criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.Ghidra/Debug/Debugger-agent-dbgeng/src/main/py/src/ghidradbg/methods.py

    """Evaluate a Python3 expression."""
    return str(eval(expr, shared_globals))

+8

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.Ghidra/Debug/Debugger-agent-dbgeng/src/main/py/src/ghidradbg/methods.py

        with redirect_stdout(data):
            exec(cmd, shared_globals)
        return data.getvalue()
    else:

+7

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.Ghidra/Debug/Debugger-agent-drgn/src/main/py/src/ghidradrgn/commands.py

    if type(value) != str:
        value = eval("{}".format(value))
    if schema == sch.BOOL_ARR:
        return to_bool_list(value), schema

+8

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.Ghidra/Debug/Debugger-agent-drgn/src/main/py/src/ghidradrgn/commands.py

    if type(value) != str:
        value = eval("{}".format(value))
    if schema == sch.BOOL_ARR:
        return to_bool_list(value), schema

+7

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads.Ghidra/Debug/Debugger-agent-drgn/src/main/py/src/ghidradrgn/methods.py

        with redirect_stdout(data):
            exec(cmd, shared_globals)
        return data.getvalue()
    else:

+7

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/methods.py

def pyeval(expr: str) -> Any:
    return eval(expr)

+8

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.Ghidra/Debug/Debugger-agent-dbgeng/src/main/py/src/ghidradbg/methods.py+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.Ghidra/Debug/Debugger-agent-gdb/src/main/py/src/ghidragdb/methods.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.Ghidra/Debug/Debugger-agent-gdb/src/main/py/src/ghidragdb/util.py+3

warningHigh-entropy string literalsFound 10 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.Ghidra/Debug/Debugger-agent-x64dbg/src/main/py/src/ghidraxdbg/methods.py+3

warningHigh-entropy string literalsFound 3 long strings with high Shannon entropy. This is common in obfuscated payloads that hide URLs, keys, or bytecode.Ghidra/Debug/Debugger-agent-dbgeng/data/support/kernel-dbgeng.py+3

infoSuspicious file in repoExecutable file (kernel-dbgeng.bat) in repositoryGhidra/Debug/Debugger-agent-dbgeng/data/debugger-launchers/kernel-dbgeng.bat+2

infoSuspicious file in repoExecutable file (local-dbgeng-attach.bat) in repositoryGhidra/Debug/Debugger-agent-dbgeng/data/debugger-launchers/local-dbgeng-attach.bat+2

infoSuspicious file in repoExecutable file (local-dbgeng-ext.bat) in repositoryGhidra/Debug/Debugger-agent-dbgeng/data/debugger-launchers/local-dbgeng-ext.bat+2

infoAuthor has no other public repositoriesGitHub user "dragonmacher" has no other public repositories, common for burner accounts used in scams.+2

NationalSecurityAgency/ghidra

FINDINGS ░▒▓

NationalSecurityAgency/ghidra

architecture░▒▓