{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9308024644851685, "class": 0 } ], "prob": 0.93080246, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-04-30T05:03:37Z" }, "path": "task.c", "raw": { "v": "4", "fs": [ { "f": "O(Erâ‚‚)", "x": 2, "id": 0, "is": [ "isc__task_purgeevent", "isc__task_beginexclusive", "isc__task_privilege", "isc__taskmgr_mode", "REQUIRE", "EMPTY", "REQUIRE", "EMPTY", "REQUIRE", "REQUIRE", "XTRACE", "LOCK", "UNLINK", "FINISHED", "BROADCAST", "UNLOCK", "DESTROYLOCK", "isc_mem_put", "REQUIRE", "VALID_MANAGER", "REQUIRE", "isc_mem_get", "XTRACE", "isc_mutex_init", "isc_mem_put", "LOCK", "LOCK", "INIT_LIST", "INIT_LIST", "memset", "INIT_LINK", "INIT_LINK", "INIT_LINK", "UNLOCK", "UNLOCK", "LOCK", "APPEND", "UNLOCK", "DESTROYLOCK", "isc_mem_put", "REQUIRE", "VALID_TASK", "REQUIRE", "XTTRACE", "LOCK", "UNLOCK", "XTRACE", "TASK_SHUTTINGDOWN", "XTRACE", "isc_msgcat_get", "INSIST", "EMPTY", "INSIST", "TAIL", "PREV", "DEQUEUE", "ENQUEUE", "isc__task_privilege", "REQUIRE", "VALID_MANAGER", "REQUIRE", "XTRACE", "LOCK", "push_readyq", "SIGNAL", "UNLOCK", "REQUIRE", "XTRACE", "INSIST", "EMPTY", "REQUIRE", "REQUIRE", "VALID_TASK", "XTRACE", "LOCK", "task_detach", "UNLOCK", "task_ready", "REQUIRE", "REQUIRE", "REQUIRE", "REQUIRE", "XTRACE", "INSIST", "EMPTY", "INSIST", "ENQUEUE", "REQUIRE", "VALID_TASK", "XTRACE", "LOCK", "task_send", "UNLOCK", "task_ready", "REQUIRE", "REQUIRE", "VALID_TASK", "XTRACE", "LOCK", "task_send", "task_detach", "UNLOCK", "INSIST", "task_ready", "REQUIRE", "VALID_TASK", "REQUIRE", "XTRACE", "LOCK", "HEAD", "NEXT", "PURGE_OK", "DEQUEUE", "ENQUEUE", "UNLOCK", "XTRACE", "ISC_LIST_INIT", "dequeue_events", "HEAD", "NEXT", "isc_event_free", "XTRACE", "isc__task_purgerange", "REQUIRE", "VALID_TASK", "LOCK", "HEAD", "NEXT", "PURGE_OK", "DEQUEUE", "UNLOCK", "isc_event_free", "XTRACE", "dequeue_events", "XTRACE", "dequeue_events", "REQUIRE", "VALID_TASK", "REQUIRE", "isc_event_allocate", "LOCK", "TASK_SHUTTINGDOWN", "ENQUEUE", "UNLOCK", "isc_mem_put", "REQUIRE", "VALID_TASK", "LOCK", "task_shutdown", "UNLOCK", "task_ready", "REQUIRE", "isc_task_shutdown", "isc_task_detach", "REQUIRE", "VALID_TASK", "LOCK", "memset", "strncpy", "UNLOCK", "REQUIRE", "VALID_TASK", "REQUIRE", "VALID_TASK", "REQUIRE", "VALID_TASK", "REQUIRE", "LOCK", "UNLOCK", "ISC_TF", "EMPTY", "HEAD", "HEAD", "DEQUEUE", "ISC_LINK_LINKED", "DEQUEUE", "ENQUEUE", "ENQUEUE", "VALID_MANAGER", "ISC_LIST_INIT", "ISC_LIST_INIT", "LOCK", "FINISHED", "empty_readyq", "FINISHED", "XTHREADTRACE", "isc_msgcat_get", "WAIT", "XTHREADTRACE", "isc_