{
  "ml": {
    "v": "7",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.00001385808,
        "rte": "az",
        "prob": 0.00001385808
      },
      {
        "cls": 0,
        "raw": 0.0000045001507,
        "rte": "az/source",
        "prob": 0.0000045001507
      },
      {
        "cls": 0,
        "raw": 0.000004082918,
        "rte": "az/c",
        "prob": 0.000004082918
      }
    ],
    "prob": 0.00001385808,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.00001385807991027832,
        "type": "c"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-14T12:20:03Z"
  },
  "path": "picorun.c",
  "raw": {
    "v": "7",
    "tv": "c7b65",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 3,
            "b": "asXH3z/x#xx\u003eIa3atLSah6t!9Aa\u0026V\u003ey-(C{wm]E8avfKYwPz\u003c2A^n=%vqWhSx\u003e8m0z/cX0A+PSbA=Su[B.LV5",
            "l": 2
          },
          {
            "a": 72,
            "b": "asW",
            "l": 3
          },
          {
            "a": 75,
            "b": "asXHiwN]H@BAh88B-.tozxJw9wfu2owGUY8aAIEzA:@V6vqYP#vRGZ*A^n^tz/PYoefGdJBz8!nAV/NuBzbPnBrCBswnbT\u0026v{%E[z/d9Gvrb]",
            "l": 4,
            "n": [
              {
                "c": 2,
                "d": "English language detection",
                "i": "micro-behaviors/data/text/language::lang-english",
                "o": 93,
                "z": 3
              }
            ]
          },
          {
            "a": 163,
            "b": "asXHMwPzT4BAz88aAhvtC4\u003eF#wft#cvrrSlxK@q#z!%ldCwg@cay/tcwncd1z/fRsvrb{4zdN/I",
            "l": 5
          },
          {
            "a": 224,
            "b": "asW",
            "l": 6
          },
          {
            "a": 6870,
            "b": "2)(1",
            "l": 222
          },
          {
            "a": 6874,
            "b": "2)\u0026mm",
            "l": 223
          },
          {
            "a": 6879,
            "b": "2)?.7avG{:wN/*@C4z!bz!i#jviwlZvpS5CvSC)$C%J\u0026caARJAB7GCoz/{7yxKL^?y?kjwrDz.ZayPslvixJfwN/\u003e6B8M7wBz\u0026pgzG#",
            "l": 224,
            "n": [
              {
                "c": 3,
                "d": "LoadLibraryA call in source",
                "i": "micro-behaviors/dylib/load/source::load-library-a-source",
                "o": 6901,
                "z": 12
              }
            ]
          },
          {
            "a": 6962,
            "b": "2)?.7av*0+p\u0026ZF:l1BIDwPI]ny\u0026slcB-qyAvQTs?wft/daARphB0bpcBy/Fnz/df",
            "l": 225,
            "n": [
              {
                "c": 2,
                "d": "Windows GetProcAddress in source",
                "i": "micro-behaviors/dylib/lookup::get-proc-address-source",
                "o": 6967,
                "z": 14
              }
            ]
          },
          {
            "a": 7014,
            "b": "2)?.7f8",
            "l": 226
          },
          {
            "a": 7020,
            "b": "2)\u003efVB7DFdw/@HkzGG]AeK1o4AaHdPjS)M)lR?5Xpe+b0oIu(TDJ",
            "l": 227
          }
        ],
        "mol": "H(Ds)",
        "sha": "df019e7a631111cd3ef5a2ddf7ef9d23f8e5a7cb22da9f908f8ae434c7ad8267",
        "fact": {
          "id": "c",
          "imp": [
            [
              "",
              "FIRST_PICO_DIRECTIVE"
            ],
            [
              "",
              "NEXT_PICO_DIRECTIVE"
            ],
            [
              "",
              "FIRST_PICO_DIRECTIVE"
            ],
            [
              "",
              "movsb"
            ],
            [
              "",
              "funcs.LoadLibraryA"
            ],
            [
              "",
              "funcs.GetProcAddress"
            ],
            [
              "",
              "NEXT_PICO_DIRECTIVE"
            ],
            [
              "",
              "loaderdefs.h"
            ],
            [
              "",
              "tcg.h"
            ]
          ],
          "mbr": [
            "copy.dst_offset",
            "copy.src_offset",
            "copy.total",
            "entry.option",
            "entry.type",
