Identify functions containing both input-source and dangerous-sink callees. Returns list of dicts: {addr_int, addr_hex, func_name, sources, sinks

Thread-safe read of decompile metadata.

Build environment/path information for AI clients.

Return common file metadata for script headers.

Hardlink *src* → *dst* if same filesystem, else copy. Returns 'link' or 'copy'.

Check if an IP is private, reserved, loopback, or link-local using ipaddress module. Covers CGNAT (100.64.0.0/10), multicast, and other non-routa

Build a single encrypted FILE entry for testing.

Parse interface dispatch tables from .go.itab / .itablink section. Each itab is a fixed-size structure: inter (ptr) — pointer to interfa

Fill every cache that caused cross-file contamination.

Convert our architecture string to a Qiling QL_ARCH enum value.

Convert our OS string to a Qiling QL_OS enum value.

Read JSON from *path*, returning None on missing/corrupt.

Returns (func_addr, func_name) or None.

Score a single family against all provided evidence. Categories where the family has KB data contribute their score and weight normally. Cat

Start a hard timeout that kills this process after *seconds*.

Fallback when RDA fails: confirm source and sink coexist, check block ordering heuristic. Returns a flow dict with method='structural' and co

Attempt deobfuscation with de4dot-cex.

Attempt deobfuscation with NETReactorSlayer.

Verify a downloaded file against a pinned SHA256 checksum, if available. Returns True if the checksum matches or no checksum is pinned for this U

Activate the per-session state for the current context and return it.

Restore user-mutable state from an overlay dict. Acquires per-field locks to prevent concurrent readers from seeing partial state dur

* Appends the elements of `values` to `array`. * * @private * @param {Array} array The array to modify. * @param {Array} values The values to appe

* This function is like `assignValue` except that it doesn't assign * `undefined` values. * * @private * @param {Object} object The object to modi

* Assigns `value` to `key` of `object` if the existing value is not equivalent * using [`SameValueZero`](http://ecma-international.org/ecma-262/7.0/#

* The base implementation of methods like `_.max` and `_.min` which accepts a * `comparator` to determine the extremum value. * * @private * @para

* The base implementation of `_.flatten` with support for restricting flattening. * * @private * @param {Array} array The array to flatten. * @par

* The base implementation of `_.get` without support for default values. * * @private * @param {Object} object The object to query. * @param {Arra

* The base implementation of `_.keys` which doesn't treat sparse arrays as dense. * * @private * @param {Object} object The object to query. * @re

Thread-safe clear of all artifacts. Returns count removed.

Thread-safe clear. Returns count removed.

* Creates a clone of `arrayBuffer`. * * @private * @param {ArrayBuffer} arrayBuffer The array buffer to clone. * @returns {ArrayBuffer} Returns th

[Phase: dynamic] Search emulated memory for strings or byte patterns. Searches across all mapped memory regions. For string patterns, searches

[Phase: dynamic] Queue input data for stubbed console input (ReadConsoleA). When I/O stubs are enabled (stub_io=True on debug_start), ReadConsole

Delete many artifacts in one locked pass — replaces N×O(L) scans with one O(L+N) sweep where L = total artifact count. Returns ``{art

Delete a single binary from the BSim signature DB.

Remove a config key from ~/.arkana/config.json. Returns True if key existed.

[Phase: explore] Scan the loaded binary for contiguous null-byte (0x00) regions. These regions cause angr's CFG to create fake 'add [rax], al

[Phase: explore] Uses angr heuristics to detect packing or obfuscation. Complements PEiD/triage with entropy, import count, and section analy

DJB2 hash (Daniel J. Bernstein). Default seed is 5381.

[Phase: explore] Extracts the embedded application manifest (RT_MANIFEST resource). Manifests reveal requested privileges (e.g. requireAdmini

[Phase: explore] Extracts PE resource data with types, sizes, language IDs, entropy, and the first 64 bytes of each resource payload (hex enc

Fetch a chunk of hex data from the API.

FNV-1a hash (32-bit). Default seed (offset basis) is 0x811C9DC5.

Report whatever project is currently bound to state.

Thread-safe read of all custom types (deep copies mutable nested data).

Thread-safe snapshot of all notes for cache persistence.

Return a snapshot of all active session states (for heartbeat monitoring).

Return function-level match details for a matched binary from triage cache.

Return cached decompilation for a function, or indicate not cached.

Return the default YARA rules store path if it contains any rules. Does NOT trigger a download — call :func:`ensure_yara_rules_exist` first i

Import/export tables for the imports dashboard page.

[Phase: explore] Parses the Load Configuration directory in detail: Control Flow Guard (CFG), security cookie, SafeSEH handlers, and guard fl

Section names, VA ranges, sizes, permissions, entropy, plus PE metadata.

Extract a unique session key from an MCP ``Context`` object. Falls back to ``"default"`` when no session can be identified (e.g. stdio mode),

Return structured settings data for the settings page.

* Checks if `value` is a property name and not a property path. * * @private * @param {*} value The value to check. * @param {Object} [object] The

* Checks if `value` is a valid array-like length. * * **Note:** This method is loosely based on * [`ToLength`](http://ecma-international.org/ecma-2

Check if an IP address is benign (private, loopback, link-local, reserved, multicast).

* Creates an array of the own and inherited enumerable property names of `object`. * * **Note:** Non-object values are coerced to objects. * * @st

Synchronous kill for use in reaper thread.

ROR13 hash (commonly used by shellcode). Seed is the initial hash value.

* Gets the value at `key`, unless `key` is "__proto__" or "constructor". * * @private * @param {Object} object The object to query. * @param {stri

Persist a small piece of dashboard state into the project manifest. Used for "resume where I left off" — last_tab, hex_offset, last_function.

Atomically save *overlay* for *sha256*. Tags with overlay version + meta.