msgcat_get", "empty_readyq", "XTHREADTRACE", "isc_msgcat_get", "pop_readyq", "INSIST", "VALID_TASK", "UNLOCK", "LOCK", "INSIST", "XTRACE", "isc_msgcat_get", "isc_stdtime_get", "EMPTY", "HEAD", "DEQUEUE", "XTRACE", "isc_msgcat_get", "UNLOCK", "LOCK", "EMPTY", "TASK_SHUTTINGDOWN", "task_shutdown", "INSIST", "EMPTY", "XTRACE", "isc_msgcat_get", "TASK_SHUTTINGDOWN", "XTRACE", "isc_msgcat_get", "XTRACE", "isc_msgcat_get", "UNLOCK", "task_finished", "LOCK", "SIGNAL", "SIGNAL", "push_readyq", "ENQUEUE", "ENQUEUE", "empty_readyq", "empty_readyq", "BROADCAST", "ISC_LIST_APPENDLIST", "ISC_LIST_APPENDLIST", "empty_readyq", "UNLOCK", "XTHREADTRACE", "isc_msgcat_get", "dispatch", "XTHREADTRACE", "isc_msgcat_get", "ERR_remove_state", "LOCK", "isc_condition_destroy", "isc_condition_destroy", "isc_condition_destroy", "isc_mem_free", "UNLOCK", "DESTROYLOCK", "isc_mem_put", "isc_mem_detach", "UNUSED", "UNUSED", "isc_mem_get", "isc_mutex_init", "LOCK", "isc_mem_allocate", "isc_condition_init", "UNEXPECTED_ERROR", "isc_msgcat_get", "isc_condition_init", "UNEXPECTED_ERROR", "isc_msgcat_get", "isc_condition_init", "UNEXPECTED_ERROR", "isc_msgcat_get", "INIT_LIST", "INIT_LIST", "INIT_LIST", "isc_mem_attach", "isc_thread_create", "UNLOCK", "manager_free", "isc_thread_setconcurrency", "UNLOCK", "isc_condition_destroy", "isc_condition_destroy", "isc_mem_free", "UNLOCK", "DESTROYLOCK", "isc_mem_put", "VALID_MANAGER", "UNUSED", "XTHREADTRACE", "LOCK", "INSIST", "HEAD", "NEXT", "LOCK", "task_shutdown", "push_readyq", "UNLOCK", "BROADCAST", "UNLOCK", "isc_thread_join", "UNLOCK", "isc__taskmgr_ready", "isc__taskmgr_dispatch", "ISC_LIST_EMPTY", "isc_mem_printallactive", "INSIST", "ISC_LIST_EMPTY", "manager_free", "LOCK", "UNLOCK", "LOCK", "UNLOCK", "LOCK", "empty_readyq", "UNLOCK", "dispatch", "LOCK", "WAIT", "UNLOCK", "LOCK", "BROADCAST", "UNLOCK", "LOCK", "UNLOCK", "WAIT", "UNUSED", "LOCK", "BROADCAST", "UNUSED", "LOCK", "ISC_TF", "LOCK", "ISC_LINK_LINKED", "ENQUEUE", "ISC_LINK_LINKED", "DEQUEUE", "ISC_TF", "isc_task_register", "VALID_TASK", "TASK_SHUTTINGDOWN", "xmlTextWriterStartElement", "xmlTextWriterStartElement", "xmlTextWriterWriteString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "ISC_LIST_HEAD", "xmlTextWriterStartElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterStartElement", "xmlTextWriterWriteFormatString", "xmlTextWriterEndElement", "xmlTextWriterEndElement", "ISC_LIST_NEXT", "xmlTextWriterEndElement" ], "ms": { "text": { "tab_count": 2231.0, "digit_ratio": 0.01, "space_count": 3991.0, "total_lines": 1813.0, "char_entropy": 