Hanlin Zhang - RankMe

Year	Rank	Type	Title / Venue / Authors
2026	J	`jnl`	Crowdsourced federated learning with inconsistent label representation. Inf. Fusion Yunlong He, Fei Chen, Hanlin Zhang, Jia Yu
2026	J	`jnl`	Enhancing the Policy Generalization on OOD Tasks via Latent Variable Distribution Enhancement Sampler. IEEE Trans. Neural Networks Learn. Syst. Shaobo Li, Jie Lin, Xiangyuan Yang, Hanlin Zhang, Peng Zhao
2026	J	`jnl`	KOG: A secret sharing-based scalable privacy-preserving training framework for decision trees. VLDB J. Gang Cheng, Hanlin Zhang, Jie Lin, Fanyu Kong, Hansong Xu, Kun Hua
2025	J	`jnl`	Enhancing adversarial transferability via transformation inference. Neural Networks Jiaxin Hu, Jie Lin, Xiangyuan Yang, Hanlin Zhang, Peng Zhao
2025	J	`jnl`	Fedai: Federated recommendation system with anonymized interactions. Expert Syst. Appl. Yunlong He, Lingtao Wei, Fei Chen, Hanlin Zhang, Jia Yu, Haiyang Wang
2025	J	`jnl`	How to Securely Outsource the Multiple Kernel Fuzzy Clustering Task in Edge Computing. IEEE Internet Things J. Xinrong Sun, Yunting Tao, Fanyu Kong, Qian Yu, Chunpeng Ge, Qiuliang Xu, Hanlin Zhang
2025	J	`jnl`	Improving Exploration in Deep Reinforcement Learning for Incomplete Information Competition Environments. IEEE Trans. Emerg. Top. Comput. Intell. Jie Lin, Yuhao Ye, Shaobo Li, Hanlin Zhang, Peng Zhao
2025	J	`jnl`	Privacy-Preserving Edge-Aided Eigenvalue Decomposition in Internet of Things. IEEE Internet Things J. Xiaotong Zhao, Hanlin Zhang, Jie Lin, Fan Liang, Fanyu Kong, Hansong Xu, Kun Hua
2025	J	`jnl`	Rethinking the optimization objective for transferable adversarial examples from a fuzzy perspective. Neural Networks Xiangyuan Yang, Jie Lin, Hanlin Zhang, Peng Zhao
2025	J	`jnl`	SLIoTDI: Scalable and Lightweight IoT Device Identification With Session-Level Grayscale Fingerprinting and Adversarial Training. IEEE Trans. Netw. Serv. Manag. Qian Lu, Zaiting Xu, Hanlin Zhang, Hequn Xian
2025	B	`conf`	SMART: a practical and robust client-side RAP detection approach. ICCCN Tong Sun, Qian Lu, Hanlin Zhang, Qianqian Su, Xinrui Ge
2025	J	`jnl`	SMCD: Privacy-preserving deep learning based malicious code detection. Comput. Secur. Gaoli Mu, Hanlin Zhang, Jie Lin, Fanyu Kong
2025	J	`jnl`	Towards efficient privacy-preserving conjunctive keywords search over encrypted cloud data. Future Gener. Comput. Syst. Yaru Liu, Xiaodong Xiao, Fanyu Kong, Hanlin Zhang, Jia Yu
2024	J	`jnl`	An auxiliary correction model implemented by the Correction Property of intermediate layer against adversarial examples. Appl. Soft Comput. Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2024	J	`jnl`	Bot-DM: A dual-modal botnet detection method based on the combination of implicit semantic expression and graphical expression. Expert Syst. Appl. Guangli Wu, Xingyue Wang, Qian Lu, Hanlin Zhang
2024	J	`jnl`	Eliminating Rogue Access Point Attacks in IoT: A Deep Learning Approach With Physical-Layer Feature Purification and Device Identification. IEEE Internet Things J. Zaikai Yang, Qian Lu, Hanlin Zhang, Fei Chen, Hequn Xian
2024	C	`conf`	Fast Distributed Polynomial Multiplication Algorithm for Lattice-based Cryptographic Decryption In Blockchain Systems. ISPA Hongjian Zhao, Yunting Tao, Fanyu Kong, Guoyan Zhang, Hanlin Zhang, Jia Yu
2024	J	`jnl`	Improving query efficiency of black-box attacks via the preference of deep learning models. Inf. Sci. Xiangyuan Yang, Jie Lin, Hanlin Zhang, Peng Zhao
2024	J	`jnl`	MRFE: A Deep-Learning-Based Multidimensional Radio Frequency Fingerprinting Enhancement Approach for IoT Device Identification. IEEE Internet Things J. Qian Lu, Zaikai Yang, Hanlin Zhang, Fei Chen, Hequn Xian
2024	J	`jnl`	Optimized verifiable delegated private set intersection on outsourced private datasets. Comput. Secur. Guangshang Jiang, Hanlin Zhang, Jie Lin, Fanyu Kong, Leyun Yu
2024	J	`jnl`	PVFL: Verifiable federated learning and prediction with privacy-preserving. Comput. Secur. Benxin Yin, Hanlin Zhang, Jie Lin, Fanyu Kong, Leyun Yu
2024	B	`conf`	Privacy-Preserving Edge Assistance for Solving Matrix Eigenvalue Problem. ICCCN Xiaotong Zhao, Hanlin Zhang, Jie Lin, Fanyu Kong, Leyun Yu
2024	B	`conf`	Privacy-Preserving Group Closeness Maximization. ICCCN Zihao Zhao, Sijia Cao, Hanlin Zhang, Jie Lin, Fanyu Kong, Leyun Yu
2024	—	`conf`	Privacy-preserving Deep Learning for Autism Spectrum Disorder Classification. SmartCloud Guangmao Gao, Hanlin Zhang, Jie Lin, Hansong Xu, Fanyu Kong, Leyun Yu
2024	J	`jnl`	Privacy-preserving outsourcing scheme of face recognition based on locally linear embedding. Comput. Secur. Yunting Tao, Yuqun Li, Fanyu Kong, Yuliang Shi, Ming Yang, Jia Yu, Hanlin Zhang
2024	J	`jnl`	Secure Edge-Aided Singular Value Decomposition in Internet of Things. IEEE Internet Things J. Yongjie Li, Hanlin Zhang, Jie Lin, Fan Liang, Hansong Xu, Xing Liu, Leyun Yu
2024	J	`jnl`	Secure Outsourcing Evaluation for Sparse Decision Trees. IEEE Trans. Dependable Secur. Comput. Zhixiang Zhang, Hanlin Zhang, Xiangfu Song, Jie Lin, Fanyu Kong
