Interpreting the Result of Byte Coverage Analysis

Posted | Modified
Author

Below is the result when running HexLasso on an executable file which has a size of 151040 bytes.

       338 / 151040     0.22%   SameAsciiByteSeq
       925 / 150702     0.61%   AsciiStringOfSpecial
       169 / 149777     0.11%   AsciiStringOfDigits
      8472 / 149608     5.61%   AsciiString
      2084 / 141136     1.38%   UnicodeString
      4803 / 139052     3.18%   SpAsciiString
     10323 / 134249     6.83%   X86Fragment
     18384 / 123926     12.17%  SameByteSeq
        36 / 105542     0.02%   SameByteDiffSeq
        55 / 105506     0.04%   DecByteSeq
      4736 / 105451     3.14%   SpSameByteDiffSeq
      1176 / 100715     0.78%   SpDecByteSeq
      1146 / 99539      0.76%   SpIncByteSeq
       797 / 98393      0.53%   PredictedByteSeq
      1787 / 97596      1.18%   SpSameByteSeq
       206 / 95809      0.14%   SymmetricByteSeq
       312 / 95603      0.21%   ByteMulOf4
       859 / 95291      0.57%   SpByteMulOf4
      4654 / 94432      3.08%   PredictedByte
      4444 / 89778      2.94%   QWordMatch
      7835 / 85334      5.19%   DWordMatch
     53442 / 77499      35.38%  WordMatch
       429 / 24057      0.28%   SpPredictedByte
     13385 / 23628      8.86%   ExtAsciiByte
     10243 / 10243      6.78%   AsciiByte

The result should be interpreted in the following way.

338 bytes out of 151040 bytes cover SameAsciiByteSeq. 150702 bytes remaining.
925 bytes out of 150702 bytes cover AsciiStringOfSpecial. 149777 bytes remaining.
169 bytes out of 149777 bytes cover AsciiStringOfDigits. 149608 bytes remaining.
[…]
13385 bytes out of 23628 bytes cover ExtAsciiByte. 10243 bytes remaining.
10243 bytes out of 10243 bytes cover AsciiByte. 0 bytes remaining.

The percentage preceding the analyzer name indicates the extent of the coverage in the file.