Variable INVESTIGATION_EXAMPLESConst

Type Declaration

• build_call_path: {
      functions: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
      goal: { address: string };
      start: { address: string };
  }

• correlate_static_and_runtime: {
      mappings: {
          hypothesis: { expected_pattern: string; statement: string };
          runtime: { comparison_evidence_id: string; dimension: string };
          side_alignment: string;
          static: {
              comparison_evidence_id: string;
              selector: { dimension: string; kind: string };
          };
      }[];
      runtime_comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
      static_comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
  }

• find_changed_behavior: {
      comparisons: (
          | {
              analysis_profile: {
                  digest: string;
                  parameters: Record<string, JSONType>;
                  provider: { id: string; name: string; version: string };
                  provider_profile_schema_version: number;
                  schema_version: 1;
              };
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
          | {
              authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference";
              confidence: "observed"
              | "derived"
              | "inferred";
              environment:
                  | {
                      architecture: string;
                      id: string;
                      isolation: "process"
                      | "none"
                      | "container"
                      | "virtual-machine";
                      platform: string;
                  }
                  | null;
              evidence_id: string;
              evidence_links: string[];
              limitations: string[];
              locations: (
                  | { address: string; kind: "address" }
                  | { end: string; kind: "address-range"; start: string }
                  | { kind: "artifact-path"; path: string }
                  | { kind: "file-offset"; offset: number }
                  | { end: number; kind: "file-offset-range"; start: number }
              )[];
              normalized_result: JSONType;
              operation: string;
              parameters: Record<string, JSONType>;
              predicate_type: string;
              provider: { id: string; name: string; version: string | null };
              raw_result: JSONType;
              schema_version: 2;
              subject:
                  | {
                      architecture: "x86"
                      | "x86_64"
                      | "arm"
                      | "arm64"
                      | null;
                      digest: { sha256: string };
                      format:
                          | "unknown"
                          | "file"
                          | "directory"
                          | "javascript"
                          | "source-map"
                          | "plist"
                          | "entitlements"
                          | "dmg"
                          | "zip"
                          | "pkg"
                          | "asar"
                          | "javascript-bundle"
                          | "mach-o-universal"
                          | "mach-o"
                          | "elf"
                          | "pe"
                          | "hopper"
                          | "analysis-database"
                          | "ipa"
                          | "apk";
                      local_path: string;
                      name: string;
                  }
                  | null;
          }
      )[];
  }