2023	J	`jnl`	A Deep-Reinforcement-Learning-Based Computation Offloading With Mobile Vehicles in Vehicular Edge Computing. IEEE Internet Things J. Jie Lin, Siqi Huang, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	J	`jnl`	A novel coalition game based distributed cooperative content caching in mobile edge networks. Veh. Commun. Jie Lin, Siqi Huang, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	J	`jnl`	A verifiable and privacy-preserving framework for federated recommendation system. J. Ambient Intell. Humaniz. Comput. Fei Gao, Hanlin Zhang, Jie Lin, Hansong Xu, Fanyu Kong, Guoqiang Yang
2023	J	`jnl`	Action density based frame sampling for human action recognition in videos. J. Vis. Commun. Image Represent. Jie Lin, Zekun Mu, Tianqing Zhao, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	C	`conf`	Efficient Privacy-Preserving Multi-Functional Data Aggregation Scheme for Multi-Tier IoT System. ISCC Yunting Tao, Fanyu Kong, Yuliang Shi, Jia Yu, Hanlin Zhang, Huiyi Liu
2023	J	`jnl`	Efficient, secure and verifiable outsourcing scheme for SVD-based collaborative filtering recommender system. Future Gener. Comput. Syst. Yunting Tao, Fanyu Kong, Yuliang Shi, Jia Yu, Hanlin Zhang, Xiangyi Wang
2023	J	`jnl`	Fuzziness-tuned: Improving the Transferability of Adversarial Examples. CoRR Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	J	`jnl`	Improving the Transferability of Adversarial Examples via Direction Tuning. CoRR Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	J	`jnl`	Improving the transferability of adversarial examples via direction tuning. Inf. Sci. Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2023	B	`conf`	Secure parallel Outsourcing Scheme for Large-scale Matrix Multiplication on Distributed Cloud Servers. ICPADS Yinlong Wang, Yunting Tao, Fanyu Kong, Zhaoquan Gu, Jia Yu, Hanlin Zhang
2023	B	`conf`	SecureGAN: Secure Three-Party GAN Training. ICCCN Sijia Cao, Hanlin Zhang, Yuhang Wang, Jie Lin, Fanyu Kong, Leyun Yu
2022	J	`jnl`	A Novel Lyapunov based Dynamic Resource Allocation for UAVs-assisted Edge Computing. Comput. Networks Jie Lin, Lin Huang, Hanlin Zhang, Xinyu Yang, Peng Zhao
2022	J	`jnl`	An Improved Outsourcing Algorithm to Solve Quadratic Congruence Equations in Internet of Things. IEEE Internet Things J. Xiulan Li, Jingguo Bi, Chengliang Tian, Hanlin Zhang, Jia Yu, Yanbin Pan
2022	J	`jnl`	Enhancing the Transferability of Adversarial Examples via a Few Queries. CoRR Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2022	J	`jnl`	FACM: Correct the Output of Deep Neural Network with Middle Layers Features against Adversarial Samples. CoRR Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2022	—	`conf`	MLPSI: Multi-party Privacy Set Intersection with Linear Complexity. ICBDT Benxin Yin, Hansong Xu, Xinliang Li, Jun Sun, Hanlin Zhang
2022	J	`jnl`	Machine Learning on Cloud With Blockchain: A Secure, Verifiable and Fair Approach to Outsource the Linear Regression. IEEE Trans. Netw. Sci. Eng. Hanlin Zhang, Peng Gao, Jia Yu, Jie Lin, Neal N. Xiong
2022	J	`jnl`	Mask-Guided Divergence Loss Improves the Generalization and Robustness of Deep Neural Network. CoRR Xiangyuan Yang, Jie Lin, Hanlin Zhang, Xinyu Yang, Peng Zhao
2022	J	`jnl`	Novel Secure Outsourcing of Modular Inversion for Arbitrary and Variable Modulus. IEEE Trans. Serv. Comput. Chengliang Tian, Jia Yu, Hanlin Zhang, Haiyang Xue, Cong Wang, Kui Ren
2022	B	`conf`	Privacy-Preserving and Verifiable Outsourcing Message Transmission and Authentication Protocol in IoT. TrustCom Hongjun Li, Fanyu Kong, Jia Yu, Hanlin Zhang, Luhong Diao, Yunting Tao
2022	J	`jnl`	Privacy-Preserving and verifiable SRC-based face recognition with cloud/edge server assistance. Comput. Secur. Xin Sun, Chengliang Tian, Changhui Hu, Weizhong Tian, Hanlin Zhang, Jia Yu
2022	J	`jnl`	Privacy-Preserving cloud-Aided broad learning system. Comput. Secur. Haiyang Liu, Hanlin Zhang, Li Guo, Jia Yu, Jie Lin
2022	J	`jnl`	SPPS: A Search Pattern Privacy System for Approximate Shortest Distance Query of Encrypted Graphs in IIoT. IEEE Trans. Syst. Man Cybern. Syst. Xinrui Ge, Jia Yu, Hanlin Zhang, Jianli Bai, Jianxi Fan, Neal N. Xiong
2022	J	`jnl`	Secure Edge-Aided Computations for Social Internet-of-Things Systems. IEEE Trans. Comput. Soc. Syst. Hanlin Zhang, Jia Yu, Mohammad S. Obaidat, Pandi Vijayakumar, Linqiang Ge, Jie Lin, Jianxi Fan, Rong Hao
2021	J	`jnl`	A novel Latency-Guaranteed based Resource Double Auction for market-oriented edge computing. Comput. Networks Jie Lin, Lin Huang, Hanlin Zhang, Xinyu Yang, Peng Zhao
2021	J	`jnl`	Blockchain Aided Privacy-Preserving Outsourcing Algorithms of Bilinear Pairings for Internet of Things Devices. CoRR Hanlin Zhang, Le Tong, Jia Yu, Jie Lin
2021	J	`jnl`	Blockchain-Aided Privacy-Preserving Outsourcing Algorithms of Bilinear Pairings for Internet of Things Devices. IEEE Internet Things J. Hanlin Zhang, Le Tong, Jia Yu, Jie Lin
2021	J	`jnl`	Lattice-based weak-key analysis on single-server outsourcing protocols of modular exponentiations and basic countermeasures. J. Comput. Syst. Sci. Yunhai Zheng, Chengliang Tian, Hanlin Zhang, Jia Yu, Fengjun Li
2021	J	`jnl`	Machine Learning on Cloud with Blockchain: A Secure, Verifiable and Fair Approach to Outsource the Linear Regression. CoRR Hanlin Zhang, Peng Gao, Jia Yu, Jie Lin, Neal N. Xiong
2021	J	`jnl`	Privacy-Preserving Cloud-Aided Broad Learning System. CoRR Haiyang Liu, Hanlin Zhang, Li Guo, Jia Yu, Jie Lin
2021	J	`jnl`	Secure Cloud-Aided Object Recognition on Hyperspectral Remote Sensing Images. IEEE Internet Things J. Peng Gao, Hanlin Zhang, Jia Yu, Jie Lin, Xiaopeng Wang, Ming Yang, Fanyu Kong
