Implement Import/Export Symbol Classification Pipeline

Summary

Implement the classification pipeline that converts parsed import/export symbol metadata and section names from ContainerInfo into tagged, scored FoundString objects. This is the missing bridge between the container parsers and the string ranking/output layers.

Current State

The following components are already implemented and ready to build on:

Component	Status	Location
ELF/PE/Mach-O container parsers	✅ Done	`src/container/`
`ImportInfo` / `ExportInfo` types	✅ Done	`src/types/mod.rs`
`Tag::Import` / `Tag::Export` variants	✅ Done	`src/types/mod.rs`
`StringSource::ImportName` / `ExportName`	✅ Done	`src/types/mod.rs`
`SymbolDemangler` (Rust + C++)	✅ Done	`src/classification/symbols.rs`
`RankingEngine` with Import/Export boosts (+60)	✅ Done	`src/classification/ranking.rs`
`SemanticClassifier` (URLs, IPs, paths, etc.)	✅ Done	`src/classification/mod.rs`

What is missing: Nothing currently converts the Vec<ImportInfo> and Vec<ExportInfo> stored in ContainerInfo into FoundString objects. The Tag::Import and Tag::Export ranking boosts are defined but never applied because no code path creates strings with those tags from binary metadata.

Required Work

1. New `ImportClassifier` in `src/classification/imports.rs`

Create a struct that consumes ContainerInfo metadata and emits Vec<FoundString>:

pub struct ImportClassifier {
    demangler: SymbolDemangler,
    crypto_apis: HashSet<&'static str>,
    network_apis: HashSet<&'static str>,
    file_apis: HashSet<&'static str>,
    entry_points: HashSet<&'static str>,
}

impl ImportClassifier {
    /// Convert all imports in ContainerInfo to tagged FoundStrings
    pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString>;

    /// Convert all exports in ContainerInfo to tagged FoundStrings
    pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString>;

    /// Extract section names as high-value FoundStrings
    pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString>;
}

/// Main entry point for the pipeline
pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>;

Import processing rules:

source: StringSource::ImportName
tags: always include Tag::Import; add semantic tags (Tag::Crypto, Tag::Network, Tag::FileIO) based on symbol name
section: use library field from ImportInfo if present, otherwise ".idata" (PE) or ".dynsym" (ELF)
rva: from ImportInfo::address if available
confidence: 1.0 (import names are high-confidence by nature)

Export processing rules:

source: StringSource::ExportName
tags: always include Tag::Export; apply SymbolDemangler and add Tag::DemangledSymbol if demangled; add Tag::EntryPoint for known entry symbols
rva: from ExportInfo::address
Entry point symbols to detect: main, _start, DllMain, WinMain, wWinMain

Section name processing:

source: StringSource::SectionData
confidence: 1.0
Useful for downstream context when ranking strings by section

2. New `Tag` Variants in `src/types/mod.rs`

Add the following variants to the Tag enum and update FromStr, Display, and any exhaustive match sites:

#[serde(rename = "crypto")]
Crypto,        // Cryptographic API (CryptEncrypt, EVP_*, AES_*)

#[serde(rename = "network")]
Network,       // Network API (socket, connect, WSA*, curl_*)

#[serde(rename = "fileio")]
FileIO,        // File I/O API (CreateFileW, fopen, ReadFile)

#[serde(rename = "entry-point")]
EntryPoint,    // Binary entry point (main, _start, DllMain)

3. Update `RankingConfig` in `src/classification/ranking.rs`

Add tag boosts for the four new tags:

Tag	Suggested Boost
`Tag::Crypto`	+50
`Tag::Network`	+45
`Tag::FileIO`	+35
`Tag::EntryPoint`	+40

4. Export from `src/classification/mod.rs`

pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};

5. API Pattern Sets

Use std::sync::LazyLock (already used in this codebase—do not use once_cell) for static API sets:

Crypto APIs: CryptEncrypt, CryptDecrypt, CryptHashData, EVP_EncryptInit, EVP_DecryptInit, AES_encrypt, AES_decrypt, BCryptEncrypt, BCryptDecrypt, crypto_secretbox, crypto_box

