Fission

utils/ manifest

Last verified: 2026-05-04

The utils/ tree holds checked-in data and specs used by builds, tests, and tooling. It is not a dumping ground for one-off binaries (see docs/MALWARE_SAMPLE_POLICY.md).

Major subtrees

Path	Role
ghidra-data/	Ghidra-derived opinion files and related packaged data (see NOTICE). Detailed provenance: THIRD_PARTY.md.
signatures/die/detect-it-easy/	Detect It Easy signature corpus used by detector integrations. License: bundled MIT LICENSE; upstream horsicq/DiE.
signatures/typeinfo/win32/	Canonical Win32 API/type surface: win_api_signatures.txt, base_types.json, structures.json, GDT/type supplements used by crates/fission-signatures.
signatures/patterns/	MSVC/CRT byte-pattern corpora (e.g. msvc_x64_crt.json) for SignatureDatabase.
signatures/fid/	FIDBF/FIDB assets consumed by FID loaders in crates/fission-signatures.
Other paths under signatures/	Additional signature assets — document sizable imports here; crates/fission-signatures must not duplicate them under data/.

Conventions

• Prefer small, verifiable fixtures over large opaque blobs.
• When importing upstream dumps, record upstream URL + tag/commit in THIRD_PARTY.md and bump Last verified here.
• For DIE primitive gaps or unsupported detectors, coordinate metric naming with docs/QUALITY_METRICS.md rather than inventing parallel JSON schemas.

This site is open source. Improve this page.