{ "ml": { "l": -1, "v": "6", "fs": [ { "l": -1, "id": 0, "prob": 0.00002934535405074712 } ], "prob": 0.000029345354, "models": [ { "m": "az", "raw": 0.000029345354, "prob": 0.000029345354, "class": 0 }, { "m": "az/source", "raw": 0.000032424927, "prob": 0.000032424927, "class": 0 }, { "m": "az/c", "raw": 0.0000385046, "prob": 0.0000385046, "class": 0 } ], "version": "v17.17", "analyzed_at": "2026-06-08T02:56:03Z" }, "path": "port.c", "raw": { "v": "6", "fs": [ { "f": "O(Er)H(F)", "x": 3, "ff": { "i": [ [ "", "satan_port_hook_seq_show" ], [ "", "satan_port_unhook_seq_show" ], [ "", "hidden_ports_list_clear" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "satan_port_tcp_hide" ], [ "", "satan_port_udp_hide" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "satan_port_tcp_unhide" ], [ "", "satan_port_udp_unhide" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "hidden_ports_list_add" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "hidden_ports_list_del" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "RETURN_IF_PORT_INVALID" ], [ "", "list_for_each" ], [ "", "list_entry" ], [ "", "hidden_ports_list_get" ], [ "", "pr_alert" ], [ "", "kmalloc" ], [ "", "snprintf" ], [ "", "pr_info" ], [ "", "list_add_tail" ], [ "", "hidden_ports_list_get" ], [ "", "pr_info" ], [ "", "pr_info" ], [ "", "list_del" ], [ "", "kfree" ], [ "", "list_for_each_safe" ], [ "", "list_entry" ], [ "", "pr_info" ], [ "", "list_del" ], [ "", "kfree" ], [ "", "filp_open" ], [ "", "IS_ERR" ], [ "", "pr_alert" ], [ "", "PDE_DATA" ], [ "", "filp_close" ], [ "", "filp_open" ], [ "", "IS_ERR" ], [ "", "pr_alert" ], [ "", "PDE_DATA" ], [ "", "filp_close" ], [ "", "real_seq_show" ], [ "", "list_for_each" ], [ "", "list_entry" ], [ "", "strnstr" ], [ "", "pr_alert" ], [ "", "\u003clinux/list.h\u003e" ], [ "", "\u003clinux/proc_fs.h\u003e" ], [ "", "\u003clinux/string.h\u003e" ], [ "", "\u003cnet/tcp.h\u003e" ], [ "", "port.h" ] ], "m": { "ast": { "op.eq": 1.0, "op.add": 5.0, "op.sub": 2.0, "op.band": 6.0, "op.lnot": 1.0, "max_depth": 11.0, "op.concat": 5.0, "bind_count": 21.0, "call_count": 48.0, "node_count": 1459.0, "member_count": 10.0, "op_density.eq": 0.0, "op_density.add": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.lnot": 0.0, "identifier_count": 64.0, "member_depth_max": 4.0, "op_density.concat": 0.0, "string_literal_count": 12.0 }, "file": { "size": 7005.0, "entropy": 4.66, "size_bytes": 7005.0 }, "text": { "digit_ratio": 0.01, "space_count": 1745.0, "total_lines": 288.0, "char_entropy": 4.66, "unique_chars": 85.0, "string_density": 0.04, "avg_line_length": 23.32, "max_line_length": 94.0, "empty_line_ratio": 0.24, "last_line_length": 1.0, "whitespace_ratio": 0.29, "most_common_ratio": 0.07, "identifier_density": 0.92, "line_length_stddev": 23.85, "normalized_string_count": 0.71, "repeated_char_sequences": 31.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.08, "max_inline_whitespace_run": 45.