tokmd_analysis_types/
entropy.rs1use serde::{Deserialize, Serialize};
7
8#[derive(Debug, Clone, Serialize, Deserialize)]
9pub struct EntropyReport {
10 pub suspects: Vec<EntropyFinding>,
11}
12
13#[derive(Debug, Clone, Serialize, Deserialize)]
14pub struct EntropyFinding {
15 pub path: String,
16 pub module: String,
17 pub entropy_bits_per_byte: f32,
18 pub sample_bytes: u32,
19 pub class: EntropyClass,
20}
21
22#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
23#[serde(rename_all = "snake_case")]
24pub enum EntropyClass {
25 Low,
26 Normal,
27 Suspicious,
28 High,
29}
30
31#[cfg(test)]
32mod tests {
33 use super::EntropyClass;
34
35 #[test]
36 fn entropy_class_serde_roundtrip() -> Result<(), Box<dyn std::error::Error>> {
37 for variant in [
38 EntropyClass::Low,
39 EntropyClass::Normal,
40 EntropyClass::Suspicious,
41 EntropyClass::High,
42 ] {
43 let json = serde_json::to_string(&variant)?;
44 let back: EntropyClass = serde_json::from_str(&json)?;
45 assert_eq!(back, variant);
46 }
47 Ok(())
48 }
49
50 #[test]
51 fn entropy_class_uses_snake_case() -> Result<(), Box<dyn std::error::Error>> {
52 assert_eq!(
53 serde_json::to_string(&EntropyClass::Suspicious)?,
54 "\"suspicious\""
55 );
56 Ok(())
57 }
58}