{ "ml": { "v": "7", "eng": "2.2.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000061392784, "rte": "az", "prob": 0.000061392784 } ], "prob": 0.000061392784, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006139278411865234, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000011046727195207495, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.000010669231414794922, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T05:47:30Z" }, "path": "btrfs-progs-libs-6.17.1-r1.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "H(F)Md(He)", "sha": "dfee8fd91c95a935dcd7e30b9a1d8e9020785bfa5366d0378ae415fb5a5184ea", "path": "btrfs-progs-libs-6.17.1-r1.apk", "risk": 2, "size": 22990, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 22990.0, "entropy": 7.98, "size_bytes": 22990.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 7.98, "peak_region_bytes": 22990.0, "peak_region_entropy": 7.82 } } }, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 3 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "from": [ { "file": 1 }, { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files by fd/path", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "from": [ { "file": 1 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:000007\u003ezU!0000000000kMA+z3JJA(82$GN0rr91", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#", "n": [ { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 4601, "z": 12, "cf": 0.949999988079071 } ], "ln": 4585 }, { "b": "vSVT5B6\u003c6ix(4c$D2v9(z/xo90af8AA=M5ouU\u003cT\u003cvruj4zuaf.z/YE\u0026vSVT5B6\u003c6i", "n": [ { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 4743, "z": 4, "cf": 0.800000011920929 } ], "ln": 4727 }, { "b": "uUjv^CvticuVQHgv/P\u003eyB97\u00262yHpN+yHpWZx(0=\u003cBAhhezuaJZy\u00261310bVp:A:@^60a{m.wDlT/wO${#0chTVy\u00261310aH4\u003cw]?s4BzkL#x(^T5BZ/Jjy\u0026%Pa", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 4988, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::openat", "o": 5030, "z": 6, "cf": 0.6600000262260437 } ], "ln": 4972 }, { "b": "y\u0026%PauUi*Gw]\u002665By]N]w]\u002665Bo2=(A+ox1B-.tluVQv0C5IhtzdN6*B6\u003c90y?WA!w=", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 5134, "z": 5, "cf": 0.800000011920929 } ], "ln": 5118 }, { "b": "vS(WaB.$X%x(mK3uUi*GxjVf@B.Lv^vSVT5B6\u003c6ix(4c$BZ/Jjy\u0026%PauUr}(uUKy\u0026z^N8", "n": [ { "c": 3, "d": "POSIX user lookup functions", "i": "objectives/discovery/account/enum::passive-user-lookup", "o": 5445, "z": 7, "cf": 0.4000000059604645 } ], "ln": 5429 }, { "b": "By!*2zEEH9xM501w[iT%B-82fzFJW50aH4\u003cw]?s4BzkL#B9g@nz!%MkwNxH@vq{p3z//t#", "n": [ { "c": 3, "d": "Delete files by fd/path", "i": "micro-behaviors/fs/file/delete::unlinkat", "o": 6695, "z": 8, "cf": 0.30000001192092896 } ], "ln": 6679 }, { "b": "A=l8tA@Z2\u003cvQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu/BAg#mB-.tle]$}-f-T)slpaTHmPf", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 7410, "z": 6, "cf": 0.5 } ], "ln": 7394 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEl]Oe]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 32871, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 32863, "z": 7, "cf": 0.8999999761581421 } ], "ln": 32847 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 33014, "z": 8, "cf": 0.8999999761581421 } ], "ln": 32998 } ], "depth": 1, "facts": { "exp": [ [ "btrfs_util_subvolume_delete_by_id_fd" ], [ "btrfs_util_subvolume_get_read_only" ], [ "btrfs_util_get_default_subvolume" ], [ "btrfs_util_subvolume_get_path" ], [ "btrfs_util_create_snapshot_fd" ], [ "btrfs_util_subvolume_delete_fd" ], [ "btrfs_util_set_default_subvolume" ], [ "btrfs_util_subvolume_get_info" ], [ "btrfs_util_get_subvolume_read_only_fd" ], [ "btrfs_util_qgroup_inherit_get_groups" ], [ "btrfs_util_subvolume_snapshot_fd2" ], [ "btrfs_util_qgroup_inherit_create" ], [ "btrfs_util_destroy_subvolume_iterator" ], [ "btrfs_util_start_sync_fd" ], [ "btrfs_util_set_subvolume_read_only_fd" ], [ "btrfs_util_subvolume_set_read_only" ], [ "btrfs_util_subvolume_is_valid_fd" ], [ "btrfs_util_qgroup_inherit_destroy" ], [ "btrfs_util_subvolume_path" ], [ "btrfs_util_subvolume_create_fd" ], [ "btrfs_util_subvolume_delete" ], [ "btrfs_util_subvolume_iterator_next" ], [ "btrfs_util_subvolume_iterator_next_info" ], [ "btrfs_util_subvolume_create" ], [ "btrfs_util_subvolume_list_deleted_fd" ], [ "btrfs_util_subvolume_iter_next_info" ], [ "btrfs_util_fs_start_sync" ], [ "btrfs_util_subvolume_info" ], [ "btrfs_util_create_subvolume_iterator" ], [ "btrfs_util_subvolume_get_info_fd" ], [ "btrfs_util_subvolume_get_path_fd" ], [ "btrfs_util_subvolume_snapshot_fd" ], [ "btrfs_util_sync_fd" ], [ "btrfs_util_subvolume_list_deleted" ], [ "btrfs_util_wait_sync" ], [ "btrfs_util_destroy_qgroup_inherit" ], [ "btrfs_util_subvolume_get_id_fd" ], [ "btrfs_util_delete_subvolume_by_id_fd" ], [ "btrfs_util_subvolume_iter_next" ], [ "btrfs_util_sync" ], [ "btrfs_util_subvolume_iter_destroy" ], [ "btrfs_util_deleted_subvolumes" ], [ "btrfs_util_delete_subvolume_fd" ], [ "btrfs_util_subvolume_iter_create_fd" ], [ "btrfs_util_wait_sync_fd" ], [ "btrfs_util_subvolume_id" ], [ "btrfs_util_deleted_subvolumes_fd" ], [ "btrfs_util_subvolume_set_read_only_fd" ], [ "btrfs_util_subvolume_info_fd" ], [ "btrfs_util_subvolume_path_fd" ], [ "btrfs_util_subvolume_get_id" ], [ "btrfs_util_subvolume_snapshot" ], [ "btrfs_util_subvolume_get_default" ], [ "btrfs_util_subvolume_iter_create" ], [ "btrfs_util_is_subvolume" ], [ "btrfs_util_subvolume_id_fd" ], [ "btrfs_util_subvolume_set_default_fd" ], [ "btrfs_util_qgroup_inherit_add_group" ], [ "btrfs_util_fs_sync" ], [ "btrfs_util_fs_wait_sync_fd" ], [ "btrfs_util_create_subvolume" ], [ "btrfs_util_strerror" ], [ "btrfs_util_create_subvolume_iterator_fd" ], [ "btrfs_util_fs_wait_sync" ], [ "btrfs_util_fs_sync_fd" ], [ "btrfs_util_subvolume_is_valid" ], [ "btrfs_util_delete_subvolume" ], [ "LIBBTRFSUTIL_1.1" ], [ "LIBBTRFSUTIL_1.2" ], [ "LIBBTRFSUTIL_1.3" ], [ "btrfs_util_create_snapshot_fd2" ], [ "btrfs_util_get_subvolume_read_only" ], [ "btrfs_util_fs_start_sync_fd" ], [ "btrfs_util_subvolume_iterator_fd" ], [ "btrfs_util_create_subvolume_fd" ], [ "btrfs_util_subvolume_get_read_only_fd" ], [ "btrfs_util_start_sync" ], [ "btrfs_util_is_subvolume_fd" ], [ "btrfs_util_create_snapshot" ], [ "btrfs_util_set_default_subvolume_fd" ], [ "btrfs_util_create_qgroup_inherit" ], [ "btrfs_util_set_subvolume_read_only" ], [ "btrfs_util_subvolume_get_default_fd" ], [ "btrfs_util_subvolume_iterator_get_fd" ], [ "btrfs_util_get_default_subvolume_fd" ], [ "btrfs_util_subvolume_set_default" ] ], "imp": [ [ "", "ioctl" ], [ "", "memrchr" ], [ "", "geteuid" ], [ "", "memmove" ], [ "", "cxa_finalize" ], [ "", "malloc" ], [ "", "statfs" ], [ "", "fstatfs" ], [ "", "stack_chk_fail" ], [ "", "calloc" ], [ "", "fstat" ], [ "", "unlinkat" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strncmp" ], [ "", "realloc" ], [ "", "memcmp" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "stat" ], [ "", "errno_location" ], [ "", "openat" ], [ "", "strlen" ], [ "", "open" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.14, "alloc" ], [ ".gnu.hash", 768, 1060, 4.38, "alloc" ], [ ".dynsym", 1832, 2712, 2.29, "alloc" ], [ ".dynstr", 4544, 2947, 4.3, "alloc" ], [ ".gnu.version", 7492, 226, 1.82, "alloc" ], [ ".gnu.version_d", 7720, 128, 2.57, "alloc" ], [ ".rela.dyn", 7848, 1080, 1.43, "alloc" ], [ ".relr.dyn", 