{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000033011038, "rte": "az", "prob": 0.000033011038 }, { "cls": 0, "raw": 0.513883, "rte": "az/source", "prob": 0.513883 }, { "cls": 0, "raw": 0.7008299, "rte": "az/c", "prob": 0.7008299 } ], "prob": 0.000033011038, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00003301103788544424, "type": "c" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:00:43Z" }, "path": "source.c", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 121, "b": "bwz49y\u0026%o1auTEOzGQgSB8kn]e[^A", "l": 7 }, { "a": 145, "b": "", "l": 8 }, { "a": 146, "b": "o\u00261eSoHSqZnKC{wq:\u00268Um]h(6dlv", "l": 9, "n": [ { "c": 2, "d": "Declares Linux kernel module license", "i": "micro-behaviors/os/kernel/module::linux-module-license-macro", "o": 146, "z": 14 } ] }, { "a": 169, "b": "o\u00261eSoHSqOrA8H+qyA-gAa@\u0026]A=t-9a$kO", "l": 10, "n": [ { "c": 2, "d": "MODULE_AUTHOR declaration (attacker attribution)", "i": "objectives/evasion/kernel-hide/lkm/headers::module-author-macro", "o": 169, "z": 13 } ] }, { "a": 197, "b": "o\u00261eSoHSq?mn^5QpFJqZf!LdjfD}@c", "l": 11 }, { "a": 222, "b": "", "l": 12 }, { "a": 436, "b": "B98CBv@@\u0026czF%5%as.tJz!0y2uUKy@wmW?", "l": 20 }, { "a": 464, "b": "", "l": 21 }, { "a": 465, "b": "B98CBv@@\u00267x(WM\u003cz/fVdCYU5TvQS+ZB-pX#x(WM\u003cz/fVdCYV1", "l": 22, "n": [ { "c": 2, "d": "Linux dir_context struct", "i": "micro-behaviors/os/syscall/invoke::dir-context-struct", "o": 465, "z": 18 } ] }, { "a": 505, "b": "", "l": 23 }, { "a": 506, "b": "fdFB", "l": 24 }, { "a": 510, "b": "asXHBze:PhwPF#oxK@r5x(!wsz!pbhx\u003ehocBz\u0026pnx\u003eg^c", "l": 25, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 521, "z": 3 } ] }, { "a": 547, "b": "asY2", "l": 26 }, { "a": 551, "b": "B97\u0026jx\u003e5oez!S-8wO(ydD0+J8woha1z^Nf(wmYa:x(!wAC5I89dlv", "l": 27 }, { "a": 3023, "b": "arR^HarR^HEe", "l": 111 }, { "a": 3033, "b": "", "l": 112 }, { "a": 3034, "b": "arR^HarR^Hy?W%juU0.:c#:9Cdlv", "l": 113, "n": [ { "c": 2, "d": "Kernel list deletion (module hiding)", "i": "objectives/evasion/kernel-hide/lkm/syscalls::list-del-call", "o": 3042, "z": 8 } ] }, { "a": 3057, "b": "arR^HarR^HyI4P#wHIIiwgoO", "l": 114, "n": [ { "c": 2, "d": "Kernel memory free (often used", "i": "objectives/evasion/kernel-hide/lkm/hiding::kfree-call", "o": 3065, "z": 5 } ] }, { "a": 3077, "b": "arR^HEe", "l": 115 }, { "a": 3083, "b": "Ee", "l": 116 }, { "a": 3662, "b": "arR^HB98CBv@@\u0026jvruf9Ab](buVoB}xGD", "l": 139 }, { "a": 3689, "b": "arR^Hx\u003ewFoyH}K7uVoB}xEDXPpEvPIuQNE-uR\u003c3/ngU(qefDoUA=kC{Aa9\u003c4djDx^", "l": 140 }, { "a": 3742, "b": "arR^HarR^HAb]VgBzAo$mn=(/mn^2ab5qdrz!0D{wmW!AyH}K7uVoB}xDQ[}x(4u\u003eaA}Hky?j-hA^qwpxcqqmaA8jgzxJ[sz!0y2e)Jordlv", "l": 141, "n": [ { "c": 3, "d": "Kernel log fn (module code)", "i": "objectives/evasion/kernel-hide/module::printk-sym", "o": 3750, "z": 6 } ] }, { "a": 3829, "b": "arR^HarR^HA+funA=9@", "l": 142 }, { "a": 3845, "b": "arR^HEe", "l": 143 }, { "a": 5376, "b": "Ee", "l": 186 }, { "a": 5378, "b": "", "l": 187 }, { "a": 5379, "b": "zeS%cy?l%/zFshvzeS@(x(mTbdlv", "l": 188, "n": [ { "c": 3, "d": "Registers Linux