5.38, "mixed_indent": true, "unique_chars": 90.0, "import_density": 20.74, "string_density": 0.09, "avg_line_length": 24.77, "max_line_length": 80.0, "empty_line_ratio": 0.15, "last_line_length": 34.0, "most_common_char": "e", "whitespace_ratio": 0.17, "most_common_ratio": 0.06, "identifier_density": 0.98, "line_length_stddev": 20.12, "normalized_import_count": 8.83, "normalized_string_count": 3.64, "suspicious_comment_ratio": 0.06, "max_inline_whitespace_run": 9.0, "normalized_function_count": 1.03, "imports_to_functions_ratio": 8.55, "strings_to_functions_ratio": 3.52, "suspicious_identifier_ratio": 0.01, "normalized_unique_identifiers": 21.8, "identifiers_to_functions_ratio": 5.36 }, "imports": { "total": 376.0, "unique_modules": 81.0, "third_party_count": 376.0, "third_party_ratio": 1.0 }, "strings": { "total": 155.0, "avg_length": 10.69, "max_length": 28.0, "avg_entropy": 2.73, "total_bytes": 1657.0, "entropy_stddev": 0.92 }, "comments": { "chars": 11336.0, "lines": 417.0, "total": 108.0, "xxx_count": 2.0, "to_code_ratio": 0.3, "high_entropy_comments": 6.0 }, "functions": { "total": 44.0, "length_stddev": 47.17, "over_100_lines": 3.0, "avg_name_length": 56.52, "no_params_count": 44.0, "avg_length_lines": 32.52, "max_length_lines": 294.0, "min_length_lines": 4.0, "high_entropy_names": 42.0, "density_per_100_lines": 2.43, "code_in_functions_ratio": 0.79 }, "identifiers": { "total": 1772.0, "avg_length": 12.01, "max_length": 30.0, "min_length": 1.0, "avg_entropy": 2.88, "reuse_ratio": 0.13, "unique_count": 236.0, "length_stddev": 6.05, "has_digit_ratio": 0.04, "sequential_names": 3.0, "single_char_count": 3.0, "single_char_ratio": 0.01, "high_entropy_count": 38.0, "high_entropy_ratio": 0.16, "all_lowercase_ratio": 0.6, "all_uppercase_ratio": 0.34, "numeric_suffix_count": 9.0, "double_underscore_count": 2.0, "underscore_prefix_count": 3.0 } }, "ss": [ [ 1034, "\u003cconfig.h\u003e" ], [ 1055, "\u003cisc/condition.h\u003e" ], [ 1082, "\u003cisc/event.h\u003e" ], [ 1105, "\u003cisc/magic.h\u003e" ], [ 1128, "\u003cisc/mem.h\u003e" ], [ 1149, "\u003cisc/msgs.h\u003e" ], [ 1171, "\u003cisc/platform.h\u003e" ], [ 1197, "\u003cisc/string.h\u003e" ], [ 1221, "\u003cisc/task.h\u003e" ], [ 1243, "\u003cisc/thread.h\u003e" ], [ 1267, "\u003cisc/util.h\u003e" ], [ 1289, "\u003cisc/xml.h\u003e" ], [ 1332, "\u003copenssl/err.h\u003e" ], [ 2106, "task_p.h" ], [ 2107, "task_p.h" ], [ 2741, "idle" ], [ 2742, "idle" ], [ 2749, "ready" ], [ 2750, "ready" ], [ 2758, "running" ], [ 2759, "running" ], [ 2769, "done" ], [ 2770, "done" ], [ 8781, "task_finished" ], [ 