8928, 24, 1.49, "alloc" ], [ ".init", 12288, 3, 1.58, "alloc,executable" ], [ ".text", 12304, 10972, 6.05, "alloc,executable" ], [ ".fini", 23276, 3, 1.58, "alloc,executable" ], [ ".rodata", 24576, 779, 4.69, "alloc,merge,strings" ], [ ".eh_frame_hdr", 25356, 436, 4.73, "alloc" ], [ ".eh_frame", 25792, 2852, 4.9, "alloc" ], [ ".init_array", 31664, 8, 1.06, "write,alloc" ], [ ".fini_array", 31672, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 31680, 216, 1.78, "write,alloc" ], [ ".dynamic", 31896, 480, 1.45, "write,alloc" ], [ ".got", 32376, 384, 0.05, "write,alloc" ], [ ".data", 32768, 8, 0.54, "write,alloc" ], [ ".comment", 32776, 28, 3.99, "merge,strings" ], [ ".shstrtab", 32804, 244, 4.18, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 113.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 45.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "dt_versym_count": 113.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 10991.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 10991.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 34648.0, "entropy": 4.49, "size_bytes": 34648.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.05, "data_entropy": 1.02, "overlay_size": 1600.0, "string_count": 173.0, "overlay_ratio": 0.05, "overall_entropy": 4.49, "overlay_entropy": 1.43, "entropy_variance": 2.7, "avg_string_length": 22.34, "max_string_length": 67.0, "peak_region_bytes": 10240.0, "code_to_data_ratio": 0.91, "peak_region_entropy": 6.02, "string_length_stddev": 12.38, "largest_section_ratio": 0.32, "sentence_string_count": 25.0, "sentence_string_ratio": 0.14, "high_entropy_string_count": 0.0 }, "exports": { "count": 86.0 }, "imports": { "count": 26.0 }, "sections": { "count": 25.0, "code_size": 10978.0, "entropy_max": 6.05, "entropy_mean": 2.7, "name_entropy": 4.13, "writable_count": 7.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 1, "mol": "H(F)Md(He)", "path": "btrfs-progs-libs-6.17.1-r1.apk!!usr/lib/libbtrfsutil.so.1.3.2", "risk": 2, "sha": "a6aad1d391dd89c97ebfc01621e0f2992a9f72e6d81a22b8eca1fefef7c6f5c2", "size": 34648, "traits": [ { "id": "micro-behaviors/os/privilege/query::geteuid", "crit": 2, "desc": "Get effective user ID", "spans": [ [ 5445, 7 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 4601, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/delete::unlinkat", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files by fd/path", "spans": [ [ 6695, 8 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 5134, 5 ], [ 5135, 4 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 4601, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 4601, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 4601, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr910000000000kMy=:000007?0yA0000000000kMA+z3JJA(7YUuL0rr91", "n": [ { "c": 3, "d": "No full symbol table (likely stripped)", "i": "metadata/hardening/missing::stripped-binary", "o": 0, "z": 25, "cf": 0.800000011920929 } ], "ln": 0 }, { "b": "A-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib0af8zwPzu{x(!xcA:JB0vqPN.x(mK30af8NwOkZ#By/G1w].r%wNxd?w]vV\u0026wNP9HuTEw+A=b/5y\u0026r/(BzkVh0crl)wPz!\u003ew]I^8zGGE\u003cuTE\u003e@vpK7Wv}YT+w)]y\u00260bVdXy\u0026r!-vSVT5B6\u0026%0vpS.NzE^9[A=kD0B8$Yf", "n": [ { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 1723, "z": 14, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 1684, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Benign terminal socket exec context", "i": "objectives/command-and-control/reverse-shell/dup::unix-terminal-socket-exec-benign-context", "o": 1625, "z": 12, "cf": 0.949999988079071 } ], "ln": 1609 }, { "b": "uVG.0z!%Pd0bVp:v@le+z/xo9vrqGVy\u0026sxa0aPCNy\u0026r!