{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.8383554220199585,
        "class": 0
      }
    ],
    "prob": 0.8383554,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/scripts",
        "prob": 0.36127168,
        "class": 0
      },
      {
        "m": "az/shell",
        "prob": 0.083333336,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-26T04:27:43Z"
  },
  "path": "display-lib.exp",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)H(Po)",
        "x": 29,
        "ff": {
          "i": [
            [
              "",
              "proc"
            ],
            [
              "",
              "proc"
            ],
            [
              "",
              "global"
            ],
            [
              "",
              "global"
            ],
            [
              "",
              "global"
            ],
            [
              "",
              "global"
            ],
            [
              "",
              "verbose"
            ],
            [
              "",
              "verbose"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "try"
            ],
            [
              "",
              "try"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "set"
            ],
            [
              "",
              "regsub"
            ],
            [
              "",
              "regsub"
            ],
            [
              "",
              "lindex"
            ],
            [
              "",
              "lindex"
            ],
            [
              "",
              "string"
            ],
            [
              "",
              "string"
            ]
          ],
          "m": {
            "ast": {
              "max_depth": 6.0,
              "call_count": 15.0,
              "node_count": 644.0,
              "identifier_count": 82.0,
              "string_literal_count": 38.0
            },
            "file": {
              "size": 3671.0,
              "entropy": 5.0,
              "size_bytes": 3671.0
            },
            "text": {
              "tab_count": 24.0,
              "digit_ratio": 0.02,
              "space_count": 732.0,
              "total_lines": 105.0,
              "char_entropy": 5.0,
              "mixed_indent": 1.0,
              "unique_chars": 81.0,
              "string_density": 0.36,
              "avg_line_length": 33.96,
              "max_line_length": 78.0,
              "empty_line_ratio": 0.07,
              "last_line_length": 1.0,
              "whitespace_ratio": 0.23,
              "most_common_ratio": 0.06,
              "identifier_density": 2.6,
              "line_length_stddev": 24.33,
              "normalized_string_count": 3.71,
              "repeated_char_sequences": 2.0,
              "most_common_char_is_null": 0.0,
              "suspicious_comment_ratio": 0.07,
              "max_inline_whitespace_run": 3.0,
              "trailing_whitespace_lines": 2.0,
              "most_common_char_codepoint": 116.0,
              "normalized_unique_identifiers": 12.21
            },
            "calls": {
              "count": 15.0
            },
            "strings": {
              "total": 38.0,
              "avg_length": 20.71,
              "max_length": 252.0,
              "avg_entropy": 2.95,
              "empty_count": 7.0,
              "total_bytes": 787.0,
              "entropy_stddev": 1.3
            },
            "comments": {
              "chars": 1234.0,
              "lines": 23.0,
              "total": 27.0,
              "to_code_ratio": 0.28,
              "empty_comments": 4.0,
              "high_entropy_comments": 2.0
            },
            "identifiers": {
              "count": 82.0,
              "total": 273.0,
              "avg_length": 5.6,
              "max_length": 19.0,
              "min_length": 1.0,
              "avg_entropy": 2.04,
              "reuse_ratio": 0.3,
              "unique_count": 82.0,
              "length_stddev": 3.26,
              "single_char_count": 4.0,
              "single_char_ratio": 0.05,
              "high_entropy_count": 2.0,
              "high_entropy_ratio": 0.02,
              "all_lowercase_ratio": 0.68,
              "all_uppercase_ratio": 0.1
            }
          },
          "s": [
            [
              1061,
              "u8",
              "$command"
            ],
            [
              1126,
              "u8",
              "sh"
            ],
            [
              1127,
              "u8",
              "sh"
            ],
            [
              1131,
              "u8",
              "-c"
            ],
            [
              1132,
              "u8",
              "-c"
            ],
            [
              1136,
              "u8",
              "$command"
            ],
            [
              1147,
              "u8",
              "2\u003e@1"
            ],
            [
              1148,
              "u8",
              "2\u003e@1"
            ],
            [
              1167,
              "10",
              "0"
            ],
            [
              1263,
              "10",
              "2"
            ],
            [
              1308,
              "u8",
              "\\n$"
            ],
            [
              1309,
              "u8",
              "\\n"
            ],
            [
              1365,
              "10",
              "0"
            ],
            [
              1371,
              "10",
              "0"
            ],
            [
              1434,
              "u8",
              "child process exited abnormally"
            ],
            [
              1435,
              "u8",
              "child process exited abnormally"
            ],
            [
              1570,
              "10",
              "0"
            ],
            [
              1990,
              "u8",
              " "
            ],
            [
              2033,
              "u8",
              " "
            ],
            [
              2041,
              "u8",
              "$dir.$cflags,$gprofflags"
            ],
            [
              2046,
              "u8",
              "."
