{
    "kind": "struct",
    "name": "math",
    "attributes": [
        {
            "kind": "value",
            "name": "MEAN_BYTES",
            "documentation": "",
            "type": "f"
        },
        {
            "kind": "function",
            "name": "in_range",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "f",
                            "name": "test"
                        },
                        {
                            "type": "f",
                            "name": "lower"
                        },
                        {
                            "type": "f",
                            "name": "upper"
                        }
                    ],
                    "documentation": "Returns true if the *test* value is between *lower* and *upper* values. The comparisons are inclusive. Example: ```math.in_range(math.deviation(0, filesize, math.MEAN_BYTES), 63.9, 64,1)```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "deviation",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "offset"
                        },
                        {
                            "type": "i",
                            "name": "size"
                        },
                        {
                            "type": "f",
                            "name": "mean"
                        }
                    ],
                    "documentation": "Returns the deviation from the mean for the *size* bytes starting at *offset*. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float. The mean of an equally distributed random sample of bytes is 127.5, which is available as the constant math.MEAN_BYTES. Example: ```math.deviation(0, filesize, math.MEAN_BYTES) == 64.0```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": "string"
                        },
                        {
                            "type": "f",
                            "name": "mean"
                        }
                    ],
                    "documentation": "Return the deviation from the mean for the given string."
                }
            ]
        },
        {
            "kind": "function",
            "name": "mean",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": ""
                        },
                        {
                            "type": "i",
                            "name": ""
                        }
                    ],
                    "documentation": "Returns the mean for the *size* bytes starting at *offset*. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float. Example: ```math.mean(0, filesize) < 72.0```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": ""
                        }
                    ],
                    "documentation": "Return the mean for the given string."
                }
            ]
        },
        {
            "kind": "function",
            "name": "serial_correlation",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": ""
                        },
                        {
                            "type": "i",
                            "name": ""
                        }
                    ],
                    "documentation": "Returns the serial correlation for the *size* bytes starting at *offset*. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float between 0.0 and 1.0. Example: ```math.serial_correlation(0, filesize) < 0.2```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": ""
                        }
                    ],
                    "documentation": "Return the serial correlation for the given string."
                }
            ]
        },
        {
            "kind": "function",
            "name": "monte_carlo_pi",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": ""
                        },
                        {
                            "type": "i",
                            "name": ""
                        }
                    ],
                    "documentation": "Returns the percentage away from Pi for the *size* bytes starting at *offset* when run through the Monte Carlo from Pi test. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float. Example: ```math.monte_carlo_pi(0, filesize) < 0.07```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": ""
                        }
                    ],
                    "documentation": "Return the percentage away from Pi for the given string."
                }
            ]
        },
        {
            "kind": "function",
            "name": "entropy",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "offset"
                        },
                        {
                            "type": "i",
                            "name": "size"
                        }
                    ],
                    "documentation": "Returns the entropy for *size* bytes starting at *offset*. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float. Example: ```math.entropy(0, filesize) >= 7```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": ""
                        }
                    ],
                    "documentation": "Returns the entropy for the given string. ```Example: math.entropy(\"dummy\") > 7```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "min",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "int"
                        },
                        {
                            "type": "i",
                            "name": "int"
                        }
                    ],
                    "documentation": "Returns the minimum of two unsigned integer values."
                }
            ]
        },
        {
            "kind": "function",
            "name": "max",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "int"
                        },
                        {
                            "type": "i",
                            "name": "int"
                        }
                    ],
                    "documentation": "Returns the maximum of two unsigned integer values."
