Attempt to parse *value* as an integer (including hex) or float.

Add a binary to *project* by copying it into binaries/. Hashing happens here unless ``declared_sha256`` is supplied (in which case th

Compute similarity between two feature vectors. Parameters ---------- features_a, features_b : dict Feature vectors from extract_

Create a new (empty) project. Used by the dashboard "New project" button.

Thread-safe deep read of renames, optionally filtered by type.

[Phase: explore] Maps every section's permission flags (Read/Write/Execute) with anomaly detection. Flags sections with dangerous W+X (writab

Atomically set all angr analysis results.

Convert a space-separated hex pattern with ?? wildcards to a bytes regex. Example: "4D 5A ?? ?? 50 45" → re pattern matching MZ..PE

Create a mock section with the fields detect_packing reads.

Convert a VA to file offset using PE section table. Args: va: Virtual address to convert. image_base: PE ImageBase. secti

Replace auto-generated function names (sub_HEXADDR) with user-assigned names.

[Phase: dynamic] Create a custom API stub at runtime. When the binary calls the specified Windows API, the stub intercepts it: sets the retur

Persist current overlay to the active project (if any). Returns True on flush. Snapshot and dirty-flag update happen under ``_project_lock``,

Generate a Frida script that logs API calls as structured JSON lines. Args: apis: List of API names to hook. include_args: Includ

[Phase: explore] Returns extended PE metadata not covered by basic header tools: machine type, subsystem, OS version, linker version, ASLR/DE

Return the effective value for a registered setting. Resolution: env var > config.json > registry default. Returns the value cast to the corr

* Checks if `value` is the * [language type](http://www.ecma-international.org/ecma-262/7.0/#sec-ecmascript-language-types) * of `Object`. (e.g. arr

Collect alerts for running and overtime background tasks.

Extract the compact shorthand from a ``---compact:`` line in the docstring. Every tool docstring should contain a line like:: ---compact

Generate JS to read a single Frida hook argument.

Jaccard index for two sets.

Create a mock PE object with sections and OPTIONAL_HEADER.

Create a mock PE section with the given data and characteristics.

Read a null-terminated string from data at offset, bounded by max_len. Returns empty string on any error.

Run detect_packing with a mocked project, return the result dict.

Return extended format info from the first 4 bytes. First checks binary formats via detect_format_from_magic(), then tries extended signature

Quick count of unique warnings.

Remove cancel event and thread ref for a completed/failed task.

Build a structured CTI report as a JSON-friendly dict.

Construct a minimal valid PE file via struct.pack_into.

Build a minimal VB6 PE file with struct.pack. Returns (data_bytes, image_base, sections_list).

Check file-level properties: size, null ratio, entropy. Returns (issues, flags, entropy, null_ratio).

Return an empty unified report structure.

Encode a Go name as [flags] [len_hi] [len_lo] [name_bytes].

Build and cache a flat list of strings from FLOSS + basic_ascii data. Two cache variants via ``state.result_cache``: - ``("_flat_strings", "f

Search known sample directories for a file matching *sha256*. Returns the absolute path of the first match, or "" if nothing is found. Used b

Extract (major, minor) from a Go version string. Handles formats like 'go1.21.5', '1.17', 'go1.18rc1', 'go1.20beta1'. Returns None if the ver

RC4 decryption (KSA + PRGA).

Apply variable renames to decompiled code lines. Uses a single combined regex so all old names are matched in one pass, preventing cascading

Auto-detect sandbox format from report JSON structure.

Extract a feature vector from a single angr Function object. Parameters ---------- project : angr.Project cfg : angr.analyses.CFGFast

Initialise the schema (idempotent). Uses CREATE TABLE/INDEX IF NOT EXISTS, so safe to call on existing DBs.

Find ordered API call sequences in trace entries. Scans the trace for occurrences where each step's substring appears in the API name of succ

Register a cancel event (and optional thread) for *task_id*. Must be called **before** ``set_task(task_id, ...)`` so that ``cancel_al

Search instruction dicts for *pattern* and return matching regions. Searches each instruction's ``mnemonic + " " + op_str``, plus ``call_targ

Thread-safe triage status update. Returns the entry.

Extract (api_name, dll_name) tuples from pe_data imports. Handles the canonical format: [{"dll_name": "kernel32.dll", "symbols": [{"name"

Determine what phase of analysis the session is in. Uses a short TTL cache (2s) keyed on tool_history length to avoid recomputing on every ca

Helper to run the IP extraction logic from _triage_network_iocs.

Get current program counter value.

Convert an integer to hex string, handling None.

Build a session-scoped decompile cache key.

State with MockPE (shellcode/ELF) — has __data__ but no OPTIONAL_HEADER.

Read a Go name from data at the given offset. Go names are encoded as: [flags_byte] [len_hi] [len_lo] [name_bytes...] The first byte contains

Run GoReSym binary and parse JSON output. GoReSym flags: -t (types), -d (type definitions), -p (file paths). Returns parsed result dict with

Return True if this record comes from a library we track.

Validate and normalise an address string.

Call a tool and assert that it returns an error. If the tool is unknown on this server build, the test is skipped.

Thread-safe struct creation. Returns the struct definition.

[Phase: explore] Extracts UTF-16LE (wide) strings from the binary. Essential for Windows GUI applications and .NET binaries where strings are

Force-release and invalidate all current holders. Called on file switch so new threads can acquire the lock immediately, without wait

Generate a Frida script that bypasses common VM detection techniques.

Generate a Frida script that monitors for process injection patterns.

Generate a Frida Stalker script that collects basic-block coverage. Args: target_module: Module name to restrict coverage to (e.g. 'sampl

Retrieves a high-level summary of the pre-loaded and analyzed PE file. ---compact: high-level file summary | hashes, sections, imports, FLOS