            "export.offset",
            "export.tag",
            "funcs.GetProcAddress",
            "funcs.LoadLibraryA",
            "hdr.entryAddress",
            "hdr.rsrcOffset",
            "patch.offset"
          ],
          "met": {
            "ast": {
              "op.eq": 11.0,
              "op.ge": 1.0,
              "op.add": 14.0,
              "op.mul": 5.0,
              "op.sub": 2.0,
              "max_depth": 19.0,
              "bind_count": 26.0,
              "call_count": 9.0,
              "node_count": 1366.0,
              "member_count": 12.0,
              "op_density.eq": 0.01,
              "op_density.ge": 0.0,
              "op_density.add": 0.01,
              "op_density.mul": 0.0,
              "op_density.sub": 0.0,
              "identifier_count": 67.0,
              "member_depth_max": 2.0,
              "string_literal_count": 2.0,
              "string_concat_chain_max_length": 3.0
            },
            "file": {
              "size": 7688.0,
              "entropy": 5.38,
              "size_bytes": 7688.0
            },
            "text": {
              "tab_count": 331.0,
              "digit_ratio": 0.01,
              "space_count": 1009.0,
              "total_lines": 248.0,
              "char_entropy": 5.38,
              "mixed_indent": 1.0,
              "unique_chars": 84.0,
              "string_density": 0.01,
              "avg_line_length": 30.0,
              "high_byte_ratio": 0.0,
              "max_line_length": 124.0,
              "non_ascii_ratio": 0.0,
              "empty_line_ratio": 0.13,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.21,
              "most_common_ratio": 0.05,
              "identifier_density": 1.19,
              "line_length_stddev": 28.43,
              "normalized_string_count": 0.13,
              "repeated_char_sequences": 4.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.13,
              "max_inline_whitespace_run": 17.0,
              "most_common_char_codepoint": 101.0,
              "suspicious_identifier_ratio": 0.01,
              "normalized_unique_identifiers": 8.42
            },
            "binds": {
              "count": 26.0
            },
            "calls": {
              "count": 9.0
            },
            "binary": {
              "overall_entropy": 5.38
            },
            "source": {
              "function_count": 6.0
            },
            "imports": {
              "count": 2.0,
              "unique_modules": 2.0,
              "third_party_count": 2.0,
              "third_party_ratio": 1.0
            },
            "members": {
              "count": 12.0
            },
            "strings": {
              "total": 2.0,
              "avg_length": 8.5,
              "max_length": 12.0,
              "avg_entropy": 2.79,
              "total_bytes": 17.0,
              "entropy_stddev": 0.46
            },
            "comments": {
              "chars": 3071.0,
              "lines": 64.0,
              "total": 15.0,
              "to_code_ratio": 0.35,
              "high_entropy_comments": 2.0
            },
            "functions": {
              "count": 6.0
            },
            "identifiers": {
              "count": 67.0,
              "total": 295.0,
              "avg_length": 10.49,
              "max_length": 21.0,
              "min_length": 1.0,
              "avg_entropy": 2.7,
              "reuse_ratio": 0.23,
              "unique_count": 67.0,
              "length_stddev": 5.92,
              "has_digit_ratio": 0.01,
              "sequential_names": 1.0,
              "single_char_count": 1.0,
              "single_char_ratio": 0.01,
              "all_lowercase_ratio": 0.39,
              "all_uppercase_ratio": 0.4,
              "numeric_suffix_count": 1.0,
              "underscore_prefix_count": 1.0
            }
          },
          "str": [
            [
              1586,
              "u8",
              "loaderdefs.h"
            ],
            [
              1587,
              "u8",
              "loaderdefs.h"
            ],
            [
