Skip test if Binary Refinery is not installed.

Thread-safe warning capture with deduplication. Returns the new entry dict, or None if deduplicated (count incremented). Uses a deque

Return the ``AnalyzerState`` for the current context.

Check CSRF token from X-CSRF-Token header or form field. Recomputes the expected HMAC-based token from the request's auth cookie (or the dash

Add an entry to the API trace from any hook or stub.

Convert a hex string (with optional spaces/0x/\\x prefixes) to bytes.

Helper to run async functions in tests.

Clear cache for a specific tool, or all tools if *tool_name* is ``None``.

Read the first 4 bytes of *file_path* and return a human-readable format hint. This is the canonical implementation used by ``list_samples`` and

Parse a query string into a list of predicates. Args: query: Comma-separated predicates (e.g. ``"api=VirtualAlloc,seq>10"``). Return

Raise a descriptive RuntimeError if pe_object is unavailable. Call *after* ``_check_pe_loaded()``. Many PE-specific tools access ``state.pe_

Set up state and invoke detect_vm_protection.__wrapped__.

Check if enrichment has been cancelled or superseded by a newer run.

Raise RuntimeError if a required library is not installed.

Test whether a single trace entry matches a predicate. Args: entry: A trace entry dict (seq, api, args, retval, ...). pred: A par

Open a WAL-mode connection to the signatures DB.

Parse an integer parameter that may be given as hex string. Accepts plain ``int``, ``"0x1b22d8"``, ``"1778392"``, ``"0b1010"``, or ``"0o777"`

Raise a clear error if binary-refinery is not installed.

Read the Nth parameter (0-indexed) for the current architecture. For x86 STDCALL: params are on the stack at ESP+4, ESP+8, etc. For x86-64 fa

Set the API return value register for the current architecture.

Search *lines* for *pattern* and return matching regions with context. Args: lines: List of text lines (e.g. decompiled pseudocode).

Set up state with pe_data loaded but configurable pe_object.

Read a pointer-sized value (4 or 8 bytes).

Build a Go ABI annotation dict for a call instruction. Args: target_name: The resolved function name at the call target. abi_type

Store a ``pe_data`` dict in the cache. Returns True on success. v2 cache format: user-mutable state (notes, artifacts, renames,

Validate a regex pattern for safety before compilation. Raises ValueError if the pattern is too long, contains constructs that are known to c

Get the file path to analyze, defaulting to the loaded file.

Set up state with a full mock pefile.PE object for happy-path testing.

Parse and validate a JSON POST body. Returns (body_dict, None) on success, or (None, error_response) on failure.

Register a background task and its cancel event atomically. Creates a cancel event, registers it in ``_task_cancel_events``, then calls ``sta

Helper to run async coroutines in tests.

Call *func* and return its result. On any exception, return an error dict so that partial analysis results are still available.

Detect VM-based code obfuscation (VMProtect, Themida, Code Virtualizer). Phase: 3 — Map Identifies virtual machine-based code protection by

Return the path to the signatures database.

Update enrichment task progress.

Thread-safe snapshot of all artifacts for cache persistence.

Helper to run async functions in tests.

Mimic pefile.get_data for signature extraction attempts.

Parse a sequence pattern string into API name patterns. Args: sequence: Semicolon-separated API name substrings (e.g. ``"Virt

Compute the Shannon entropy of a byte sequence. Returns a value between 0.0 (uniform) and 8.0 (maximum randomness). Returns 0.0 for empty inp

Convert bytes to a hex string, truncating if needed.

Assert func has output_path: Optional[str] = None parameter.

Get the raw bytes of the currently loaded file.

Check if any issue has the given code.

Build a hashable cache key from keyword arguments. Excludes ``offset``, ``limit``, ``compact``, and ``ctx`` so that different pages of the sa

Parse binary data according to schema. Returns (fields_dict, bytes_consumed).

Resolve a function address, trying RVA-to-VA correction if needed. Returns (function_object, address_used). Uses a local snapshot of the CFG

Scan decompiled pseudocode lines for MBA patterns.

Create a manager with a mocked session on the state.

Cancel all running/overtime background tasks and mark them FAILED. Called during force file switch to ensure no stale tasks persist.

Determine whether a Go binary uses register or stack ABI. Args: go_version_hint: Go version string (e.g. 'go1.21.5'). arch: Archi

Thread-safe read of the active project.

Return the current dashboard theme name, cached for 2s.

Check if a function name follows Go naming conventions. Returns True for names like ``main.main``, ``crypto/tls.(*Conn).Read``, ``runtime.mal

Two-phase query: SQL pre-filter then full similarity + confidence scoring. Phase 1: SQL filters candidates by block_count and instruction_count

Thread-safe partial update. Returns updated note or None. For hypothesis notes, also accepts: confidence, hypothesis_status, evidence

Categorizes a string based on a set of regular expressions for common indicator of compromise (IOC) patterns. Args: string_value

State with pe_data but pe_object=None (simulates cache restore).

Read ~/.arkana/config.json and return its contents as a dict.

Thread-safe function rename. Returns the rename entry.

Return a done-callback that logs unhandled exceptions from background tasks.

Create a mock angr loader + project with controllable sections/imports.

Run pre-parse integrity checks on raw binary data. Args: data: Raw file bytes. detected_format: One of "pe", "elf", "macho", "she

Decrypt a buffer by XOR with PRNG keystream.

Build a structured CTI report in markdown format.

Get data from hex, or a slice of the loaded file, or the full loaded file. Priority: data_hex > file_offset+length from loaded file > full loaded

Promote ``self.active_project`` if it is currently a ScratchProject. Called from mutation methods (add_note, register_artifact, rename_*,

Parse a gopclntab header at *base* in *data*. Returns ``None`` on invalid/truncated data.

Safely slice a value to at most *n* items.