Han-Xiong Li

from dataclasses import dataclass, field
from typing import Literal, List, Dict, Optional


@dataclass
class Hash:
    md5: str
    sha1: str
    sha256: str


@dataclass
class Hashes:
    md5: str
    sha1: str
    sha256: str
    ssdeep_hash: str
    tlsh_hash: str
    authentihash: Optional[str] = None  # PE
    imphash: Optional[str] = None  # PE
    impfuzzy: Optional[str] = None  # PE TODO: implement
    typerefhash: Optional[str] = None  # DotNet
    richhash: Optional[str] = None  # PE
    richpe_hash: Optional[str] = None  # PE
    richpv_hash: Optional[str] = None  # PE
    richpv_hash_sorted: Optional[str] = None  # PE
    import_hash: Optional[str] = None  # ELF
    export_hash: Optional[str] = None  # ELF
    section_hash: Optional[str] = None  # ELF
    symbol_hash: Optional[str] = None  # ELF (symhash)
    dynamic_hash: Optional[str] = None  # ELF
    # Mach-O similarity hashes
    macho_dylib_hash: Optional[str] = None  # Mach-O: MD5 of sorted dylib names
    macho_import_hash: Optional[str] = None  # Mach-O: MD5 of sorted imported function names
    macho_export_hash: Optional[str] = None  # Mach-O: MD5 of sorted exported symbol names
    macho_entitlement_hash: Optional[str] = None  # Mach-O: MD5 of sorted entitlement names/values
    macho_symhash: Optional[str] = None  # Mach-O: MD5 of external undefined symbols
    # APK similarity hashes
    permhash: Optional[str] = None  # APK: SHA-256 of sorted permissions (Mandiant/Google)

@dataclass
class BasicProperties:
    filename: str
    sample_name: str
    filesize: int
    filetype: str
    filetype_mime: str
    filetype_magika: str
    file_entropy: float
    is_packed: Optional[bool] = None
    is_fat: Optional[bool] = None  # True for FAT Mach-O containers only
    child_sha256: Optional[List[str]] = None  # SHA256 hashes of children (FAT slices, zip contents)
    child_architecture: Optional[List[str]] = None  # Architecture names for FAT Mach-O slices
    child_filetype: Optional[List[str]] = None  # Magika filetypes for children (useful for zip archives)
    first_seen: Optional[str] = None  # From catalog_samples, None for local files


@dataclass
class DIEinfo:
    die_full_dump: str  # TODO: fix the ES schema type to have the full object
    die_info: dict = field(default_factory=dict)


@dataclass
class CAPA:
    capa_dump: str
    capabilities: list
    namespaces: list
    attack_dump: str
    tactics: list
    techniques: list
    techniques_id: list
    mbc_dump: str
    mbc_objectives: list
    mbc_behaviors: list
    mbc_behaviors_id: list


@dataclass
class Malcontent:
    """Malcontent analysis results from chainguard-dev/malcontent tool."""
    malcontent_dump: str  # JSON dump of analysis results (unwrapped from Files)
    version: str  # Malcontent tool version
    risk_score: int  # Overall risk score (0-4)
    risk_level: str  # Risk level: LOW, MEDIUM, HIGH, CRITICAL


# @dataclass
# class Strings:
#     # strings_total_unique: int
#     # strings_stored_unique: int
#     # strings: list = field(default_factory=list)
#     # # strings_ranked: list = field(default_factory=list)
#     strings: dict[str, String]

@dataclass
class String:
    string: str # this is basically the key
    string_length: int
    string_entropy: float
    string_frequency: int
    md5: list[str] = field(default_factory=list)
    sha1: list[str] = field(default_factory=list)
    sha256: list[str] = field(default_factory=list)

@dataclass
class Decompiled:
    _id: str
    decompiled_function_name: str
    decompiled_function_address: str
    decompiled_function: str


