Scan the dump for ALL "Linux version " strings and return every implied shift. The kernel keeps multiple copies (image, printk log, /proc/version), so

Network-byte-order helpers (kernel stores be16/be32 in BE).

Emit base_types (INT, FLOAT) keyed by name.

Build user_types: STRUCT, UNION (with fields). Same name dedup is best-effort — in the wild, BTF can include multiple anonymous structs; we suffix-dis

Resolves the bundled fetch_symbols.sh — searches several plausible roots so it works from build trees, install prefixes, and `cwd`-relative invocation

Output directory for fetched / generated ISFs. Precedence: 1. `preferred` (--symbol-cache), if given 2. $LMPFS_SYMBOL_CACHE (so the env var actually o

True when size() is cheap enough to resolve during a directory listing.

Converts a C++ time_point to a Windows FILETIME (100ns units since 1601-01-01). Used so file timestamps stay STABLE across queries — otherwise editors

Sanitise a printk text payload for the output file. Linux text may contain raw control bytes (e.g. embedded CR) — strip them.

---- machine-readable exports: same global hits, rendered CSV/JSON ---------

Global IOC pass: extract strings per process, filter through the IOC battery (URL/IPv4/email/JWT/AWS). At namespace scope (moved out of the anonymous

Wall-clock seconds at boot (UTC), or 0 if not derivable. With it we can convert every boot-relative event (process starts, dmesg, eBPF) to absolute ti

Walk `parent` creating intermediate `DirNode`s for each path component except the last. Returns the deepest DirNode + the leaf filename.

Ensure /plugins/ exists at the root; return the DirNode.

"#<digits>" (bash) or "#+<digits>" (tcsh) timestamp marker → digit string, or "" if the line isn't a timestamp marker. A bash epoch is ~10 digits.

Extract one VMA's strings. Streams 64 KiB at a time so we don't have to materialise the whole VMA in memory.

Walk a PT_NOTE segment and return the desc of the "VMCOREINFO" note, or empty if not present. Each note: Elf64_Nhdr + name (rounded to 4) + desc (roun

Read a path string from a struct file*'s f_path.dentry chain. Reuses the dentry_path infrastructure shared with fdtable/pagecache.

AWS access-key-ID: "AKIA" + 16 uppercase alphanumerics.

Email: simplistic — looks for "user@host.tld" with valid char classes.

IPv4 dotted-quad: each octet 0..255. Reject 0.0.0.0 and 255.255.255.255 to suppress null-padding noise.

JWT: 3 base64url segments separated by dots, first must start with "eyJ" (the JOSE header { ... ).

Return the highest-addressed kallsyms entry whose address is ≤ addr.

"https?://" + run of url-safe chars

Recursively flatten members of `t` into `fields`. When a field is an anonymous** struct/union (name empty) we inline that nested type's members at the

========================================================================= /sys/net/arp — neighbour cache (best-effort; full walk deferred) ===========

========================================================================= /sys/boottime — wall-clock at boot ========================================

========================================================================= /sys/cpuinfo — boot_cpu_data (a struct cpuinfo_x86) =======================

========================================================================= /sys/dns.txt — resolver config (best-effort via page-cache reads) ==========