Build executive summary from conclusion/hypothesis notes or triage.

Return the list of family entries from the knowledge base.

Normalized distance similarity for scalar feature dicts. Returns a value in [0, 1] where 1.0 means identical. Uses normalized absolute differ

Extract null-terminated strings sequentially from data.

Parse JSON coverage (Lighthouse/Frida format). Expected formats: {"coverage": [{"address": 0x..., "size": N}, ...]} {"modules": [

Parse Intel PIN-format trace: r:<regs> / i:<addr>:<size>:<hex> pairs.

Parse a single runtime._type at the given file offset. Returns a dict with: name, kind, kind_name, size, tflag, has_uncommon, and the raw fie

Fallback Rust detection by scanning binary for Rust-specific strings. Works on stripped binaries where rustbininfo cannot find metadata. Retu

Convert any value to a JSON-safe int, or None.

Serialize *obj* to JSON, returning *fallback* on encoding errors.

Persist the index file. Caller must hold ``_lock``.

Return an error JSONResponse if address is invalid, else None.

Validate and normalize the unified report in-place.

Write bytes to disk and register as a session artifact. Validates the path against allowed paths, computes hashes, detects file type, and reg

[Phase: explore] Computes sliding-window Shannon entropy across the binary to locate encrypted, compressed, or packed regions. ---compac

* The base implementation of `_.iteratee`. * * @private * @param {*} [value=_.identity] The value to convert to an iteratee. * @returns {Function}

Summarise anti-VM bypass triggers collected during emulation. Args: triggers: List of trigger dicts populated by the bypass hooks. R

Compute an API hash with optional seed and case handling. Args: name: API function name to hash. algorithm: Hash algorithm name (

Thread-safe enum creation. Returns the enum definition.

Spawn a new debug subprocess and initialise Qiling.

Filter trace entries against all predicates (AND logic). Args: entries: List of trace entry dicts. predicates: Parsed predicate l

Return a flat list of all API names from the database. Args: include_extended: If True, also include the ~10K OALabs export list.

[Phase: explore] Computes import-based similarity hashes (imphash) and categorizes imports by function: networking, crypto, process manipulat

Check if a function is a CGO bridge (uses platform ABI, not Go ABI).

Heuristic detection of Go binaries from function name sample. Scans up to ``_DETECTION_SAMPLE_SIZE`` function names and returns True if at le

Analyse a single function for CFF obfuscation patterns. Returns a finding dict if CFF-like patterns are detected, else None.

Build a tar.gz with the given (name, data, member_type) entries.

Build a sorted list of (start, end, addr_hex, name) from angr KB + renames. Results are cached per-state for ``_FUNC_LOOKUP_TTL`` seconds to avoi

Construct a minimal valid ELF header.

Build a synthetic runtime._type and return (data, name_abs_offset). Returns the complete binary data with the type descriptor and the name pl

Calculate Shannon entropy of a string. Higher = more random.

Cancel the hard timeout if it's running.

Categorise an API call the same way the attribution system does.

Validate that Qiling is available, raising RuntimeError with rootfs guidance if not.

Derive (status, confidence) from issues list. Returns: status: "healthy", "suspicious", "partial", or "corrupt" confidence: "high

L5-v8: Remove stale entries for a reaped session from module-level caches. Called from the session reaper in state.py to prevent stale entries

Cosine similarity between two histograms (dicts of counts).

Detect file type from magic bytes. Returns type string or None.

Extract package name from a Go function name. Go naming: ``package.Function``, ``package.(*Type).Method``, ``crypto/tls.(*Conn).Read``.

Scan raw bytes for gopclntab magic with header validation. Returns the file offset of the valid header, or None.

Find gopclntab via section name. Returns (file_offset, size) or None.

Binary search for the function containing virtual address *va*. *func_lookup* is a ``(entries, starts)`` tuple from ``_build_function_lookup`

Find a family by name or alias (case-insensitive).

Format byte count into a human-readable string.

Synchronous worker — runs in thread.

Fallback Go detection by scanning binary for Go-specific strings. Works when pygore cannot parse the binary (e.g. newer Go versions). Returns

Patch+hook an API at its import symbol addresses via hook_address(). Unlike set_api() which hooks ALL Qiling-internal addresses (including forwar

Detect binary format, validate rootfs/DLLs, and create a Qiling instance. Qiling requires the binary to live *inside* the rootfs so it can map

Create a temp file with the given content and return its path.

Match custom attribute names against known obfuscator signatures.

Append a bypass trigger record if under the cap. Args: triggers: Mutable list to append to (passed by reference). bypass_type: Ca

Resolve a project by id-or-name. Falls back to active if id_or_name is None.

Return the default rootfs path.

32-bit left rotate.

Invoke the qiling runner subprocess in the isolated venv.

Optionally save script to disk and register as artifact.

Set up API/syscall interception appropriate for the target OS. Qiling uses different hook mechanisms per OS: - Windows: ql.os.set_api("*", ca

Launch full FLOSS deep analysis as a background daemon thread. The result overwrites ``state.pe_data["floss_analysis"]`` in-place so the dash

Thread-safe label creation at an address.

* The base implementation of `getTag` without fallbacks for buggy environments. * * @private * @param {*} value The value to query. * @returns {st

Build a hash→API name lookup table. Args: api_names: List of API function names. algorithm: Hash algorithm name. seed: Cu

Clear all warnings. Returns count removed.

Compare two BSim-indexed binaries function-by-function from the DB. For each non-trivial function in *sha_a*, finds the best-scoring function

[Phase: explore] Scans the binary for embedded compression/archive magic bytes: zlib, gzip, LZMA, ZIP, RAR, 7z, bzip2, cab, and XZ. ---c

* Gets the native function at `key` of `object`. * * @private * @param {Object} object The object to query. * @param {string} key The key of the m

Return filtered + sorted artifacts plus aggregate counts. Snapshots the artifact list exactly once and derives both the filtered view and the

Return structured analysis digest for the dashboard. Mirrors ``get_analysis_digest()`` from ``tools_session.py`` but never updates ``last_dig

Compare every member of *project_a_id* against every member of *project_b_id*. For each ``(member_a, member_b)`` pair where both binaries are ind