@dataclass
class PE:
    dos_header: str
    nt_header: str
    optional_header: str
    file_header: str
    magic: str  # pe.OPTIONAL_HEADER.Magic
    entry_point: str  # pe.OPTIONAL_HEADER.AddressOfEntryPoint
    major_linker_version: int  # pe.OPTIONAL_HEADER.MajorLinkerVersion
    minor_linker_version: int  # pe.OPTIONAL_HEADER.MinorLinkerVersion
    target_machine: str  # pe.FILE_HEADER.Machine
    architecture: str
    compilation_time: int
    compilation_time_utc: str
    is_dotnet: bool
    is_signed: bool
    has_overlay: bool
    number_of_sections: int
    number_of_imports: int
    number_of_exports: int
    number_of_resources: int
    type: Literal["DLL", "EXE", "DRIVER"]
    dbg_struct: Optional[str] = None
    dbg_timestamp: Optional[int] = None
    dbg_timestamp_utc: Optional[str] = None
    dbg_pdb_info: Optional[str] = None
    dbg_pdb_info_raw: Optional[str] = None
    tls_struct: Optional[str] = None
    export_timestamp: Optional[int] = None
    rich_header_dump: Optional[dict] = None
    rich_header_parsed: Optional[list] = None
    version_info: Optional[list] = None
    export_library_name: Optional[str] = None
    export_library_name_raw: Optional[str] = None
    export_symbols_list: Optional[list] = None
    tls_callbacks: Optional[list] = None


@dataclass
class PEDotNet:
    dotnet: dict = field(default_factory=dict)


@dataclass
class PEImport:
    pe_imports_total: int
    pe_import_libraryName: Optional[list] = None
    pe_import_functions: Optional[list] = None


@dataclass
class PESection:
    _id: str
    section_entropy: float
    section_sha256: str
    section_md5: str
    section_name: str
    section_name_b64: str
    section_pointer_to_raw_data: str
    section_size: int
    section_v_addr: str
    section_v_addr_hex: str
    section_v_size: int


# @dataclass
# class PESections:
#     sections_total: int
#     sections: list = field(default_factory=list)
#     section: Dict[str, PESection] = field(default_factory=dict)


@dataclass
class PEResource:
    _id: str
    resource_type: str
    resource_entropy: float
    resource_sha256: str
    resource_filetype: str
    resource_magika: str
    resource_language: str
    resource_sub_lang: str
    resource_rva: str
    resource_size: int


# @dataclass
# class PEResources:
#     resources_total: int
#     resources: list = field(default_factory=list)
#     resource: Dict[str, PEResource] = field(default_factory=dict)


@dataclass
class PEOverlay:
    _id: str
    overlay_size: int
    overlay_entropy: float
    overlay_offset: str
    overlay_mimetype: str
    overlay_type: str
    overlay_magika: str
    overlay_sha256: str
    overlay_sha1: str
    overlay_md5: str


@dataclass
class PESigner:
    signer_serial_number: str
    signer_subject: str
    signer_issuer: str
    signer_valid_from: str
    signer_valid_to: str
    signer_thumbprint: str  # sha1
    signer_algorithm: str


@dataclass
class PECertificate:
    certificate_serial_number: str
    certificate_subject: str
    certificate_issuer: str
    certificate_valid_from: str
    certificate_valid_to: str
    certificate_thumbprint: str  # sha1
    certificate_algorithm: str


@dataclass
class PECodeSigningInfo:
    _id: str
    signature_verified: bool
    number_of_certificates: int
    x509_certificates: Optional[list] = None
    signers: Optional[list] = None
    countersigners: Optional[list] = None
    date_signed: Optional[str] = None
    spcSpOpusInfo: Optional[dict] = None


@dataclass
class PEExtraFinding:
    context: str
    finding: Optional[Dict] = None


# @dataclass
# class PECodeSigning:
#     certificates: list = field(default_factory=list)
#     signer_info: list = field(default_factory=list)


