TCP ports.", "source.strings[9]": "Failed to clear hidden UDP ports.", "source.has_imports": true, "source.imports[10]": "all_of", "source.imports[11]": "atoi", "source.imports[12]": "catch", "source.imports[13]": "commandName.compare", "source.imports[14]": "e.what", "source.imports[15]": "endl", "source.imports[16]": "hNidhogg.get", "source.imports[17]": "hiddenPorts.empty", "source.imports[18]": "hiddenPorts.push_back", "source.imports[19]": "params.at", "source.imports[20]": "params.at.begin", "source.imports[21]": "params.at.c_str", "source.imports[22]": "params.at.empty", "source.imports[23]": "params.at.end", "source.imports[24]": "params.begin", "source.imports[25]": "params.erase", "source.imports[26]": "params.size", "source.imports[27]": "pch.h", "source.imports[28]": "portType.compare", "source.strings[10]": "Failed to hide port ", "source.strings[11]": "Failed to list hidden ports.", "source.strings[12]": "Failed to unhide port ", "source.strings[13]": "Invalid option!", "source.strings[14]": "Invalid port number", "source.strings[15]": "Invalid port type. Use 'tcp' or 'udp'.", "source.strings[16]": "Invalid remote/local option. Use 'remote' or 'local'.", "source.strings[17]": "Invalid usage", "source.strings[18]": "NetworkHandler.h", "source.strings[19]": "No hidden TCP ports found.", "source.strings[20]": "No hidden UDP ports found.", "source.strings[21]": "Port number must be between 1 and 65535", "source.strings[22]": "[+] Port: ", "source.strings[23]": "remote", "source.strings[24]": "restore", "source.strings[25]": "unhide" } }, "find": [ { "id": "objectives/evasion/kernel-hide/lkm/hiding::inline__hiding-mention-comment__any_7", "conf": 1.0, "crit": 3, "desc": "Derived ast condition" }, { "id": "metadata/file/text/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string" }, { "id": "metadata/file/text/format::vocab-invalid", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary invalid" }, { "id": "metadata/file/text/format::vocab-number", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary number" }, { "id": "micro-behaviors/fs/file/handle::device-io-control-win", "conf": 0.8500000238418579, "crit": 3, "desc": "DeviceIoControl API usage" } ], "path": "/data/samples/bad/projects/Nidhogg/NidhoggClient/NetworkHandler.cpp", "risk": 2, "size": 8053, "type": "c" } ] } }