Network APIs: socket, connect, bind, listen, accept, send, recv, sendto, recvfrom, WSAStartup, WSASocket, WSAConnect, curl_easy_init, curl_easy_perform, getaddrinfo, gethostbyname

File I/O APIs: CreateFileW, CreateFileA, ReadFile, WriteFile, open, fopen, fread, fwrite, NtCreateFile, ZwCreateFile

Test Requirements

Create tests/classification_symbols.rs covering:

Import classification: Tag::Import always set; crypto/network/file I/O tags applied correctly; library name preserved in section field
Export classification: Tag::Export always set; demangled symbols get Tag::DemangledSymbol; entry points get Tag::EntryPoint
API pattern detection: Each API category hits at least 3 representative symbols; non-matching symbols do not receive semantic tags
Section name extraction: Section names produce FoundString with source: StringSource::SectionData
Integration tests: Use existing fixtures from tests/fixtures/ (ELF, PE, Mach-O) to verify end-to-end extract_symbol_strings output

Documentation Fix

docs/src/classification.md currently references once_cell::sync::Lazy but the codebase uses std::sync::LazyLock. Update the pattern matching engine example to reflect the actual implementation.

Success Criteria

ImportClassifier implemented in src/classification/imports.rs
extract_symbol_strings(&ContainerInfo) -> Vec<FoundString> public API
All imports tagged with Tag::Import + applicable semantic tags
All exports tagged with Tag::Export; demangled where applicable
Tag::Crypto, Tag::Network, Tag::FileIO, Tag::EntryPoint added to type system
New tags wired into RankingConfig with appropriate boosts
tests/classification_symbols.rs with unit + integration tests
docs/src/classification.md updated (fix once_cell → std::sync::LazyLock)

References

src/classification/symbols.rs — SymbolDemangler (already implemented, reuse directly)
src/classification/ranking.rs — RankingConfig tag boosts to extend
src/types/mod.rs — Tag enum, ImportInfo, ExportInfo, ContainerInfo
src/container/elf/mod.rs, pe/mod.rs, macho/mod.rs — how ImportInfo/ExportInfo are populated

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

Plan

Observations

The codebase has a complete foundation with container parsers (ELF, PE, Mach-O) that extract imports/exports into ContainerInfo. The SymbolDemangler is already implemented in src/classification/symbols.rs with full Rust and C++ demangling support. The RankingEngine with tag boosts is complete but currently only applies boosts to Tag::Import and Tag::Export (both +60). The missing piece is the bridge: code that converts ImportInfo/ExportInfo from ContainerInfo into FoundString objects with appropriate tags and semantic classification.

Approach

Create a new ImportClassifier struct in src/classification/imports.rs that consumes ContainerInfo and emits Vec<FoundString>. Implement three processing methods: process_imports(), process_exports(), and process_section_names(). Add four new Tag variants (Crypto, Network, FileIO, EntryPoint) to the type system. Update RankingConfig with boosts for the new tags. Use std::sync::LazyLock for static API pattern sets (crypto, network, file I/O). Reuse the existing SymbolDemangler for export symbol demangling. Create comprehensive tests covering all three binary formats.

Mermaid Diagram

sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant IC as ImportClassifier
    participant SD as SymbolDemangler
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over IC,FS: Symbol Classification Phase (New Implementation)
    CI->>IC: extract_symbol_strings(&container_info)
    
    IC->>IC: process_imports(&imports)
    loop For each ImportInfo
        IC->>IC: Check against crypto_apis, network_apis, file_apis
        Note over IC: Apply semantic tags (Crypto, Network, FileIO)
        IC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: source: ImportName, confidence: 1.0
    end
    
    IC->>IC: process_exports(&exports)
    loop For each ExportInfo
        IC->>SD: demangle(symbol_name)
        alt Demangled successfully
            SD-->>IC: demangled_name + Tag::DemangledSymbol
        else Not mangled
            SD-->>IC: original_name
        end
        IC->>IC: Check for entry points (main, _start, DllMain, etc.)
        IC->>FS: Create FoundString with Tag::Export + optional EntryPoint
        Note over FS: source: ExportName, confidence: 1.0
    end
    