2021	J	`jnl`	Towards Achieving Keyword Search over Dynamic Encrypted Cloud Data with Symmetric-Key Based Verification. IEEE Trans. Dependable Secur. Comput. Xinrui Ge, Jia Yu, Hanlin Zhang, Chengyu Hu, Zengpeng Li, Zhan Qin, Rong Hao
2020	J	`jnl`	A novel multitype-users welfare equilibrium based real-time pricing in smart grid. Future Gener. Comput. Syst. Jie Lin, Biao Xiao, Hanlin Zhang, Xinyu Yang, Peng Zhao
2020	J	`jnl`	An Edge Computing Based Public Vehicle System for Smart Transportation. IEEE Trans. Veh. Technol. Jie Lin, Wei Yu, Xinyu Yang, Peng Zhao, Hanlin Zhang, Wei Zhao
2020	J	`jnl`	Blockchain-based two-party fair contract signing scheme. Inf. Sci. Liang Zhang, Hanlin Zhang, Jia Yu, Hequn Xian
2020	J	`jnl`	Efficient and Secure Outsourcing Scheme for RSA Decryption in Internet of Things. IEEE Internet Things J. Hanlin Zhang, Jia Yu, Chengliang Tian, Le Tong, Jie Lin, Linqiang Ge, Huaqun Wang
2020	J	`jnl`	How to Securely Outsource Finding the Min-Cut of Undirected Edge-Weighted Graphs. IEEE Trans. Inf. Forensics Secur. Pu Zhao, Jia Yu, Hanlin Zhang, Zhan Qin, Cong Wang
2020	J	`jnl`	How to securely outsource the extended euclidean algorithm for large-scale polynomials over finite fields. Inf. Sci. Qiang Zhou, Chengliang Tian, Hanlin Zhang, Jia Yu, Fengjun Li
2020	J	`jnl`	Practical and Secure Outsourcing Algorithms for Solving Quadratic Congruences in Internet of Things. IEEE Internet Things J. Hanlin Zhang, Jia Yu, Chengliang Tian, Guobin Xu, Peng Gao, Jie Lin
2020	J	`jnl`	Privacy-Preserving and Distributed Algorithms for Modular Exponentiation in IoT With Edge Computing Assistance. IEEE Internet Things J. Hongjun Li, Jia Yu, Hanlin Zhang, Ming Yang, Huaqun Wang
2019	J	`jnl`	An Energy Scheduling Strategy With Priority Within Islanded Microgrids. IEEE Access Xialei Zhang, Liang Guo, Hanlin Zhang, Lifeng Guo, Kai Feng, Jie Lin
2019	J	`jnl`	Practical and Secure Outsourcing Algorithms of Matrix Operations Based on a Novel Matrix Encryption Method. IEEE Access Shengxia Zhang, Chengliang Tian, Hanlin Zhang, Jia Yu, Fengjun Li
2019	—	`conf`	Secure Outsourcing Algorithm for Bilinear Pairings without Pre-Computation. DSC Le Tong, Jia Yu, Hanlin Zhang
2019	J	`jnl`	Secure Outsourcing Algorithm for Signature Generation in Privacy-preserving Public Cloud Storage Auditing. J. Inf. Sci. Eng. Pu Zhao, Jia Yu, Hanlin Zhang
2018	Misc	`conf`	A Framework to Enable Multiple Coexisting Internet of Things Applications. ICNC Wei Yu, Hanlin Zhang, Yalong Wu, David W. Griffith, Nada Golmie
2018	J	`jnl`	Cloud Storage for Electronic Health Records Based on Secret Sharing With Verifiable Reconstruction Outsourcing. IEEE Access Hanlin Zhang, Jia Yu, Chengliang Tian, Pu Zhao, Guobin Xu, Jie Lin
2018	J	`jnl`	Enabling Efficient Verifiable Fuzzy Keyword Search Over Encrypted Data in Cloud Computing. IEEE Access Xinrui Ge, Jia Yu, Chengyu Hu, Hanlin Zhang, Rong Hao
2018	J	`jnl`	Enabling secure auditing and deduplicating data without owner-relationship exposure in cloud storage. Clust. Comput. Huiying Hou, Jia Yu, Hanlin Zhang, Yan Xu, Rong Hao
2018	J	`jnl`	Intrusion-resilient identity-based signatures: Concrete scheme in the standard model and generic construction. Inf. Sci. Jia Yu, Rong Hao, Hui Xia, Hanlin Zhang, Xiangguo Cheng, Fanyu Kong
2017	J	`jnl`	A Survey on Internet of Things: Architecture, Enabling Technologies, Security and Privacy, and Applications. IEEE Internet Things J. Jie Lin, Wei Yu, Nan Zhang, Xinyu Yang, Hanlin Zhang, Wei Zhao
2017	J	`jnl`	How to securely outsource the inversion modulo a large composite number. J. Syst. Softw. Qianqian Su, Jia Yu, Chengliang Tian, Hanlin Zhang, Rong Hao
2017	J	`jnl`	Light-weight and privacy-preserving secure cloud auditing scheme for group users via the third party medium. J. Netw. Comput. Appl. Wenting Shen, Jia Yu, Hui Xia, Hanlin Zhang, Xiuqing Lu, Rong Hao
2017	J	`jnl`	Remote data possession checking with privacy-preserving authenticators for cloud storage. Future Gener. Comput. Syst. Wenting Shen, Guangyang Yang, Jia Yu, Hanlin Zhang, Fanyu Kong, Rong Hao
2016	C	`conf`	A streaming-based network monitoring and threat detection system. SERA Zhijiang Chen, Hanlin Zhang, William G. Hatcher, James H. Nguyen, Wei Yu
2016	B	`conf`	Ultra-Dense Networks: Survey of State of the Art and Future Directions. ICCCN Wei Yu, Hansong Xu, Hanlin Zhang, David W. Griffith, Nada Golmie
2015	J	`jnl`	A cloud computing based system for cyber security management. Int. J. Parallel Emergent Distributed Syst. Guobin Xu, Wei Yu, Zhijiang Chen, Hanlin Zhang, Paul Moulema, Xinwen Fu, Chao Lu
2015	—	`conf`	ScanMe mobile: a local and cloud hybrid service for analyzing APKs. RACS Yevgeniy Cole, Hanlin Zhang, Linqiang Ge, Sixiao Wei, Wei Yu, Chao Lu, Genshe Chen, Dan Shen, Erik Blasch, Khanh D. Pham
2013	B	`conf`	On behavior-based detection of malware on Android platform. GLOBECOM Wei Yu, Hanlin Zhang, Linqiang Ge, Rommie L. Hardy
2013	—	`conf`	On effective data aggregation techniques in Host-based Intrusion Detection in MANET. CCNC Difan Zhang, Linqiang Ge, Rommie L. Hardy, Wei Yu, Hanlin Zhang, Robert J. Reschly
2013	J	`jnl`	On effective data aggregation techniques in host-based intrusion detection in MANET. Int. J. Secur. Networks Difan Zhang, Linqiang Ge, Wei Yu, Hanlin Zhang, Rommie L. Hardy, Robert J. Reschly