@dataclass
class DotNetInconsistencyTests:
    test_dotnet_data_dir_hidden: Optional[bool]
    test_dotnet_fake_types: Optional[bool]
    test_dotnet_extra_data: Optional[bool]
    test_dotnet_invalid_type_ref: Optional[bool]
    test_dotnet_fake_datastreams: Optional[bool]
    test_dotnet_extra_module_table: Optional[bool]
    test_dotnet_extra_assembly_table: Optional[bool]
    test_dotnet_invalid_strings_stream: Optional[bool]
    test_dotnet_streams_mixed_case: Optional[bool]
    test_dotnet_method_def_invalid_table: Optional[bool]
    test_dotnet_max_len_exceeding_strings: Optional[bool]


@dataclass
class PEInconsistencyTests:
    test_rich_header_checksum: Optional[bool]
    test_rich_header_duplicate: Optional[bool]
    test_rich_header_linker: Optional[bool]
    test_rich_header_import_count: Optional[bool]


@dataclass
class YaraRule:
    """
    YARA rule metadata (stored in yara_rules table).

    Fields added during export: rule_id, source_collection, ingested_at, rule_text
    """
    rule_name: str
    rule_tags: List[str]
    rule_meta: Dict[str, str]


@dataclass
class YaraMatch:
    """
    YARA rule match (stored in yara_matches table).

    Fields added during export: sha256, rule_id, scan_date
    """
    rule_name: str
    match_strings: List[str]
# ============================================================================
# ELF Dataclasses
# ============================================================================

@dataclass
class ELFFeatures:
    """Main ELF header and binary properties."""
    # ELF Header data
    ei_class: int  # 1=32-bit, 2=64-bit
    ei_data: int  # 1=Little-endian, 2=Big-endian
    ei_version: int
    ei_osabi: int  # 0=SYSV, 1=HPUX, 2=NETBSD, 3=LINUX, 6=SOLARIS, 9=FREEBSD
    ei_abiversion: int
    e_type: int  # 0=NONE, 1=REL, 2=EXEC, 3=DYN, 4=CORE
    e_machine: int
    e_version: int
    e_entry: int
    e_flags: int
    # Human readable values
    ei_class_str: str
    ei_data_str: str
    ei_osabi_str: str
    e_type_str: str
    e_machine_str: str
    # Binary properties
    is_64bit: int
    is_stripped: int
    is_pie: int
    has_canary: int
    has_nx: int
    has_relro: int
    has_fortify: int
    # Counts
    number_of_segments: int
    number_of_sections: int
    number_of_symbols: int
    number_of_dynamic_symbols: int
    number_of_relocations: int
    number_of_dependencies: int
    # Build information
    gnu_hash_present: int
    has_debug_info: int
    build_id: Optional[str] = None


@dataclass
class ELFDependency:
    """ELF dynamic dependency (DT_NEEDED, DT_SONAME, DT_RPATH, DT_RUNPATH)."""
    dependency_name: str
    dependency_type: int  # 1=NEEDED, 14=SONAME, 15=RPATH, 29=RUNPATH
    dependency_type_str: str  # NEEDED, SONAME, RPATH, RUNPATH


@dataclass
class ELFImport:
    """ELF import information (libraries and functions)."""
    elf_imports_total: int
    elf_import_libraries: List[str] = field(default_factory=list)
    elf_import_functions: List[str] = field(default_factory=list)


@dataclass
class ELFExport:
    """ELF export information (exported functions)."""
    elf_exports_total: int
    elf_export_functions: List[str] = field(default_factory=list)


@dataclass
class ELFSection:
    """ELF section information."""
    section_name: str
    section_type: int  # 0=NULL, 1=PROGBITS, 2=SYMTAB, 3=STRTAB, 4=RELA, 5=HASH, 6=DYNAMIC, 7=NOTE, 8=NOBITS, 9=REL, 11=DYNSYM
    section_type_str: str
    section_flags: int
    section_flags_str: List[str]  # WRITE, ALLOC, EXECINSTR, MERGE, STRINGS, etc.
    section_addr: int
    section_offset: int
    section_size: int
    section_link: int
    section_info: int
    section_addralign: int
    section_entsize: int
    section_entropy: float
    section_sha256: str
    section_md5: str


