topology

type EntropyClass int

type EntropyProfile struct {
	// Overall entropy of the function body
	Overall float64

	// Entropy of string literals within the function
	StringLiteralEntropy float64

	// Entropy classification
	Classification EntropyClass
}

type FunctionTopology struct {
	FuzzyHash string

	// Basic metrics
	ParamCount  int
	ReturnCount int
	BlockCount  int
	InstrCount  int
	LoopCount   int
	BranchCount int // if statements
	PhiCount    int

	// Complexity metrics
	CyclomaticComplexity int

	// Call profile: map of "package.func" or "method" -> count
	CallSignatures map[string]int

	// Granular instruction tracking
	InstrCounts map[string]int

	// Type signature (normalized)
	ParamTypes  []string
	ReturnTypes []string

	// Control flow features
	HasDefer   bool
	HasRecover bool
	HasPanic   bool
	HasGo      bool
	HasSelect  bool
	HasRange   bool

	// Operator profile
	BinOpCounts map[string]int
	UnOpCounts  map[string]int

	// String literal hashes (for behavioral matching)
	StringLiterals []string

	// Entropy analysis for obfuscation detection
	EntropyScore   float64
	EntropyProfile EntropyProfile

	// Multi-signal obfuscation analysis: sliding-window and const-pool entropy,
	// indirect/reflective dispatch ratio, control-flow flattening, and in-loop
	// decoder fingerprints. Captures payloads the string-only entropy path misses.
	Obfuscation ObfuscationProfile
	// contains filtered or unexported fields
}

type ObfuscationClass int

type ObfuscationProfile struct {
	// MaxWindowEntropy is the highest Shannon entropy (0..8) found in any
	// sliding window across the concatenated constant pool (strings + byte/int
	// arrays). Unlike a global mean, a single packed blob surfaces here even
	// when surrounded by benign data.
	MaxWindowEntropy float64

	// ConstPoolEntropy is the Shannon entropy (0..8) of the *non-string*
	// constant pool: integer and byte constants flowing into the function.
	// This is the signal the old path was completely missing.
	ConstPoolEntropy float64

	// ByteArrayPayloadBytes is the total number of bytes contributed by
	// small-integer constants (0..255) that look like an encoded payload.
	ByteArrayPayloadBytes int

	// IndirectCallRatio is dynamic+reflective calls over all calls. High values
	// indicate dispatch-table / reflection obfuscation that evades name-based
	// signatures.
	IndirectCallRatio float64

	// FlatteningScore estimates control-flow-flattening likelihood from the
	// dispatcher shape (one block with many predecessors and successors driving
	// a state variable). 0..1.
	FlatteningScore float64

	// DecoderLoopLikelihood is 0..1 evidence of an in-loop decode/XOR routine:
	// a loop body containing byte-wise arithmetic/bitwise ops over an indexed
	// buffer. This is the structural fingerprint of a string/payload decryptor.
	DecoderLoopLikelihood float64

	// Score is the aggregate 0..1 obfuscation score.
	Score float64

	// Class is the bucketed Score.
	Class ObfuscationClass

	// Indicators lists the human-readable signals that fired, for reporting.
	Indicators []string
}