# REDB Test Suite

## Running Tests

```bash
# All unit tests (no external dependencies, fast)
pytest tests/unit/                    # 784 tests, ~4s

# Integration tests (requires pefile, elftools, magic, etc.)
pytest tests/integration/             # ~209 tests

# By binary format
pytest -m pe                          # PE-specific tests
pytest -m elf                         # ELF-specific tests
pytest -m macho                       # Mach-O-specific tests
pytest -m apk                         # APK-specific tests

# By category
pytest -m dataclass                   # Dataclass construction tests
pytest -m exporters                   # Database exporter tests

# Decompiler / Binary Ninja tests only (mocked, no license needed)
pytest tests/unit/test_decompile_*.py # 227 tests, ~1s
pytest -k decompile                   # Same, by keyword

# Individual decompiler module
pytest tests/unit/test_decompile_utils.py        # Hashes, JSON encoder, normalization
pytest tests/unit/test_decompile_similarity.py   # MinHash
pytest tests/unit/test_decompile_ioc_extractor.py # IOC scraping & extraction
pytest tests/unit/test_decompile_analysis.py     # CFG, disassembly, LLIL analysis
pytest tests/unit/test_decompile_binja_extractor.py # DecompileBinja + ClickHouse schemas
pytest tests/unit/test_decompile_decompiler.py   # BinaryNinjaDecompiler orchestration
pytest tests/unit/test_decompile_arch.py         # x86 architecture, opcode categories
pytest tests/unit/test_decompile_scores.py       # Obfuscation scores
pytest tests/unit/test_decompile_strings.py      # String analysis
pytest tests/unit/test_decompile_function_type.py # Function type classification

# Combinations
pytest -m "pe and unit"               # PE unit tests only
pytest -m "elf and integration"       # ELF integration tests
pytest -m "unit and not exporters"    # Unit tests excluding exporters

# Run everything
pytest                                # All tests (requires full deps)

# Verbose with short traceback
pytest -v --tb=short

# Stop on first failure
pytest -x
```

---

## Directory Structure

```
tests/
├── conftest.py                        # Shared fixtures for all tests
├── TEST_INDEX.md                      # This file
├── DECOMPILE_TEST_PLAN.md             # Detailed test plan for decompiler modules
├── __init__.py
│
├── unit/                              # Tests with NO external dependencies
│   ├── __init__.py
│   ├── conftest.py                    # Stubs for heavy imports (magic, pefile, etc.)
│   ├── conftest_binja_stubs.py        # Binary Ninja stubs (enums, mock factories)
│   ├── test_database_exporters.py     # 28 tests — ClickHouse, Elasticsearch, Print
│   ├── test_dataclasses.py            # 46 tests — All data model dataclasses
│   ├── test_macho_dataclasses.py      # 20 tests — Mach-O dataclasses
│   ├── test_apk_dataclasses.py       # 24 tests — APK dataclasses + Tag enum
│   ├── test_apk_extractors.py        # 61 tests — APK extractors, base class, worker dispatch
│   ├── test_apk_code_analyzer.py     # 48 tests — APKCodeAnalyzer, LibraryFilter, SmaliParser
│   ├── test_apk_jadx_wrapper.py      # 13 tests — JADX subprocess, output parsing, timeouts
│   ├── test_apk_apktool_wrapper.py   # 12 tests — Apktool subprocess, smali dir detection
│   ├── test_apk_method_extractor.py  # 32 tests — Hashing, obfuscation, type conversion
│   ├── test_apk_process_method.py   # 29 tests — _process_method androguard integration, xrefs
│   ├── test_apk_strings_ioc.py      # 30 tests — APK string extraction, IOC integration
│   ├── test_apk_decompile_extractor.py # 40 tests — DecompileAPK extractor, export, schema
│   ├── test_decompile_utils.py        # 20 tests — Hashes, JSON encoder, normalization
│   ├── test_decompile_similarity.py   # 27 tests — MinHashCustom, MinHasher
│   ├── test_decompile_ioc_extractor.py # 34 tests — IOCScraper, IOCExtractorFromResults
│   ├── test_decompile_analysis.py     # 44 tests — CFG, disassembly, LLIL analysis
│   ├── test_decompile_binja_extractor.py # 36 tests — DecompileBinja + export schemas
│   ├── test_decompile_decompiler.py   # 21 tests — BinaryNinjaDecompiler orchestration
│   ├── test_decompile_arch.py         # 18 tests — ArchitectureCreator, Arch_x86
│   ├── test_decompile_scores.py       # 11 tests — ObfuscationScores
│   ├── test_decompile_strings.py      #  9 tests — StringAnalysis
│   ├── test_decompile_function_type.py #  7 tests — FunctionType enum + analysis
│   └── test_force_reprocessing.py     # 77 tests — --force flag, dedup bypass, YARA dedup
│
├── integration/                       # Tests requiring real binaries & libs
│   ├── __init__.py
│   ├── test_base_extractor.py
│   ├── test_basicproperties.py
│   ├── test_elf_extractor.py
│   ├── test_elf_extractors.py
│   ├── test_hashes.py
│   ├── test_pe_extractor.py
│   └── test_pe_extractors.py
│
└── scripts/                           # Manual CLI tools (not pytest)
    ├── test_linking.py
    └── test_macho_extractors_local.py
```

---

## Unit Tests (`tests/unit/`)

Unit tests run without any external dependencies. The `tests/unit/conftest.py`
stubs out heavy imports (`elasticsearch`, `clickhouse_connect`, `magic`, `pefile`,
etc.) so these tests execute in any environment.

### `test_database_exporters.py`
**Markers:** `unit`, `exporters` | **28 tests**

Tests for the database exporter classes in `redb/extractors/database_exporters.py`:

- **PrintExporter**: Initialization, exporting dataclasses/dicts/lists, handling None/empty data
- **ElasticsearchExporter**: Initialization, export with mocked client, error handling, custom IDs
- **ClickHouseExporter**: Initialization, tuple/multi-table exports, null/array handling, connection context manager
- **DatabaseExporter ABC**: Verifies abstract base class cannot be instantiated directly
- **Edge cases**: Nested data, datetime serialization, type conversions

### `test_dataclasses.py`
**Markers:** `unit`, `dataclass` | **46 tests**

Comprehensive tests for all dataclasses in `redb/models/dataclasses.py` (excluding Mach-O):

- **Hash / Hashes**: Required fields, optional PE/ELF/Mach-O hash fields, defaults
- **BasicProperties**: Required fields, FAT Mach-O fields (`is_fat`, `child_sha256`, etc.)
- **DIEinfo / CAPA**: Creation with default and populated fields
- **String**: String metadata with hash associations
- **PE dataclasses**: PE, PEImport, PESection, PEResource, PEOverlay, PESigner, PECertificate, PECodeSigningInfo, PEExtraFinding, PEDotNet, PEInconsistencyTests, DotNetInconsistencyTests
- **ELF dataclasses**: ELFFeatures, ELFDependency, ELFImport, ELFExport, ELFSection, ELFSegment, ELFSymbol, ELFRelocation, ELFNote
- **YARA dataclasses**: YaraRule, YaraMatch
- **Decompiled**: Decompiled function metadata

### `test_macho_dataclasses.py`
**Markers:** `unit`, `dataclass`, `macho` | **20 tests**

Tests for Mach-O dataclasses in `redb/models/dataclasses.py`:

- **MachO**: Required/optional fields, architecture lists, flags
- **MachOSegment**: Segment properties, entropy, hashes
- **MachOImport / MachOExport**: Import/export totals and lists
- **MachODylib**: Dynamic library dependencies
- **MachOLoadCommand**: Load command types and sizes
- **MachOUniversal**: FAT binary detection, architecture info
- **MachOCertificate**: Code signing certificate fields
- **MachOCodeDirectory**: Bundle ID, team ID, CD hash
- **MachOCodeSigningInfo**: Signing type (certificate/ad-hoc/unsigned), entitlements
- **MachOEntitlement**: Boolean/string/array entitlement values