kernel module init", "i": "micro-behaviors/os/kernel/module::linux-module-init-macro", "o": 5379, "z": 11 } ] }, { "a": 5402, "b": "zeS%cy?l%+CXImFzeS@(wQ4{hdlv", "l": 189, "n": [ { "c": 3, "d": "Registers Linux kernel module exit", "i": "micro-behaviors/os/kernel/module::linux-module-exit-macro", "o": 5402, "z": 11 } ] }, { "a": 5425, "b": "", "l": 190 } ], "mol": "O(Er)H(Os)", "sha": "f5de5facbee91c63427348d7b0f1c9ce6711df42dcae0712f46381dcfef0d374", "fact": { "id": "c", "imp": [ [ "", "MODULE_LICENSE" ], [ "", "MODULE_AUTHOR" ], [ "", "MODULE_VERSION" ], [ "", "should_hide_pid" ], [ "", "backup_dir_context.actor" ], [ "", "procfs_backup_fops.iterate_shared" ], [ "", "kstrtoint" ], [ "", "mutex_lock" ], [ "", "list_for_each_entry" ], [ "", "mutex_unlock" ], [ "", "list_for_each_safe" ], [ "", "list_entry" ], [ "", "list_del" ], [ "", "kfree" ], [ "", "kern_path" ], [ "", "kern_path" ], [ "", "printk" ], [ "", "printk" ], [ "", "printk" ], [ "", "register_readpid_chrdev" ], [ "", "printk" ], [ "", "printk" ], [ "", "printk" ], [ "", "override_procfs_fops" ], [ "", "printk" ], [ "", "printk" ], [ "", "restore_procfs_fops_to_default" ], [ "", "empty_pids_to_hide_list" ], [ "", "unregister_readpid_chrdev" ], [ "", "printk" ], [ "", "printk" ], [ "", "module_init" ], [ "", "module_exit" ], [ "", "\u003clinux/fcntl.h\u003e" ], [ "", "\u003clinux/fs.h\u003e" ], [ "", "\u003clinux/namei.h\u003e" ], [ "", "\u003clinux/proc_fs.h\u003e" ], [ "", "\u003clinux/slab.h\u003e" ], [ "", "readpid.h" ] ], "mbr": [ "backup_dir_context.actor", "dir_ctx.pos", "kprochide_ctx.pos", "pid_to_hide.pid", "proc_path.dentry", "proc_path.dentry.d_inode", "procfs_backup_fops.iterate_shared", "procfs_fops.iterate_shared", "procfs_inode.i_fop" ], "met": { "ast": { "op.eq": 4.0, "op.lt": 1.0, "op.lor": 1.0, "op.mul": 1.0, "op.sub": 5.0, "op.band": 10.0, "max_depth": 10.0, "op.concat": 5.0, "bind_count": 15.0, "call_count": 33.0, "node_count": 1096.0, "member_count": 9.0, "op_density.eq": 0.0, "op_density.lt": 0.0, "op_density.lor": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.01, "identifier_count": 78.0, "member_depth_max": 3.0, "op_density.concat": 0.0, "string_literal_count": 15.0, "array_literal_max_length": 2.0 }, "file": { "size": 5425.0, "entropy": 4.81, "size_bytes": 5425.0 }, "text": { "digit_ratio": 0.0, "space_count": 977.0, "total_lines": 189.0, "char_entropy": 4.81, "unique_chars": 74.0, "string_density": 0.08, "avg_line_length": 27.7, "max_line_length": 102.0, "empty_line_ratio": 0.2, "last_line_length": 22.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.06, "identifier_density": 1.06, "line_length_stddev": 27.14, "normalized_string_count": 1.09, "repeated_char_sequences": 8.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 10.