                }
            ]
        },
        {
            "kind": "function",
            "name": "to_number",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "b",
                            "name": "boolean"
                        }
                    ],
                    "documentation": "Returns 0 or 1, it's useful when writing a score based rule. Example: ```math.tonumber(SubRule1) * 60 + math.tonumber(SubRule2) * 20 + math.tonumber(SubRule3) * 70 > 80*```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "abs",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "int"
                        }
                    ],
                    "documentation": "Returns the absolute value of the signed integer. ```Example: math.abs(@a - @b) == 1```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "count",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "byte"
                        },
                        {
                            "type": "i",
                            "name": "offset"
                        },
                        {
                            "type": "i",
                            "name": "size"
                        }
                    ],
                    "documentation": "Returns how often a specific byte occurs, starting at *offset* and looking at the next *size* bytes. When scanning a running process the *offset* argument should be a virtual address within the process address space. *offset* and *size* are optional; if left empty, the complete file is searched. Example: ```math.count(0x4A, filesize-1024, filesize) >= 10```"
                },
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "byte"
                        }
                    ],
                    "documentation": "Returns how often a specific byte occurs, the complete file is searched. Example: ```math.count(0x4A) >= 10```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "percentage",
            "return_type": "f",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "byte"
                        },
                        {
                            "type": "i",
                            "name": "offset"
                        },
                        {
                            "type": "i",
                            "name": "size"
                        }
                    ],
                    "documentation": "Returns the occurrence rate of a specific byte, starting at *offset* and looking at the next *size* bytes. When scanning a running process the *offset* argument should be a virtual address within the process address space. The returned value is a float between 0 and 1. *offset* and *size* are optional; if left empty, the complete file is searched. Example: ```math.percentage(0xFF, filesize-1024, filesize) >= 0.9```"
                },
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "byte"
                        }
                    ],
                    "documentation": "Returns the occurrence rate of a specific byte, the complete file is searched. The returned value is a float between 0 and 1. Example: ```math.percentage(0x4A) >= 0.4```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "mode",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "offset"
                        },
                        {
                            "type": "i",
                            "name": "size"
                        }
                    ],
                    "documentation": "Returns the most common byte, starting at *offset* and looking at the next *size* bytes. When scanning a running process the *offset* argument should be a virtual address within the process address space. *offset* and *size* are optional; if left empty, the complete file is searched. Example: ```math.mode(0, filesize) == 0xFF```"
                },
                {
                    "arguments": [],
                    "documentation": "Returns the most common byte, the complete file is searched. The returned value is a float. Example: ```math.mode() == 0xFF```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "to_int",
            "return_type": "i",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": "string"
                        }
                    ],
                    "documentation": "Convert the given string to a signed integer. If the string starts with \"0x\" it is treated as base 16. If the string starts with \"0\" it is treated base 8. Leading '+' or '-' is also supported. ```Example: math.to_int(\"1234\") == 1234``` ```Example: math.to_int(\"-10\") == -10``` ```Example: math.to_int(\"-010\" == -8```"
                },
                {
                    "arguments": [
                        {
                            "type": "s",
                            "name": "string"
                        },
                        {
                            "type": "i",
                            "name": "base"
                        }
                    ],
                    "documentation": "Convert the given string, interpreted with the given base, to a signed integer. Base must be 0 or between 2 and 32 inclusive. If it is zero then the string will be intrepreted as base 16 if it starts with \"0x\" or as base 8 if it starts with \"0\". Leading '+' or '-' is also supported. ```Example: math.to_int(\"011\", 8) == \"9\"``` ```Example: math.to_int(\"-011\", 0) == \"-9\"```"
                }
            ]
        },
        {
            "kind": "function",
            "name": "to_string",
            "return_type": "s",
            "overloads": [
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "int"
                        }
                    ],
                    "documentation": "Convert the given integer to a string. Note: integers in YARA are signed. ```Example: math.to_string(10) == \"10\"``` ```Example: math.to_string(-1) == \"-1\"```"
                },
                {
                    "arguments": [
                        {
                            "type": "i",
                            "name": "int"
                        },
                        {
                            "type": "i",
                            "name": "base"
                        }
                    ],
                    "documentation": "Convert the given integer to a string in the given base. Supported bases are 10, 8 and 16. Note: integers in YARA are signed. ```Example: math.to_string(32, 16) == \"20\"``` ```Example: math.to_string(-1, 16) == \"ffffffffffffffff\"```"
                }
            ]
        }
    ]
}
