{ "ml": { "v": "7", "eng": "2.12.0-beta.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.04334271, "rte": "az", "prob": 0.04334271 }, { "cls": 0, "raw": 0.0038232405, "rte": "az/native", "prob": 0.0038232405 }, { "cls": 0, "raw": 0.0074530444, "rte": "az/elf", "prob": 0.0074530444 } ], "prob": 0.04334271, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0433427095413208, "type": "elf" } ], "version": "v18.18", "analyzed_at": "2026-10-01T00:57:18Z" }, "path": "bmp.so", "raw": { "v": "8", "rev": "c1ea9", "files": [ { "id": 0, "ctx": [ { "b": "E))420S-r400000000000%2!g0rr910000000000kMy=:00000?#-#W0000000000kMA+z2()i\u003c8VQ=R0rr911POJ5000000000000000000000000000000U-5LZ00000U-5L", "ln": 0 }, { "b": ".VtLy000000SSi2p5\u003em]0rr911][S601:UX0fvfXp5\u003em]pxgv{e+w(?[ay*F000000000000000000000000000000000000@@Vd02LXo000000000000000000000@%8pkMQ#!000000000000000]z!\u003c\u003e5=.[i000000000000000000005^egm5=.[", "ln": 632 }, { "b": "XDz)j5=-suFo?g}00000fAzdN00000@SAi35=-suUZluI00000h#\u0026{U000000af8CzeTr0B97\u0026hByewPuRai\u003euU0.*wOkZ#By/F(o*--nzE(^QvR/PQuRai\u003euVGZ\u003cx(!xcA-t+2y\u0026si5raflLwDl7Av%zA?w[=c\u003ey?Xib08drvvqGHIlVl*Xvrb]VuTE\u003c", "ln": 2552 }, { "b": "y!XFTz/Qa6lVl{?o\u003c}WGv@21+A+PA7090SLz*a]:xk7\u003c\u003emr\u0026rNAcb/jzua3JB97\u00262yHpN+yHpWZx(0=vB47m-zGFM\u003cxj\u003e{@x8\u003e.DwO%?Jz^\u0026Yuz!0i(wKyxMAa9=#07QQxnO})GwLWn!x(v\u003e?oMaMrvp%p:yEJzTzGC\u003eGwPQHXvp%dBx(!w\u0026wO#d5xAh1LvqZc#z/L", "ln": 2877 }, { "b": "f/yU9z.r:#0bMvUv\u003eI?ve\u0026AYCwg.RizGQgQvpsg^xF}X1B8JV=0aG!:e]$}hm[=GvlTIP3f/G7j0000000962009620096200962009620096200963009620096200962009620096200963009620096200ic30096200ri40096200962009620096", "ln": 3935 }, { "b": "[bJET5O:Pb5jcFYaoAUo[bJET5Pf(f5mL:7aoAUo[bJET5PQej5p$1DaoAUo[bJET5Q3Cn5txn?aoAUo[bJET5QD.r5w!KiaoAUo[bJET5Q)1v5Ai!OaoAUo[bJET5Rrpz5cq#%aoAUo[bJET5R-ND5f.mtaoAUo[bJET5Se\u003cH5jcIZaoAUo[bJET5SPcL5mL^8aoAUo[bJET5T2AP", "ln": 6624 }, { "b": "00000o\u003ewfWA^o@!y\u0026r/(BzkVhmQZ1EwN\u003e=ve?O!fe?ZZMwmY!5fjF^qe[j\u003eY00000nO@A!z/xodnO})GwK{xvwmY=Y00000c389[A@Vgux(do\u003ewNxd?w]w!njS(d.z/fSr", "ln": 31796 }, { "b": "00000nP5YWy?WAEz!%ujzddxPzE^s600000e?O!fe?Y}cxk7\u003c\u003elVm0RfjO{pz/PY6A4M3Hx)9{bwIdS@00000cNA*YiV].\u00260000000000rC(w)AaJK3wN[kEwku/bx(4tX00000", "ln": 33612 }, { "b": "000000000000000000000000000000000000000000000000000000000000PDa1j00000oDs9k000000rr9100000ciTwH000000rr9100000kM}b/000000rr9100000n^bg{000004GDFe00000u\u003ccJg000003\u0026*nc0000002LXo000004fcwd00000\u003eZ9pf0000082%Tp00000", "ln": 64888 }, { "b": "vR]K^x\u003e7{*z/Pzvh.G88hz3Tqe[wK5B.pW*\u003eE]rc}++8Ju(G@Y1Mr.!!eRY[i5\u0026Z9h-JPFvkQ28h8^iDwmmwPhd!*UvpRhKhE{qNfFLKCwhL#IwNY^{00000h0s?