snikrflow 0.1.0__tar.gz

snikrflow-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stodachon (redhound)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

snikrflow-0.1.0/PKG-INFO

@@ -0,0 +1,240 @@
+Metadata-Version: 2.4
+Name: snikrflow
+Version: 0.1.0
+Summary: Native binary security triage and reachability platform, built on angr and Claripy.
+Author: Stodachon
+License: MIT License
+        
+        Copyright (c) 2026 Stodachon (redhound)
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/stodachon/snikrflow
+Project-URL: Repository, https://github.com/stodachon/snikrflow
+Project-URL: Issues, https://github.com/stodachon/snikrflow/issues
+Keywords: security,reverse-engineering,android,jni,binary-analysis,angr,symbolic-execution,triage,reachability,elf
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Disassemblers
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: angr
+Requires-Dist: claripy
+Requires-Dist: pyelftools
+Requires-Dist: typer[all]
+Requires-Dist: rich
+Requires-Dist: networkx
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Dynamic: license-file
+
+<p align="center">
+  <img src="logo.svg" width="140" alt="SnikrFlow logo"/>
+</p>
+
+<h1 align="center">SnikrFlow</h1>
+
+<p align="center">
+  <b>Native binary security triage and reachability platform.</b><br/>
+  Stop wondering where to start reversing a binary. Let SnikrFlow tell you.
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/snikrflow/"><img alt="PyPI" src="https://img.shields.io/pypi/v/snikrflow.svg"></a>
+  <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-orange.svg"></a>
+  <img alt="Python" src="https://img.shields.io/badge/python-3.11%2B-blue.svg">
+</p>
+
+---
+
+## The problem
+
+You've got a large ELF binary or an Android `.so` library. Thousands of functions.
+No idea where the interesting stuff is. You could spend two hours blindly
+following callers, references, and branches in Ghidra... or you could ask:
+
+> "Before I spend two hours reversing this binary, tell me where I should
+> spend those two hours."
+
+That's what SnikrFlow answers.
+
+SnikrFlow is **not** a replacement for Ghidra, IDA, Binary Ninja, or GDB. It's
+the step *before* those tools: automated triage, reachability analysis, and
+symbolic execution that narrows "here are thousands of functions" down to
+"here are the paths you should investigate first."
+
+```
+Large ELF / Android .so
+        │
+        ▼
+    SnikrFlow
+        │
+        ├── ELF analysis          ├── Call graph analysis
+        ├── Function discovery    ├── Reachability
+        ├── JNI discovery         ├── Data-flow analysis
+        ├── Security sink detect  └── Symbolic execution
+        ├── CFG analysis
+        │
+        ▼
+  Prioritized findings
+        │
+        ▼
+      Ghidra
+        │
+        ▼
+  Deep manual RE
+```
+
+## Install
+
+```bash
+pip install snikrflow
+```
+
+(Or, for development: clone the repo and `pip install -e .`)
+
+Requires Python 3.11+. Built on [angr](https://angr.io) + Claripy for the
+underlying static/symbolic analysis engine.
+
+## Quick start
+
+```bash
+# The whole pipeline, orchestrated -- this is the one you actually want
+snikrflow audit libfoo.so
+
+# Or drill in stage by stage:
+snikrflow info libfoo.so                 # ELF metadata
+snikrflow functions libfoo.so            # discovered functions (angr CFGFast + symbols)
+snikrflow jni libfoo.so                  # statically-exported JNI entry points
+snikrflow sinks libfoo.so                # security-sensitive function calls
+snikrflow cfg libfoo.so                  # control-flow graph summary
+snikrflow callers libfoo.so 0x400d80     # who calls this address
+snikrflow callees libfoo.so 0x400d80     # what this address calls
+snikrflow reach libfoo.so --source 0x403a00 --sink 0x400d80     # static reachability
+snikrflow solve libfoo.so --source 0x403a00 --target 0x400d80   # symbolic candidate input