              1610,
              "u8",
              "tcg.h"
            ],
            [
              1611,
              "u8",
              "tcg.h"
            ],
            [
              3423,
              "10",
              "0"
            ],
            [
              5719,
              "10",
              "1"
            ]
          ],
          "tgt": [
            "FIRST_PICO_DIRECTIVE",
            "NEXT_PICO_DIRECTIVE",
            "__movsb",
            "funcs.GetProcAddress",
            "funcs.LoadLibraryA"
          ],
          "val": {
            "file.stem": "picorun",
            "file.basename": "picorun.c",
            "source.language": "c",
            "source.imports[0]": "FIRST_PICO_DIRECTIVE",
            "source.imports[1]": "NEXT_PICO_DIRECTIVE",
            "source.imports[2]": "funcs.GetProcAddress",
            "source.imports[3]": "funcs.LoadLibraryA",
            "source.imports[4]": "loaderdefs.h",
            "source.imports[5]": "movsb",
            "source.imports[6]": "tcg.h",
            "source.strings[0]": "loaderdefs.h",
            "source.has_imports": true,
            "source.functions[0]": "PicoCodeSize(char * src)",
            "source.functions[1]": "PicoDataSize(char * src)",
            "source.functions[2]": "PicoEntryPoint(char * src, char * base)",
            "source.functions[3]": "PicoGetExport(char * src, char * base, int tag)",
            "source.functions[4]": "PicoLoad(IMPORTFUNCS * funcs, char * src, char * dstCode, char * dstData)",
            "source.functions[5]": "if (entry-\u003etype == PICO_INST_COMPLETE)",
            "source.functions[6]": "if (entry-\u003etype == PICO_INST_COPY)",
            "source.functions[7]": "if (entry-\u003etype == PICO_INST_GPA)",
            "source.functions[8]": "if (entry-\u003etype == PICO_INST_LL)",
            "source.functions[9]": "if (entry-\u003etype == PICO_INST_PATCH_DIFF)"
          }
        },
        "find": [
          {
            "id": "metadata/file/text/format::vocab-expected",
            "conf": 0.9700000286102295,
            "crit": 1,
            "desc": "Validation vocabulary expected"
          },
          {
            "id": "micro-behaviors/dylib/lookup::get-proc-address-source",
            "atk": "T1574.002",
            "conf": 0.949999988079071,
            "crit": 2,
            "desc": "Windows GetProcAddress in source"
          },
          {
            "id": "micro-behaviors/data/text/llm/override::llm-instruction-context",
            "conf": 0.7200000286102295,
            "crit": 1,
            "desc": "LLM instruction context"
          },
          {
            "id": "micro-behaviors/data/text/language::lang-english",
            "conf": 0.800000011920929,
            "crit": 2,
            "desc": "English language detection"
          },
          {
            "id": "micro-behaviors/data/text/keywords/media-permission::permission-grant-verb",
            "conf": 0.8600000143051147,
            "crit": 1,
            "desc": "Permission-grant action verb keyword"
          },
          {
            "id": "micro-behaviors/dylib/load/source::load-library-a-source",
            "atk": "T1574.002",
            "conf": 0.949999988079071,
            "crit": 3,
            "desc": "LoadLibraryA call in source"
          },
          {
            "id": "objectives/impact/wipe/logs::native-log-wipe-null-redirection",
            "atk": "T1070.002",
            "mbc": "E1070",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "Native log null redirection"
          },
          {
            "id": "micro-behaviors/data/text/keywords/lexicon::target-source-test",
            "conf": 0.8799999952316284,
            "crit": 1,
            "desc": "Source or test keyword"
          },
          {
            "id": "metadata/file/text/format::vocab-array",
            "conf": 0.9700000286102295,
            "crit": 1,
            "desc": "Validation vocabulary array"
          }
        ],
        "path": "picorun.c",
        "risk": 2,
        "size": 7688,
        "type": "c"
      }
    ]
  }
}