Update app.py

app.py

@@ -12,13 +12,21 @@ import time
 import struct
 import subprocess
 from datetime import datetime
-from typing import List, Dict, Any, Tuple
+from typing import List, Dict, Any, Tuple, Set
 
 from fastapi import FastAPI, UploadFile, File, Request, WebSocket, WebSocketDisconnect
 from fastapi.responses import HTMLResponse, FileResponse
 from fastapi.templating import Jinja2Templates
 
-app = FastAPI(title="APK & Binary Advanced RE Inspector")
+from elftools.elf.elffile import ELFFile
+from elftools.elf.sections import SymbolTableSection
+
+try:
+    import cxxfilt
+except ImportError:
+    cxxfilt = None
+
+app = FastAPI(title="Professional ELF & Native RE Inspector")
 
 WORKSPACE_DIR = "/tmp/re_workspace"
 OUTPUT_DIR = "/tmp/re_output"
@@ -27,36 +35,26 @@ os.makedirs(OUTPUT_DIR, exist_ok=True)
 
 templates = Jinja2Templates(directory="templates")
 
-# الامتدادات المقتطعة لتوفير الوقت والرام
-IGNORED_EXTENSIONS = {
-    '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.webp', '.ico',
-    '.mp4', '.avi', '.mkv', '.mov', '.flv', '.wmv', '.mp3', '.wav', '.ogg',
-    '.ttf', '.otf', '.woff', '.woff2', '.eot', '.pdf'
-}
+# 1. قائمة التصفية والاستبعاد الصارمة للقضاء على النويز وHTML/CSS
+NOISE_REJECT_PATTERNS = [
+    '<', '>', 'style=', 'font-family', 'margin-top', 'padding-', 'background-color',
+    'display:', 'position:', 'color:', 'width:', 'height:', 'border:', '.css', '.js',
+    '.png', '.jpg', '.jpeg', '.gif', '.svg', 'http://www.w3.org/', 'xmlns:'
+]
 
-# المجلدات المستبعدة لتجنب الإيجابيات الخاطئة في تصميم الواجهات
-IGNORED_SUBDIRS = ['res/drawable', 'res/color', 'res/anim', 'res/mipmap']
+ALLOWED_SECTIONS = {'.rodata', '.data', '.dynstr', '.strtab'}
 
-# تعابير نمطية مستهدفة بدقة
+# 2. التعابير النمطية المستهدفة
 DISCORD_PATTERN = re.compile(r'discord\.(?:gg|com/invite)/[a-zA-Z0-9_-]+', re.IGNORECASE)
 STUART_PATTERN = re.compile(r'https?://[a-zA-Z0-9.-]*stuartmods[a-zA-Z0-9.-]*\.[a-zA-Z]{2,}[^\s<>"{}|\\^`\']*', re.IGNORECASE)
 GENERIC_URL_PATTERN = re.compile(r'https?://[^\s<>"{}|\\^`\']+', re.IGNORECASE)
-EMAIL_PATTERN = re.compile(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}', re.IGNORECASE)
 
-# أنماط السياق البرمجي (Code Context Analysis)
-CODE_CONTEXT_PATTERNS = [
-    (re.compile(r'(?:getKey|get_Key|verify|LicenseManager|NetworkClient|loadUrl)\s*\(\s*["\']([^"\']+)["\']', re.IGNORECASE), "METHOD_CALL"),
-    (re.compile(r'(?:BaseURL|API_URL|ENDPOINT|SERVER_URL|HOST_URL)\s*[:=]\s*["\']([^"\']+)["\']', re.IGNORECASE), "API_ENDPOINT_VAR"),
-    (re.compile(r'const-string\s+v\d+,\s*["\']([^"\']+)["\']', re.IGNORECASE), "SMALI_CONST_STRING")
+ACCEPT_KEYWORD_TRIGGERS = [
+    'http://', 'https://', 'discord.gg', 'discord.com', 'stuartmods',
+    'api.', 'verify', 'license', 'activation', 'key', 'password', 'check_key', 'auth'
 ]
 