    IC->>IC: process_section_names(&sections)
    loop For each SectionInfo
        IC->>FS: Create FoundString from section name
        Note over FS: source: SectionData, confidence: 1.0
    end
    
    IC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output

Implementation Tasks

1. Add New Tag Variants to `file:src/types/mod.rs`

Add four new semantic tag variants to the Tag enum (after line 58, before the closing brace):

#[serde(rename = "crypto")]
Crypto,

#[serde(rename = "network")]
Network,

#[serde(rename = "fileio")]
FileIO,

#[serde(rename = "entry-point")]
EntryPoint,

Update the FromStr implementation (lines 60-89) to handle the new tags:

Add "crypto" => Ok(Tag::Crypto)
Add "network" => Ok(Tag::Network)
Add "fileio" => Ok(Tag::FileIO)
Add "entry-point" => Ok(Tag::EntryPoint)

2. Create `file:src/classification/imports.rs` (New File)

Implement the ImportClassifier struct with the following structure:

Static API Pattern Sets (using std::sync::LazyLock):

CRYPTO_APIS: CryptEncrypt, CryptDecrypt, CryptHashData, EVP_EncryptInit, EVP_DecryptInit, AES_encrypt, AES_decrypt, BCryptEncrypt, BCryptDecrypt, crypto_secretbox, crypto_box
NETWORK_APIS: socket, connect, bind, listen, accept, send, recv, sendto, recvfrom, WSAStartup, WSASocket, WSAConnect, curl_easy_init, curl_easy_perform, getaddrinfo, gethostbyname
FILE_APIS: CreateFileW, CreateFileA, ReadFile, WriteFile, open, fopen, fread, fwrite, NtCreateFile, ZwCreateFile
ENTRY_POINTS: main, _start, DllMain, WinMain, wWinMain

ImportClassifier struct:

pub struct ImportClassifier {
    demangler: SymbolDemangler,
}

Methods:

pub fn new() -> Self - Constructor that initializes SymbolDemangler
pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString> - Convert all imports to FoundString with Tag::Import + semantic tags
pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString> - Convert all exports to FoundString with Tag::Export, apply demangling, detect entry points
pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString> - Extract section names as FoundString with StringSource::SectionData
fn classify_symbol(&self, name: &str) -> Vec<Tag> - Return semantic tags (Crypto, Network, FileIO) based on API pattern matching
fn is_entry_point(&self, name: &str) -> bool - Check if symbol is in ENTRY_POINTS set

Main entry point:

pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>

Implementation details:

Imports: Always include Tag::Import, add semantic tags from classify_symbol(), set source: StringSource::ImportName, confidence: 1.0, use library name as section if available
Exports: Always include Tag::Export, apply demangler to symbol name, add Tag::EntryPoint if detected, set source: StringSource::ExportName, confidence: 1.0
Section names: Use source: StringSource::SectionData, confidence: 1.0

3. Update `file:src/classification/mod.rs`

Add module declaration and re-exports (after line 47):

pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};

4. Update `file:src/classification/ranking.rs`

Add tag boosts to the RankingConfig::default() method (in the tag_boosts HashMap, around line 121-142):

tag_boosts.insert(Tag::Crypto, 50);
tag_boosts.insert(Tag::Network, 45);
tag_boosts.insert(Tag::FileIO, 35);
tag_boosts.insert(Tag::EntryPoint, 40);

Also update the test test_default_config_values() (around line 304-350) to verify the new tag boosts are present.

5. Create `file:tests/classification_symbols.rs` (New File)

Comprehensive test suite covering:

Import classification tests:

test_import_crypto_api_detection - Verify crypto APIs get Tag::Crypto
test_import_network_api_detection - Verify network APIs get Tag::Network
test_import_file_api_detection - Verify file APIs get Tag::FileIO
test_import_always_tagged - Verify all imports get Tag::Import
test_import_library_preserved - Verify library name is in section field
test_import_source_and_confidence - Verify source is ImportName and confidence is 1.0