+snikrflow dataflow libfoo.so --source 0x403a00 --sink 0x400d80  # does tainted data reach the sink?
+```
+
+Every command supports `--json` for scripting/piping into other tools.
+
+## What `audit` actually does
+
+`audit` is the flagship command -- it runs the full pipeline automatically:
+
+1. Discovers all functions, JNI entry points, and security-sensitive sinks.
+2. Checks static (call-graph) reachability across every JNI-to-sink pair --
+   cheap, so it covers everything.
+3. Ranks the statically-reachable pairs by call-chain directness and picks
+   the most promising few for **deep analysis**.
+4. Runs data-flow (symbolic) analysis on that shortlist -- expensive, so
+   it's spent only where it matters.
+5. Scores risk transparently and prints ranked findings.
+
+```
+SnikrFlow Security Audit
+═══════════════════════════
+Binary
+  Architecture: x86_64
+  Type:         Shared Object
+Functions
+  294 discovered
+  3 JNI candidates
+Security-sensitive operations
+  2 identified
+Interesting paths
+  1 statically reachable
+  1 selected for data-flow analysis
+Findings
+  [MEDIUM] JNI -> memory
+    Source: Java_..._MainActivity_init @ 0x403a00
+    Sink:   strncpy @ 0x400d80  (memory)
+    Status: statically_reachable
+```
+
+Risk levels are a **prioritization aid, not a vulnerability verdict**. Manual
+verification is still required -- SnikrFlow narrows the search space, it
+doesn't replace the researcher.
+
+## Architecture
+
+SnikrFlow is built in layers, deliberately kept independent from its analysis
+backend:
+
+```
+CLI ──┐
+      ├──> Core Engine ──> SnikrFlow Models ──> Analysis Interfaces ──> Backends
+Future GUI ──┘                                                          (angr today;
+                                                                     Unicorn/Pin/Dyninst
+                                                                          possible later)
+```
+
+- **SnikrFlow owns the concepts** (`Function`, `SecuritySink`, `AnalysisPath`,
+  `SymbolicResult`, `AnalysisFinding`, ...). The CLI never touches angr
+  objects directly.
+- **`analysis/interfaces/`** define *what* SnikrFlow can do.
+  **`analysis/backends/angr/`** define *how* angr does it today. Adding a
+  future backend means writing a new backend module, not rewriting the CLI.
+- The sink signature database (`sinks/signatures.py`) is a plain, editable
+  Python dict -- add your own categories/functions freely.
+
+## Terminology (read this before trusting a finding)
+
+SnikrFlow is deliberately precise about what different results mean --
+these are never used interchangeably:
+
+| Term | Meaning |
+|---|---|
+| `statically_reachable` | A direct call-graph path exists. Doesn't see indirect calls (function pointers, vtables). |
+| `SAT` (solve) | A concrete candidate input exists that walks this exact path. Not a confirmed exploit. |
+| `POSSIBLE` (dataflow) | Symbolic input appears to reach the sink's argument. Heuristic, not sound taint analysis. |
+| Risk level (audit) | A prioritization signal. Never a confirmed vulnerability. |
+
+## Responsible use
+
+SnikrFlow is for authorized security research only -- use it against binaries
+you own or have explicit permission to analyze.
+
+## Roadmap
+
+- [x] M1 -- ELF foundation (`info`, `functions`)
+- [x] M2 -- Security triage (`jni`, `sinks`)
+- [x] M3 -- Program structure (`cfg`, `callers`, `callees`)
+- [x] M4 -- Reachability (`reach`)
+- [x] M5 -- Symbolic execution (`solve`)
+- [x] M6 -- Data flow (`dataflow`)
+- [x] M7 -- Audit engine (`audit`)
+- [ ] M8 -- Android APK support (`audit app.apk`)
+- [ ] M9 -- Advanced analysis (better taint tracking, caching, SARIF)
+- [ ] M10 -- GUI (presentation layer over the same engine, no duplicated logic)
+
+## Credits
+
+Built on [angr](https://angr.io) and Claripy. CLI powered by
+[Typer](https://typer.tiangolo.com) and [Rich](https://rich.readthedocs.io).
+
+## License
+
+MIT -- see [LICENSE](LICENSE).