-NETWORK_API_PATTERNS = re.compile(
-    r'(?:HttpURLConnection|OkHttpClient|Retrofit|WebView|loadUrl|HttpClient|curl_easy_init|SSL_read)',
-    re.IGNORECASE
-)
-
-BASE64_PATTERN = re.compile(r'(?:[A-Za-z0-9+/]{4}){5,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?')
-HEX_ESCAPED_PATTERN = re.compile(r'(?:\\x[0-9a-fA-F]{2}){4,}')
+FUNCTION_TRIGGER_KEYWORDS = ['check', 'verify', 'license', 'auth', 'java_', 'jni_onload', 'stuart', 'key']
 
 class ConnectionManager:
     def __init__(self):
@@ -112,27 +110,22 @@ def calculate_entropy(data: bytes) -> float:
         entropy -= p * math.log2(p)
     return entropy
 
-def rot13(text: str) -> str:
-    trans = str.maketrans(
-        'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz',
-        'NOPQRSTUVWXYZABCDEFGHIJKLMnopqrstuvwxyzabcdefghijklm'
-    )
-    return text.translate(trans)
+def is_noise_string(text: str) -> bool:
+    """فلتر صارم لاستبعاد نصوص HTML/CSS والأيقونات"""
+    text_lower = text.lower()
+    for noise in NOISE_REJECT_PATTERNS:
+        if noise in text_lower:
+            return True
+    return False
 
-def extract_strings_native(file_path: str) -> str:
-    try:
-        res = subprocess.run(['strings', '-n', '4', file_path], capture_output=True, text=True, errors='ignore', timeout=10)
-        return res.stdout
-    except Exception:
-        try:
-            with open(file_path, 'rb') as f:
-                content = f.read()
-            matches = re.findall(rb'[\x20-\x7e]{4,}', content)
-            return "\n".join([m.decode('ascii', errors='ignore') for m in matches])
-        except Exception:
-            return ""
+def extract_snippet(text: str, start: int, end: int, margin: int = 100) -> str:
+    s_start = max(0, start - margin)
+    s_end = min(len(text), end + margin)
+    clean_text = text[s_start:s_end].replace('\n', ' ').replace('\r', ' ')
+    return f"...{clean_text}..."
 
 def parse_il2cpp_metadata(file_path: str) -> List[str]:
+    """محلل بنية Unity global-metadata.dat لاستخراج جدول النصوص C# مباشرة"""
     extracted_strings = []
     try:
         with open(file_path, 'rb') as f:
@@ -155,22 +148,94 @@ def parse_il2cpp_metadata(file_path: str) -> List[str]:
                 lit_len, lit_data_off = struct.unpack("<II", data[sl_offset + i * 8 : sl_offset + i * 8 + 8])
                 if sld_offset + lit_data_off + lit_len <= len(data):
                     s = data[sld_offset + lit_data_off : sld_offset + lit_data_off + lit_len].decode('utf-8', errors='ignore')
-                    if len(s.strip()) > 2:
+                    if len(s.strip()) > 3 and not is_noise_string(s):
                         extracted_strings.append(s)
     except Exception:
         pass
     return extracted_strings
 