\u003e04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaK6iC(PEmz//LyxkR\u0026AvS=y3wg.Ia04}]4BUmuoB7+Lawo\u00266lD2iKlwo\u00266lBAdvlxkR\u0026AC4CYnx(v\u003e?", "ln": 66160 } ], "mol": "Md₃(BiBkHe₂)", "sha": "fd6d9ac6b7c474c7caf6a577f28be80a3e9529397814e4b4256caa4a997022d8", "path": "bmp.so", "risk": 4, "size": 68256, "supp": [ { "by": [ { "id": "metadata/binary/linking/runtime::elf-dynamic-linking-metadata" } ], "id": "metadata/binary/linking/static::static-linked-heuristic", "crit": "notable", "kind": "unless" }, { "by": [ { "id": "section", "spans": [ [ 7360, 31 ] ] } ], "id": "objectives/anti-static/pack/polymorphic::unusual-entry-point-section", "crit": "notable", "kind": "unless" } ], "type": "elf", "facts": { "exp": [ [ "RegisterBMPImage" ], [ "UnregisterBMPImage" ] ], "imp": [ [ "", "DestroyImageInfo" ], [ "", "SyncImage" ], [ "", "GetStringInfoLength" ], [ "", "ReadBlobLSBSignedLong" ], [ "", "IsStringTrue" ], [ "", "UnregisterMagickInfo" ], [ "", "SyncAuthenticPixels" ], [ "", "ReadBlobByte" ], [ "", "EOFBlob" ], [ "", "FormatLocaleString" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "WriteBlobLSBSignedLong" ], [ "", "BlobToImage" ], [ "", "cxa_finalize" ], [ "", "DestroyStringInfo" ], [ "", "IsEventLogging" ], [ "", "DestroyString" ], [ "", "LocaleCompare" ], [ "", "SetImageProgress" ], [ "", "GetStringInfoDatum" ], [ "", "AcquireMagickInfo" ], [ "", "SeekBlob" ], [ "", "WriteBlobLSBLong" ], [ "", "QueueAuthenticPixels" ], [ "", "GetExceptionMessage" ], [ "", "memset" ], [ "", "ReadBlobLSBShort" ], [ "", "GetImageProfile" ], [ "", "LogMagickEvent" ], [ "", "AcquireQuantumMemory" ], [ "", "stack_chk_fail" ], [ "", "GetNextImageInList" ], [ "", "gmon_start__" ], [ "", "SetImageStorageClass" ], [ "", "stack_chk_guard" ], [ "", "GetVirtualPixels" ], [ "", "RegisterMagickInfo" ], [ "", "AcquireVirtualMemory" ], [ "", "WriteBlobLSBShort" ], [ "", "GetBlobSize" ], [ "", "TransformImageColorspace" ], [ "", "SyncNextImageInList" ], [ "", "ReadBlobLSBLong" ], [ "", "ReadBlobStream" ], [ "", "TellBlob" ], [ "", "AcquireImage" ], [ "", "RelinquishVirtualMemory" ], [ "", "CopyMagickString" ], [ "", "DuplicateBlob" ], [ "", "WriteBlob" ], [ "", "LocaleNCompare" ], [ "", "AcquireProfileStringInfo" ], [ "", "ThrowMagickException" ], [ "", "SetImageExtent" ], [ "", "ReadBlob" ], [ "", "OpenBlob" ], [ "", "GetFirstImageInList" ], [ "", "FlipImage" ], [ "", "SetImageProfilePrivate" ], [ "", "ReplaceImageInList" ], [ "", "ConstantString" ], [ "", "CloseBlob" ], [ "", "SetStringInfoLength" ], [ "", "GetVirtualMemoryBlob" ], [ "", "ITM_registerTMCloneTable" ], [ "", "DestroyImageList" ], [ "", "RelinquishMagickMemory" ], [ "", "assert_fail" ], [ "", "errno_location" ], [ "", "AcquireNextImage" ], [ "", "AcquireImageInfo" ], [ "", "WriteBlobLSBSignedShort" ], [ "", "AcquireImageColormap" ], [ "", "GetImageListLength" ], [ "", "GetImageOption" ] ], "sec": [ [ ".note.gnu.property", 568, 32, 1.69, "alloc" ], [ ".note.gnu.build-id", 600, 36, 4.25, "alloc" ], [ ".gnu.hash", 640, 40, 2.67, "alloc" ], [ ".dynsym", 680, 1920, 1.1, "alloc" ], [ ".dynstr", 2600, 1394, 