### `test_apk_dataclasses.py`
**Markers:** `unit`, `dataclass`, `apk` | **24 tests**

Tests for APK dataclasses in `redb/models/dataclasses.py`:

- **APKFeatures**: Required fields (package_name, app_name, version_code, version_name), optional field defaults (SDK versions, debuggable, backup, ABIs, DEX counts), fully populated creation, asdict roundtrip
- **APKManifestComponent**: Creation with intent filters, default empty lists
- **APKManifest**: Required counts, optional list defaults, fully populated with XML
- **APKPermission / APKPermissions**: Permission creation, custom permissions, dangerous classification, permission details with permhash
- **APKCertificate / APKCodeSigningInfo**: Certificate fields, optional algorithm/key_size, signing info with scheme versions and certificate list
- **APKDexFile**: Required fields, optional TLSH/API usage/obfuscation indicators, TLSH populated
- **APKResource**: Creation, suspicious flag
- **APKNativeLib**: Creation, known packer detection
- **APKInconsistencyTests**: All 10 test fields default to None, fully populated, field count validation (exactly 10)
- **Hashes.permhash**: Default None, populated 64-char hash
- **Tag enum**: All 8 APK tags exist with correct values

### `test_apk_extractors.py`
**Markers:** `unit`, `apk` | **62 tests**

Tests for all 8 APK extractors, base class, module registry, and worker dispatch:

- **APKFeaturesExtractor**: tag(), get_clickhouse_table(), extract() returns APKFeatures dataclass, detects native code/assets, handles missing version_code, prepare_export_data() for ClickHouse (tuple format with column names/types), Elasticsearch (dataclass), and None when no extract
- **APKManifestExtractor**: tag(), table, extract() returns APKManifest with component counts
- **APKPermissionsExtractor**: tag(), table, extract() returns APKPermissions, classifies dangerous permissions, handles no-permission APKs
- **APKSignatureExtractor**: tag(), table, detects v1/v2/v3 signature schemes, handles unsigned APKs, certificate subject/issuer uses RFC 4514 short names (CN=, O=) not long names
- **APKDexExtractor**: tag(), table, extract() returns list of APKDexFile with mocked androguard DEX parser, TLSH computation for sufficient data, TLSH None for small DEX (<50 bytes), ClickHouse export includes dex_tlsh column, returns None for no DEX
- **APKResourceExtractor**: tag(), table, extract() returns dict with resources list
- **APKNativeLibExtractor**: tag(), table, finds native libs in ZIP, detects known packer libs (libjiagu.so), returns None for no libs
- **APKInconsistencyTestsExtractor**: tag(), table, extract() returns APKInconsistencyTests dataclass
- **APKModuleRegistry**: All 8 APK modules registered in workers.py get_module_by_name(), correct class mappings
- **APKWorkerDispatch**: APK excluded from DIE/BasicProperties/Hash general guards (source inspection), APK dispatch branch exists with all 8 extractors, APK branch runs BasicPropertiesExtractor and HashExtractor
- **APKExtractorBase**: binary property returns file content, _is_valid_apk() with/without APK object, _list_files(), _get_zip_file(), SHA256 matches file content

### `test_apk_code_analyzer.py`
**Markers:** `unit`, `apk`, `decompile` | **48 tests**

Tests for APK code analysis core components:

- **LibraryFilter**: Default prefixes loaded, user classes not filtered, Dalvik descriptor format, custom prefixes, env var override, filter stats, class name normalization, Google/Kotlin/third-party libs filtered, empty class name
- **SmaliParser**: Parse smali content, method names/class names/signatures extracted, instruction/register counts, abstract/native skipped, normalization (strips .line directives, comments), count_instructions, make_method_key, parse_smali_file, parse_smali_directory, empty/class-only files
- **MethodExtractor**: SHA-256 determinism/length/different inputs, ssdeep/TLSH for short/long input, Dalvik-to-Java class/type conversion, Java prototype generation, obfuscation detection (short names, string encryption, reflection, excessive goto), Dalvik param parsing
- **APKCodeAnalyzer**: Init defaults/custom timeout/env var, extract returns correct dict keys, androguard failure handling, cleanup removes temp dirs, Java normalization

### `test_apk_jadx_wrapper.py`
**Markers:** `unit`, `apk`, `decompile` | **13 tests**

Tests for JADX subprocess wrapper:

- **Init**: Default/custom path, env var override
- **Decompile**: Success, non-zero exit, timeout handling (SIGTERM/SIGKILL), not found, command args verification
- **Output parsing**: Empty directory, Java file parsing, method extraction, method declaration detection, control flow exclusion, static methods

### `test_apk_apktool_wrapper.py`
**Markers:** `unit`, `apk`, `decompile` | **12 tests**

Tests for apktool subprocess wrapper:

- **Init**: Default/custom path, env var override
- **Disassemble**: Success, failure, timeout, not found, command args
- **Smali directories**: Single DEX, multi-DEX (smali_classes2, smali_classes3), empty dir, nonexistent path

### `test_apk_method_extractor.py`
**Markers:** `unit`, `apk`, `decompile` | **32 tests**

Tests for method-level hashing, obfuscation detection, and type conversion:

- **Hashing**: SHA-256 determinism/length/uniqueness, ssdeep/TLSH null for short input
- **Obfuscation**: Short method/class names, string encryption detection, reflection calls, excessive goto (including goto/16)
- **Type conversion**: All Dalvik primitives, object types, arrays, empty
- **Prototypes**: Simple methods, multi-param, object return, empty signature
- **Param parsing**: Empty, single/multiple primitives, objects, mixed, arrays

### `test_apk_process_method.py`
**Markers:** `unit`, `apk`, `decompile` | **29 tests**

Mock-based tests for `APKCodeAnalyzer._process_method` and androguard integration:

- **XrefExtraction**: androguard 4.x xref format (MethodAnalysis wrapper unwrap), 3.x fallback (direct EncodedMethod), empty xrefs, xref exception resilience, multiple callers/callees
- **MethodFiltering**: External method skipping, library method filtering, min instruction threshold (below/at threshold)
- **SmaliLookup**: Apktool smali used when available, androguard fallback disassembly, no-code skip, bytecode exception handling
- **OutputPopulation**: All 6 result dict keys populated (smali_content, smali_refs, decompiled_content, decompiled_refs, similarity_metrics with block_features), content deduplication (smali and decompiled)
- **DisassembleWithAndroguard**: No code returns None, no bytecode returns None, basic disassembly, invoke operand normalization (brace wrapping), bytecode exception handling

### `test_apk_strings_ioc.py`
**Markers:** `unit`, `apk` | **30 tests**

Tests for APK string extraction and IOC extraction integration:

- **StringEntropy**: Empty/single/repeated chars, two-char entropy = 1.0, higher variety = higher entropy, URL string entropy
- **ExtractStrings**: Basic extraction, field schema (string, encoding, offset, length, entropy), deduplication across DEX files, empty/null string filtering, no DEX files, DEX returning None, DEX exception handling, entropy computed, incremental offsets, URL preservation
- **ExtractStringsIntegration**: Strings included in extract() output, string extraction error is non-fatal (recorded in analysis_errors)
- **DecompileAPKStringsExport**: Strings table present in export, schema validation (7 columns), SHA256 propagation, empty strings not exported
- **IOCExtractorAPKFormat**: IOCs from APK strings, IOCs from decompiled_content (APK key), LIBRARY methods skipped, combined Binja+APK sources, APK-only results (no 'decompiled' key), source_type correctness (STRING vs DECOMPILED_FUNCTION)
- **WorkerAPKIOCWiring**: Verify workers.py has IOCExtractorFromResults in APK branch