snikrflow-0.1.0/README.md

@@ -0,0 +1,187 @@
+<p align="center">
+  <img src="logo.svg" width="140" alt="SnikrFlow logo"/>
+</p>
+
+<h1 align="center">SnikrFlow</h1>
+
+<p align="center">
+  <b>Native binary security triage and reachability platform.</b><br/>
+  Stop wondering where to start reversing a binary. Let SnikrFlow tell you.
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/snikrflow/"><img alt="PyPI" src="https://img.shields.io/pypi/v/snikrflow.svg"></a>
+  <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-orange.svg"></a>
+  <img alt="Python" src="https://img.shields.io/badge/python-3.11%2B-blue.svg">
+</p>
+
+---
+
+## The problem
+
+You've got a large ELF binary or an Android `.so` library. Thousands of functions.
+No idea where the interesting stuff is. You could spend two hours blindly
+following callers, references, and branches in Ghidra... or you could ask:
+
+> "Before I spend two hours reversing this binary, tell me where I should
+> spend those two hours."
+
+That's what SnikrFlow answers.
+
+SnikrFlow is **not** a replacement for Ghidra, IDA, Binary Ninja, or GDB. It's
+the step *before* those tools: automated triage, reachability analysis, and
+symbolic execution that narrows "here are thousands of functions" down to
+"here are the paths you should investigate first."
+
+```
+Large ELF / Android .so
+        │
+        ▼
+    SnikrFlow
+        │
+        ├── ELF analysis          ├── Call graph analysis
+        ├── Function discovery    ├── Reachability
+        ├── JNI discovery         ├── Data-flow analysis
+        ├── Security sink detect  └── Symbolic execution
+        ├── CFG analysis
+        │
+        ▼
+  Prioritized findings
+        │
+        ▼
+      Ghidra
+        │
+        ▼
+  Deep manual RE
+```
+
+## Install
+
+```bash
+pip install snikrflow
+```
+
+(Or, for development: clone the repo and `pip install -e .`)
+
+Requires Python 3.11+. Built on [angr](https://angr.io) + Claripy for the
+underlying static/symbolic analysis engine.
+
+## Quick start
+
+```bash
+# The whole pipeline, orchestrated -- this is the one you actually want
+snikrflow audit libfoo.so
+
+# Or drill in stage by stage:
+snikrflow info libfoo.so                 # ELF metadata
+snikrflow functions libfoo.so            # discovered functions (angr CFGFast + symbols)
+snikrflow jni libfoo.so                  # statically-exported JNI entry points
+snikrflow sinks libfoo.so                # security-sensitive function calls
+snikrflow cfg libfoo.so                  # control-flow graph summary
+snikrflow callers libfoo.so 0x400d80     # who calls this address
+snikrflow callees libfoo.so 0x400d80     # what this address calls
+snikrflow reach libfoo.so --source 0x403a00 --sink 0x400d80     # static reachability
+snikrflow solve libfoo.so --source 0x403a00 --target 0x400d80   # symbolic candidate input
+snikrflow dataflow libfoo.so --source 0x403a00 --sink 0x400d80  # does tainted data reach the sink?
+```
+
+Every command supports `--json` for scripting/piping into other tools.
+
+## What `audit` actually does
+
+`audit` is the flagship command -- it runs the full pipeline automatically:
+
+1. Discovers all functions, JNI entry points, and security-sensitive sinks.
+2. Checks static (call-graph) reachability across every JNI-to-sink pair --
+   cheap, so it covers everything.
+3. Ranks the statically-reachable pairs by call-chain directness and picks
+   the most promising few for **deep analysis**.
+4. Runs data-flow (symbolic) analysis on that shortlist -- expensive, so
+   it's spent only where it matters.
+5. Scores risk transparently and prints ranked findings.
+
+```
+SnikrFlow Security Audit
+═══════════════════════════
+Binary
+  Architecture: x86_64
+  Type:         Shared Object
+Functions
+  294 discovered
+  3 JNI candidates
+Security-sensitive operations
+  2 identified
+Interesting paths
+  1 statically reachable
+  1 selected for data-flow analysis
+Findings
+  [MEDIUM] JNI -> memory
+    Source: Java_..._MainActivity_init @ 0x403a00
+    Sink:   strncpy @ 0x400d80  (memory)
+    Status: statically_reachable
+```
+
+Risk levels are a **prioritization aid, not a vulnerability verdict**. Manual
+verification is still required -- SnikrFlow narrows the search space, it
+doesn't replace the researcher.
+
+## Architecture
+
+SnikrFlow is built in layers, deliberately kept independent from its analysis
+backend:
+
+```
+CLI ──┐
+      ├──> Core Engine ──> SnikrFlow Models ──> Analysis Interfaces ──> Backends
+Future GUI ──┘                                                          (angr today;
+                                                                     Unicorn/Pin/Dyninst
+                                                                          possible later)
+```
+
+- **SnikrFlow owns the concepts** (`Function`, `SecuritySink`, `AnalysisPath`,
+  `SymbolicResult`, `AnalysisFinding`, ...). The CLI never touches angr
+  objects directly.
+- **`analysis/interfaces/`** define *what* SnikrFlow can do.
+  **`analysis/backends/angr/`** define *how* angr does it today. Adding a
+  future backend means writing a new backend module, not rewriting the CLI.
+- The sink signature database (`sinks/signatures.py`) is a plain, editable
+  Python dict -- add your own categories/functions freely.
+
+## Terminology (read this before trusting a finding)
+
+SnikrFlow is deliberately precise about what different results mean --
+these are never used interchangeably:
+
+| Term | Meaning |
+|---|---|
+| `statically_reachable` | A direct call-graph path exists. Doesn't see indirect calls (function pointers, vtables). |
+| `SAT` (solve) | A concrete candidate input exists that walks this exact path. Not a confirmed exploit. |
+| `POSSIBLE` (dataflow) | Symbolic input appears to reach the sink's argument. Heuristic, not sound taint analysis. |
+| Risk level (audit) | A prioritization signal. Never a confirmed vulnerability. |
+
+## Responsible use
+
+SnikrFlow is for authorized security research only -- use it against binaries
+you own or have explicit permission to analyze.
+
+## Roadmap
+
+- [x] M1 -- ELF foundation (`info`, `functions`)
+- [x] M2 -- Security triage (`jni`, `sinks`)
+- [x] M3 -- Program structure (`cfg`, `callers`, `callees`)
+- [x] M4 -- Reachability (`reach`)
+- [x] M5 -- Symbolic execution (`solve`)
+- [x] M6 -- Data flow (`dataflow`)
+- [x] M7 -- Audit engine (`audit`)
+- [ ] M8 -- Android APK support (`audit app.apk`)
+- [ ] M9 -- Advanced analysis (better taint tracking, caching, SARIF)
+- [ ] M10 -- GUI (presentation layer over the same engine, no duplicated logic)
+
+## Credits
+
+Built on [angr](https://angr.io) and Claripy. CLI powered by
+[Typer](https://typer.tiangolo.com) and [Rich](https://rich.readthedocs.io).
+
+## License
+
+MIT -- see [LICENSE](LICENSE).