            ],
            [
              2054,
              "u8",
              ","
            ],
            [
              2082,
              "u8",
              "$srcdir/gprofng.display/$dir"
            ],
            [
              2090,
              "u8",
              "/gprofng.display/"
            ],
            [
              2126,
              "u8",
              "tmpdir/$testdir"
            ],
            [
              2127,
              "u8",
              "tmpdir/"
            ],
            [
              2154,
              "u8",
              "create dir: $tdir\\n"
            ],
            [
              2155,
              "u8",
              "create dir: "
            ],
            [
              2172,
              "u8",
              "\\n"
            ],
            [
              2209,
              "u8",
              "mkdir -p $tdir"
            ],
            [
              2210,
              "u8",
              "mkdir -p "
            ],
            [
              2277,
              "u8",
              "$tdir/rules.txt"
            ],
            [
              2283,
              "u8",
              "/rules.txt"
            ],
            [
              2295,
              "u8",
              "w"
            ],
            [
              2296,
              "u8",
              "w"
            ],
            [
              2377,
              "u8",
              "-metrics i.totalcpu:i.cycles -func"
            ],
            [
              2378,
              "u8",
              "-metrics i.totalcpu:i.cycles -func"
            ],
            [
              2429,
              "u8",
              "Cpu, 2, 0\\n"
            ],
            [
              2430,
              "u8",
              "Cpu, 2, 0\\n"
            ],
            [
              2458,
              "u8",
              "Cycles, 2, 1\\n"
            ],
            [
              2459,
              "u8",
              "Cycles, 2, 1\\n"
            ],
            [
              2520,
              "u8",
              "-metrics i.cycles -func"
            ],
            [
              2521,
              "u8",
              "-metrics i.cycles -func"
            ],
            [
              2561,
              "u8",
              "Cycles, 2, 0\\n"
            ],
            [
              2562,
              "u8",
              "Cycles, 2, 0\\n"
            ],
            [
              2623,
              "u8",
              "-metrics i.totalcpu -func"
            ],
            [
              2624,
              "u8",
              "-metrics i.totalcpu -func"
            ],
            [
              2666,
              "u8",
              "Cpu, 2, 0\\n"
            ],
            [
              2667,
              "u8",
              "Cpu, 2, 0\\n"
            ],
            [
              2719,
              "u8",
              "-f $sdir/Makefile srcdir=\\\"$sdir\\\" builddir=\\\"$BUILDDIR\\\" \\\n        VPATH=\\\"$dir\\\" CC=\\\"$CC\\\" CFLAGS=\\\"$cflags\\\" LDFLAGS=\\\"$LDFL"
            ],
            [
              2720,
              "u8",
              "-f "
            ],
            [
              2728,
              "u8",
              "/Makefile srcdir=\\"
            ],
            [
              2752,
              "u8",
              "\\\" builddir=\\"
            ],
            [
              2775,
              "u8",
              "\\\" \\\n        VPATH=\\"
            ],
            [
              2800,
              "u8",
              "\\\" CC=\\"
            ],
            [
              2811,
              "u8",
              "\\\" CFLAGS=\\"
            ],
            [
              2830,
              "u8",
              "\\\" LDFLAGS=\\"
            ],
            [
              2851,
              "u8",
              "\\\" \\\n        DISPLAY_FLAGS=\\"
            ],
            [
              2894,
              "u8",
              "\\\" \\\n        COLLECT_FLAGS=\\"
            ],
            [
              2934,
              "u8",
              "\\\" GPROFNG=\\"
            ],
            [
              2955,
              "u8",
              "\\\" MAKE=\\"
            ],
            [
              2970,
              "u8",
              "\\"
            ],
            [
              3010,
              "u8",
              "cd $tdir \u0026\u0026 $MAKE $make_args all"
            ],
            [
              3011,
              "u8",
              "cd "
            ],
            [
              3019,
              "u8",
              " \u0026\u0026 "
