Build a tar.gz of *src_path* into a NamedTemporaryFile and return its path. Streams via tarfile rather than buffering bytes in memory. Caller is

Derive output path from input path, placing in a temp directory.

Check cache, compute on miss, cache, slice, return with pagination metadata. Args: cache: The ``_ToolResultCache`` instance (from ``Analy

Cancel the hard timeout if it's running.

Lazy check for NETReactorSlayer availability. Called on first use.

Lazy check for Speakeasy availability. Called on first use.

Classify CFG functions as source-callers, sink-callers, or both. Returns ``(source_funcs, sink_funcs)`` mapping address → matched API names.

Collect bookmark entries from triage status.

Disassemble up to `count` instructions at `address`.

Extract name from LIEF enum repr (e.g. 'CPU_TYPES.x86_64' → 'x86_64').

Read an env var with ARKANA_* preferred, PEMCP_* as fallback.

Find the appropriate rootfs directory for the given OS and architecture.

Yield (filename, function_name) for every @tool_decorator function.

Convert bytes to human-readable size string.

Return set of hex addresses that have been decompiled for the current session.

Read all registers for the current architecture.

Check if a function appears to be a null-byte disassembly artifact. Returns True if the function's first block consists entirely of 0x00 bytes

Load and cache the bundled Windows API name database. Returns dict mapping DLL names to lists of exported function names.

Loads a Vivisect workspace for FLOSS analysis. For PE files, splits workspace creation (``analyze=False``) from analysis (``vw.analyze()``) s

Wrap a hook_address-style stub for use with ql.os.set_api(). set_api callbacks receive (ql, pc, params) but our stubs use (ql, address, _api_

Build a snapshot dict from a psutil.Process.

Map findings to MITRE ATT&CK synchronously. No MCP overhead.

Apply inline markdown formatting (bold, code). SECURITY: _md_inline() MUST only be called AFTER escape() — it injects raw HTML tags (<code>,

Read memory from the Speakeasy emulator.

Calculate completion stats for a curriculum module.

Extract section headers from an ELF binary using only struct. Returns list of dicts with keys: name, offset, size, vaddr. Returns empty list

Extract section headers from a Mach-O binary using only struct. Returns list of dicts with keys: name, offset, size, vaddr. Returns empty lis

Read a Go name using relative offset (Go 1.17+). In Go 1.17+, name offsets are relative to the type descriptor address, not absolute.

Record a triggered bypass if under the cap.

Resolve and validate the output path for a generated script.

Parse gopclntab from a Go binary file. Returns a dict in go_analyze format, or None if not a Go binary.

Execute the exact cleanup sequence from open_file().

Run emulation with re-entry loop for API hook processing. Qiling's ql.run() returns after each API hook dispatch (simprocedure handling). Thi

Run angr's Decompiler with a fallback for cffi pickle errors. angr's Clinic pass uses ``copy.copy()`` on AIL blocks. Python's copy module fa

Sanitize a filename for filesystem use. Empty / dotfiles are normalised.

Scan a single function for vulnerability patterns. Returns number of new findings.

Replicate the exact cache lookup logic from get_overview_data().

Synchronous attack surface analysis — runs in thread.

Synchronous data flow analysis worker — runs in thread.

Try to parse a hex string to int, return None on failure.

Write a script to disk, compute hashes, and register as artifact.

* A specialized version of `_.map` for arrays without support for iteratee * shorthands. * * @private * @param {Array} [array] The array to iterat

* Gets the index at which the `key` is found in `array` of key-value pairs. * * @private * @param {Array} array The array to inspect. * @param {*}

* The base implementation of `assignValue` and `assignMergeValue` without * value checks. * * @private * @param {Object} object The object to modi

* The base implementation of `_.rest` which doesn't validate or coerce arguments. * * @private * @param {Function} func The function to apply a res

* The base implementation of `_.unary` without support for storing metadata. * * @private * @param {Function} func The function to cap arguments fo

* Casts `value` to a path array if it's not one. * * @private * @param {*} value The value to inspect. * @param {Object} [object] The object to qu

Compute inverse document frequency for API calls across the DB. Returns a dict mapping API name → IDF weight. Rare APIs get higher weights.

Create and return the dashboard Starlette ASGI app. If *token* is not provided, loads/generates from ~/.arkana/dashboard_token. Stores the to

[Phase: dynamic] Remove a user-defined API stub. Only user-defined stubs (created via debug_stub_api) can be removed. Builtin I/O and CRT stu

Generate Frida hook for a raw address.

Generate a comprehensive tracing script for a list of APIs. Each entry in `apis` should have at least 'name' and optionally 'module', 'category'.

* Gets the data for `map`. * * @private * @param {Object} map The map to query. * @param {string} key The reference key. * @returns {*} Returns t

Thread-safe snapshot for cache persistence.

Thread-safe snapshot for cache persistence (deep copies mutable nested data).

Return the cancel event for *task_id*, or ``None``.

Retrieves the complete analysis results for the pre-loaded PE file. ---compact: full PE analysis dump | all parsed structures, hashes, scans

Return combined xrefs, strings, suspicious APIs, and complexity for a function. Used by the callgraph sidebar tabbed panel.

Return user-assigned name for a function address, or None.

Return strings associated with a function address.

Return full detail for a single project (including member list).

Return all projects (filtered/sorted) plus the active project's id. Returns *summaries* (no per-member breakdown). Use ``get_project_detail_data`

L2-v8: Thread-safe set of tool names without copying the full deque.

Return cache statistics.