Crate fnprint_core 

Index / match / query, built on the loader + emulator + fingerprint + db.

Structs

Changed

EffectTrace

The full result of micro-executing one function.

EvalResult

IndexedFunc

MatchReport

Named

TriageHit

Enums

Verdict

Constants

LOW_COVERAGE_ADVISORY

advisory only: a coverage at or below this is worth an analyst’s second look (the print was built from a small slice of the body). it does NOT gate a verdict. low coverage cannot gate, because the functions that matter most for n-day work (large input-driven state machines like zlib inflate/deflate) legitimately execute almost none of their body on microexecution’s junk input, so a hard gate would refuse verdicts on exactly the crown-jewel CVE functions. coverage is surfaced next to results so a human can discount a suspicious low-coverage match; it is not a forgery gate. see SECURITY.md.

MIN_COMPLEXITY

below this we don’t trust a match, thunks and tiny leaves all look alike

SAME_THRESH

two prints this close are “the same function”

SIG_LEN

Functions

dump_traces

debug helper: micro-execute one named function and return its effect traces (one per seed/path). used by fnprint dump to see what the engine records.

eval

rank every signal-bearing function in A against all of B, using symbol names as ground truth. this is the headline accuracy measurement.

index_bytes

micro-execute + fingerprint every discovered function in an ELF blob.

index_bytes_shard

index only the functions assigned to shard shard_idx of shard_count. the loader’s function list is deterministically sorted+deduped, so assigning the function at sorted position i to shard i % shard_count partitions the work identically in every process with no coordination. run one shard per jailed worker process to get real parallelism back (the emu lock only serializes within a process, and separate processes share no qemu TCG state). (0, 1) is the whole binary, i.e. the old single-process behavior. the caller merges the shards and sorts by entry to reconstruct the single-process order, so the resulting corpus is byte-identical regardless of shard_count.

index_to_db

match_by_name

align two indexes by symbol name and report which shared functions actually changed behavior. this is the “what did the vendor quietly patch” view.

query_corpus

for each function in the target that we can trust, pull the best-matching named function out of the corpus db. withholds tiny/low-signal functions.

source_str

triage

rank each target function against a known-vulnerable corpus and a known-patched corpus and call which side it leans to. a function close to the vulnerable version and clearly separated from the patched one is a candidate worth a human’s time, which is more useful for n-day work than a single match score.

warm_pool

Force the rayon global pool to spawn its worker threads now. The sandboxed worker calls this before it jails itself, so the jail can forbid clone/clone3 (no thread creation after lockdown) without starving the parallel index.