@dataclass
class ELFSegment:
    """ELF segment (program header) information."""
    segment_type: int  # 0=NULL, 1=LOAD, 2=DYNAMIC, 3=INTERP, 4=NOTE, 5=SHLIB, 6=PHDR, 7=TLS
    segment_type_str: str
    segment_flags: int
    segment_flags_str: List[str]  # READ, WRITE, EXECUTE
    segment_offset: int
    segment_vaddr: int
    segment_paddr: int
    segment_filesz: int
    segment_memsz: int
    segment_align: int
    segment_entropy: float
    segment_sha256: str
    segment_md5: str


@dataclass
class ELFSymbol:
    """ELF symbol information."""
    symbol_name: str
    symbol_value: int
    symbol_size: int
    symbol_type: int  # 0=NOTYPE, 1=OBJECT, 2=FUNC, 3=SECTION, 4=FILE, 5=COMMON, 6=TLS
    symbol_type_str: str
    symbol_bind: int  # 0=LOCAL, 1=GLOBAL, 2=WEAK
    symbol_bind_str: str
    symbol_visibility: int  # 0=DEFAULT, 1=INTERNAL, 2=HIDDEN, 3=PROTECTED
    symbol_visibility_str: str
    symbol_section_index: int  # 0=UNDEF, 65521=ABS, 65522=COMMON, or actual section index
    symbol_section_index_str: str  # UNDEF, ABS, COMMON, or section index as string
    is_dynamic: int  # 0=static (.symtab), 1=dynamic (.dynsym)


@dataclass
class ELFRelocation:
    """ELF relocation information."""
    relocation_offset: int
    relocation_type: int
    relocation_type_str: str
    relocation_symbol_index: int
    relocation_symbol_name: str
    relocation_section: str
    relocation_addend: Optional[int] = None  # Only present in RELA sections


@dataclass
class ELFNote:
    """ELF note information (e.g., build ID, ABI tag)."""
    note_name: str  # e.g., "GNU"
    note_type: int  # e.g., 3 for NT_GNU_BUILD_ID
    note_type_str: str  # e.g., "NT_GNU_BUILD_ID"
    note_desc: str  # Note description/content (hex encoded for binary data)
    note_section: str  # Section or segment where the note was found


# ============================================================================
# Mach-O Dataclasses
# ============================================================================

@dataclass
class MachO:
    """Main Mach-O header and binary properties."""
    # Raw values (for analytics/ML)
    magic: int
    cputype: int
    cpusubtype: int
    filetype: int
    ncmds: int
    sizeofcmds: int
    flags: int
    architecture: int
    architectures: List[int]
    # Human-readable values (for display)
    magic_str: str
    cputype_str: str
    cpusubtype_str: str
    filetype_str: str
    flags_str: List[str]
    architecture_str: str
    architectures_str: List[str]
    # Additional properties
    is_64bit: bool
    is_signed: bool
    number_of_load_commands: int = 0
    load_commands_set: Optional[List[str]] = None
    number_of_segments: int = 0
    number_of_dylibs: int = 0
    number_of_imports: int = 0
    number_of_exports: int = 0
    entry_point: Optional[int] = None
    uuid: Optional[str] = None
    version_info: Optional[dict] = None
    version_info_str: Optional[dict] = None


@dataclass
class MachOSegment:
    """Mach-O segment information."""
    segment_name: str
    segment_vaddr: int
    segment_vsize: int
    segment_offset: int
    segment_size: int
    segment_max_vm_protection: int
    segment_initial_vm_protection: int
    segment_nsects: int
    segment_flags: int
    segment_entropy: float
    segment_sha256: str


@dataclass
class MachOImport:
    """Mach-O import information."""
    macho_imports_total: int
    macho_import_libraryName: Optional[list] = None
    macho_import_functions: Optional[list] = None