Export classification tests:

test_export_always_tagged - Verify all exports get Tag::Export
test_export_entry_point_detection - Verify main, _start, DllMain, WinMain get Tag::EntryPoint
test_export_demangling - Verify mangled symbols are demangled and get Tag::DemangledSymbol
test_export_source_and_confidence - Verify source is ExportName and confidence is 1.0

Section name tests:

test_section_names_extracted - Verify section names become FoundString objects
test_section_names_source - Verify source is SectionData
test_section_names_confidence - Verify confidence is 1.0

Integration tests (using fixtures from tests/fixtures/):

test_extract_symbol_strings_elf - Full pipeline with ELF fixture
test_extract_symbol_strings_pe - Full pipeline with PE fixture (if available)
test_extract_symbol_strings_macho - Full pipeline with Mach-O fixture (if available)
test_empty_container_info - Graceful handling of empty imports/exports/sections

Use the fixture loading pattern from tests/integration_elf.rs (lines 5-10).

6. Update `file:docs/src/classification.md`

Fix the documentation reference from once_cell::sync::Lazy to std::sync::LazyLock in the pattern matching engine example. Add a new section documenting the ImportClassifier:

Explain the purpose of import/export classification
Document the API pattern sets and their purpose
Show example output of extract_symbol_strings()
Document entry point detection
Explain how demangling integrates with export processing

7. Update `file:README.md`

Add a section describing the symbol classification feature:

Import/export processing capabilities
Semantic API detection (crypto, network, file I/O)
Entry point identification
Rust symbol demangling support
Example output showing classified symbols

Ensure the feature list reflects that symbol classification is now implemented.

Import In IDE

🤖 Prompt for AI Agents

### Observations

The codebase has a complete foundation with container parsers (ELF, PE, Mach-O) that extract imports/exports into `ContainerInfo`. The `SymbolDemangler` is already implemented in `src/classification/symbols.rs` with full Rust and C++ demangling support. The `RankingEngine` with tag boosts is complete but currently only applies boosts to `Tag::Import` and `Tag::Export` (both +60). The missing piece is the bridge: code that converts `ImportInfo`/`ExportInfo` from `ContainerInfo` into `FoundString` objects with appropriate tags and semantic classification.

### Approach

Create a new `ImportClassifier` struct in `src/classification/imports.rs` that consumes `ContainerInfo` and emits `Vec<FoundString>`. Implement three processing methods: `process_imports()`, `process_exports()`, and `process_section_names()`. Add four new `Tag` variants (`Crypto`, `Network`, `FileIO`, `EntryPoint`) to the type system. Update `RankingConfig` with boosts for the new tags. Use `std::sync::LazyLock` for static API pattern sets (crypto, network, file I/O). Reuse the existing `SymbolDemangler` for export symbol demangling. Create comprehensive tests covering all three binary formats.

## Mermaid Diagram

```mermaid
sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant IC as ImportClassifier
    participant SD as SymbolDemangler
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over IC,FS: Symbol Classification Phase (New Implementation)
    CI->>IC: extract_symbol_strings(&container_info)
    
    IC->>IC: process_imports(&imports)
    loop For each ImportInfo
        IC->>IC: Check against crypto_apis, network_apis, file_apis
        Note over IC: Apply semantic tags (Crypto, Network, FileIO)
        IC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: source: ImportName, confidence: 1.0
    end
    
    IC->>IC: process_exports(&exports)
    loop For each ExportInfo
        IC->>SD: demangle(symbol_name)
        alt Demangled successfully
            SD-->>IC: demangled_name + Tag::DemangledSymbol
        else Not mangled
            SD-->>IC: original_name
        end
        IC->>IC: Check for entry points (main, _start, DllMain, etc.)
        IC->>FS: Create FoundString with Tag::Export + optional EntryPoint
        Note over FS: source: ExportName, confidence: 1.0
    end
    
    IC->>IC: process_section_names(&sections)
    loop For each SectionInfo
        IC->>FS: Create FoundString from section name
        Note over FS: source: SectionData, confidence: 1.0
    end
    
    IC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output
```