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 10.31 }, "binds": { "count": 15.0 }, "calls": { "count": 33.0 }, "binary": { "overall_entropy": 4.81 }, "source": { "class_count": 7.0, "function_count": 8.0 }, "imports": { "count": 6.0, "unique_modules": 6.0, "third_party_count": 6.0, "third_party_ratio": 1.0 }, "members": { "count": 9.0 }, "strings": { "total": 15.0, "avg_length": 34.6, "max_length": 65.0, "avg_entropy": 3.57, "total_bytes": 519.0, "entropy_stddev": 0.92 }, "comments": { "chars": 729.0, "lines": 21.0, "total": 13.0, "to_code_ratio": 0.13 }, "functions": { "count": 15.0 }, "identifiers": { "count": 78.0, "total": 200.0, "avg_length": 10.92, "max_length": 30.0, "min_length": 3.0, "avg_entropy": 2.83, "reuse_ratio": 0.39, "unique_count": 78.0, "length_stddev": 6.57, "has_digit_ratio": 0.01, "high_entropy_count": 11.0, "high_entropy_ratio": 0.14, "all_lowercase_ratio": 0.85, "all_uppercase_ratio": 0.14, "numeric_suffix_count": 1.0, "underscore_prefix_count": 2.0 } }, "str": [ [ 9, "u8", "readpid.h" ], [ 10, "u8", "readpid.h" ], [ 31, "u8", "\u003clinux/namei.h\u003e" ], [ 56, "u8", "\u003clinux/fcntl.h\u003e" ], [ 81, "u8", "\u003clinux/fs.h\u003e" ], [ 103, "u8", "\u003clinux/proc_fs.h\u003e" ], [ 130, "u8", "\u003clinux/slab.h\u003e" ], [ 161, "u8", "GPL" ], [ 162, "u8", "GPL" ], [ 183, "u8", "spiderpig" ], [ 184, "u8", "spiderpig" ], [ 212, "u8", "1.0.0" ], [ 213, "u8", "1.0.0" ], [ 297, "u8", "kprochide_readpid" ], [ 298, "u8", "kprochide_readpid" ], [ 1408, "10", "0" ], [ 1595, "10", "0" ], [ 1705, "10", "0" ], [ 1995, "10", "0" ], [ 2026, "10", "0" ], [ 3184, "10", "0" ], [ 3609, "10", "0" ], [ 3724, "10", "0" ], [ 3757, "u8", "KERN_ERR \"kprochide: kern_path failed while trying to open procfs.\\n" ], [ 3766, "u8", "kprochide: kern_path failed while trying to open procfs.\\n" ], [ 3767, "u8", "kprochide: kern_path failed while trying to open procfs." ], [ 3863, "u8", "KERN_INFO \"kprochide: restoring procfs' original file_operations\\n" ], [ 3873, "u8", "kprochide: restoring procfs' original file_operations\\n" ], [ 3874, "u8", "kprochide: restoring procfs' original file_operations" ], [ 4074, "u8", "KERN_INFO \"kprochide: LKM loaded\\n" ], [ 4084, "u8", "kprochide: LKM loaded\\n" ], [ 4085, "u8", "kprochide: LKM loaded" ], [ 4224, "10", "0" ], [ 4244, "u8", "KERN_ERR \"kprochide: failed to register char device (%d)\\n" ], [ 4253, "u8", "kprochide: failed to register char device (%d)\\n" ], [ 4254, "u8", "kprochide: failed to register char device (%d)" ], [ 4373, "u8", "KERN_INFO \"kprochide: registered char device (%d)\\n" ], [ 4383, "u8", "kprochide: registered char device (%d)\\n" ], [ 4384, "u8", "kprochide: registered char device (%d)" ], [ 4465, "u8", "KERN_INFO \"kprochide: please run 'mknod /dev/readpid c %d 0'\\n" ], [ 4475, "u8", "kprochide: please run 'mknod /dev/readpid c %d 0'\\n" ], [ 4476, "u8", "kprochide: please run 'mknod /dev/readpid c %d 0" ], [ 4607, "u8", "KERN_ERR \"kprochide: kern_path failed to replace procfs' file_operations.\\n" ], [ 4616, "u8", "kprochide: kern_path failed to replace procfs' file_operations.