-def extract_snippet(text: str, start: int, end: int, margin: int = 100) -> str:
-    s_start = max(0, start - margin)
-    s_end = min(len(text), end + margin)
-    snippet_text = text[s_start:s_end].replace('\n', ' ').replace('\r', ' ')
-    return f"...{snippet_text}..."
+def demangle_symbol_name(sym_name: str) -> str:
+    """فك تزييف أسماء C++ Mangled Symbols"""
+    if not sym_name:
+        return ""
+    if cxxfilt:
+        try:
+            return cxxfilt.demangle(sym_name)
+        except Exception:
+            pass
+    return sym_name
+
+def analyze_elf_binary(file_path: str) -> Tuple[str, List[Dict[str, Any]], List[Dict[str, Any]]]:
+    """قراءة هيكلية ELF الرسمية واستخراج الأقسام والرموز والدوال المشبوهة"""
+    extracted_text_blocks = []
+    suspicious_symbols = []
+    high_entropy_sections = []
+
+    try:
+        with open(file_path, 'rb') as f:
+            elf = ELFFile(f)
+
+            # 1. استخراج الأقسام الحيوية فقط وسحب النصوص منها
+            for section in elf.iter_sections():
+                sec_name = section.name
+                sec_data = section.data()
+                sec_entropy = calculate_entropy(sec_data)
+
+                if sec_entropy > 7.4 and section.size() > 1024:
+                    high_entropy_sections.append({
+                        "section_name": sec_name,
+                        "size": section.size(),
+                        "entropy": round(sec_entropy, 2),
+                        "suggested_action": "XOR Brute-force / Custom Unpacker Required"
+                    })
+
+                if sec_name in ALLOWED_SECTIONS:
+                    matches = re.findall(rb'[\x20-\x7e]{4,}', sec_data)
+                    for m in matches:
+                        try:
+                            s = m.decode('ascii', errors='ignore')
+                            if not is_noise_string(s):
+                                s_lower = s.lower()
+                                if any(trigger in s_lower for k in ACCEPT_KEYWORD_TRIGGERS for trigger in [k]):
+                                    extracted_text_blocks.append(s)
+                        except Exception:
+                            pass
+
+                # 2. استخراج الرموز والدوال المشبوهة من جداول الرموز
+                if isinstance(section, SymbolTableSection):
+                    for symbol in section.iter_symbols():
+                        sym_name = symbol.name
+                        if not sym_name:
+                            continue
+                        
+                        sym_lower = sym_name.lower()
+                        if any(kw in sym_lower for kw in FUNCTION_TRIGGER_KEYWORDS):
+                            demangled = demangle_symbol_name(sym_name)
+                            suspicious_symbols.append({
+                                "mangled": sym_name,
+                                "demangled": demangled,
+                                "section": sec_name,
+                                "binding": symbol['st_info']['bind']
+                            })
+
+    except Exception:
+        # حل بديل إذا كان الملف ثنائياً عادياً وليس ELF قياسي
+        try:
+            res = subprocess.run(['strings', '-n', '4', file_path], capture_output=True, text=True, errors='ignore', timeout=10)
+            for line in res.stdout.splitlines():
+                if not is_noise_string(line):
+                    line_lower = line.lower()
+                    if any(trigger in line_lower for trigger in ACCEPT_KEYWORD_TRIGGERS):
+                        extracted_text_blocks.append(line)
+        except Exception:
+            pass
+
+    return "\n".join(extracted_text_blocks), suspicious_symbols, high_entropy_sections
 
 def brute_force_xor_full(raw_bytes: bytes) -> List[Dict[str, Any]]:
-    """تطبيق XOR على كامل مفاتيح 1-255 للملفات الصغيرة"""
+    """تطبيق مفاتيح XOR العنيفة (1-255) على الملفات وحصد النتائج الحقيقية"""
     results = []
-    sample = raw_bytes[:200000] # أخذ عينة 200KB للأداء الفائق
+    sample = raw_bytes[:250000]
     targets = [b"http://", b"https://", b"discord", b"stuartmods", b"license", b"verify"]
 
     for key in range(1, 256):
@@ -179,10 +244,11 @@ def brute_force_xor_full(raw_bytes: bytes) -> List[Dict[str, Any]]:
             if t in dec.lower():
                 urls = GENERIC_URL_PATTERN.findall(dec.decode('ascii', errors='ignore'))
                 for u in set(urls[:5]):
-                    results.append({
-                        "key": f"0x{key:02X}",
-                        "decoded": u
-                    })
+                    if not is_noise_string(u):
+                        results.append({
+                            "key": f"0x{key:02X}",
+                            "decoded": u
+                        })
                 break
     return results
 
@@ -191,8 +257,8 @@ def analyze_file_deep(file_path: str, extract_root: str) -> Dict[str, Any]:
     file_name = os.path.basename(file_path).lower()
     file_size = os.path.getsize(file_path)
 
-    links_found = []
-    suspicious_findings = []
+    critical_links = []
+    suspicious_functions = []
     encrypted_findings = []
 
     try:
@@ -202,25 +268,42 @@ def analyze_file_deep(file_path: str, extract_root: str) -> Dict[str, Any]:
         entropy = calculate_entropy(raw_bytes)
         text_content = ""
 
-        # 1. تحليل global-metadata.dat
+        # أ) ملفات global-metadata.dat
         if "global-metadata.dat" in file_name:
             metadata_strings = parse_il2cpp_metadata(file_path)
             if metadata_strings:
                 text_content = "\n".join(metadata_strings)
 
