topology

type EntropyClass int

type EntropyProfile struct {
	// Overall entropy of the function body
	Overall float64

	// Entropy of string literals within the function
	StringLiteralEntropy float64

	// Entropy classification
	Classification EntropyClass
}

type FunctionTopology struct {
	FuzzyHash string

	// Basic metrics
	ParamCount  int
	ReturnCount int
	BlockCount  int
	InstrCount  int
	LoopCount   int
	BranchCount int // if statements
	PhiCount    int

	// Complexity metrics
	CyclomaticComplexity int

	// Call profile: map of "package.func" or "method" -> count
	CallSignatures map[string]int

	// CallTargets counts every function called or referenced as a value,
	// keyed by import-path-qualified name ("os/exec.Command"). Package
	// initializers are excluded. Capabilities maps the subset of those keys
	// that are security-sensitive to their capability class (CapExec, ...).
	CallTargets  map[string]int
	Capabilities map[string]string

	// Checks holds the verifications this function performs: calls to a
	// verification primitive (MAC and signature checks, certificate
	// verification, password hash comparison; see IsVerificationCall), to a
	// helper that reaches one, and to a function or interface method named
	// like a verification whose result decides a branch (see
	// collectCheckHelpers). Losing one is how a guard gets deleted.
	Checks map[string]bool

	// CapabilityGuards maps each Capabilities key to the fewest conditional
	// branches, loop conditions excluded, that any of its references in this
	// function is control-dependent on. 0 means some reference runs
	// unconditionally. Nil when the function has more than 2000 blocks.
	CapabilityGuards map[string]int

	// WeakSettings and SecureSettings hold constant stores to security
	// configuration fields, written "crypto/tls.Config.InsecureSkipVerify=true".
	// A weak setting weakens security on its own; a secure setting weakens it
	// by its removal. See collectSecuritySettings.
	WeakSettings   map[string]bool
	SecureSettings map[string]bool

	// ErrorExits counts the two-way branches with exactly one side that ends
	// the function with a failure: a non-nil error return, a panic, a call
	// that never returns, or an HTTP 4xx/5xx response.
	ErrorExits int

	// Granular instruction tracking
	InstrCounts map[string]int

	// Type signature (normalized)
	ParamTypes  []string
	ReturnTypes []string

	// Control flow features
	HasDefer   bool
	HasRecover bool
	HasPanic   bool
	HasGo      bool
	HasSelect  bool
	HasRange   bool

	// HasInfiniteLoop reports a `for` statement without a condition
	// (`for { ... }`) in the function's own body. Such a loop only ends
	// through break, return, goto or panic.
	HasInfiniteLoop bool

	// Operator profile
	BinOpCounts map[string]int
	UnOpCounts  map[string]int

	// String literal hashes (for behavioral matching)
	StringLiterals []string

	// Entropy analysis for obfuscation detection
	EntropyScore   float64
	EntropyProfile EntropyProfile

	// Multi-signal obfuscation analysis: sliding-window and const-pool entropy,
	// indirect/reflective dispatch ratio, control-flow flattening, and in-loop
	// decoder fingerprints. Captures payloads the string-only entropy path misses.
	Obfuscation ObfuscationProfile
	// contains filtered or unexported fields
}

type ObfuscationClass int

type ObfuscationProfile struct {
	// MaxWindowEntropy is the highest Shannon entropy (0..8) found in any
	// sliding window across the concatenated constant pool (strings + byte/int
	// arrays). Unlike a global mean, a single packed blob surfaces here even
	// when surrounded by benign data.
	MaxWindowEntropy float64

	// ConstPoolEntropy is the Shannon entropy (0..8) of the *non-string*
	// constant pool: integer and byte constants flowing into the function.
	// This is the signal the old path was completely missing.
	ConstPoolEntropy float64

	// ByteArrayPayloadBytes is the total number of bytes contributed by
	// small-integer constants (0..255) that look like an encoded payload.
	ByteArrayPayloadBytes int

	// IndirectCallRatio is dynamic+reflective calls over all calls. High values
	// indicate dispatch-table / reflection obfuscation that evades name-based
	// signatures.
	IndirectCallRatio float64

	// FlatteningScore estimates control-flow-flattening likelihood from the
	// dispatcher shape (one block with many predecessors and successors driving
	// a state variable). 0..1.
	FlatteningScore float64

	// DecoderLoopLikelihood is 0..1 evidence of an in-loop decode/XOR routine:
	// a loop body containing byte-wise arithmetic/bitwise ops over an indexed
	// buffer. This is the structural fingerprint of a string/payload decryptor.
	DecoderLoopLikelihood float64

	// Score is the aggregate 0..1 obfuscation score.
	Score float64

	// Class is the bucketed Score.
	Class ObfuscationClass

	// Indicators lists the human-readable signals that fired, for reporting.
	Indicators []string
}