@dataclass
class MachOExport:
    """Mach-O export information."""
    macho_exports_total: int
    macho_export_symbols: Optional[list] = None


@dataclass
class MachODylib:
    """Mach-O dynamic library dependency."""
    dylib_name: str
    dylib_timestamp: int
    dylib_current_version: int
    dylib_compat_version: int


@dataclass
class MachOLoadCommand:
    """Mach-O load command."""
    load_command: int
    load_command_str: str
    load_command_size: int


@dataclass
class MachOUniversal:
    """Mach-O Universal/FAT binary information."""
    is_fat: bool
    architecture_count: int
    architectures: List[str]
    architecture_info: List[dict]
    fat_hash: Optional[str] = None
    fat_md5: Optional[str] = None
    fat_sha1: Optional[str] = None


@dataclass
class MachOCertificate:
    """Certificate information extracted from MachO code signature (mirrors PECertificate)."""
    subject: str
    issuer: str
    serial_number: str
    not_before: str
    not_after: str
    thumbprint: str  # SHA-1 (industry standard)
    certificate_type: str  # 'leaf', 'intermediate', 'root'
    order: int
    algorithm: Optional[str] = None
    common_name: Optional[str] = None
    organizational_unit: Optional[str] = None
    organization: Optional[str] = None


@dataclass
class MachOCodeDirectory:
    """Code Directory information from LC_CODE_SIGNATURE (simplified for malware analysis)."""
    identifier: Optional[str] = None  # Bundle ID
    team_id: Optional[str] = None     # Developer team ID
    flags: Optional[int] = None       # CD flags (includes CS_RUNTIME for hardened runtime)
    cd_hash: Optional[str] = None     # SHA-256 hash of the CodeDirectory itself


@dataclass
class MachOCodeSigningInfo:
    """Complete code signing information (mirrors PECodeSigningInfo)."""
    _id: str  # sha256
    signing_type: str  # 'certificate', 'ad-hoc', 'unsigned'
    has_signature: bool  # True if CMS signature structure present (not cryptographic verification)
    number_of_certificates: int
    code_directories: Optional[List[MachOCodeDirectory]] = None
    entitlements: Optional[Dict] = None
    x509_certificates: Optional[List[MachOCertificate]] = None
    date_signed: Optional[str] = None
    arch_identifier: Optional[str] = None  # For FAT binaries
    has_hardened_runtime: bool = False
    has_library_validation: bool = False
    has_runtime_version: bool = False


@dataclass
class MachOEntitlement:
    """Single entitlement entry for database export."""
    key: str
    value_type: str  # 'boolean', 'string', 'array', 'dict'
    value_bool: Optional[bool] = None
    value_string: Optional[str] = None
    value_array: Optional[List[str]] = None


# ============================================================================
# APK Dataclasses
# ============================================================================

@dataclass
class APKFeatures:
    """Core APK metadata and properties."""
    package_name: Optional[str] = None
    app_name: Optional[str] = None
    version_code: Optional[int] = None
    version_name: Optional[str] = None
    min_sdk_version: Optional[int] = None
    target_sdk_version: Optional[int] = None
    compile_sdk_version: Optional[int] = None
    main_activity: Optional[str] = None
    is_debuggable: bool = False
    allow_backup: bool = True
    uses_cleartext_traffic: bool = False
    supported_abis: List[str] = field(default_factory=list)
    dex_count: int = 0
    total_dex_size: int = 0
    total_file_count: int = 0
    has_native_code: bool = False
    has_assets: bool = False
    uses_libraries: List[str] = field(default_factory=list)
    earliest_content_modification: Optional[str] = None  # ISO 8601
    latest_content_modification: Optional[str] = None    # ISO 8601
    contains_embedded_apk: bool = False