## Implementation Tasks

### 1. Add New Tag Variants to `file:src/types/mod.rs`

Add four new semantic tag variants to the `Tag` enum (after line 58, before the closing brace):

```rust
#[serde(rename = "crypto")]
Crypto,

#[serde(rename = "network")]
Network,

#[serde(rename = "fileio")]
FileIO,

#[serde(rename = "entry-point")]
EntryPoint,
```

Update the `FromStr` implementation (lines 60-89) to handle the new tags:
- Add `"crypto" => Ok(Tag::Crypto)`
- Add `"network" => Ok(Tag::Network)`
- Add `"fileio" => Ok(Tag::FileIO)`
- Add `"entry-point" => Ok(Tag::EntryPoint)`

### 2. Create `file:src/classification/imports.rs` (New File)

Implement the `ImportClassifier` struct with the following structure:

**Static API Pattern Sets** (using `std::sync::LazyLock`):
- `CRYPTO_APIS`: CryptEncrypt, CryptDecrypt, CryptHashData, EVP_EncryptInit, EVP_DecryptInit, AES_encrypt, AES_decrypt, BCryptEncrypt, BCryptDecrypt, crypto_secretbox, crypto_box
- `NETWORK_APIS`: socket, connect, bind, listen, accept, send, recv, sendto, recvfrom, WSAStartup, WSASocket, WSAConnect, curl_easy_init, curl_easy_perform, getaddrinfo, gethostbyname
- `FILE_APIS`: CreateFileW, CreateFileA, ReadFile, WriteFile, open, fopen, fread, fwrite, NtCreateFile, ZwCreateFile
- `ENTRY_POINTS`: main, _start, DllMain, WinMain, wWinMain

**ImportClassifier struct**:
```rust
pub struct ImportClassifier {
    demangler: SymbolDemangler,
}
```

**Methods**:
- `pub fn new() -> Self` - Constructor that initializes SymbolDemangler
- `pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString>` - Convert all imports to FoundString with Tag::Import + semantic tags
- `pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString>` - Convert all exports to FoundString with Tag::Export, apply demangling, detect entry points
- `pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString>` - Extract section names as FoundString with StringSource::SectionData
- `fn classify_symbol(&self, name: &str) -> Vec<Tag>` - Return semantic tags (Crypto, Network, FileIO) based on API pattern matching
- `fn is_entry_point(&self, name: &str) -> bool` - Check if symbol is in ENTRY_POINTS set

**Main entry point**:
```rust
pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>
```

**Implementation details**:
- Imports: Always include Tag::Import, add semantic tags from `classify_symbol()`, set `source: StringSource::ImportName`, `confidence: 1.0`, use library name as section if available
- Exports: Always include Tag::Export, apply demangler to symbol name, add Tag::EntryPoint if detected, set `source: StringSource::ExportName`, `confidence: 1.0`
- Section names: Use `source: StringSource::SectionData`, `confidence: 1.0`

### 3. Update `file:src/classification/mod.rs`

Add module declaration and re-exports (after line 47):
```rust
pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};
```

### 4. Update `file:src/classification/ranking.rs`

Add tag boosts to the `RankingConfig::default()` method (in the `tag_boosts` HashMap, around line 121-142):
- `tag_boosts.insert(Tag::Crypto, 50);`
- `tag_boosts.insert(Tag::Network, 45);`
- `tag_boosts.insert(Tag::FileIO, 35);`
- `tag_boosts.insert(Tag::EntryPoint, 40);`

Also update the test `test_default_config_values()` (around line 304-350) to verify the new tag boosts are present.

### 5. Create `file:tests/classification_symbols.rs` (New File)

Comprehensive test suite covering:

**Import classification tests**:
- `test_import_crypto_api_detection` - Verify crypto APIs get Tag::Crypto
- `test_import_network_api_detection` - Verify network APIs get Tag::Network
- `test_import_file_api_detection` - Verify file APIs get Tag::FileIO
- `test_import_always_tagged` - Verify all imports get Tag::Import
- `test_import_library_preserved` - Verify library name is in section field
- `test_import_source_and_confidence` - Verify source is ImportName and confidence is 1.0