-        # 2. الملفات الثنائية (.so, .dex, .dat)
+        # ب) ملفات .so المباشرة والـ ELF Binaries
         if not text_content:
-            if file_name.endswith(('.so', '.dex', '.dat')) or b'\x00' in raw_bytes[:512]:
-                text_content = extract_strings_native(file_path)
+            if file_name.endswith('.so') or b'ELF' in raw_bytes[:4]:
+                extracted_text, elf_syms, high_sec = analyze_elf_binary(file_path)
+                text_content = extracted_text
+                
+                for sym in elf_syms:
+                    suspicious_functions.append({
+                        "function_name": sym["demangled"] or sym["mangled"],
+                        "mangled_symbol": sym["mangled"],
+                        "section": sym["section"],
+                        "severity": "HIGH" if "verify" in sym["mangled"].lower() or "license" in sym["mangled"].lower() else "MEDIUM"
+                    })
+
+                for sec in high_sec:
+                    encrypted_findings.append({
+                        "method": f"High Entropy Section ({sec['section_name']})",
+                        "value": f"الحجم: {sec['size']} bytes | العشوائية: {sec['entropy']}",
+                        "snippet": sec["suggested_action"],
+                        "severity": "HIGH"
+                    })
             else:
                 text_content = raw_bytes.decode('utf-8', errors='ignore')
 
-        # أ) البحث في روابط Discord وسيرفر stuartmods (CRITICAL)
+        # 1. كشف وتصفية الروابط الحرجّة (Discord & StuartMods)
         for m in DISCORD_PATTERN.finditer(text_content):
             val = m.group()
             snip = extract_snippet(text_content, m.start(), m.end(), 100)
-            links_found.append({
-                "type": "DISCORD_LINK",
+            critical_links.append({
+                "type": "DISCORD_INVITE",
                 "value": val,
                 "snippet": snip,
                 "severity": "CRITICAL"
@@ -229,67 +312,46 @@ def analyze_file_deep(file_path: str, extract_root: str) -> Dict[str, Any]:
         for m in STUART_PATTERN.finditer(text_content):
             val = m.group()
             snip = extract_snippet(text_content, m.start(), m.end(), 100)
-            links_found.append({
+            critical_links.append({
                 "type": "STUARTMODS_SERVER",
                 "value": val,
                 "snippet": snip,
                 "severity": "CRITICAL"
             })
 
-        # ب) البحث في الروابط العامة والربط بالسياق البرمجي (HIGH / MEDIUM)
+        # 2. كشف الروابط العامة التابعة لـ APIs والتحقق
         for m in GENERIC_URL_PATTERN.finditer(text_content):
             val = m.group()
-            if "discord" not in val.lower() and "stuartmods" not in val.lower():
+            if not is_noise_string(val) and "discord" not in val.lower() and "stuartmods" not in val.lower():
                 snip = extract_snippet(text_content, m.start(), m.end(), 100)
-                # تقييم ذكي بناءً على الكلمات المجاورة
                 snip_lower = snip.lower()
+                
                 is_high = any(k in snip_lower for k in ["verify", "license", "activation", "api", "auth", "getkey"])
-                links_found.append({
-                    "type": "URL",
-                    "value": val,
-                    "snippet": snip,
-                    "severity": "HIGH" if is_high else "MEDIUM"
-                })
-
-        # ج) تحليل السياق البرمجي والدوال الشبكية (Suspicious Files)
-        has_net_api = bool(NETWORK_API_PATTERNS.search(text_content))
-        for pattern, ctx_type in CODE_CONTEXT_PATTERNS:
-            for m in pattern.finditer(text_content):
-                matched_val = m.group(1) if m.groups() else m.group()
-                snip = extract_snippet(text_content, m.start(), m.end(), 100)
-                suspicious_findings.append({
-                    "type": f"CODE_CONTEXT_{ctx_type}",
-                    "value": matched_val,
-                    "snippet": snip,
-                    "severity": "HIGH" if has_net_api else "MEDIUM"
-                })
+                if is_high:
+                    critical_links.append({
+                        "type": "VERIFICATION_API_URL",
+                        "value": val,
+                        "snippet": snip,
+                        "severity": "HIGH"
+                    })
 
-        # د) فك التشفير المتقدم (ROT13, Base64, Hex, XOR, Zlib)
-        # Base64
-        for b64 in BASE64_PATTERN.findall(text_content)[:10]:
+        # 3. فك تشفير Base64 وسلاسل XOR
+        base64_matches = re.findall(r'(?:[A-Za-z0-9+/]{4}){6,}(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?', text_content)
+        for b64 in base64_matches[:10]:
             try:
                 dec = base64.b64decode(b64).decode('utf-8', errors='ignore')
-                if any(k in dec.lower() for k in ['http', 'discord', 'stuartmods', 'key', 'license', 'verify']):
+                if not is_noise_string(dec) and any(k in dec.lower() for k in ['http', 'discord', 'stuartmods', 'key', 'license', 'verify']):
                     encrypted_findings.append({
                         "method": "Base64 Decoded",
                         "value": f"{b64} -> {dec}",
-                        "snippet": f"مفكوك Base64: {dec}",
-                        "severity": "HIGH" if "discord" in dec.lower() or "http" in dec.lower() else "MEDIUM"
+                        "snippet": f"فك ترميز Base64: {dec}",
+                        "severity": "CRITICAL" if "discord" in dec.lower() or "stuartmods" in dec.lower() else "HIGH"
                     })
             except Exception:
                 pass
 
