Install all instruction-level anti-VM bypass hooks on a Qiling instance. Installs CPUID spoofing, RDTSC timing normalisation, and VMware back

Check if a binary with the given SHA256 is already in the signature DB.

Quick check: does the PE entry point match the VB6 startup pattern? Looks for PUSH imm32 (68h) at entry point, then validates "VB5!" signature

Normalize a hex address to lowercase with 0x prefix.

[Phase: explore] Parses PE authenticode signatures: extracts certificate details (subject, issuer, serial, thumbprint, validity), countersign

Parse Go runtime type descriptors from binary data. Args: file_data: Raw bytes of the Go binary. sections: List of section dicts

Promote *scratch* to a real on-disk Project. Members are copied into binaries/ and the manifest is written. Caller is responsible for

Insert a batch of function features and commit (no lock — caller holds it).

Clear the active project binding without flushing.

[Phase: utility] Correlates all temporal artifacts from the binary: PE compile timestamp, debug directory timestamps, Rich header build info,

Build the de4dot CLI command line (runs via mono on Linux). de4dot CLI syntax: de4dot [options] -f <file> [-o <output>] -d (detect and exit)

Lazy check for de4dot-cex availability. Called on first use.

Validate ELF headers. Returns (issues, flags, format_details).

Lazy check for Qiling Framework availability. Called on first use.

Attempts to decode data by bruteforcing a single-byte XOR key. It tries every possible key from 1 to 255. For each result, it checks how

Load or generate the dashboard token. Persisted to ~/.arkana/dashboard_token.

Extract name from a function object, or return fallback.

Extract section data from the binary.

Identify file type from magic bytes.

Check if a name contains non-ASCII characters (common in obfuscated .NET).

Return the cached path for *sha256* if still valid, else None. Cache validity requires THREE conditions: 1. Entry hasn't expired (TTL).

If authenticated via query param, set cookie and redirect to strip token from URL. Always stores the canonical dashboard_token in the cookie, not

Factory: create a CALL-hook closure for a data-driven stub. Args: api_name: API function name (for trace logging) retval: Return

Match resource names against known obfuscator patterns.

Extract name — handles both function objects and raw ints.

Performs string extraction using FLOSS, enriches with context, ranks with StringSifter, and returns a structured result.

Run a subprocess with timeout, return (returncode, stdout, stderr). Uses a pseudo-terminal for stdin so .NET ``Console.ReadKey()`` sees a rea

Safely traverse nested dicts.

Thread-safe store with LRU eviction when exceeding max size. When *skip_line_cap* is True, stores the full line array without truncation. Use

Sync function renames to the BSim signature DB (best-effort). User rename state now lives in project overlays (persisted on flush_overlay / c

Synchronous scan worker — runs in thread.

Convert a PE timestamp to human-readable string.

Raise ValueError if *name* is not a valid project name.

Write multiple extracted files to a directory and register as artifacts. Each file is written individually for backward compat, **and** the e

[Phase: explore] Deep parsing of the debug directory: extracts PDB paths and GUIDs (CodeView NB10/RSDS), parses POGO sections, decodes Rich h

[Phase: explore] Parses the BASE_RELOC directory to enumerate relocation blocks, types, and anomalies. Detects ASLR bypass indicators, reloca

[Phase: explore] Analyzes Structured Exception Handling (SEH) data: parses x64 RUNTIME_FUNCTION entries from the exception directory, enumera

* Copies properties of `source` to `object`. * * @private * @param {Object} source The object to copy properties from. * @param {Array} props The

Thread-safe removal. Returns True if found.

Thread-safe removal of a rename/label. Returns True if found.

[Phase: explore] Scans for known cryptographic constants (AES S-box, DES, SHA, RC4, etc.) to identify crypto algorithm usage without symbolic

Auto-detect which PRNG the AutoIt3 binary uses. Scans for: - 0x53A9B4FB (RanRot LCG multiplier) -> 'ranrot' - 0x6C078965 only (MT multipl

Return all registered settings with current effective values and metadata. Each entry includes: key, label, group, type, default, current_value,

Thread-safe filtered read of artifacts. Returns copies.

Extract FLOSS analysis summary for the strings page detail panel.

Return the full config with sensitive values masked. Useful for displaying config to users without exposing secrets.

Get or lazily create an ``AnalyzerState`` for *session_key*. For stdio mode (``"default"``), returns the global ``_default_state`` directly s

Return the latest resource snapshot, or None if unavailable.

Return lowercase process names associated with VM tools. Used to filter results from ``CreateToolhelp32Snapshot`` / ``Process32First`` / ``Pr

Search across functions, strings, imports, and notes.

* Checks if the given arguments are from an iteratee call. * * @private * @param {*} value The potential iteratee value argument. * @param {*} ind

Initial load: clear and fill from a given offset.

[Phase: explore] Scans for known API name hashes used by shellcode and malware to hide imports via dynamic resolution (e.g. ror13, djb2, crc3

Enable or disable brief tool descriptions. Must be called before tool registration.

Register a background task and launch ``angr_background_worker`` in a daemon thread. Returns the *task_id* so callers can track it. Thi

* Converts `value` to a string key if it's not a string or symbol. * * @private * @param {*} value The value to inspect. * @returns {string|symbol