8782, "task_finished" ], [ 9700, "isc_task_create" ], [ 9701, "isc_task_create" ], [ 11183, "isc_task_attach" ], [ 11184, "isc_task_attach" ], [ 11502, "task_shutdown" ], [ 11503, "task_shutdown" ], [ 11643, "shutting down" ], [ 11644, "shutting down" ], [ 12625, "task_ready" ], [ 12626, "task_ready" ], [ 13033, "detach" ], [ 13034, "detach" ], [ 13814, "isc_task_detach" ], [ 13815, "isc_task_detach" ], [ 14306, "task_send" ], [ 14307, "task_send" ], [ 14846, "isc_task_send" ], [ 14847, "isc_task_send" ], [ 16157, "isc_task_sendanddetach" ], [ 16158, "isc_task_sendanddetach" ], [ 16933, "dequeue_events" ], [ 16934, "dequeue_events" ], [ 18047, "isc_task_purgerange" ], [ 18048, "isc_task_purgerange" ], [ 18584, "isc_task_purge" ], [ 18585, "isc_task_purge" ], [ 19996, "isc_task_unsendrange" ], [ 19997, "isc_task_unsendrange" ], [ 20334, "isc_task_unsend" ], [ 20335, "isc_task_unsend" ], [ 26657, "wait" ], [ 26658, "wait" ], [ 26813, "awake" ], [ 26814, "awake" ], [ 27072, "working" ], [ 27073, "working" ], [ 27769, "running" ], [ 27770, "running" ], [ 28089, "execute action" ], [ 28090, "execute action" ], [ 29435, "empty" ], [ 29436, "empty" ], [ 29690, "done" ], [ 29691, "done" ], [ 30273, "quantum" ], [ 30274, "quantum" ], [ 32816, "starting" ], [ 32817, "starting" ], [ 32938, "exiting" ], [ 32939, "exiting" ], [ 35111, "isc_condition_init() %s" ], [ 35112, "isc_condition_init() %s" ], [ 35212, "failed" ], [ 35213, "failed" ], [ 35397, "isc_condition_init() %s" ], [ 35398, "isc_condition_init() %s" ], [ 35498, "failed" ], [ 35499, "failed" ], [ 35678, "isc_condition_init() %s" ], [ 35679, "isc_condition_init() %s" ], [ 35779, "failed" ], [ 35780, "failed" ], [ 37768, "isc_taskmgr_destroy" ], [ 37769, "isc_taskmgr_destroy" ], [ 44155, "ISC_XMLCHAR \"thread-model" ], [ 44167, "thread-model" ], [ 44168, "thread-model" ], [ 44250, "ISC_XMLCHAR \"type" ], [ 44262, "type" ], [ 44263, "type" ], [ 44305, "ISC_XMLCHAR \"threaded" ], [ 44317, "threaded" ], [ 44318, "threaded" ], [ 44411, "ISC_XMLCHAR \"worker-threads" ], [ 44423, "worker-threads" ], [ 44424, "worker-threads" ], [ 44482, "%d" ], [ 44483, "%d" ], [ 44629, "ISC_XMLCHAR \"type" ], [ 44641, "type" ], [ 44642, "type" ], [ 44684, "ISC_XMLCHAR \"non-threaded" ], [ 44696, "non-threaded" ], [ 44697, "non-threaded" ], [ 44794, "ISC_XMLCHAR \"references" ], [ 44806, "references" ], [ 44807, "references" ], [ 44861, "%d" ], [ 44862, "%d" ], [ 45003, "ISC_XMLCHAR \"default-quantum" ], [ 45015, "default-quantum" ], [ 45016, "default-quantum" ], [ 45075, "%d" ], [ 45076, "%d" ], [ 