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.03, "normalized_unique_identifiers": 7.83 }, "binds": { "count": 21.0 }, "calls": { "count": 48.0 }, "binary": { "overall_entropy": 4.66 }, "source": { "class_count": 5.0, "function_count": 15.0 }, "imports": { "count": 5.0, "unique_modules": 5.0, "third_party_count": 5.0, "third_party_ratio": 1.0 }, "members": { "count": 10.0 }, "strings": { "total": 12.0, "avg_length": 29.92, "max_length": 53.0, "path_count": 2.0, "avg_entropy": 3.48, "total_bytes": 359.0, "entropy_stddev": 0.61 }, "comments": { "chars": 1042.0, "lines": 43.0, "total": 13.0, "to_code_ratio": 0.18, "high_entropy_comments": 1.0 }, "functions": { "count": 20.0 }, "identifiers": { "count": 64.0, "total": 264.0, "avg_length": 10.8, "max_length": 26.0, "min_length": 1.0, "avg_entropy": 2.76, "reuse_ratio": 0.24, "unique_count": 64.0, "length_stddev": 6.51, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.03, "high_entropy_count": 13.0, "high_entropy_ratio": 0.2, "all_lowercase_ratio": 0.84, "all_uppercase_ratio": 0.16 } }, "s": [ [ 65, "u8", "port.h" ], [ 66, "u8", "port.h" ], [ 84, "u8", "\u003clinux/list.h\u003e" ], [ 108, "u8", "\u003clinux/proc_fs.h\u003e" ], [ 135, "u8", "\u003clinux/string.h\u003e" ], [ 161, "u8", "\u003cnet/tcp.h\u003e" ], [ 1648, "10", "0" ], [ 2016, "10", "0" ], [ 3013, "10", "0" ], [ 3298, "10", "0" ], [ 3910, "u8", "satan: port: %d is already hidden.\\n" ], [ 3911, "u8", "satan: port: %d is already hidden." ], [ 3984, "10", "1" ], [ 4175, "u8", "%04X" ], [ 4176, "u8", "%04X" ], [ 4212, "u8", "satan: port: adding %d to list of hidden ports\\n" ], [ 4213, "u8", "satan: port: adding %d to list of hidden ports" ], [ 4345, "10", "0" ], [ 4517, "u8", "satan: port: %d has not been hidden.\\n" ], [ 4518, "u8", "satan: port: %d has not been hidden." ], [ 4593, "10", "1" ], [ 4624, "u8", "satan: port: removing %d from list of hidden ports.\\n" ], [ 4625, "u8", "satan: port: removing %d from list of hidden ports." ], [ 4755, "10", "0" ], [ 5067, "u8", "satan: port: removing %d from list of hidden ports.\\n" ], [ 5068, "u8", "satan: port: removing %d from list of hidden ports." ], [ 5272, "10", "0" ], [ 5382, "u8", "/proc/net/tcp" ], [ 5383, "u8", "/proc/net/tcp" ], [ 5409, "10", "0" ], [ 5463, "u8", "Failed to open /proc/net/tcp\\n" ], [ 5464, "u8", "Failed to open /proc/net/tcp" ], [ 5516, "10", "1" ], [ 5759, "10", "0" ], [ 5851, "10", "0" ], [ 5961, "u8", "/proc/net/tcp" ], [ 5962, "u8", "/proc/net/tcp" ], [ 5988, "10", "0" ], [ 6042, "u8", "Failed to open /proc/net/tcp\\n" ], [ 6043, "u8", "Failed to open /proc/net/tcp" ], [ 6095, "10", "1" ], [ 6321, "10", "0" ], [ 6826, "u8", "satan: port: hiding tcp port %d.\\n" ], [ 6827, "u8", "satan: port: hiding tcp port %d." ] ], "v": { "file.stem": "port", "file.basename": "port.c", "source.language": "c", "source.imports[0]": "\u003clinux/list.h\u003e", "source.imports[1]": "\u003clinux/proc_fs.h\u003e", "source.imports[2]": "\u003clinux/string.h\u003e", "source.imports[3]": "\u003cnet/tcp.h\u003e", "source.imports[4]": "IS_ERR", "source.imports[5]": "PDE_DATA", "source.imports[6]": "RETURN_IF_PORT_INVALID", "source.imports[7]": "filp_close", "source.imports[8]": "filp_open", "source.imports[9]": "hidden_ports_list_add", "source.strings[0]": "/proc/net/tcp", "source.strings[1]": "\u003clinux/list.h\u003e", "source.strings[2]": "\u003clinux/proc_fs.h\u003e", "source.strings[3]": "\u003clinux/string.h\u003e", "source.strings[4]": "\u003cnet/tcp.h\u003e", "source.strings[5]": "Failed to open /proc/net/tcp", "source.strings[6]": "Failed to open /proc/net/tcp\\n", "source.strings[7]": "port.h", "source.strings[8]": "satan: port: %d has not been hidden.", "source.strings[9]": "satan: port: %d has not been hidden.