            ],
            [
              3039,
              "u8",
              " all"
            ],
            [
              3127,
              "10",
              "0"
            ],
            [
              3133,
              "10",
              "0"
            ],
            [
              3174,
              "10",
              "1"
            ],
            [
              3200,
              "u8",
              "$tdir/diff.out"
            ],
            [
              3206,
              "u8",
              "/diff.out"
            ],
            [
              3243,
              "u8",
              "comparison of results in $dir failed:\\n$out\\n"
            ],
            [
              3244,
              "u8",
              "comparison of results in "
            ],
            [
              3273,
              "u8",
              " failed:\\n"
            ],
            [
              3287,
              "u8",
              "\\n"
            ],
            [
              3346,
              "u8",
              "aarch64"
            ],
            [
              3347,
              "u8",
              "aarch64"
            ],
            [
              3398,
              "10",
              "0"
            ],
            [
              3425,
              "u8",
              "comparison of results in $dir failed"
            ],
            [
              3426,
              "u8",
              "comparison of results in "
            ],
            [
              3455,
              "u8",
              " failed"
            ],
            [
              3496,
              "u8",
              "compilation of test program in $dir failed:\\n$out\\n"
            ],
            [
              3497,
              "u8",
              "compilation of test program in "
            ],
            [
              3532,
              "u8",
              " failed:\\n"
            ],
            [
              3546,
              "u8",
              "\\n"
            ],
            [
              3565,
              "u8",
              "compilation of test program in $dir failed"
            ],
            [
              3566,
              "u8",
              "compilation of test program in "
            ],
            [
              3601,
              "u8",
              " failed"
            ],
            [
              3647,
              "10",
              "0"
            ]
          ],
          "v": {
            "source.language": "bash",
            "source.imports[0]": "global",
            "source.imports[1]": "lindex",
            "source.imports[2]": "proc",
            "source.imports[3]": "regsub",
            "source.imports[4]": "set",
            "source.imports[5]": "string",
            "source.imports[6]": "try",
            "source.imports[7]": "verbose",
            "source.strings[0]": " failed",
            "source.strings[1]": " failed:\\n",
            "source.strings[2]": "$command",
            "source.strings[3]": "$dir.$cflags,$gprofflags",
            "source.strings[4]": "$srcdir/gprofng.display/$dir",
            "source.strings[5]": "$tdir/diff.out",
            "source.strings[6]": "$tdir/rules.txt",
            "source.strings[7]": "-f $sdir/Makefile srcdir=\\\"$sdir\\\" builddir=\\\"$BUILDDIR\\\" \\\n        VPATH=\\\"$dir\\\" CC=\\\"$CC\\\" CFLAGS=\\\"$cflags\\\" LDFLAGS=\\\"$LDFLAGS\\\" \\\n        DISPLAY_FLAGS=\\\"$DISPLAY_FLAGS\\\" \\\n        COLLECT_FLAGS=\\\"$gprofflags\\\" GPROFNG=\\\"$gprofng\\\" MAKE=\\\"$MAKE\\",
            "source.strings[8]": "-metrics i.cycles -func",
            "source.strings[9]": "-metrics i.totalcpu -func",
            "source.has_imports": true,
            "source.strings[10]": "-metrics i.totalcpu:i.cycles -func",
            "source.strings[11]": "/Makefile srcdir=\\",
            "source.strings[12]": "/diff.out",
            "source.strings[13]": "/gprofng.display/",
            "source.strings[14]": "/rules.txt",
            "source.strings[15]": "Cpu, 2, 0\\n",
            "source.strings[16]": "Cycles, 2, 0\\n",
            "source.strings[17]": "Cycles, 2, 1\\n",
            "source.strings[18]": "\\\" CC=\\",
            "source.strings[19]": "\\\" CFLAGS=\\",
            "source.strings[20]": "\\\" GPROFNG=\\",
            "source.strings[21]": "\\\" LDFLAGS=\\",
            "source.strings[22]": "\\\" MAKE=\\",
            "source.strings[23]": "\\\" \\\n        COLLECT_FLAGS=\\",
            "source.strings[24]": "\\\" \\\n        DISPLAY_FLAGS=\\",
            "source.strings[25]": "\\\" \\\n        VPATH=\\",
