{
  "ml": {
    "v": "4",
    "fs": [
      {
        "id": 0,
        "prob": 0.9102563858032227,
        "class": 0
      }
    ],
    "prob": 0.9102564,
    "class": 0,
    "models": [
      {
        "m": "az",
        "prob": 0.8383554,
        "class": 0
      },
      {
        "m": "az/source",
        "prob": 0.8613861,
        "class": 0
      },
      {
        "m": "az/c",
        "prob": 0.9102564,
        "class": 0
      }
    ],
    "version": "v17.17",
    "thresholds": [
      0.999503,
      0.9998882
    ],
    "analyzed_at": "2026-05-25T18:59:08Z"
  },
  "path": "syscall_helper.h",
  "raw": {
    "v": "5",
    "fs": [
      {
        "f": "O(Er)",
        "x": 39,
        "ff": {
          "m": {
            "ast": {
              "max_depth": 6.0,
              "call_count": 0.0,
              "node_count": 76.0,
              "target_count": 0.0,
              "string_literal_count": 2.0
            },
            "file": {
              "size": 1673.0,
              "entropy": 4.65,
              "size_bytes": 1673.0
            },
            "text": {
              "digit_ratio": 0.01,
              "space_count": 251.0,
              "total_lines": 49.0,
              "char_entropy": 4.65,
              "unique_chars": 55.0,
              "string_density": 0.04,
              "avg_line_length": 33.14,
              "max_line_length": 80.0,
              "empty_line_ratio": 0.08,
              "last_line_length": 35.0,
              "whitespace_ratio": 0.18,
              "most_common_ratio": 0.07,
              "identifier_density": 0.16,
              "line_length_stddev": 29.67,
              "normalized_string_count": 0.29,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 1.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 1.42
            },
            "imports": {
              "count": 5.0,
              "unique_modules": 5.0,
              "third_party_count": 5.0,
              "third_party_ratio": 1.0
            },
            "strings": {
              "total": 2.0,
              "avg_length": 13.0,
              "max_length": 20.0,
              "avg_entropy": 2.82,
              "total_bytes": 26.0,
              "entropy_stddev": 0.9
            },
            "comments": {
              "chars": 1359.0,
              "lines": 36.0,
              "total": 4.0,
              "to_code_ratio": 2.77
            },
            "identifiers": {
              "total": 8.0,
              "avg_length": 10.75,
              "max_length": 21.0,
              "min_length": 3.0,
              "avg_entropy": 2.6,
              "reuse_ratio": 1.0,
              "unique_count": 8.0,
              "length_stddev": 6.67,
              "has_digit_ratio": 0.25,
              "high_entropy_count": 1.0,
              "high_entropy_ratio": 0.13,
              "all_lowercase_ratio": 0.75
            }
          },
          "s": [
            [
              9,
              "u8",
              "\u003clinux/module.h\u003e"
            ],
            [
              35,
              "u8",
              "\u003clinux/stop_machine.h\u003e"
            ],
            [
              67,
              "u8",
              "\u003clinux/syscalls.h\u003e"
            ],
            [
              95,
              "u8",
              "hook.h"
            ],
            [
              96,
              "u8",
              "hook.h"
            ],
            [
              113,
              "u8",
              "instruction_helper.h"
            ],
            [
              114,
              "u8",
              "instruction_helper.h"
            ]
          ],
          "v": {
            "source.language": "c",
            "source.strings[0]": "\u003clinux/module.h\u003e",
            "source.strings[1]": "\u003clinux/stop_machine.h\u003e",
            "source.strings[2]": "\u003clinux/syscalls.h\u003e",
            "source.strings[3]": "hook.h",
            "source.strings[4]": "instruction_helper.h"
          },
          "id": "c"
        },
        "id": 0,
        "sz": 1673,
        "ts": [
          {
            "a": "T1106",
            "c": 0.9900000095367432,
            "d": "Linux kernel module header include (linux/module.h)",
            "e": [
              "linux/module.h"
            ],
            "i": "micro-behaviors/os/syscall/invoke::kernel-module-include-detect",
            "l": 1
          },
          {
            "c": 0.9900000095367432,
            "d": "Linux kernel module header detection",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/headers::kernel-module-header-detect",
            "l": 2
          },
          {
            "c": 1.0,
            "d": "shell script command substitution",
            "e": [
              "`x64_sys_call`"
            ],
            "i": "micro-behaviors/process/create/shell/invoke::command-substitution",
            "l": 2
          },
          {
            "a": "T1014",
            "c": 0.949999988079071,
            "d": "Rootkit header file pattern",
            "e": [
              "\u003clinux/module.h\u003e"
            ],
            "i": "objectives/evasion/kernel-hide/lkm/rootkit::rootkit-header",
            "l": 4
          }
        ],
        "sha": "fb30dab806a9185e00329f23210ef1e748a4e57f639b6eea737af1a668a367b6",
        "path": "/data/samples/bad/projects/ksymless/src/kernel/syscall_helper.h",
        "type": "c"
      }
    ],
    "tv": "cf883"
  }
}