| Name | Type | Description | Notes |
|---|---|---|---|
| address | String | Function's virtual address, hex-encoded | |
| categories | List<CategoriesEnum> | Distinct execution categories evidenced by this function | |
| confidence | ConfidenceEnum | High when a direct name match was found, medium when the function only calls into execution APIs | |
| directMatches | List<ExecutionDirectMatch> | Matches against the function's own name | [optional] |
| evidenceCount | Long | Total number of direct matches and execution calls | |
| executes | Boolean | Whether this function evidences executing code rather than only supporting it | |
| executionCalls | List<ExecutionCall> | Matches against names this function calls | [optional] |
| functionId | Long | ID of the function the finding was reported in | |
| functionName | String | Name of the function the finding was reported in | |
| functionSize | Long | Size of the function in bytes | |
| sources | List<SourcesEnum> | Distinct execution sources evidenced by this function | |
| verification | ExecutionVerification | LLM verdict checking this finding against its decompilation. Present only when the run verified this finding. | [optional] |
| Name | Value |
|---|---|
| DYNAMIC_RESOLVE | "dynamic-resolve" |
| HOOKING | "hooking" |
| INJECTION | "injection" |
| MEMORY_EXEC | "memory-exec" |
| MODULE_LOAD | "module-load" |
| PROCESS_CONTROL | "process-control" |
| PROCESS_CREATE | "process-create" |
| SCRIPT_EXEC | "script-exec" |
| SHELLCODE | "shellcode" |
| THREAD_CREATE | "thread-create" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| HIGH | "high" |
| MEDIUM | "medium" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |
| Name | Value |
|---|---|
| BOOST | "boost" |
| CPP | "cpp" |
| CPP_STDLIB | "cpp-stdlib" |
| GENERIC | "generic" |
| LIBC | "libc" |
| QT | "qt" |
| SCRIPT_ENGINE | "script-engine" |
| WINDOWS | "windows" |
| UNKNOWN_DEFAULT_OPEN_API | "unknown_default_open_api" |