4.95, "alloc" ], [ ".gnu.version", 3994, 160, 1.21, "alloc" ], [ ".gnu.version_r", 4160, 64, 2.34, "alloc" ], [ ".rela.dyn", 4224, 192, 1.88, "alloc" ], [ ".rela.plt", 4416, 1728, 1.71, "alloc,info_link" ], [ ".init", 6144, 28, 3.99, "alloc,executable" ], [ ".plt", 6176, 1184, 4.44, "alloc,executable" ], [ ".text", 7360, 24360, 6.57, "alloc,executable" ], [ ".fini", 31720, 24, 3.72, "alloc,executable" ], [ ".rodata", 31744, 2430, 4.95, "alloc" ], [ ".eh_frame_hdr", 34176, 92, 3.54, "alloc" ], [ ".eh_frame", 34272, 1744, 5.44, "alloc" ], [ ".init_array", 64936, 8, 1.06, "write,alloc" ], [ ".fini_array", 64944, 8, 1.06, "write,alloc" ], [ ".dynamic", 64952, 512, 1.54, "write,alloc" ], [ ".got", 65464, 48, 0.44, "write,alloc" ], [ ".got.plt", 65512, 600, 1.04, "write,alloc" ], [ ".data", 66112, 8, 1.3, "write,alloc" ], [ ".gnu_debugaltlink", 66120, 87, 5.31, "" ], [ ".gnu_debuglink", 66208, 52, 4.14, "" ], [ ".shstrtab", 66260, 264, 4.26, "" ] ], "tgt": [ "entry0", "fcn.00001ce0", "fcn.00001dc0", "fcn.00001e88", "sym.imp.AcquireImage", "sym.imp.AcquireImageColormap", "sym.imp.AcquireImageInfo", "sym.imp.AcquireMagickInfo", "sym.imp.AcquireNextImage", "sym.imp.AcquireProfileStringInfo", "sym.imp.AcquireQuantumMemory", "sym.imp.AcquireVirtualMemory", "sym.imp.BlobToImage", "sym.imp.CloseBlob", "sym.imp.ConstantString", "sym.imp.CopyMagickString", "sym.imp.DestroyImageInfo", "sym.imp.DestroyImageList", "sym.imp.DestroyString", "sym.imp.DestroyStringInfo", "sym.imp.DuplicateBlob", "sym.imp.EOFBlob", "sym.imp.FlipImage", "sym.imp.FormatLocaleString", "sym.imp.GetBlobSize", "sym.imp.GetExceptionMessage", "sym.imp.GetFirstImageInList", "sym.imp.GetImageListLength", "sym.imp.GetImageOption", "sym.imp.GetImageProfile", "sym.imp.GetNextImageInList", "sym.imp.GetStringInfoDatum", "sym.imp.GetStringInfoLength", "sym.imp.GetVirtualMemoryBlob", "sym.imp.GetVirtualPixels", "sym.imp.IsEventLogging", "sym.imp.IsStringTrue", "sym.imp.LocaleCompare", "sym.imp.LocaleNCompare", "sym.imp.LogMagickEvent", "sym.imp.OpenBlob", "sym.imp.QueueAuthenticPixels", "sym.imp.ReadBlob", "sym.imp.ReadBlobByte", "sym.imp.ReadBlobLSBLong", "sym.imp.ReadBlobLSBShort", "sym.imp.ReadBlobLSBSignedLong", "sym.imp.ReadBlobStream", "sym.imp.RegisterMagickInfo", "sym.imp.RelinquishMagickMemory", "sym.imp.RelinquishVirtualMemory", "sym.imp.ReplaceImageInList", "sym.imp.SeekBlob", "sym.imp.SetImageExtent", "sym.imp.SetImageProfilePrivate", "sym.imp.SetImageProgress", "sym.imp.SetImageStorageClass", "sym.imp.SetStringInfoLength", "sym.imp.SyncAuthenticPixels", "sym.imp.SyncImage", "sym.imp.SyncNextImageInList", "sym.imp.TellBlob", "sym.imp.ThrowMagickException", "sym.imp.TransformImageColorspace", "sym.imp.UnregisterMagickInfo", "sym.imp.WriteBlob", "sym.imp.WriteBlobLSBLong", "sym.imp.WriteBlobLSBShort", "sym.imp.WriteBlobLSBSignedLong", "sym.imp.WriteBlobLSBSignedShort", "sym.imp.__assert_fail", "sym.imp.