### `test_apk_decompile_extractor.py`
**Markers:** `unit`, `apk`, `decompile` | **40 tests**

Tests for DecompileAPK extractor and ClickHouse export schemas:

- **DecompileAPK**: tag(), get_clickhouse_table(), timeout defaults/env/invalid, calculate_md5(), context manager, cleanup_run()
- **Export schemas**: Returns None when no results, multi_table flag, all 6 table keys present, per-table schema validation (column names, types, data row length), SHA-256 propagation to refs, empty tables excluded, non-ClickHouse returns None
- **Dataclasses**: APKDecompiledMethodContent, APKDecompiledMethodReference, APKSmaliMethodContent, APKSmaliMethodReference, APKMethodSimilarityMetrics, APKCodeAnalysisError — defaults, populated, asdict roundtrip
- **Tag enum**: APK_DECOMPILED exists with correct value
- **Worker integration**: DecompileAPK registered in modules, dispatch source includes DecompileAPK

---

## Decompiler Unit Tests (`tests/unit/test_decompile_*.py`)

These 227 tests cover the `redb/extractors/decompiler/` subtree and the
`redb/extractors/ioc_extractor/` module. Binary Ninja is **not required** --
all BN dependencies are mocked via `conftest_binja_stubs.py`.

**Source modules tested:** `bninja/utils/`, `bninja/similarity/`, `bninja/arch/`,
`bninja/analysis/`, `bninja/decompiler.py`, `bninja/function_type.py`,
`DecompileBinja.py`, `ioc_extractor/`.

### Binary Ninja Stubs (`conftest_binja_stubs.py`)

Not a test file -- provides the mocking infrastructure used by all `test_decompile_*.py` files.

- **Stub enums**: `BranchType`, `InstructionTextTokenType`, `SymbolType`, `HighLevelILOperation`, `LowLevelILOperation` as real `IntEnum` classes matching Binary Ninja's values
- **Mock factories**: `MockInstructionToken`, `MockBasicBlock`, `MockFunction`, `MockBinaryView`, `MockILInstruction`, `MockLLILFunction`, `MockHLILInstruction`, `MockEdge`, `MockSymbol`
- **Module stubs**: Injects mock `binaryninja`, `binaryninja.enums`, `binaryninja.lowlevelil`, `binaryninja.highlevelil`, `binaryninja.mediumlevelil` into `sys.modules`

### `test_decompile_utils.py`
**20 tests** | Source: `bninja/utils/hashes.py`, `bninja/utils/json_encoder.py`, `bninja/analysis/low_level_normalization.py`

- **TestCalculateMD5**: Known values, empty string
- **TestCalculateSHA256**: Known values, empty string, 64-char hex output
- **TestCalculateTLSH**: Long data (>=50 bytes), short data returns None, determinism
- **TestCalculateSSDeep**: Valid data, short data returns None, determinism
- **TestBinaryNinjaEncoder**: Objects with `.value`/`.confidence`, `__str__` fallback, standard types, unsupported types raise TypeError
- **TestLowLevelNormalization**: Single instruction, nested operands, empty operands, list operands, None input, deep nesting

### `test_decompile_similarity.py`
**27 tests** | Source: `bninja/similarity/minhashcustom.py`, `bninja/similarity/minhasher.py`

- **TestMinHashCustom**: Default construction, init from signature/bytes, both-raises ValueError, set/get roundtrip, truncation to `2^MINHASH_BITS`, `hashData()` for string/bytes/list/unsupported types, identical/different scores, 8-bit vs 32-bit modes, `scoreAgainst()` instance method
- **TestMinHasher**: n-gram generation (basic, short input, exact-n), minhash calculation (empty function, determinism, output length, value range), shingle hash determinism, seed reproducibility

### `test_decompile_ioc_extractor.py`
**34 tests** | Source: `ioc_extractor/standalone_ioc_extractor.py`, `ioc_extractor/ioc_extractor.py`

- **TestIOCScraper**: IPv4 (excluded private/reserved IPs, valid public), IPv6, URLs, defanged URLs (`hxxps://`, `[.]`), emails, FQDNs (valid + excluded domains), `.onion` addresses, MD5/SHA1/SHA256 hashes, hash deduplication (SHA256 not also emitted as MD5/SHA1 substring), invalid hashes (all zeros/low entropy), CVE/CWE identifiers, BTC/ETH crypto addresses, Linux/Windows file paths, server `ip:port` patterns, deduplication within text, empty text
- **TestIOCExtractorFromResults**: Extract from strings, extract from decompiled functions (Binja + APK formats), skip LIBRARY/THUNK functions, handle bytes-encoded strings, empty results, ClickHouse export format, print export format, no-IOCs returns None, `get_clickhouse_table()`, `tag()`

### `test_decompile_analysis.py`
**44 tests** | Source: `bninja/analysis/cfg.py`, `bninja/analysis/disassembly.py`, `bninja/analysis/low_level.py`

- **TestCFGAnalysis**: Cyclomatic complexity (linear, branch, loop), CFG structure extraction, block JSON schema (14 fields), branch types (RETURN, CONDITIONAL, DIRECT, CALL, FALLTHROUGH, UNKNOWN), block types (CODE, THUNK, DATA), BFS depth map, sequential block IDs, block flags (EntryBlock, ExitBlock, LoopBlock), dominators, post-dominators
- **TestDisassemblyAnalysis**: `get_json()` structure (12+ keys), hash determinism, instruction type collection, memory patterns (MEM_STACK, MEM_DIRECT, MEM_SCALED_INDEX, MEM_BASE_OFFSET), register usage (GPR, SIMD, FPU), data reference counting, max block size, CALL counting, stack size estimation, opcode normalization
- **TestLowLevelAnalysis**: Return type `(dict, list)`, JSON schema (15 keys), control flow counting, memory patterns, register usage reads/writes, data references, CALL+TAILCALL counting, instruction type collection, normalized instruction lists, negative offset clamping

### `test_decompile_binja_extractor.py`
**36 tests** | Source: `DecompileBinja.py`

- **TestDecompileBinja**: `calculate_md5()`, timeout defaults (BINJA=1200, DECOMPILE=2580), timeout from env vars, invalid env fallback, `.NET` detection (non-PE, with/without COM descriptor), Go detection (ELF with `.gopclntab`, ELF without, PE with Go strings, non-PE/ELF), `tag()` returns `"decompiled"`, context manager protocol, `cleanup_run()` state clearing, goresym file cleanup, thread timeout handling, hash propagation on successful extract, .NET binary skipping, goresym invocation for Go
- **TestPrepareExportData (ClickHouse schemas)**: Returns None when no results, `multi_table: True` flag, all 10 table keys present, schema validation for each table (decompiled_content, decompiled_refs, disassembled_content, disassembled_refs, llil_content, llil_refs, cfg_blocks_content, cfg_blocks_refs, function_similarity_metrics, strings_raw, function_analysis_errors), golang_metadata presence/absence, array field None-to-empty, list pass-through, register usage map conversion

