string-intelligence

To classify security-relevant strings from decompiled code, extract string literals from per-function analysis databases and apply a canonical taxonomy to categorize URLs, registry keys, file paths, and GUIDs for rapid triage.

Extracting URLs and registry keys from decompiled functions involves scanning per-module analysis DBs containing string_literals data and categorizing matches against a security taxonomy to surface high-risk indicators.

Yes, you can scan an entire binary module for threat intel indicators by running deep analysis scripts on the module database to enumerate and categorize string literals like file paths and GUIDs.

String classification for decompiled code supports both module-wide scans and targeted function-level queries, returning structured JSON outputs to integrate high-risk string triage into automation workflows.

Before classifying decompiled string literals, you need existing per-module analysis databases containing string_literals data extracted from decompiled functions, which the classification taxonomy then processes.

Triage of decompiled string literals relies strictly on the string_literals data present in analysis DBs and the canonical taxonomy's pattern definitions, limiting results to recognized categories like URLs, registry keys, and file paths.