__cxa_finalize", "sym.imp.__errno_location", "sym.imp.__stack_chk_fail", "sym.imp.memset" ], "funcs": [ [ "fcn.00001804", 6148 ], [ "fcn.00001824", 6180 ], [ "sym.imp.DestroyImageInfo", 6208 ], [ "sym.imp.SyncImage", 6224 ], [ "sym.imp.GetStringInfoLength", 6240 ], [ "sym.imp.ReadBlobLSBSignedLong", 6256 ], [ "sym.imp.IsStringTrue", 6272 ], [ "sym.imp.UnregisterMagickInfo", 6288 ], [ "sym.imp.SyncAuthenticPixels", 6304 ], [ "sym.imp.ReadBlobByte", 6320 ], [ "sym.imp.EOFBlob", 6336 ], [ "sym.imp.FormatLocaleString", 6352 ], [ "sym.imp.WriteBlobLSBSignedLong", 6368 ], [ "sym.imp.BlobToImage", 6384 ], [ "sym.imp.__cxa_finalize", 6400 ], [ "sym.imp.DestroyStringInfo", 6416 ], [ "sym.imp.IsEventLogging", 6432 ], [ "sym.imp.DestroyString", 6448 ], [ "sym.imp.LocaleCompare", 6464 ], [ "sym.imp.SetImageProgress", 6480 ], [ "sym.imp.GetStringInfoDatum", 6496 ], [ "sym.imp.AcquireMagickInfo", 6512 ], [ "sym.imp.SeekBlob", 6528 ], [ "sym.imp.WriteBlobLSBLong", 6544 ], [ "sym.imp.QueueAuthenticPixels", 6560 ], [ "sym.imp.GetExceptionMessage", 6576 ], [ "sym.imp.memset", 6592 ], [ "sym.imp.ReadBlobLSBShort", 6608 ], [ "sym.imp.GetImageProfile", 6624 ], [ "sym.imp.LogMagickEvent", 6640 ], [ "sym.imp.AcquireQuantumMemory", 6656 ], [ "sym.imp.__stack_chk_fail", 6672 ], [ "sym.imp.GetNextImageInList", 6688 ], [ "sym.imp.SetImageStorageClass", 6720 ], [ "sym.imp.GetVirtualPixels", 6736 ], [ "sym.imp.RegisterMagickInfo", 6752 ], [ "sym.imp.AcquireVirtualMemory", 6768 ], [ "sym.imp.WriteBlobLSBShort", 6784 ], [ "sym.imp.GetBlobSize", 6800 ], [ "sym.imp.TransformImageColorspace", 6816 ], [ "sym.imp.SyncNextImageInList", 6832 ], [ "sym.imp.ReadBlobLSBLong", 6848 ], [ "sym.imp.ReadBlobStream", 6864 ], [ "sym.imp.TellBlob", 6880 ], [ "sym.imp.AcquireImage", 6896 ], [ "sym.imp.RelinquishVirtualMemory", 6912 ], [ "sym.imp.CopyMagickString", 6928 ], [ "sym.imp.DuplicateBlob", 6944 ], [ "sym.imp.WriteBlob", 6960 ], [ "sym.imp.LocaleNCompare", 6976 ], [ "sym.imp.AcquireProfileStringInfo", 6992 ], [ "sym.imp.ThrowMagickException", 7008 ], [ "sym.imp.SetImageExtent", 7024 ], [ "sym.imp.ReadBlob", 7040 ], [ "sym.imp.OpenBlob", 7056 ], [ "sym.imp.GetFirstImageInList", 7072 ], [ "sym.imp.FlipImage", 7088 ], [ "sym.imp.SetImageProfilePrivate", 7104 ], [ "sym.imp.ReplaceImageInList", 7120 ], [ "sym.imp.ConstantString", 7136 ], [ "sym.imp.CloseBlob", 7152 ], [ "sym.imp.SetStringInfoLength", 7168 ], [ "sym.imp.GetVirtualMemoryBlob", 7184 ], [ "sym.imp.DestroyImageList", 7200 ], [ "sym.imp.RelinquishMagickMemory", 7216 ], [ "sym.imp.__assert_fail", 7232 ], [ "sym.imp.