• verify_reconstruction: {
      evidence_bundle: {
          artifacts: {
              architecture: "x86" | "x86_64" | "arm" | "arm64" | null;
              digest: { sha256: string };
              format:
                  | "unknown"
                  | "file"
                  | "directory"
                  | "javascript"
                  | "source-map"
                  | "plist"
                  | "entitlements"
                  | "dmg"
                  | "zip"
                  | "pkg"
                  | "asar"
                  | "javascript-bundle"
                  | "mach-o-universal"
                  | "mach-o"
                  | "elf"
                  | "pe"
                  | "hopper"
                  | "analysis-database"
                  | "ipa"
                  | "apk";
          }[];
          bundle_version: 2;
          captures: { evidence_id: string; predicate_type: string }[];
          environments: {
              architecture: string;
              id: string;
              isolation: "process" | "none" | "container" | "virtual-machine";
              platform: string;
          }[];
          providers: { id: string; name: string; version: string
          | null }[];
          records: (
              | {
                  analysis_profile: {
                      digest: string;
                      parameters: Record<string, JSONType>;
                      provider: { id: string; name: string; version: string };
                      provider_profile_schema_version: number;
                      schema_version: 1;
                  };
                  authority: | "shipped-artifact"
                  | "controlled-replay"
                  | "historical-reference"
                  | "external-service"
                  | "analyst-inference";
                  confidence: "observed"
                  | "derived"
                  | "inferred";
                  environment:
                      | {
                          architecture: string;
                          id: string;
                          isolation: "process"
                          | "none"
                          | "container"
                          | "virtual-machine";
                          platform: string;
                      }
                      | null;
                  evidence_id: string;
                  evidence_links: string[];
                  limitations: string[];
                  locations: (
                      | { address: string; kind: "address" }
                      | { end: string; kind: "address-range"; start: string }
                      | { kind: "artifact-path"; path: string }
                      | { kind: "file-offset"; offset: number }
                      | { end: number; kind: "file-offset-range"; start: number }
                  )[];
                  normalized_result: JSONType;
                  operation: string;
                  parameters: Record<string, JSONType>;
                  predicate_type: string;
                  provider: { id: string; name: string; version: string | null };
                  raw_result: JSONType;
                  schema_version: 2;
                  subject:
                      | {
                          architecture: "x86"
                          | "x86_64"
                          | "arm"
                          | "arm64"
                          | null;
                          digest: { sha256: string };
                          format:
                              | "unknown"
                              | "file"
                              | "directory"
                              | "javascript"
                              | "source-map"
                              | "plist"
                              | "entitlements"
                              | "dmg"
                              | "zip"
                              | "pkg"
                              | "asar"
                              | "javascript-bundle"
                              | "mach-o-universal"
                              | "mach-o"
                              | "elf"
                              | "pe"
                              | "hopper"
                              | "analysis-database"
                              | "ipa"
                              | "apk";
                          local_path: string;
                          name: string;
                      }
                      | null;
              }
              | {
                  authority: | "shipped-artifact"
                  | "controlled-replay"
                  | "historical-reference"
                  | "external-service"
                  | "analyst-inference";
                  confidence: "observed"
                  | "derived"
                  | "inferred";
                  environment:
                      | {
                          architecture: string;
                          id: string;
                          isolation: "process"
                          | "none"
                          | "container"
                          | "virtual-machine";
                          platform: string;
                      }
                      | null;
                  evidence_id: string;
                  evidence_links: string[];
                  limitations: string[];
                  locations: (
                      | { address: string; kind: "address" }
                      | { end: string; kind: "address-range"; start: string }
                      | { kind: "artifact-path"; path: string }
                      | { kind: "file-offset"; offset: number }
                      | { end: number; kind: "file-offset-range"; start: number }
                  )[];
                  normalized_result: JSONType;
                  operation: string;
                  parameters: Record<string, JSONType>;
                  predicate_type: string;
                  provider: { id: string; name: string; version: string | null };
                  raw_result: JSONType;
                  schema_version: 2;
                  subject:
                      | {
                          architecture: "x86"
                          | "x86_64"
                          | "arm"
                          | "arm64"
                          | null;
                          digest: { sha256: string };
                          format:
                              | "unknown"
                              | "file"
                              | "directory"
                              | "javascript"
                              | "source-map"
                              | "plist"
                              | "entitlements"
                              | "dmg"
                              | "zip"
                              | "pkg"
                              | "asar"
                              | "javascript-bundle"
                              | "mach-o-universal"
                              | "mach-o"
                              | "elf"
                              | "pe"
                              | "hopper"
                              | "analysis-database"
                              | "ipa"
                              | "apk";
                          local_path: string;
                          name: string;
                      }
                      | null;
              }
          )[];
          scenarios: {
              authority: "controlled-replay";
              evidence_id: string;
              operation: string;
          }[];
          unknowns: {
              contradicting_evidence_ids: string[];
              domain: string;
              mutation_evidence_ids: string[];
              previous_revision_digest: string
              | null;
              question: string;
              recommended_probes: { operation: string; rationale: string }[];
              registry_version: 1;
              relationships: {
                  type: "depends-on" | "related-to" | "contradicts";
                  unknown_id: string;
              }[];
              required_authority: | "shipped-artifact"
              | "controlled-replay"
              | "historical-reference"
              | "external-service"
              | "analyst-inference"
              | null;
              required_confidence: "observed"
              | "derived"
              | "inferred";
              required_environment:
                  | {
                      architecture: string
                      | null;
                      id: string | null;
                      isolation: "process" | "none" | "container" | "virtual-machine" | null;
                      platform: string | null;
                  }
                  | null;
              resolution: | {
                  disposition: "verified";
                  evidence_ids: string[];
                  rationale: string;
              }
              | {
                  disposition: "withdrawn"
                  | "out-of-scope";
                  evidence_ids: string[];
                  rationale: string;
              }
              | null;
              revision: number;
              revision_digest: string;
              scope_digest: string
              | null;
              severity: "low" | "medium" | "high" | "critical";
              status:
                  | "open"
                  | "investigating"
                  | "blocked"
                  | "contradicted"
                  | "resolved";
              supporting_evidence_ids: string[];
              unknown_id: string;
          }[];
      };
      specification: {
          claims: {
              claim_id: string;
              comparison_evidence_id: string;
              dimension: string;
              kind: string;
              title: string;
          }[];
          name: string;
          schema_version: number;
      };
  }