Decode YARA match bytes to a display string (UTF-8 > Latin-1 > hex).

Detect binary format from magic bytes. Returns (os_type, arch, format_desc).

Determine analysis phase from an explicit state object. Uses canonical tool sets from tools_session and efficient accessors.

Post a coroutine to the event loop from the current (worker) thread. Accepts a callable and args rather than a pre-created coroutine to avoid

Download a YARA rules ZIP and extract it into *target_dir*. Returns True on success, False on failure.

Return a fresh learner profile structure.

Add a ``projects: [{id, name}]`` field to every entry in ``triage_result['results']`` based on the current project membership. Called on EVER

Lazily start the monitor thread if not already running.

Escape a string for safe interpolation into JS string literals.

Evaluate breakpoint conditions. Returns True if conditions are met.

Resolve address and extract string.

Dig into ExceptionGroup / BaseExceptionGroup to find the real error.

Convert a PE file offset to a virtual address using pefile. Returns the VA as an ``int``, or ``None`` on failure.

Find lines in decompiled code that reference any of the given API names.

Resolve which PE section contains a file offset.

Return a stack of patches for a full FLOSS analysis with mocked deps.

Format calling convention info for a single angr Function object.

Map an API/callee name to a semantic category.

Retrieve decompiled lines from the cache for the given function address.

Look up Keystone arch/mode tuple, raising ValueError on unknown arch.

Get a summary of the memory map.

Get memory regions from the Speakeasy emulator. Speakeasy's memory manager API varies by version: - Some versions: emu.get_address_map() retu

Return cached mount mappings, building on first call.

Return cached (featurizer, ranker) tuple, loading from disk on first call.

Read the top N values from the stack.

Handle old-style hard CFG timeout (when soft timeout is disabled). Accepts a partial CFG if enough functions were discovered.

Initialize Capstone disassembler for the given architecture.

Insert a single function feature row (no commit).

Force the next ``get_dashboard_theme()`` call to re-read from disk.

Detect HTTPS from scheme or X-Forwarded-Proto header. Note: trusts X-Forwarded-Proto unconditionally. This is acceptable because the dashboa

Yield (list_of_dicts, type_label) for each string source in pe_data.

Load and cache the malware signatures YAML knowledge base.

Load learner profile from disk, creating a fresh one if absent/corrupt.

Load learner profile from disk without acquiring the lock. Caller MUST hold ``_profile_lock``.

Build a mock CFG from a spec dict: {addr: (name, [callee_addrs], is_plt)}.

H1: Factory function to create a SimProcedure with correct closure binding.

Create a temporary breakpoint callback that fires once.

Merge multiple IOC dicts into one with deduplicated sorted lists.

Normalize cipher name for fuzzy matching.

Build API call summary from Cuckoo/CAPE behavior.

Parse dropped files from Cuckoo/CAPE.

Fast static-only FLOSS extraction — no Vivisect workspace needed. Returns the same structure as ``_parse_floss_analysis`` but with only stati

Extract MITRE techniques from Cuckoo/CAPE signatures.

Parse network data from Cuckoo/CAPE format.

Parse process tree from Cuckoo/CAPE behavior section.

Parse signatures from Cuckoo/CAPE.

Check if the first object descriptor at `start` looks valid.

Fallback: probe common PE memory ranges when get_address_map is unavailable. Tries to read at standard base addresses and reports which are reada

Process match details for a single capa rule. Returns result dict (sync).

Return the full project card including a per-member breakdown. Uses ``Project.snapshot_members_with_presence`` for the lock-once snapshot, th

Read a length-prefixed, PRNG-encrypted string. Returns (decoded_string, new_position).

Read a length-prefixed null-terminated string: uint32_le length | chars | null.

Read the return value register (RAX for 64-bit, EAX for 32-bit).

Remove both the on-disk entry and its metadata index record.

Resolve the internal export directory from environment with fallback chain. Checks ARKANA_EXPORT_DIR / PEMCP_EXPORT_DIR first, then /output, then

Helper to run async coroutines in tests.

Invoke the speakeasy runner subprocess in the isolated venv.

Persist learner profile to disk without acquiring the lock. Caller MUST hold ``_profile_lock``.

Fallback: parse output of the binwalk CLI tool.

Set up ENTER+EXIT hooks for full syscall/API timeline with return values. Captures both arguments (on entry) and return values (on exit) for a

Start a hard timeout that kills this process after *seconds*.

Synchronous CFF detection worker.

Synchronous opaque predicate detection worker.

Scan executable PE sections for anti-debug/anti-analysis instruction patterns. Searches for known byte sequences (RDTSC, CPUID, INT 2Dh, SIDT) in

Detect the source language / compiler toolchain from sections and strings.

Extract IPs, URLs, domains, and registry paths from strings.

Scan raw binary data for VM/sandbox/analysis-tool indicator strings. Uses the same comprehensive indicator list as ``find_anti_debug_comprehensiv

Try to salvage a partial CFG after an exception during CFG build/post-processing. If enough functions were discovered in project.kb before the cr

Load, modify, and save the learner profile atomically.

Validate that a file path exists and is a regular file. Defense-in-depth: the parent MCP tool layer enforces path sandboxing, but direct invo

Validate that a file path exists and is a regular file.

Append rows at the bottom of the table (scroll down).

* Creates an array of the enumerable property names of the array-like `value`. * * @private * @param {*} value The value to query. * @param {boole