\\n" ], [ 4617, "u8", "kprochide: kern_path failed to replace procfs' file_operations." ], [ 4725, "u8", "KERN_INFO \"kprochide: successfully replaced procfs' file_operations\\n" ], [ 4735, "u8", "kprochide: successfully replaced procfs' file_operations\\n" ], [ 4736, "u8", "kprochide: successfully replaced procfs' file_operations" ], [ 4810, "10", "0" ], [ 5230, "u8", "KERN_INFO \"kprochide: unregistered char device %d\\n" ], [ 5240, "u8", "kprochide: unregistered char device %d\\n" ], [ 5241, "u8", "kprochide: unregistered char device %d" ], [ 5323, "u8", "KERN_INFO \"kprochide: LKM successfully unloaded\\n" ], [ 5333, "u8", "kprochide: LKM successfully unloaded\\n" ], [ 5334, "u8", "kprochide: LKM successfully unloaded" ] ], "tgt": [ "MODULE_AUTHOR", "MODULE_LICENSE", "MODULE_VERSION", "backup_dir_context.actor", "empty_pids_to_hide_list", "kern_path", "kfree", "kstrtoint", "list_del", "list_entry", "list_for_each_entry", "list_for_each_safe", "module_exit", "module_init", "mutex_lock", "mutex_unlock", "override_procfs_fops", "printk", "procfs_backup_fops.iterate_shared", "register_readpid_chrdev", "restore_procfs_fops_to_default", "should_hide_pid", "unregister_readpid_chrdev" ], "val": { "file.stem": "source", "file.basename": "source.c", "source.language": "c", "source.imports[0]": "\u003clinux/fcntl.h\u003e", "source.imports[1]": "\u003clinux/fs.h\u003e", "source.imports[2]": "\u003clinux/namei.h\u003e", "source.imports[3]": "\u003clinux/proc_fs.h\u003e", "source.imports[4]": "\u003clinux/slab.h\u003e", "source.imports[5]": "MODULE_AUTHOR", "source.imports[6]": "MODULE_LICENSE", "source.imports[7]": "MODULE_VERSION", "source.imports[8]": "backup_dir_context.actor", "source.imports[9]": "empty_pids_to_hide_list", "source.strings[0]": "\u003clinux/fcntl.h\u003e", "source.strings[1]": "\u003clinux/fs.h\u003e", "source.strings[2]": "\u003clinux/namei.h\u003e", "source.strings[3]": "\u003clinux/proc_fs.h\u003e", "source.strings[4]": "\u003clinux/slab.h\u003e", "source.strings[5]": "KERN_ERR \"kprochide: failed to register char device (%d)\\n", "source.strings[6]": "KERN_ERR \"kprochide: kern_path failed to replace procfs' file_operations.\\n", "source.strings[7]": "KERN_ERR \"kprochide: kern_path failed while trying to open procfs.\\n", "source.strings[8]": "KERN_INFO \"kprochide: LKM loaded\\n", "source.strings[9]": "KERN_INFO \"kprochide: LKM successfully unloaded\\n", "source.has_imports": true, "source.imports[10]": "kern_path", "source.imports[11]": "kfree", "source.imports[12]": "kstrtoint", "source.imports[13]": "list_del", "source.imports[14]": "list_entry", "source.imports[15]": "list_for_each_entry", "source.imports[16]": "list_for_each_safe", "source.imports[17]": "module_exit", "source.imports[18]": "module_init", "source.imports[19]": "mutex_lock", "source.imports[20]": "mutex_unlock", "source.imports[21]": "override_procfs_fops", "source.imports[22]": "printk", "source.imports[23]": "procfs_backup_fops.iterate_shared", "source.imports[24]": "readpid.h", "source.imports[25]": "register_readpid_chrdev", "source.imports[26]": "restore_procfs_fops_to_default", "source.imports[27]": "should_hide_pid", "source.imports[28]": "unregister_readpid_chrdev", "source.strings[10]": "KERN_INFO \"kprochide: please run 'mknod /dev/readpid c %d 0'\\n", "source.strings[11]": "KERN_INFO \"kprochide: registered char device (%d)\\n", "source.strings[12]": "KERN_INFO \"kprochide: restoring procfs' original file_operations\\n", "source.strings[13]": "KERN_INFO \"kprochide: successfully