Documentation
¶
Index ¶
- func ApplyAnnotationWarnings(res *wt.Result)
- func CompeteHypotheses(hyps []wt.Hypothesis, topN int) []wt.Hypothesis
- func ComputeChecksum(alg ChecksumAlg, data []byte) uint64
- func ExplainCompetition(hyps []wt.Hypothesis, start, end, topN int) []wt.Hypothesis
- func Pearson(x, y []float64) (float64, bool)
- func Spearman(x, y []float64) (float64, bool)
- type AnnotationPass
- type ArrayPass
- type BitfieldPass
- type ChecksumAlg
- type ChecksumPass
- type CounterPass
- type EntropyClassPass
- type IntegerPass
- type LengthFieldPass
- type NestedPass
- type StringPass
- type StructuredPass
- type TLVPass
- type TimestampPass
- type VarintPass
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplyAnnotationWarnings ¶
ApplyAnnotationWarnings appends CLI-facing warnings when observations note conflicts.
func CompeteHypotheses ¶
func CompeteHypotheses(hyps []wt.Hypothesis, topN int) []wt.Hypothesis
CompeteHypotheses prunes near-duplicates and ranks clearer winners per offset span. Losers are recorded on winners' Alternates with a short reason in Params["lost_to_reason"]. topN caps retained hypotheses (0 = keep all winners after collapse).
Prefer fewer high-quality hypotheses: same-span Medium losers under a High winner are dropped, weak Medium integer/pattern spam overlapping High structural winners is pruned, nested envelopes lose to concrete structure, and overlapping same-family fields collapse to non-overlapping winners (improves measured precision / lowers FPR without inventing confidence).
func ComputeChecksum ¶
func ComputeChecksum(alg ChecksumAlg, data []byte) uint64
ComputeChecksum is exported for tests/fuzz.
func ExplainCompetition ¶
func ExplainCompetition(hyps []wt.Hypothesis, start, end, topN int) []wt.Hypothesis
ExplainCompetition returns top-N hypotheses overlapping [start,end) with loser notes.
Types ¶
type AnnotationPass ¶
type AnnotationPass struct {
Annotations []project.Annotation
}
AnnotationPass boosts hypotheses that agree with trusted human annotations and warns (via observations) when evidence contradicts an annotation. Annotations are never overwritten.
func (AnnotationPass) Name ¶
func (a AnnotationPass) Name() string
func (AnnotationPass) Run ¶
func (a AnnotationPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type ArrayPass ¶
type ArrayPass struct{}
ArrayPass detects repeated structures: count field + repeated fixed-width records.
type BitfieldPass ¶
type BitfieldPass struct{}
BitfieldPass analyzes low-cardinality bytes as flag bitfields.
func (BitfieldPass) Name ¶
func (BitfieldPass) Name() string
func (BitfieldPass) Run ¶
func (BitfieldPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type ChecksumAlg ¶
type ChecksumAlg string
ChecksumAlg identifies a tested algorithm.
const ( AlgXOR8 ChecksumAlg = "xor8" AlgSUM8 ChecksumAlg = "sum8" AlgSUM16 ChecksumAlg = "sum16" AlgSUM32 ChecksumAlg = "sum32" AlgFletcher16 ChecksumAlg = "fletcher16" AlgFletcher32 ChecksumAlg = "fletcher32" AlgAdler32 ChecksumAlg = "adler32" AlgCRC8 ChecksumAlg = "crc8" AlgCRC16IBM ChecksumAlg = "crc16-ibm" AlgCRC16CCITT ChecksumAlg = "crc16-ccitt" AlgCRC32IEEE ChecksumAlg = "crc32-ieee" AlgCRC32C ChecksumAlg = "crc32c" )
type ChecksumPass ¶
type ChecksumPass struct {
// contains filtered or unexported fields
}
ChecksumPass tests common checksums with staged search + caching.
func (*ChecksumPass) Name ¶
func (c *ChecksumPass) Name() string
func (*ChecksumPass) Run ¶
func (c *ChecksumPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type CounterPass ¶
type CounterPass struct{}
CounterPass detects monotonically increasing counters with wrap awareness.
func (CounterPass) Name ¶
func (CounterPass) Name() string
func (CounterPass) Run ¶
func (CounterPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type EntropyClassPass ¶
type EntropyClassPass struct{}
EntropyClassPass classifies high-entropy regions as compressed / encrypted-or-compressed / random / structured-high-entropy candidates. Never claims "encrypted" without caveats.
func (EntropyClassPass) Name ¶
func (EntropyClassPass) Name() string
func (EntropyClassPass) Run ¶
func (EntropyClassPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type IntegerPass ¶
type IntegerPass struct{}
func (IntegerPass) Name ¶
func (IntegerPass) Name() string
func (IntegerPass) Run ¶
func (IntegerPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type LengthFieldPass ¶
type LengthFieldPass struct{}
LengthCorrelationPass correlates integer candidates with message length.
func (LengthFieldPass) Name ¶
func (LengthFieldPass) Name() string
func (LengthFieldPass) Run ¶
func (LengthFieldPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type NestedPass ¶
type NestedPass struct{}
NestedPass proposes nested header/payload groupings when length + array evidence aligns. Less conservative than requiring exhaustive proof: Medium confidence when length and trailing payload regions co-occur with array/count hypotheses.
func (NestedPass) Name ¶
func (NestedPass) Name() string
func (NestedPass) Run ¶
func (NestedPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type StringPass ¶
type StringPass struct{}
StringPass detects ASCII/UTF-8/null-terminated/length-prefixed strings.
func (StringPass) Name ¶
func (StringPass) Name() string
func (StringPass) Run ¶
func (StringPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type StructuredPass ¶
type StructuredPass struct{}
StructuredPass proposes IPv4/IPv6/MAC/UUID/port pattern candidates (not automatic semantics).
func (StructuredPass) Name ¶
func (StructuredPass) Name() string
func (StructuredPass) Run ¶
func (StructuredPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type TimestampPass ¶
type TimestampPass struct{}
TimestampPass finds plausible unix timestamp fields correlated with capture time.
func (TimestampPass) Name ¶
func (TimestampPass) Name() string
func (TimestampPass) Run ¶
func (TimestampPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
type VarintPass ¶
type VarintPass struct{}
VarintPass detects protobuf-like varints / wire-type candidates with low default confidence. It never asserts "this is protobuf" without repeated structural confirmation.
func (VarintPass) Name ¶
func (VarintPass) Name() string
func (VarintPass) Run ¶
func (VarintPass) Run(ctx context.Context, in *wt.PassInput) (*wt.PassOutput, error)
Source Files