snikrflow-0.1.0/pyproject.toml

@@ -0,0 +1,51 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "snikrflow"
+version = "0.1.0"
+description = "Native binary security triage and reachability platform, built on angr and Claripy."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { file = "LICENSE" }
+authors = [
+    { name = "Stodachon" }
+]
+keywords = [
+    "security", "reverse-engineering", "android", "jni", "binary-analysis",
+    "angr", "symbolic-execution", "triage", "reachability", "elf",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Environment :: Console",
+    "Intended Audience :: Information Technology",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Disassemblers",
+]
+dependencies = [
+    "angr",
+    "claripy",
+    "pyelftools",
+    "typer[all]",
+    "rich",
+    "networkx",
+]
+
+[project.optional-dependencies]
+dev = ["pytest"]
+
+[project.urls]
+Homepage = "https://github.com/stodachon/snikrflow"
+Repository = "https://github.com/stodachon/snikrflow"
+Issues = "https://github.com/stodachon/snikrflow/issues"
+
+[project.scripts]
+snikrflow = "snikrflow.cli:app"
+
+[tool.setuptools.packages.find]
+include = ["snikrflow*"]

snikrflow-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

snikrflow-0.1.0/snikrflow/analysis/backends/angr/audit.py

@@ -0,0 +1,145 @@
+"""
+SnikrFlow angr backend -- audit orchestration.
+
+Combines every prior analysis stage into one pipeline, per the doc's
+performance philosophy: cheap triage on everything, expensive symbolic/
+data-flow analysis only on the most promising candidates.
+
+Pipeline:
+  1. Discover functions, JNI candidates, sinks (cheap -- one CFGFast run,
+     reused across all three thanks to the caching guard in functions.py).
+  2. For every (JNI entry, sink) pair, check STATIC call-graph
+     reachability (cheap -- no symbolic execution).
+  3. Rank the statically-reachable pairs by call-chain length (shorter =
+     more direct = higher priority) and take the top N for deep analysis.
+  4. Run data-flow analysis (symbolic, bounded by a short per-pair
+     timeout) ONLY on that top-N subset.
+  5. Score risk transparently (see _score_risk) and sort findings by risk.
+"""
+
+from __future__ import annotations
+
+from typing import Optional
+
+from snikrflow.analysis.backends.angr.dataflow import check_data_flow
+from snikrflow.analysis.backends.angr.functions import discover_functions
+from snikrflow.analysis.backends.angr.jni import discover_jni_functions
+from snikrflow.analysis.backends.angr.reachability import check_static_reachability
+from snikrflow.analysis.backends.angr.sinks import discover_sinks
+from snikrflow.core.models import (
+    AnalysisFinding,
+    AuditResult,
+    DataFlowStatus,
+    ReachabilityType,
+    RiskLevel,
+)
+from snikrflow.elf.loader import LoadedBinary
+from snikrflow.elf.metadata import extract_binary_info
+
+# Cap on how many statically-reachable pairs get the expensive data-flow
+# treatment. Keeps `audit` bounded on binaries with many JNI x sink
+# combinations -- deep analysis is a scarce resource, spent on the most
+# direct (shortest) paths first.
+MAX_DEEP_ANALYSIS_PAIRS = 5
+DEFAULT_DEEP_TIMEOUT_SECONDS = 30
+
+# Rough, documented, and DELIBERATELY simple severity weighting per sink
+# category. This is a transparent prioritization heuristic, not a
+# vulnerability database -- edit freely.
+_CATEGORY_SEVERITY = {
+    "process_execution": 3,
+    "dynamic_loading": 3,
+    "memory": 2,
+    "networking": 2,
+    "filesystem": 1,
+}
+
+
+def _score_risk(
+    reachability_type: ReachabilityType,
+    data_flow_status: Optional[DataFlowStatus],