-B98CkB-mt4BZ/Jjy*Rscx\u003ed", "n": [ { "c": 2, "d": "Open files", "i": "micro-behaviors/fs/file/open::openat", "o": 1856, "z": 6, "cf": 0.6600000262260437 } ], "ln": 1840 }, { "b": "uUKy(Bo3b\u003evQ?3cB-RvJCSmP*hz^4cz.r:Ay?Wu/BAg#me]$}-fAs^rlpaTHmPiUFe?)", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 1936, "z": 6, "cf": 0.5 } ], "ln": 1920 }, { "b": "y?bbiwb[k{zGNNBvrl8Ze[xlBB9RQ5e[xlBB98B5e[Y6Ae{p/DB7]Mg04}]4BUm\u0026GA=U@kzEl]Oe]\u003eI", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 24687, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 24679, "z": 7, "cf": 0.8999999761581421 } ], "ln": 24663 }, { "b": "A::j[e[O*nx\u003cUp?A::j[e[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}=1zeA\u003c4Bn#pv00000", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 24817, "z": 8, "cf": 0.8999999761581421 } ], "ln": 24801 } ], "depth": 1, "facts": { "exp": [ [ "subvol_uuid_search_init" ], [ "btrfs_read_and_process_send_stream" ], [ "btrfs_subvolid_resolve" ], [ "subvol_uuid_search" ], [ "LIBBTRFS_0.1" ] ], "imp": [ [ "", "ioctl" ], [ "", "printf" ], [ "", "cxa_finalize" ], [ "", "malloc" ], [ "", "stack_chk_fail" ], [ "", "calloc" ], [ "", "fprintf" ], [ "", "strcat" ], [ "", "deregister_frame_info" ], [ "", "ITM_registerTMCloneTable" ], [ "", "read" ], [ "", "memcmp" ], [ "", "strncat" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strdup" ], [ "", "strcmp" ], [ "", "stderr" ], [ "", "errno_location" ], [ "", "openat" ], [ "", "strlen" ], [ "", "fputs" ], [ "", "register_frame_info" ], [ "", "close" ], [ "", "free" ] ], "sec": [ [ ".note.gnu.property", 680, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 728, 36, 4.06, "alloc" ], [ ".gnu.hash", 768, 80, 2.96, "alloc" ], [ ".dynsym", 848, 720, 1.08, "alloc" ], [ ".dynstr", 1568, 407, 4.6, "alloc" ], [ ".gnu.version", 1976, 60, 1.32, "alloc" ], [ ".gnu.version_d", 2040, 56, 2.25, "alloc" ], [ ".rela.dyn", 2096, 600, 1.36, "alloc" ], [ ".relr.dyn", 2696, 24, 1.22, "alloc" ], [ ".init", 4096, 3, 1.58, "alloc,executable" ], [ ".text", 4112, 10840, 6.04, "alloc,executable" ], [ ".fini", 14952, 3, 1.58, "alloc,executable" ], [ ".rodata", 16384, 2144, 7.15, "alloc" ], [ ".eh_frame_hdr", 18528, 292, 4.42, "alloc" ], [ ".eh_frame", 18824, 1324, 4.69, "alloc" ], [ ".init_array", 23856, 8, 1.06, "write,alloc" ], [ ".fini_array", 23864, 8, 1.06, "write,alloc" ], [ ".dynamic", 23872, 480, 1.43, "write,alloc" ], [ ".got", 24352, 224, 0.08, "write,alloc" ], [ ".data", 24576, 16, 0.99, "write,alloc" ], [ ".comment", 24592, 28, 3.99, "merge,strings" ], [ ".shstrtab", 24620, 231, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 0.0, "has_got": 1.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 30.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 25.0, "little_endian": 1.0, "dt_flags_1_raw": 1.0, "pltreloc_count": 0.0, "build_id_length": 20.0, "dt_versym_count": 30.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "comment_entry_count": 1.0, "program_header_count": 11.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 10859.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 10859.0, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 7.0 }, "file": { "size": 26392.0, "entropy": 4.67, "size_bytes": 26392.0 }, "binary": { "is_pie": 0.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.04, "data_entropy": 1.01, "overlay_size": 1541.0, "string_count": 78.0, "overlay_ratio": 0.06, "overall_entropy": 4.67, "overlay_entropy": 1.38, "entropy_variance": 3.44, "avg_string_length": 20.64, "max_string_length": 84.0, "peak_region_bytes": 1024.0, "code_to_data_ratio": 0.94, "peak_region_entropy": 7.82, "string_length_stddev": 18.48, "largest_section_ratio": 0.41, "sentence_string_count": 22.0, "sentence_string_ratio": 0.28, "high_entropy_string_count": 0.0 }, "exports": { "count": 5.0 }, "imports": { "count": 24.0 }, "sections": { "count": 24.0, "code_size": 10846.0, "entropy_max": 7.15, "entropy_mean": 2.69, "name_entropy": 4.15, "writable_count": 6.0, "executable_count": 3.0, "nonstandard_count": 5.