-        # ROT13 Test
-        if "discord" in rot13(text_content).lower() or "stuartmods" in rot13(text_content).lower():
-            encrypted_findings.append({
-                "method": "ROT13 Cipher",
-                "value": "اكتشاف نصوص مشفرة بـ ROT13",
-                "snippet": "تم رصد سلاسل نصية مفكوكة بـ ROT13 تحتوي على روابط أو مفاتيح",
-                "severity": "HIGH"
-            })
-
-        # XOR Full Brute Force للملفات < 5MB
-        if file_size <= 5 * 1024 * 1024 and (file_name.endswith('.so') or entropy > 6.0):
+        # XOR Full Brute Force للملفات أصغر من 5MB
+        if file_size <= 5 * 1024 * 1024 and (file_name.endswith('.so') or entropy > 6.8):
             xor_hits = brute_force_xor_full(raw_bytes)
             for x_item in xor_hits:
                 encrypted_findings.append({
@@ -299,34 +361,14 @@ def analyze_file_deep(file_path: str, extract_root: str) -> Dict[str, Any]:
                     "severity": "CRITICAL" if "discord" in x_item['decoded'].lower() or "stuartmods" in x_item['decoded'].lower() else "HIGH"
                 })
 
-        # هـ) فحص الملفات عالية العشوائية (Entropy > 7.5)
-        if entropy > 7.5:
-            suggested_decomp = "XOR / Custom Packer"
-            try:
-                zlib.decompress(raw_bytes)
-                suggested_decomp = "Zlib Compressed"
-            except Exception:
-                try:
-                    gzip.decompress(raw_bytes)
-                    suggested_decomp = "Gzip Compressed"
-                except Exception:
-                    pass
-
-            encrypted_findings.append({
-                "method": f"High Entropy ({entropy:.2f})",
-                "value": f"ملف مشفر/مضغوط: {rel_path}",
-                "snippet": f"العشوائية مرتفعة جداً ({entropy:.2f}). طريقة الفك المقترحة: {suggested_decomp}",
-                "severity": "HIGH"
-            })
-
     except Exception:
         pass
 
     return {
         "file": rel_path,
-        "links": links_found,
-        "suspicious": suspicious_findings,
-        "encrypted": encrypted_findings
+        "critical_links": critical_links,
+        "suspicious_functions": suspicious_functions,
+        "encrypted_sections": encrypted_findings
     }
 
 def run_full_analysis_sync(extract_folder: str) -> Dict[str, Any]:
@@ -334,26 +376,21 @@ def run_full_analysis_sync(extract_folder: str) -> Dict[str, Any]:
     for root, _, files in os.walk(extract_folder):
         for f in files:
             full_p = os.path.join(root, f)
-            ext = os.path.splitext(f)[1].lower()
-            if ext in IGNORED_EXTENSIONS:
-                continue
-
             rel_p = os.path.relpath(full_p, extract_folder).replace('\\', '/')
             if any(rel_p.startswith(sub) for sub in IGNORED_SUBDIRS):
                 continue
-
             files_to_scan.append(full_p)
 
     total_files = len(files_to_scan)
     
     all_links = []
-    all_suspicious = []
+    all_functions = []
     all_encrypted = []
 
     stats = {
         "total_files": total_files,
         "total_links": 0,
-        "total_suspicious": 0,
+        "total_functions": 0,
         "total_encrypted": 0,
         "critical_count": 0,
         "high_count": 0,
@@ -363,29 +400,29 @@ def run_full_analysis_sync(extract_folder: str) -> Dict[str, Any]:
     for file_p in files_to_scan:
         res = analyze_file_deep(file_p, extract_folder)
         