+    category: str,
+) -> RiskLevel:
+    severity = _CATEGORY_SEVERITY.get(category, 1)
+
+    if reachability_type != ReachabilityType.STATICALLY_REACHABLE:
+        return RiskLevel.LOW
+
+    if data_flow_status == DataFlowStatus.POSSIBLE:
+        return RiskLevel.CRITICAL if severity >= 3 else RiskLevel.HIGH
+
+    # Reachable via call graph, but data flow wasn't confirmed possible
+    # (either not checked, or checked and came back inconclusive).
+    return RiskLevel.HIGH if severity >= 3 else RiskLevel.MEDIUM
+
+
+def run_audit(binary: LoadedBinary, deep_timeout_seconds: int = DEFAULT_DEEP_TIMEOUT_SECONDS) -> AuditResult:
+    binary_info = extract_binary_info(binary)
+
+    all_functions = discover_functions(binary)      # runs CFGFast once
+    jni_functions = discover_jni_functions(binary)   # reuses it
+    sinks = discover_sinks(binary)                   # reuses it
+
+    # Step 1: cheap static reachability across every JNI x sink pair.
+    reachable_pairs = []
+    for jni_func in jni_functions:
+        for sink in sinks:
+            path = check_static_reachability(binary, jni_func.address, sink.address)
+            if path.reachable and path.reachability_type == ReachabilityType.STATICALLY_REACHABLE:
+                reachable_pairs.append((jni_func, sink, path))
+
+    # Step 2: prioritize shortest (most direct) call chains for deep analysis.
+    reachable_pairs.sort(key=lambda item: len(item[2].function_path))
+    deep_pairs = reachable_pairs[:MAX_DEEP_ANALYSIS_PAIRS]
+    deep_keys = {(j.address, s.address) for j, s, _ in deep_pairs}
+
+    # Step 3: build findings, running data-flow only on the selected subset.
+    findings: list[AnalysisFinding] = []
+    for jni_func, sink, path in reachable_pairs:
+        data_flow_status: Optional[DataFlowStatus] = None
+        confidence = path.confidence
+        notes: list[str] = [path.note] if path.note else []
+
+        if (jni_func.address, sink.address) in deep_keys:
+            try:
+                df_result = check_data_flow(
+                    binary, jni_func.address, sink.address,
+                    timeout_seconds=deep_timeout_seconds,
+                )
+                data_flow_status = df_result.status
+                confidence = df_result.confidence
+                if df_result.note:
+                    notes.append(df_result.note)
+            except Exception as e:
+                notes.append(f"Data-flow analysis failed: {e}")
+
+        risk = _score_risk(path.reachability_type, data_flow_status, sink.category)
+
+        findings.append(
+            AnalysisFinding(
+                title=f"JNI -> {sink.category}",
+                source_address=jni_func.address,
+                source_name=jni_func.name,
+                sink_address=sink.address,
+                sink_name=sink.name,
+                sink_category=sink.category,
+                reachability_type=path.reachability_type,
+                data_flow_status=data_flow_status,
+                risk_level=risk,
+                confidence=confidence,
+                notes=notes,
+            )
+        )
+
+    risk_order = {RiskLevel.CRITICAL: 0, RiskLevel.HIGH: 1, RiskLevel.MEDIUM: 2, RiskLevel.LOW: 3}
+    findings.sort(key=lambda f: risk_order.get(f.risk_level, 4))
+
+    return AuditResult(
+        binary_info=binary_info,
+        function_count=len(all_functions),
+        jni_count=len(jni_functions),
+        sink_count=len(sinks),
+        interesting_path_count=len(reachable_pairs),
+        symbolic_analysis_count=len(deep_pairs),
+        findings=findings,
+    )