Variable INVESTIGATION_EXAMPLESConst

Type Declaration

• build_call_path: {
      functions: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
      goal: { address: string };
      start: { address: string };
  }

• correlate_static_and_runtime: {
      mappings: {
          hypothesis: { expected_pattern: string; statement: string };
          runtime: { comparison_evidence_id: string; dimension: string };
          side_alignment: string;
          static: {
              comparison_evidence_id: string;
              selector: { dimension: string; kind: string };
          };
      }[];
      runtime_comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
      static_comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
  }

• find_changed_behavior: {
      comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
  }

• verify_reconstruction: {
      specification: {
          claims: {
              claim_id: string;
              comparison_evidence_id: string;
              dimension: string;
              kind: string;
              title: string;
          }[];
          name: string;
          schema_version: number;
      };
  }