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } } }, "id": 2, "mol": "Md(He)", "path": "btrfs-progs-libs-6.17.1-r1.apk!!usr/lib/libbtrfs.so.0.1.4", "risk": 1, "sha": "9a27dfc24d44ead5b807c01081e51152fad68fc272dc36ef126807d369710564", "size": 26392, "traits": [ { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 1625, 12 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 1625, 12 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 1625, 12 ] ] }, { "id": "micro-behaviors/dylib/library/family::cxx-abi-symbols", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols", "spans": [ [ 1625, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "boPG/zE)\u0026%By!#9vTf88vS=y3wfrVXf/HZsuVGThePJM", "n": [ { "c": 1, "d": "Alpine/Wolfi package info file", "i": "metadata/package/files/system-package::alpine-pkginfo-basename", "o": 0, "z": 1, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "boRbIx(mMaw)]E^A=k(raA?spB7]MgatCG8h.D\u0026", "ln": 2, "addr": 36 }, { "b": "Abf97vqPM#jS[iQA+owAAb](fB1IixvSI", "n": [ { "c": 2, "d": "Alpine/Wolfi package info metadata", "i": "metadata/package/files/system-package::alpine-apk-pkginfo", "o": 68, "z": 26, "cf": 0.9700000286102295 } ], "ln": 3, "addr": 68 }, { "b": "Abf9fwPw[Rat$\u0026bh.D*pAXN", "n": [ { "c": 1, "d": "Alpine/Wolfi package version field", "i": "metadata/package/files/system-package::alpine-pkginfo-version-field", "o": 95, "z": 18, "cf": 0.8999999761581421 } ], "ln": 4, "addr": 95 }, { "b": "Abf8%wPIu7jS)6\u003cqBTOcw[=6)B9R?GwO\u0026MjBzkM9BzkrcasI5uvSC)$x\u003equm", "ln": 5, "addr": 114 }, { "b": "B-IpvjS[AWBz#pZfe3^RA+owBCwg\u0026be]b3szE)Spz/PE", "ln": 6, "addr": 163 }, { "b": "B7]@iauZ\u00269f!+Br", "ln": 9, "addr": 280 }, { "b": "vrb\u003c\u003eauZ\u0026(i5Ub4gY", "ln": 10, "addr": 293 }, { "b": "z/PM8x(k4RayYCkw]/LyA=kPi", "n": [ { "c": 1, "d": "Alpine/Wolfi package origin field", "i": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "o": 307, "z": 20, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 307 }, { "b": "v@Dj3x(\u003eEXatvtqia+3Wwm/mgw\u0026qUUg?ynPw\u0026RRUf\u003erj3g?nK7gbQ%FhEOE0gY", "ln": 12, "addr": 328 }, { "b": "zddc@Byw)3wPw[RawMu!vqYH+y-(8-Aa6\u003eKzEWQ7vl!mqAa%i3y?W^fCRi]PxfD", "ln": 13, "addr": 378 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 664.0, "entropy": 5.19, "size_bytes": 664.0 }, "binary": { "overall_entropy": 5.19, "peak_region_bytes": 664.0, "peak_region_entropy": 5.19 } } }, "id": 3, "path": "btrfs-progs-libs-6.17.1-r1.apk!!.PKGINFO", "risk": 1, "sha": "3d5c562651e6885e376fdbd92594599742f1a53b736f9b1bff5325d066a8b129", "size": 664, "traits": [ { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "spans": [ [ 95, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgname-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgname metadata field", "spans": [ [ 68, 26 ] ] }, { "id": "metadata/package/files/system-package::arch-pkgver-field", "conf": 0.9399999976158142, "crit": 1, "desc": "Arch pkgver metadata field", "spans": [ [ 95, 18 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "spans": [ [ 307, 20 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "metadata/package/files/system-package::alpine-apk-pkginfo", "conf": 0.9700000286102295, "crit": 2, "desc": "Alpine/Wolfi package info metadata", "spans": [ [ 68, 26 ], [ 95, 18 ], [ 307, 20 ] ] } ], "type": "text" } ], "rev": "868bd", "v": "8" } }