\\n", "source.has_imports": true, "source.imports[10]": "hidden_ports_list_clear", "source.imports[11]": "hidden_ports_list_del", "source.imports[12]": "hidden_ports_list_get", "source.imports[13]": "kfree", "source.imports[14]": "kmalloc", "source.imports[15]": "list_add_tail", "source.imports[16]": "list_del", "source.imports[17]": "list_entry", "source.imports[18]": "list_for_each", "source.imports[19]": "list_for_each_safe", "source.imports[20]": "port.h", "source.imports[21]": "pr_alert", "source.imports[22]": "pr_info", "source.imports[23]": "real_seq_show", "source.imports[24]": "satan_port_hook_seq_show", "source.imports[25]": "satan_port_tcp_hide", "source.imports[26]": "satan_port_tcp_unhide", "source.imports[27]": "satan_port_udp_hide", "source.imports[28]": "satan_port_udp_unhide", "source.imports[29]": "satan_port_unhook_seq_show", "source.imports[30]": "snprintf", "source.imports[31]": "strnstr", "source.strings[10]": "satan: port: %d is already hidden.", "source.strings[11]": "satan: port: %d is already hidden.\\n", "source.strings[12]": "satan: port: adding %d to list of hidden ports", "source.strings[13]": "satan: port: adding %d to list of hidden ports\\n", "source.strings[14]": "satan: port: hiding tcp port %d.", "source.strings[15]": "satan: port: hiding tcp port %d.\\n", "source.strings[16]": "satan: port: removing %d from list of hidden ports.", "source.strings[17]": "satan: port: removing %d from list of hidden ports.\\n", "source.functions[0]": "*hidden_ports_list_get(unsigned int port_num)", "source.functions[1]": "hidden_ports_list_add(unsigned int port_num)", "source.functions[2]": "hidden_ports_list_clear(void)", "source.functions[3]": "hidden_ports_list_del(unsigned int port_num)", "source.functions[4]": "satan_port_exit(void)", "source.functions[5]": "satan_port_hide(unsigned int port_num)", "source.functions[6]": "satan_port_hook_seq_show(void)", "source.functions[7]": "satan_port_init(void)", "source.functions[8]": "satan_port_tcp_hide(unsigned int port_num)", "source.functions[9]": "satan_port_tcp_unhide(unsigned int port_num)", "source.functions[10]": "satan_port_udp_hide(unsigned int port_num)", "source.functions[11]": "satan_port_udp_unhide(unsigned int port_num)", "source.functions[12]": "satan_port_unhide(unsigned int port_num)", "source.functions[13]": "satan_port_unhook_seq_show(void)", "source.functions[14]": "satan_seq_show(struct seq_file *seq, void *v)" }, "ct": [ "IS_ERR", "PDE_DATA", "RETURN_IF_PORT_INVALID", "filp_close", "filp_open", "hidden_ports_list_add", "hidden_ports_list_clear", "hidden_ports_list_del", "hidden_ports_list_get", "kfree", "kmalloc", "list_add_tail", "list_del", "list_entry", "list_for_each", "list_for_each_safe", "pr_alert", "pr_info", "real_seq_show", "satan_port_hook_seq_show", "satan_port_tcp_hide", "satan_port_tcp_unhide", "satan_port_udp_hide", "satan_port_udp_unhide", "satan_port_unhook_seq_show", "snprintf", "strnstr" ], "id": "c", "mc": [ "afinfo.seq_ops", "afinfo.seq_ops.show", "filp.f_path", "filp.f_path.dentry", "filp.f_path.dentry.d_inode", "p.list", "p.port_num", "p.port_num_hex_str", "seq.buf", "seq.count" ] }, "id": 0, "sz": 7005, "ts": [ { "c": 0.8600000143051147, "d": "Kill hook hide markers", "e": [ "hide" ], "i": "objectives/evasion/kernel-hide/hook::kill-hook-hide-context", "l": 1 }, { "c": 0.699999988079071, "d": "Kernel memory free (often used", "e": [ "kfree" ], "i": "objectives/evasion/kernel-hide/lkm/hiding::kfree-call", "l": 2, "el": [ "127a" ] }, { "c": 0.9700000286102295, "d": "Validation vocabulary number", "e": [ "number" ], "i": "metadata/file/text/format::vocab-number", "l": 1 }, { "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "port_hide" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-11", "l": 1 }, { "c": 0.9700000286102295, "d": "Validation vocabulary string", "e": [ "string" ], "i": "metadata/file/text/format::vocab-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "hidden_port" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-hidden-object-names--rx-4", "l": 1 }, { "a": "T1014", "c": 0.949999988079071, "d": "Kernel list deletion (module hiding)", "e": [ "list_del" ], "i": "objectives/evasion/kernel-hide/lkm/syscalls::list-del-call", "l": 2, "el": [ "125c" ] }, { "c": 0.699999988079071, "d": "Read TCP connection table", "e": [ "/proc/net/tcp" ], "i": "micro-behaviors/fs/proc/info/path::proc-net-tcp", "l": 3 }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1 }, { "c": 1.0, "d": "Derived ast condition", "e": [ "/**\n * satan_port_hide() - Hides a TCP and UDP port.\n * @path: the port number.\n *\n * Return: zero o...", "/**\n * satan_port_tcp_hide() - Hides a TCP port.\n * @path: the port number.\n *\n * Return: zero on su...", "/**\n * satan_port_udp_unhide() - Unhides a UDP port.\n * @path: the port number.\n *\n * Return: zero o...", "/**\n * satan_port_unhide() - Unhides a TCP and UDP port.\n * @path: the port number.\n *\n * Return: ze...", "/**\n * satan_port_udp_hide() - Hides a UDP port.\n * @path: the port number.\n *\n * Return: zero on su...", "/**\n * satan_port_tcp_unhide() - Unhides a TCP port.\n * @path: the port number.\n *\n * Return: zero o..." ], "i": "objectives/evasion/kernel-hide/lkm/hiding::inline__hiding-mention-comment__any_7", "l": 3, "el": [ "@1447", "@2182", "@3019", "@1809", "@2740", "@2458" ] }, { "c": 0.9700000286102295, "d": "Validation vocabulary invalid", "e": [ "invalid" ], "i": "metadata/file/text/format::vocab-invalid", "l": 1 }, { "c": 0.75, "d": "snprintf formatting function", "e": [ "snprintf" ], "i": "micro-behaviors/data/format/string::snprintf-format", "l": 2 }, { "c": 0.7799999713897705, "d": "Regex component marker", "e": [ "hide() - Hides a TCP and UDP port" ], "i": "objectives/evasion/kernel-hide/ebpf::bpf-rootkit-controller-actions--rx-7", "l": 1 }, { "c": 0.9700000286102295, "d": "Form-validation vocabulary in dense non-ASCII file", "e": [ "invalid", "number", "string" ], "i": "metadata/file/text/format::i18n-validation-vocab", "l": 1 } ], "sha": "fb4f84be69439dbcf0c7f35b5c04c8787be4bf230c155b10e3c4ab527f6ecfcb", "path": "port.c", "type": "c" } ], "tv": "8e9ac" } }