45196, "ISC_XMLCHAR \"tasks-running" ], [ 45208, "tasks-running" ], [ 45209, "tasks-running" ], [ 45266, "%d" ], [ 45267, "%d" ], [ 45437, "ISC_XMLCHAR \"tasks" ], [ 45449, "tasks" ], [ 45450, "tasks" ], [ 45575, "ISC_XMLCHAR \"task" ], [ 45587, "task" ], [ 45588, "task" ], [ 45662, "ISC_XMLCHAR \"name" ], [ 45674, "name" ], [ 45675, "name" ], [ 45725, "%s" ], [ 45726, "%s" ], [ 45845, "ISC_XMLCHAR \"references" ], [ 45857, "references" ], [ 45858, "references" ], [ 45913, "%d" ], [ 45914, "%d" ], [ 46027, "ISC_XMLCHAR \"id" ], [ 46039, "id" ], [ 46040, "id" ], [ 46087, "%p" ], [ 46088, "%p" ], [ 46181, "ISC_XMLCHAR \"state" ], [ 46193, "state" ], [ 46194, "state" ], [ 46244, "%s" ], [ 46245, "%s" ], [ 46372, "ISC_XMLCHAR \"quantum" ], [ 46384, "quantum" ], [ 46385, "quantum" ], [ 46437, "%d" ], [ 46438, "%d" ], [ 18, "xor", "lewuuqhwutwee" ], [ 3603, "xor", "OLLLLLedxeulOOf! #,+ e" ], [ 7874, "xor", "://:83wQRR2(8" ], [ 11126, "xor", "m1$7\" 15edxe" ], [ 11973, "xor", "kOLLeojOLL#*7em 3 +1exe" ], [ 14779, "xor", " +!ebo 3 +1be1*eb1$6.bkOLeojOOL" ], [ 17461, "xor", "6 +! 7exxe6 +! 7leccOLLeeeem1$\"exxe" ], [ 17514, "xor", "1$\"exxe1$\"leccOLLeeeemd507\",+\"e99e" ], [ 24346, "xor", "ledxeulOLL" ], [ 25426, "xor", "ntOLeoe0+)*\u0026.6kee" ], [ 25824, "xor", "ntOLeoe0+)*\u0026.6kee" ], [ 26083, "xor", "OLLjoOLLeoe" ], [ 26595, "xor", "(6\"\u0026$1iOLLLLLLeeee" ], [ 26753, "xor", "(6\"\u0026$1iOLLLLLLeeee" ], [ 26786, "xor", "iOLLLLLLeeee" ], [ 27044, "xor", "iOLLLLLeeee" ], [ 28322, "xor", "OLLLLL1*1$)" ], [ 31302, "xor", "- OLLLLeoe\u0026*61e*#e" ], [ 31745, "xor", "ledxeulOLLLLL" ], [ 31862, "xor", "OLLjoOLLeoe" ], [ 36463, "xor", "lexxOLLeeee" ], [ 36826, "xor", "eojOOLo($+$\" 75exem,6\u0026" ] ], "sz": 46712, "ts": [ { "c": 0.699999988079071, "d": "macOS who tool reference", "e": [ "who" ], "i": "objectives/evasion/kernel-hide/rootkit::macos-who-ref", "l": 1 }, { "c": 1.0, "d": "Raw socket send call", "e": [ "send(" ], "i": "micro-behaviors/communications/socket/send::send-call-raw", "l": 2 }, { "a": "T1014", "c": 0.9800000190734863, "d": "Task flags manipulation (process hiding", "e": [ "task-\u003eflags", "task-\u003eflags", "task-\u003eflags", "task-\u003eflags", "task-\u003eflags", "task-\u003eflags", "task-\u003eflags", "task-\u003eflags" ], "i": "objectives/evasion/kernel-hide/lkm/internals::task-flags-manipulation", "l": 3 } ], "sha": "efde646e5e1e7cf6d43ec0f9239c816265596b64a7f794066625f5ea66275f4a", "path": "/data/samples/good/freebsd/usr/src/contrib/ntp/libntp/lib/isc/task.c", "type": "c" } ], "tv": "f6eaa" } }