Retrieve a config value with environment variable priority. Resolution order: 1. Environment variable (e.g. ARKANA_CACHE_ENABLED, then

Thread-safe read of triage status.

* Checks if `value` is object-like. A value is object-like if it's not `null` * and has a `typeof` result of "object". * * @static * @memberOf _

Helper to invoke _triage_compiler_language with mocked state.

Check that a specific analysis data key is available in pe_data. Provides context-aware feedback about why data might be missing, includi

Validate PE headers via struct unpacks. Returns (issues, flags, format_details).

Decode an unsigned variable-length integer. Returns (value, bytes_consumed). Returns (0, 0) on truncated input.

Extract a hex address string from various capa address formats. Capa v9 (pydantic) serializes match dicts with complex Address keys as lists

Look up decompiled lines from the authoritative meta store.

Unpack a v2 archive into a new project under ~/.arkana/projects/. The new project gets a fresh ID (we never overwrite an existing project, ev

Create a mock PE object with __data__ containing raw_bytes.

Parse an address string (hex or decimal) to int.

Parse a Speakeasy argument value to int.

Parse JSON trace: [{"address": ..., "bytes": "...", "mnemonic": "..."}].

Build a JSON-serialisable summary of a project for tool responses.

Read a null-terminated string with bounds and length cap.

Read a pointer-sized value (4 or 8 bytes).

Cast a raw string value to the correct type for *spec*. Shared by ``get_setting_value`` (single key) and ``get_all_settings`` (bulk) so the c

Helper to run an async coroutine synchronously.

Safely slice a value to at most *n* items. Handles lists, tuples, dicts, strings, sets, frozensets, and other iterables. Returns the origina

Report estimated progress for opaque subprocess operations.

Update session metadata from a command result.

Validate that a file path exists and is a regular file. Defense-in-depth: the parent MCP tool layer enforces path sandboxing, but direct invo

Validate and normalize a SHA256 hash string. Prevents path traversal.

Return True if sha256 is a valid 64-char hex string.

Bind *project* to this state. Replaces any existing binding.

Generate Frida hook JS for a single API.

Thread-safe snapshot of current task IDs.

Load the overlay for a member binary. Returns empty dict on miss.

Add *member* to the project's manifest and (optionally) mark it as primary + last-active. Used by archive importers that have already

Save multiple settings at once. Returns dict of key -> error for invalid keys. Only saves keys that are in the SETTINGS_REGISTRY. Validates t

Build a binary with specific embedded content for testing.

Build the standard execution state response.

Create a mock asyncio subprocess with given outputs.

Extract blocksize= and bigendian= keyword params from step parts.

Parse CSV coverage (address,size per line). Format: one block per line, hex or decimal addresses. 0x401000,16 0x401020,8

Parse CSV trace: address,hex_bytes[,mnemonic] per line.

Parse JSON with fallback to *default* on decode errors.

Extract permission string from section data.

Convert Unix timestamp to human-readable string.

Validate and sanitise hook target list.

Validate and sanitize a .NET type name.

Synchronously kill all debug subprocesses. Called by session reaper.

Clear the decompile meta cache. If *session_uuid* is given, only entries for that session are removed. Otherwise all entries are cleared (leg

Generate combined bypass script from a list of technique names.

Thread-safe snapshot for cache persistence.

* Checks if `value` is array-like. A value is considered array-like if it's * not a function and has a `value.length` that's an integer greater than

Filter out functions that are too small to be meaningful for similarity.

Parse gopclntab from raw binary data. Args: file_data: Raw binary file contents. sections: Optional list of section dicts with ke

Parse the VB6 header, object table, and external table from a PE. Returns a structured dict with partial results on parse failures. Args:

Thread-safe variable rename within function scope.

Execute a regex search with timeout protection against ReDoS. Even with ``validate_regex_pattern()`` catching common nested-quantifier patter

Accept a partial CFG result instead of marking the task as FAILED. Stores a ``_PartialCFG`` wrapper on state so tools can use whatever functi

Build a Ghidra Python script string from analysis state.

Build a synthetic Go 1.20+ gopclntab header.

Build an IDAPython script string from analysis state.

Check if provided token matches any valid token. Accumulates results to avoid early-return timing leak that could reveal how many valid token

Remove the staged binary copy from the rootfs. Best-effort.

Detect coverage file format from content.

Detect trace file format from content.

Find a section by name from a list of section dicts.

BFS from source functions through the call graph to find paths reaching sink functions. Returns raw chain dicts with ``confidence='low'``.

Get data from a hex string or the currently loaded file.

Get or create the emulation session manager for the current state.