-        if res["links"]:
-            stats["total_links"] += len(res["links"])
-            for l in res["links"]:
+        if res["critical_links"]:
+            stats["total_links"] += len(res["critical_links"])
+            for l in res["critical_links"]:
                 stats[f"{l['severity'].lower()}_count"] = stats.get(f"{l['severity'].lower()}_count", 0) + 1
-            all_links.append({"file": res["file"], "items": res["links"]})
+            all_links.append({"file": res["file"], "items": res["critical_links"]})
 
-        if res["suspicious"]:
-            stats["total_suspicious"] += len(res["suspicious"])
-            for s in res["suspicious"]:
-                stats[f"{s['severity'].lower()}_count"] = stats.get(f"{s['severity'].lower()}_count", 0) + 1
-            all_suspicious.append({"file": res["file"], "items": res["suspicious"]})
+        if res["suspicious_functions"]:
+            stats["total_functions"] += len(res["suspicious_functions"])
+            for f_item in res["suspicious_functions"]:
+                stats[f"{f_item['severity'].lower()}_count"] = stats.get(f"{f_item['severity'].lower()}_count", 0) + 1
+            all_functions.append({"file": res["file"], "items": res["suspicious_functions"]})
 
-        if res["encrypted"]:
-            stats["total_encrypted"] += len(res["encrypted"])
-            for e in res["encrypted"]:
+        if res["encrypted_sections"]:
+            stats["total_encrypted"] += len(res["encrypted_sections"])
+            for e in res["encrypted_sections"]:
                 stats[f"{e['severity'].lower()}_count"] = stats.get(f"{e['severity'].lower()}_count", 0) + 1
-            all_encrypted.append({"file": res["file"], "items": res["encrypted"]})
+            all_encrypted.append({"file": res["file"], "items": res["encrypted_sections"]})
 
     return {
         "summary": stats,
-        "links_found": all_links,
-        "suspicious_files": all_suspicious,
-        "encrypted_files": all_encrypted
+        "critical_links": all_links,
+        "suspicious_functions": all_functions,
+        "encrypted_sections": all_encrypted
     }
 
 @app.get("/", response_class=HTMLResponse)
@@ -405,7 +442,7 @@ async def websocket_logs(websocket: WebSocket):
 async def analyze_files(files: List[UploadFile] = File(...)):
     clean_workspace()
 
-    await manager.broadcast_log("INFO", f"بدء استقبال {len(files)} ملف/ملفات...", 5)
+    await manager.broadcast_log("INFO", f"بدء استقبال {len(files)} ملف/ملفات للتفتيش...", 5)
 
     extract_folder = os.path.join(WORKSPACE_DIR, "extracted")
     os.makedirs(extract_folder, exist_ok=True)
@@ -417,8 +454,8 @@ async def analyze_files(files: List[UploadFile] = File(...)):
             while chunk := await uploaded_file.read(4 * 1024 * 1024):
                 buffer.write(chunk)
 
-        if uploaded_file.filename.lower().endswith(".zip") or uploaded_file.filename.lower().endswith(".apk"):
-            await manager.broadcast_log("INFO", f"جاري فك ضغط الأرشيف: {uploaded_file.filename}...", 15)
+        if uploaded_file.filename.lower().endswith((".zip", ".apk")):
+            await manager.broadcast_log("INFO", f"جاري فك الأرشيف المرفوع: {uploaded_file.filename}...", 15)
             try:
                 with zipfile.ZipFile(file_path, 'r') as zf:
                     zf.extractall(extract_folder)
@@ -427,12 +464,12 @@ async def analyze_files(files: List[UploadFile] = File(...)):
         else:
             shutil.copy(file_path, os.path.join(extract_folder, uploaded_file.filename))
 
-    await manager.broadcast_log("INFO", "بدء الفحص البرمجي المتطور وتتبع الدوال والتشفير...", 30)
+    await manager.broadcast_log("INFO", "بدء تحليل ELF Sections واستخراج الرموز وفك التشفير بـ XOR...", 30)
 
-    # تشغيل التحليل في الخلفية المستقلة لمنع التجمد نهائياً
+    # تشغيل الفحص بعيداً عن الخيط الرئيسي لحماية الـ CPU والـ Event Loop
     report_data = await asyncio.to_thread(run_full_analysis_sync, extract_folder)
 