__errno_location", 7248 ], [ "sym.imp.AcquireNextImage", 7264 ], [ "sym.imp.AcquireImageInfo", 7280 ], [ "sym.imp.WriteBlobLSBSignedShort", 7296 ], [ "sym.imp.AcquireImageColormap", 7312 ], [ "sym.imp.GetImageListLength", 7328 ], [ "sym.imp.GetImageOption", 7344 ], [ "entry0", 7360 ], [ "fcn.00001ce0", 7392 ], [ "entry.fini0", 7500 ], [ "entry.init0", 7588 ], [ "fcn.00001dc0", 7616 ], [ "fcn.00001e88", 7816 ], [ "fcn.00002084", 8324 ], [ "fcn.00004264", 16996 ], [ "fcn.00004278", 17016 ], [ "sym.RegisterBMPImage", 31360 ], [ "sym.UnregisterBMPImage", 31664 ], [ "fcn.00007bec", 31724 ] ], "metrics": { "elf": { "bits": 64, "entry": 0, "has_got": 1, "has_plt": 1, "has_note": 1, "relacount": 3, "note_count": 2, "nx_enabled": 1, "dynrel_count": 0, "dynsym_count": 80, "has_build_id": 1, "has_eh_frame": 1, "has_gnu_hash": 1, "no_gnu_stack": 0, "stack_canary": 1, "symtab_count": 0, "dynrela_count": 8, "has_debuglink": 1, "little_endian": 1, "pltreloc_count": 72, "build_id_length": 20, "dt_versym_count": 80, "has_aarch64_bti": 1, "has_aarch64_pac": 1, "executable_stack": 0, "fini_array_count": 1, "init_array_count": 1, "wx_segment_count": 0, "program_header_count": 9, "stripped_with_symtab": 0, "has_direct_loader_dep": 1, "executable_segment_count": 1, "load_segment_max_file_size": 36016, "load_segment_max_memory_size": 36016, "section_relocation_group_count": 2, "stripped_metadata_section_count": 8 }, "file": { "size": 68256, "entropy": 4.02 }, "binary": { "is_pie": 0, "has_overlay": 1, "is_stripped": 1, "basic_blocks": 1124, "code_entropy": 6.47, "data_entropy": 1.23, "overlay_size": 1732, "string_count": 187, "overlay_ratio": 0.03, "avg_complexity": 8.24, "max_complexity": 365, "huge_func_count": 2, "leaf_func_count": 76, "overlay_entropy": 1.45, "tiny_func_count": 77, "avg_basic_blocks": 13.22, "entropy_variance": 3, "avg_string_length": 17.87, "max_string_length": 66, "peak_region_bytes": 15360, "code_to_data_ratio": 0.96, "peak_region_entropy": 6.58, "string_length_stddev": 9.01, "largest_section_ratio": 0.36, "sentence_string_count": 24, "sentence_string_ratio": 0.13, "high_entropy_string_count": 0 }, "exports": { "count": 2, "api_count": 2 }, "imports": { "count": 75 }, "strings": { "truncated": 0, "retained_count": 187, "extracted_count": 187 }, "sections": { "count": 27, "code_size": 25596, "entropy_max": 6.57, "entropy_mean": 2.98, "name_entropy": 4.22, "writable_count": 7, "executable_count": 4, "nonstandard_count": 7, "executable_writable_count": 0 }, "functions": { "count": 85 }, "dependencies": { "count": 3 } } }, "traits": [ { "id": "metadata/binary/linking/runtime::dynamic-loader-needed", "conf": 0.7, "crit": 3, "desc": "ELF needs the Linux dynamic loader" }, { "id": "metadata/binary/linking/runtime::library-loader-dep", "conf": 1.0, "crit": 3, "desc": "ELF directly depends on the dynamic loader" }, { "id": "metadata/hardening/mitigation::partial-relro", "conf": 0.8, "crit": 3, "desc": "Partial RELRO (GOT partially protected)" }, { "id": "metadata/build/artifact::stripped-toolchain-comment", "conf": 1.0, "crit": 3, "desc": "ELF omits compiler metadata (.comment)" }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.8, "crit": 3, "desc": "No full symbol table (likely stripped)" } ] } ] } }