Return strings to scrub from SMBIOS/firmware table responses. Covers vendor, product, and version strings for VMware, VirtualBox, QEMU, Xen,

Increment analysis generation counter. Called by ``reset_angr()`` during file switches. Safe because callers are serialized by the t

* Checks if `value` is classified as a `Symbol` primitive or object. * * @static * @memberOf _ * @since 4.0.0 * @category Lang * @param {*} valu

Parse and decrypt an AutoIt3 compiled script. Args: data: Raw bytes containing or starting with the AutoIt script. prng_type: 'au

Send JSONL command, read JSONL response.

Return a stable snapshot of every member as a list of dicts. Public alternative to dashboard code reaching into ``project._lock`` dir

* Converts `func` to its source code. * * @private * @param {Function} func The function to convert. * @returns {string} Returns the source code.

Extract address — handles both function objects and raw ints.

Merge overlapping context windows around *match_indices*. Args: items: The full list of items (lines or instruction dicts). match

Build the ilspycmd CLI command line.

Average Shannon entropy across a list of names.

Classify whether the assembly is obfuscated and deduplicate detections.

Collect notes with category 'function' grouped by address. Returns {addr_hex: combined_comment_text}.

Compute basic statistics from parsed trace entries.

Create a _TypeLayout for the detected Go version.

Extract AdaptixC2 Beacon config: size(4B LE) | ciphertext | rc4_key(16B). Decrypted config format (length-prefixed strings): [4B header][1B

Generic extractor for single-byte XOR encrypted configs.

Extract hex address from a function object or raw integer.

Return the active AnalyzerState (session or default).

Get the unicorn emulator from the Speakeasy object. Speakeasy wraps unicorn; the exact attribute path varies by version. Try common paths in

Write content to a temp file and return path.

Build a mock callgraph (NetworkX-like) from edge list.

Build mock cfg.functions dict from {addr: name}.

Simulate an ASGI request and return (status, response_body).

Build a standardised paginated response dict. Args: items: The full (or page-sliced) list of result items. offset: Current page o

Parse de4dot stdout for detected obfuscator info.

Parse DynamoRIO drcov binary format. Format: Header lines (ASCII): DRCOV VERSION: 2 DRCOV FLAVOR: drcov

Finds all strings from all sources, categorizes them, ranks them with StringSifter, and adds the enriched data back into the dictionary.

Return a lightweight project summary for the projects grid. Excludes the per-member breakdown — the grid only displays primary filename, memb

Build a ``{sha256: [{id, name}, ...]}`` map for the given sha256s. Backed by the in-memory cache from ``_get_project_membership_map`` so dash

Reconstruct a feature dict from a database row for scoring.

Run an async coroutine in a new event loop.

Parse a string or int value to int, returning default on failure.

Safely slice a value to at most *n* items.

Safely slice a value to at most *n* items.

Convert any value to a JSON-safe string.

Persist enrichment results to the disk cache. Enrichment data lives on state attributes (``_cached_triage``, etc.) and on ``_decompile_meta``

Score decrypted data: higher = more likely correct.

Set up mock state with pe_data and result_cache.

Synchronous orchestrator — runs Phase 1, optionally Phase 2 and 3.

Validate and clamp max_instructions parameter.

Validate timeout_seconds parameter.

Poll for angr CFG completion. Returns True if CFG is available.

Adapt a (ql, address, api_name) stub for hook_address's (ql) signature.

M8-v10: Remove phase cache entry for a reaped session.

[Phase: dynamic] Start an interactive debug session for the loaded binary. Creates a persistent emulation environment using Qiling Framework.

[Phase: explore] Scans for printf/scanf-style format specifiers (%s, %x, %d, %n, etc.) in strings. The dangerous %n specifier can indicate fo

* Performs a * [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#sec-samevaluezero) * comparison between two values to determine if they

Find the offset of EA05_MAGIC in binary data.

Generate a markdown analysis report for the dashboard. Reuses logic from ``generate_analysis_report()`` in ``tools_workflow.py``.

Thread-safe lookup of a custom type by name.

File info, hashes, phase, coverage stats, background tasks.

Get a session by ID, or the most recent one.

Unified string listing with search, filter, sort, and pagination.

Thread-safe filtered read of tool history.

Return known VM MAC address OUI prefixes (colon-separated). Prefixes cover VMware, VirtualBox, QEMU/KVM, Hyper-V, Xen, and Parallels. Used t

Return registry key substrings that indicate VM presence. Used by the Qiling runner to intercept ``RegOpenKeyExA``/``RegOpenKeyExW`` and retu