-    await manager.broadcast_log("SUCCESS", f"اكتمل الفحص! تم إيجاد {report_data['summary']['total_links']} رابط و {report_data['summary']['total_suspicious']} ملف مشتبه به.", 100)
+    await manager.broadcast_log("SUCCESS", f"اكتمل التفتيش! تم اكتشاف {report_data['summary']['total_links']} رابط حاسم و {report_data['summary']['total_functions']} دالة مشبوهة.", 100)
 
     json_path = os.path.join(OUTPUT_DIR, "analysis_report.json")
     with open(json_path, "w", encoding="utf-8") as f:
@@ -448,7 +485,7 @@ def generate_html_report(data: Dict[str, Any], save_path: str):
 <html lang="ar" dir="rtl">
 <head>
     <meta charset="UTF-8">
-    <title>Advanced RE Inspection Report</title>
+    <title>Professional ELF RE Inspection Report</title>
     <style>
         body {{ font-family: system-ui, sans-serif; background: #0f172a; color: #f8fafc; padding: 20px; line-height: 1.5; }}
         .card {{ background: #1e293b; padding: 16px; border-radius: 10px; margin-bottom: 16px; border: 1px solid #334155; }}
@@ -464,34 +501,34 @@ def generate_html_report(data: Dict[str, Any], save_path: str):
     </style>
 </head>
 <body>
-    <h1>تقرير التفتيش البرمجي وفحص الروابط والتشفير</h1>
+    <h1>تقرير التفتيش الهندسي ومحلل المكتبات الأصلية (ELF / SO)</h1>
     <div class="card">
         <h3>الملخص الإحصائي</h3>
         <div class="stats-grid">
             <div class="stat-card">الملفات المفحوصة<br><b>{summary['total_files']}</b></div>
-            <div class="stat-card">الروابط المكتشفة<br><b>{summary['total_links']}</b></div>
-            <div class="stat-card">الملفات المشبوهة<br><b>{summary['total_suspicious']}</b></div>
+            <div class="stat-card">الروابط الحاسمة<br><b>{summary['total_links']}</b></div>
+            <div class="stat-card">الدوال المستخرجة<br><b>{summary['total_functions']}</b></div>
             <div class="stat-card">حاسمة (CRITICAL)<br><b style="color:#dc2626;">{summary['critical_count']}</b></div>
         </div>
     </div>
 
-    <h2>1. الروابط المكتشفة (Links Found)</h2>
+    <h2>1. الروابط الحرجة (Critical Links)</h2>
 """
-    for file_item in data['links_found']:
+    for file_item in data['critical_links']:
         html += f"""<div class="card"><h4 style="color:#facc15;">📁 {file_item['file']}</h4>"""
         for item in file_item['items']:
             html += f"""<div class="snippet"><span class="badge {item['severity']}">{item['severity']}</span> <b>[{item['type']}]</b>: {item['value']}<br><span style="color:#94a3b8;">{item['snippet']}</span></div>"""
         html += "</div>"
 
-    html += "<h2>2. الملفات المشبوهة (Suspicious Files)</h2>"
-    for file_item in data['suspicious_files']:
+    html += "<h2>2. الدوال والرموز المشبوهة (Suspicious Functions)</h2>"
+    for file_item in data['suspicious_functions']:
         html += f"""<div class="card"><h4 style="color:#facc15;">📁 {file_item['file']}</h4>"""
         for item in file_item['items']:
-            html += f"""<div class="snippet"><span class="badge {item['severity']}">{item['severity']}</span> <b>[{item['type']}]</b>: {item['value']}<br><span style="color:#94a3b8;">{item['snippet']}</span></div>"""
+            html += f"""<div class="snippet"><span class="badge {item['severity']}">{item['severity']}</span> <b>[Function]</b>: {item['function_name']}<br><span style="color:#94a3b8;">Symbol: {item['mangled_symbol']} | Section: {item['section']}</span></div>"""
         html += "</div>"
 
-    html += "<h2>3. الملفات المشفرة (Encrypted Files)</h2>"
-    for file_item in data['encrypted_files']:
+    html += "<h2>3. الأقسام المشفّرة ومخرجات فك التشفير (Encrypted Sections)</h2>"
+    for file_item in data['encrypted_sections']:
         html += f"""<div class="card"><h4 style="color:#facc15;">📁 {file_item['file']}</h4>"""
         for item in file_item['items']:
             html += f"""<div class="snippet"><span class="badge {item['severity']}">{item['severity']}</span> <b>[{item['method']}]</b>: {item['value']}<br><span style="color:#94a3b8;">{item['snippet']}</span></div>"""