@dataclass
class APKManifestComponent:
    """Single Android component (activity, service, receiver, provider)."""
    component_type: str      # "activity", "service", "receiver", "provider"
    class_name: str
    is_exported: bool
    intent_actions: List[str] = field(default_factory=list)
    intent_categories: List[str] = field(default_factory=list)


@dataclass
class APKManifest:
    """Full AndroidManifest.xml analysis."""
    activity_count: int
    service_count: int
    receiver_count: int
    provider_count: int
    activities: List[str] = field(default_factory=list)
    services: List[str] = field(default_factory=list)
    receivers: List[str] = field(default_factory=list)
    providers: List[str] = field(default_factory=list)
    exported_components: List[str] = field(default_factory=list)
    intent_filters_by_action: List[str] = field(default_factory=list)
    intent_filters_by_category: List[str] = field(default_factory=list)
    uses_features: List[str] = field(default_factory=list)
    meta_data: Optional[Dict] = None
    manifest_xml: Optional[str] = None  # Full decompiled XML text


@dataclass
class APKPermission:
    """Single permission entry for ClickHouse export."""
    permission_name: str
    protection_level: str    # "normal", "dangerous", "signature", "signatureOrSystem", "unknown"
    is_custom: bool = False  # True if declared by the app itself


@dataclass
class APKPermissions:
    """APK permission summary."""
    total_permission_count: int
    dangerous_permission_count: int
    permissions: List[str] = field(default_factory=list)
    dangerous_permissions: List[str] = field(default_factory=list)
    custom_permissions: List[str] = field(default_factory=list)
    permission_details: List[APKPermission] = field(default_factory=list)
    permhash: Optional[str] = None


@dataclass
class APKCertificate:
    """X.509 certificate from APK signature."""
    subject: str
    issuer: str
    serial_number: str
    valid_from: str
    valid_to: str
    thumbprint_sha1: str
    thumbprint_sha256: str
    algorithm: Optional[str] = None
    key_size: Optional[int] = None
    is_self_signed: bool = False
    certificate_source_scheme: Optional[str] = None  # 'v1', 'v2', 'v3', or 'v1,v2' etc. when deduplicated


@dataclass
class APKCodeSigningInfo:
    """Complete APK signing information."""
    _id: str  # sha256
    is_signed: bool
    signature_scheme_versions: List[int] = field(default_factory=list)
    number_of_certificates: int = 0
    x509_certificates: Optional[List[APKCertificate]] = None
    apk_signer_subject: Optional[str] = None
    apk_signer_issuer: Optional[str] = None


@dataclass
class APKDexFile:
    """Analysis of a single DEX file."""
    filename: str
    sha256: str
    class_count: int
    method_count: int
    string_count: int
    tlsh: Optional[str] = None
    top_packages: Optional[List[Dict]] = None
    api_usage: Optional[Dict[str, List[str]]] = None
    obfuscation_indicators: Optional[Dict] = None


@dataclass
class APKResource:
    """Embedded resource file entry."""
    path: str
    size: int
    sha256: str
    filetype_magika: str
    entropy: float = 0.0
    is_suspicious: bool = False


@dataclass
class APKNativeLib:
    """Native .so library entry."""
    abi: str
    filename: str
    size: int
    sha256: str
    is_known_packer: bool = False


@dataclass
class APKInconsistencyTests:
    """APK anomaly and anti-analysis detection results."""
    test_zip_bomb: Optional[bool] = None
    test_zip_duplicate_entries: Optional[bool] = None
    test_zip_path_traversal: Optional[bool] = None
    test_zip_suspicious_timestamps: Optional[bool] = None
    test_hidden_dex_files: Optional[bool] = None
    test_manifest_component_mismatch: Optional[bool] = None
    test_debuggable_release: Optional[bool] = None
    test_emulator_detection_strings: Optional[bool] = None
    test_debugger_detection: Optional[bool] = None
    test_root_detection: Optional[bool] = None


# ============================================================================
# APK Code Analysis Dataclasses
# ============================================================================