### `test_decompile_decompiler.py`
**21 tests** | Source: `bninja/decompiler.py`

- **TestBinaryNinjaDecompiler**: `log_error()` appending and schema (7 keys), `is_too_few_blocks()` for None/empty/small-single/large-single/multiple blocks, `is_lib_or_thunk()` for USER/THUNK/EXTERNAL functions, `analyze_binary()` cross-linkage (HLIL-disasm, LLIL-disasm, CFG-disasm bidirectional hashes), cyclomatic complexity propagation, fuzzy hash calculation (ssdeep/tlsh), `extract()` success/failure, `tag()`, GoReSym application (user functions, std functions, invalid JSON handling)

### `test_decompile_arch.py`
**18 tests** | Source: `bninja/arch/creator.py`, `bninja/arch/x86.py`

- **TestArchitectureCreator**: Create x86, case-insensitive lookup, unsupported architecture raises ValueError
- **TestArchX86**: Register classification (`is_register`, `is_general_purpose_register`, `is_stack_register`, `is_xmm_register`, `is_simd_register`), opcode categories populated and correct (MOV->DATA_MOVEMENT, CALL->CONTROL_FLOW, ADD->ARITHMETIC, JNZ->CONDITIONAL_JUMP), `is_control_flow_instruction_by_mnemonic()` for JMP/CALL/RET/LOOP/MOV/empty

### `test_decompile_scores.py`
**11 tests** | Source: `bninja/analysis/scores.py`

- **TestObfuscationScores**: `flattened_score()` with no back edges (0.0), with loop (>0.0), fully flattened CFG (~1.0); `MBA_score()` with no mixed ops (0.0), some mixed (>0.0), all mixed (1.0); `get_dominated_by()` BFS; `uses_mba()` for arithmetic-only, logic-only, mixed

### `test_decompile_strings.py`
**9 tests** | Source: `bninja/analysis/strings.py`

- **TestStringAnalysis**: Entropy edge cases (empty string->0.0, single char->0.0, uniform distribution->2.0, binary->1.0), deduplication by (string, encoding), sorted by lowest offset, empty binary view, output schema validation (7 required fields)

### `test_decompile_function_type.py`
**7 tests** | Source: `bninja/function_type.py`

- **TestFunctionType**: Enum values (USER, LIBRARY, EXTERNAL, THUNK, UNKNOWN)
- **TestFunctionTypeAnalysis**: Regular function->USER, ImportedFunctionSymbol->EXTERNAL, LibraryFunctionSymbol->LIBRARY, `is_thunk=True` overrides to THUNK, exception in symbol access->UNKNOWN

### `test_force_reprocessing.py`
**77 tests** | Source: `start.py`, `redb/ingestor.py`, `redb/queries.py`

- **TestForceCliArgument**: `--force` flag default/explicit, `--modules` does not implicitly enable force, explicit `--force` required with specific modules
- **TestPerFileDedupBypass**: Default calls `is_in_db` and skips, `force=True` skips `is_in_db` check, decompile mode skips `is_in_db` (existing behavior)
- **TestBulkDedupBypass**: `fetch_s3_objects_by_repository` and `fetch_s3_objects_by_date_range` call/skip `is_in_db_bulk` based on force flag, force preserves all rows
- **TestIngestorForceParam**: Ingestor defaults `force=False`, stores `force=True` when passed
- **TestForceThreading**: `_process_file_internal`, `process_file`, `process_s3_file`, `process_zip_file`, `process_7zip_file` correctly thread `force` parameter through to `process_binary_file`
- **TestAnalyzedCliArgument**: `--analyzed` flag default/explicit, mutual exclusivity with `--path`/`--s3`, combinability with `--decompile`/`--modules`/`--magika`/`--force`, no `--repo` required
- **TestFetchAnalyzedSamples**: Queries `basic_properties` table, magika filter, decompile mode filters already-decompiled, force skips decompile check, analysis mode no filtering, missing S3_BUCKET, empty results, bytes SHA256 handling, exception handling, yara_scan bypass, CLICKHOUSE_CODE_PREFIX env var
- **TestIngestorAnalyzedParam**: Ingestor defaults `analyzed=False`, stores `analyzed=True`, combined with `decompile`
- **TestAnalyzedReExport**: `fetch_analyzed_samples` importable from `redb.ingestor`
- **TestYaraForceDedup**: `is_in_db_bulk` YARA path queries `yara_matches` with `unhex()`, handles empty table/bytes response/DB errors, `fetch_s3_objects_by_repository` and `fetch_analyzed_samples` respect `--force` for YARA dedup, `_check_yara_matches_bulk` batching

---

## Integration Tests (`tests/integration/`)

Integration tests require external dependencies (`pefile`, `elftools`, `magic`,
`signify`, `ppdeep`, `tlsh`, etc.) and use real test binaries from `test_files/`.

### `test_base_extractor.py`
**Markers:** `integration`

Tests for the base `Extractor` class in `redb/extractors/extractor.py`:

- **Static methods**: `process_binary_string()`, `remove_non_utf8()`
- **Entropy calculation**: High/low entropy data, edge cases
- **Initialization**: With/without exporters, logger setup
- **Export pipeline**: `export_data()` with PrintExporter

### `test_basicproperties.py`
**Markers:** `integration`

Tests for `BasicPropertiesExtractor` in `redb/extractors/basicproperties.py`:

- **Initialization**: With ELF/PE binaries, parent_sha256 parameter
- **Extraction**: Filename, filesize, filetype detection (magic/magika), entropy
- **FAT Mach-O support**: `is_fat`, `child_sha256`, `child_architecture`, `child_filetype`
- **ClickHouse export**: Column names and types for database schema
- **Dataclass validation**: BasicProperties field structure

### `test_hashes.py`
**Markers:** `integration`

Tests for `HashExtractor` in `redb/extractors/hashes.py`:

- **Initialization**: With ELF/PE/Mach-O objects
- **Hash extraction**: MD5, SHA1, SHA256, ssdeep, TLSH
- **PE-specific hashes**: Authentihash, imphash, richhash
- **Mach-O hashes**: dylib_hash, import_hash, export_hash, entitlement_hash, symhash
- **ClickHouse export**: Hashes dataclass columns
- **Consistency**: Same file produces same hashes, lowercase hex, correct lengths

### `test_pe_extractor.py`
**Markers:** `integration`, `pe`

Tests for base `PEExtractor` class in `redb/extractors/pe_extractor.py`:

- **Initialization**: With file path or provided pefile object
- **PE parsing**: Headers, architecture detection, .NET detection
- **Compilation timestamp**: Extraction and UTC conversion
- **Helper methods**: Section/import/export counts

### `test_pe_extractors.py`
**Markers:** `integration`, `pe`

Tests for specialized PE extractors:

- **PEFeaturesExtractor**: Headers, .NET detection, counts, rich header, version info
- **PEImportExtractor**: Import libraries and functions, ClickHouse format
- **PESectionExtractor**: Section properties, entropy ranges, hashes
- **PEResourceExtractor**: Resource types, languages, entropy
- **PEOverlayExtractor**: Overlay detection, size, hashes
- **PESignatureExtractor**: Signature presence, certificate chain
- **PEDotNetExtractor**: .NET metadata, streams
- **PEInconsistencyTestsExtractor**: Rich header anomalies, anti-analysis checks
- **PEExtraFindings**: Additional findings and anomalies

### `test_elf_extractor.py`
**Markers:** `integration`, `elf`

Tests for base `ELFExtractor` class in `redb/extractors/elf_extractor.py`:

- **Initialization**: With file path, binary content validation
- **ELF parsing**: Header fields, architecture, endianness
- **Security features**: PIE, NX, RELRO, stack canary detection
- **Helper methods**: Section/segment iteration

### `test_elf_extractors.py`
**Markers:** `integration`, `elf`

Tests for specialized ELF extractors:

- **ELFFeaturesExtractor**: Header fields, security properties, counts
- **ELFSectionExtractor**: Section names, types, flags, entropy
- **ELFSegmentExtractor**: Segment types, permissions, sizes
- **ELFSymbolExtractor**: Symbol names, types, bindings, visibility
- **ELFImportExtractor**: Imported libraries and functions
- **ELFExportExtractor**: Exported symbols
- **ELFDependencyExtractor**: DT_NEEDED, SONAME, RPATH, RUNPATH
- **ELFRelocationExtractor**: Relocation types, symbols, addends
- **ELFNoteExtractor**: Build ID, ABI tags, GNU notes

---

## Manual Scripts (`tests/scripts/`)

These are **not** part of the pytest suite. They're standalone CLI tools for
manual testing and debugging, run directly with `python <script>.py`.

### `test_linking.py`

Manual test script for verifying function linking between decompiled and
disassembled code in Binary Ninja integration. Tests that `DecompileBinja`
correctly cross-references decompiled functions with their disassembled
counterparts.

### `test_macho_extractors_local.py`

Manual test script for Mach-O extractors without database connections.
Used for local development and debugging of Mach-O feature extraction
with mocked settings.

---

## Test Fixtures (conftest.py)

### Root `tests/conftest.py`

Shared fixtures available to all tests:

- `mock_logger` / `real_logger`: Logger instances for testing
- `elf_binary_path` / `pe_binary_path`: Paths to test binaries
- `elf_binary_content` / `pe_binary_content`: Binary file contents
- `temp_binary_file` / `temp_text_file`: Temporary file factories
- `mock_print_exporter`: Mocked PrintExporter
- `known_hashes` / `pe_known_hashes`: Expected hash values for test files
- `pe_object` / `elf_object`: Parsed pefile/ELF objects
- `sample_hash_dataclass` / `sample_hashes_dataclass`: Pre-populated dataclasses
- `entropy_calculator`: Entropy computation helper
- Skip markers: `requires_die`, `requires_capa`, `requires_floss`

### Unit `tests/unit/conftest.py`

Stubs heavy dependencies so unit tests run without external packages:

- Stubs `elasticsearch`, `clickhouse_connect`, `dotenv` in `sys.modules`
- Replaces `redb.settings` with MagicMock
- Replaces `redb.extractors` package to prevent eager imports

### Binary Ninja Stubs `tests/unit/conftest_binja_stubs.py`

Provides mock infrastructure for all decompiler tests:

- Stub `IntEnum` classes matching Binary Ninja's enum values
- Mock factory classes for BN objects (functions, blocks, IL instructions, binary views)
- Injected into `sys.modules` before any `binaryninja` import

---

## Markers Reference

| Marker | Description |
|--------|-------------|
| `unit` | Pure unit tests - no external deps, no disk I/O, fast (<1s each) |
| `integration` | Integration tests - use real test binaries on disk |
| `slow` | Tests that take >5s (entropy on large files, full pipelines) |
| `pe` | Tests specific to PE binary analysis |
| `elf` | Tests specific to ELF binary analysis |
| `macho` | Tests specific to Mach-O binary analysis |
| `apk` | Tests specific to APK binary analysis |
| `exporters` | Tests for database exporters (ClickHouse, Elasticsearch, Print) |
| `dataclass` | Tests for dataclass construction and field validation |
| `binja` | Tests for Binary Ninja decompiler extractors (mocked, no license needed) |

---

## Test Count Summary

| File | Tests | Source Modules |
|------|------:|----------------|
| `test_dataclasses.py` | 46 | `redb/models/dataclasses.py` |
| `test_decompile_analysis.py` | 44 | `bninja/analysis/cfg.py`, `disassembly.py`, `low_level.py` |
| `test_decompile_binja_extractor.py` | 36 | `DecompileBinja.py` |
| `test_decompile_ioc_extractor.py` | 34 | `ioc_extractor/` |
| `test_database_exporters.py` | 28 | `database_exporters.py` |
| `test_decompile_similarity.py` | 27 | `bninja/similarity/` |
| `test_decompile_decompiler.py` | 21 | `bninja/decompiler.py` |
| `test_decompile_utils.py` | 20 | `bninja/utils/`, `bninja/analysis/low_level_normalization.py` |
| `test_macho_dataclasses.py` | 20 | `redb/models/dataclasses.py` (Mach-O) |
| `test_apk_dataclasses.py` | 24 | `redb/models/dataclasses.py` (APK), `redb/extractors/enum.py` |
| `test_apk_extractors.py` | 62 | `redb/extractors/apk_extractors/`, `redb/workers.py` |
| `test_apk_code_analyzer.py` | 48 | `redb/extractors/decompiler/apk/` (analyzer, filter, parser) |
| `test_apk_jadx_wrapper.py` | 13 | `redb/extractors/decompiler/apk/jadx_wrapper.py` |
| `test_apk_apktool_wrapper.py` | 12 | `redb/extractors/decompiler/apk/apktool_wrapper.py` |
| `test_apk_method_extractor.py` | 32 | `redb/extractors/decompiler/apk/method_extractor.py` |
| `test_apk_process_method.py` | 29 | `redb/extractors/decompiler/apk/analyzer.py` (_process_method) |
| `test_apk_strings_ioc.py` | 30 | `apk/analyzer.py` (strings), `DecompileAPK.py`, `ioc_extractor/` |
| `test_apk_decompile_extractor.py` | 40 | `DecompileAPK.py`, `redb/models/dataclasses.py` (APK code) |
| `test_decompile_arch.py` | 18 | `bninja/arch/` |
| `test_decompile_scores.py` | 11 | `bninja/analysis/scores.py` |
| `test_decompile_strings.py` | 9 | `bninja/analysis/strings.py` |
| `test_decompile_function_type.py` | 7 | `bninja/function_type.py` |
| `test_force_reprocessing.py` | 77 | `start.py`, `redb/ingestor.py`, `redb/queries.py` |
| **Unit total** | **784** | |

---

## Test Binaries

Located in `test_files/`:

| File | Type | Description |
|------|------|-------------|
| `hello` | ELF | Simple ELF executable |
| `hello_advanced` | ELF | ELF with more features (symbols, sections) |
| `d8637bdbcfc9112fcb1f0167b398e771` | PE | .NET PE executable |