replaced procfs' file_operations\\n", "source.strings[14]": "KERN_INFO \"kprochide: unregistered char device %d\\n", "source.strings[15]": "kprochide: LKM loaded", "source.strings[16]": "kprochide: LKM loaded\\n", "source.strings[17]": "kprochide: LKM successfully unloaded", "source.strings[18]": "kprochide: LKM successfully unloaded\\n", "source.strings[19]": "kprochide: failed to register char device (%d)", "source.strings[20]": "kprochide: failed to register char device (%d)\\n", "source.strings[21]": "kprochide: kern_path failed to replace procfs' file_operations.", "source.strings[22]": "kprochide: kern_path failed to replace procfs' file_operations.\\n", "source.strings[23]": "kprochide: kern_path failed while trying to open procfs.", "source.strings[24]": "kprochide: kern_path failed while trying to open procfs.\\n", "source.strings[25]": "kprochide: please run 'mknod /dev/readpid c %d 0", "source.strings[26]": "kprochide: please run 'mknod /dev/readpid c %d 0'\\n", "source.strings[27]": "kprochide: registered char device (%d)", "source.strings[28]": "kprochide: registered char device (%d)\\n", "source.strings[29]": "kprochide: restoring procfs' original file_operations", "source.strings[30]": "kprochide: restoring procfs' original file_operations\\n", "source.strings[31]": "kprochide: successfully replaced procfs' file_operations", "source.strings[32]": "kprochide: successfully replaced procfs' file_operations\\n", "source.strings[33]": "kprochide: unregistered char device %d", "source.strings[34]": "kprochide: unregistered char device %d\\n", "source.strings[35]": "kprochide_readpid", "source.strings[36]": "readpid.h", "source.strings[37]": "spiderpig", "source.functions[0]": "empty_pids_to_hide_list()", "source.functions[1]": "kprochide_filldir(struct dir_context *ctx, \n const char *name, \n int namlen, \n loff_t offset, \n u64 ino, \n unsigned int d_type)", "source.functions[2]": "kprochide_iterate_shared(struct file *file, struct dir_context *dir_ctx)", "source.functions[3]": "mod_exit(void)", "source.functions[4]": "mod_init(void)", "source.functions[5]": "override_procfs_fops()", "source.functions[6]": "restore_procfs_fops_to_default()", "source.functions[7]": "should_hide_pid(const char* pid_dir_name)" } }, "find": [ { "id": "micro-behaviors/os/kernel/module::linux-module-init-macro", "conf": 0.8999999761581421, "crit": 3, "desc": "Registers Linux kernel module init" }, { "id": "micro-behaviors/os/kernel/module::linux-module-init-symbol", "conf": 0.800000011920929, "crit": 3, "desc": "Registers Linux kernel module init" }, { "id": "micro-behaviors/os/kernel/module::linux-module-exit-macro", "conf": 0.8999999761581421, "crit": 3, "desc": "Registers Linux kernel module exit" }, { "id": "micro-behaviors/os/kernel/module::linux-module-exit-symbol", "conf": 0.800000011920929, "crit": 3, "desc": "Registers Linux kernel module exit" }, { "id": "objectives/evasion/kernel-hide/module::printk-sym", "conf": 0.699999988079071, "crit": 3, "desc": "Kernel log fn (module code)" } ], "path": "/data/samples/bad/projects/kprochide/source.c", "risk": 2, "size": 5425, "type": "c" } ] } }