@dataclass
class APKDecompiledMethodContent:
    """Decompiled Java source for a single method (content table — deduplicated by hash)."""
    decompiled_method_hash: str
    decompiled_method: str
    decompiled_method_type: str
    decompiled_has_string_encryption: bool = False
    decompiled_has_reflection_calls: bool = False
    decompiled_excessive_goto_count: bool = False


@dataclass
class APKDecompiledMethodReference:
    """Links a specific APK to one of its decompiled methods (reference table)."""
    sha256: str
    sha1: str
    md5: str
    decompiled_method_hash: str
    smali_method_hash: Optional[str] = None
    decompiled_class_name: str = ""
    decompiled_method_name: str = ""
    decompiled_method_signature: str = ""
    decompiled_method_prototype: str = ""
    functions_caller: List[str] = field(default_factory=list)
    functions_call: List[str] = field(default_factory=list)


@dataclass
class APKSmaliMethodContent:
    """Smali disassembly for a single method (content table — deduplicated by hash)."""
    smali_method_hash: str
    smali_method: str
    smali_method_type: str
    smali_instructions_count: int = 0
    smali_register_count: int = 0
    smali_has_string_encryption: bool = False
    smali_has_reflection_calls: bool = False
    smali_excessive_goto_count: bool = False
    smali_flattened_score: float = 0.0
    smali_mba_score: float = 0.0


@dataclass
class APKSmaliMethodReference:
    """Links a specific APK to one of its smali methods (reference table)."""
    sha256: str
    sha1: str
    md5: str
    smali_method_hash: str
    decompiled_method_hash: Optional[str] = None
    smali_class_name: str = ""
    smali_method_name: str = ""
    smali_method_signature: str = ""
    ssdeep_smali: Optional[str] = None
    tlsh_smali: Optional[str] = None


@dataclass
class APKMethodSimilarityMetrics:
    """Similarity hashes for method-level clustering (keyed by smali hash)."""
    smali_method_hash: str
    cyclomatic_complexity: Optional[int] = None
    block_count: Optional[int] = None
    edge_count: Optional[int] = None
    loop_count: Optional[int] = None
    max_depth: Optional[int] = None
    max_fan_out: Optional[int] = None
    ssdeep_smali: Optional[str] = None
    tlsh_smali: Optional[str] = None
    ssdeep_smali_normalized: Optional[str] = None
    tlsh_smali_normalized: Optional[str] = None
    minhash: Optional[List[int]] = field(default_factory=list)


@dataclass
class APKCodeAnalysisError:
    """Error encountered during method analysis."""
    sha256: str
    class_name: Optional[str] = None
    method_name: Optional[str] = None
    error_location: str = ""
    error_message: Optional[str] = None
    error_type: Optional[str] = None


# ============================================================================
# JavaScript Dataclasses
# ============================================================================

@dataclass
class JSFeatures:
    """Core JavaScript file metadata and obfuscation metrics."""
    line_count: int = 0
    char_count: int = 0
    text_entropy: float = 0.0
    max_line_length: int = 0
    avg_line_length: float = 0.0
    is_minified: bool = False
    is_likely_obfuscated: bool = False
    obfuscator_name: Optional[str] = None
    obfuscation_score: int = 0
    obfuscation_techniques: List[str] = field(default_factory=list)
    eval_count: int = 0
    function_constructor_count: int = 0
    settimeout_setinterval_count: int = 0
    document_write_count: int = 0
    innerhtml_count: int = 0
    unescape_count: int = 0
    fromcharcode_count: int = 0
    atob_count: int = 0
    decodeuri_count: int = 0
    total_function_count: int = 0
    total_variable_count: int = 0
    max_nesting_depth: int = 0
    avg_identifier_length: float = 0.0
    hex_string_count: int = 0
    unicode_escape_count: int = 0
    long_string_count: int = 0
    base64_string_count: int = 0
    comment_ratio: float = 0.0
    script_type: str = "unknown"
    detected_environment: str = "unknown"