            "source.strings[26]": "\\\" builddir=\\",
            "source.strings[27]": "aarch64",
            "source.strings[28]": "cd $tdir \u0026\u0026 $MAKE $make_args all",
            "source.strings[29]": "child process exited abnormally",
            "source.strings[30]": "comparison of results in ",
            "source.strings[31]": "comparison of results in $dir failed",
            "source.strings[32]": "comparison of results in $dir failed:\\n$out\\n",
            "source.strings[33]": "compilation of test program in ",
            "source.strings[34]": "compilation of test program in $dir failed",
            "source.strings[35]": "compilation of test program in $dir failed:\\n$out\\n",
            "source.strings[36]": "create dir: ",
            "source.strings[37]": "create dir: $tdir\\n",
            "source.strings[38]": "mkdir -p ",
            "source.strings[39]": "mkdir -p $tdir",
            "source.strings[40]": "tmpdir/",
            "source.strings[41]": "tmpdir/$testdir"
          },
          "ct": [
            "global",
            "lindex",
            "proc",
            "regsub",
            "set",
            "string",
            "try",
            "verbose",
            "}"
          ],
          "id": "shell"
        },
        "id": 0,
        "sz": 3671,
        "ts": [
          {
            "c": 0.800000011920929,
            "d": "Invokes mkdir",
            "e": [
              "mkdir"
            ],
            "i": "micro-behaviors/process/create/tool::mkdir-invocation",
            "l": 1
          },
          {
            "a": "T1110.001",
            "c": 0.8500000238418579,
            "d": "Service account redis",
            "e": [
              "redis"
            ],
            "i": "objectives/lateral-movement/brute-force/password::service-account-redis",
            "l": 1,
            "m": "E1110"
          },
          {
            "a": "T1106",
            "c": 0.75,
            "d": "open command execution",
            "e": [
              "open \""
            ],
            "i": "micro-behaviors/process/create/launch::open-command",
            "l": 3
          },
          {
            "c": 0.20000000298023224,
            "d": "output keyword",
            "e": [
              "output"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::output",
            "l": 1
          },
          {
            "a": "T1543",
            "c": 0.8199999928474426,
            "d": "Launch helper used with /root binary",
            "e": [
              "exec "
            ],
            "i": "objectives/persistence/system/init/script::root-binary-launcher",
            "l": 1
          },
          {
            "c": 0.20000000298023224,
            "d": "command keyword",
            "e": [
              "command"
            ],
            "i": "micro-behaviors/data/text/keywords/lexicon::command-dup",
            "l": 1
          },
          {
            "c": 1.0,
            "d": "AArch64 (ARM64) architecture string",
            "e": [
              "aarch64"
            ],
            "i": "micro-behaviors/os/sysinfo/platform/arch::arch-aarch64",
            "l": 1
          },
          {
            "a": "T1071.001",
            "c": 0.8999999761581421,
            "d": "Command/result field word",
            "e": [
              "COMMAND"
            ],
            "i": "objectives/command-and-control/beacon/network/json::result-command-word",
            "l": 1,
            "m": "B0030"
          },
          {
            "c": 0.6000000238418579,
            "d": "Copyright notice",
            "e": [
              "Copyright"
            ],
            "i": "metadata/package/license::copyright-word",
            "l": 2
          },
          {
            "c": 0.8999999761581421,
            "d": "File has 30 or more lines",
            "e": [
              "text.total_lines = 105.00"
            ],
            "i": "metadata/file/text/metrics::file-has-30-plus-lines",
            "l": 1
          },
          {
            "a": "T1204.002",
            "c": 0.699999988079071,
            "d": "Opening generic document file (macOS - TXT)",
            "e": [
              "open \"$tdir/rules.txt"
            ],
            "i": "objectives/evasion/decoy/document::open-decoy-doc-macos-3",
            "l": 4
          }
        ],
        "sha": "f107e0011d549964bee9ed3307d9bee5dc3bd0f82259f6db5197cf0fa67c546f",
        "path": "/data/samples/good/debian/binutils/binutils-2.40/gprofng/testsuite/lib/display-lib.exp",
        "type": "shell"
      }
    ],
    "tv": "60d49"
  }
}