**Export classification tests**:
- `test_export_always_tagged` - Verify all exports get Tag::Export
- `test_export_entry_point_detection` - Verify main, _start, DllMain, WinMain get Tag::EntryPoint
- `test_export_demangling` - Verify mangled symbols are demangled and get Tag::DemangledSymbol
- `test_export_source_and_confidence` - Verify source is ExportName and confidence is 1.0

**Section name tests**:
- `test_section_names_extracted` - Verify section names become FoundString objects
- `test_section_names_source` - Verify source is SectionData
- `test_section_names_confidence` - Verify confidence is 1.0

**Integration tests** (using fixtures from `tests/fixtures/`):
- `test_extract_symbol_strings_elf` - Full pipeline with ELF fixture
- `test_extract_symbol_strings_pe` - Full pipeline with PE fixture (if available)
- `test_extract_symbol_strings_macho` - Full pipeline with Mach-O fixture (if available)
- `test_empty_container_info` - Graceful handling of empty imports/exports/sections

Use the fixture loading pattern from `tests/integration_elf.rs` (lines 5-10).

### 6. Update `file:docs/src/classification.md`

Fix the documentation reference from `once_cell::sync::Lazy` to `std::sync::LazyLock` in the pattern matching engine example. Add a new section documenting the `ImportClassifier`:

- Explain the purpose of import/export classification
- Document the API pattern sets and their purpose
- Show example output of `extract_symbol_strings()`
- Document entry point detection
- Explain how demangling integrates with export processing

### 7. Update `file:README.md`

Add a section describing the symbol classification feature:
- Import/export processing capabilities
- Semantic API detection (crypto, network, file I/O)
- Entry point identification
- Rust symbol demangling support
- Example output showing classified symbols

Ensure the feature list reflects that symbol classification is now implemented.

Execution Information

Branch: main
Commit: cde9ad3

💡 Tips

Supported Commands (Inside Comments)

Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

@unclesp1d3r

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch issue #20 details
gh issue view 20 --json title,body,labels,assignees,milestone,state

# Get repository information
gh repo view --json name,description,defaultBranch

# Explore the repository structure to understand the project
fd -t f -e py -e md | head -30

Length of output: 2925

🏁 Script executed:

#!/bin/bash
# Read relevant documentation
echo "=== Classification Documentation ==="
cat docs/src/classification.md

echo -e "\n=== Binary Formats Documentation ==="
cat docs/src/binary-formats.md

echo -e "\n=== Architecture Documentation ==="
cat docs/src/architecture.md

# Find source files related to classification, imports, exports
echo -e "\n=== Source Structure ==="
fd -t f -e rs | grep -E "(src|lib)" | head -20

Length of output: 32796

🏁 Script executed:

#!/bin/bash
# Check classification module implementation
echo "=== Classification Module ==="
cat src/classification/mod.rs

echo -e "\n=== Types Module ==="
cat src/types.rs

# Check if there's existing symbol processing
echo -e "\n=== Looking for symbol-related code ==="
rg -n "symbol|Symbol|import|Import|export|Export" src/ --type rust -C 2 | head -100

# Check test structure
echo -e "\n=== Test Structure ==="
fd -t f "test" -e rs | head -20
ls -la tests/ 2>/dev/null || echo "No tests directory yet"

Length of output: 9971

🏁 Script executed:

#!/bin/bash
# Check for requirements documentation
echo "=== Looking for Requirements Documentation ==="
fd -t f "requirement" -e md -e txt
cat docs/src/architecture.md | grep -A 10 "4\."

# Check existing integration tests to understand test patterns
echo -e "\n=== Integration Test Pattern ==="
head -50 tests/integration_elf.rs

# Look for any existing classification or symbol processing code
echo -e "\n=== Check for symbol/classification stubs ==="
rg -n "classify|demangle|mangle" src/ --type rust

# Check concept.md for requirements
echo -e "\n=== Concept Documentation ==="
cat concept.md

Length of output: 11778

🏁 Script executed:

#!/bin/bash
# Update the issue with enhanced content
gh issue edit 20 \
  --title "Implement Symbol Classification and Import/Export Tagging" \
  --body "## Summary

Implement the classification layer for import/export symbols and section names, converting parsed binary metadata into tagged, scored FoundString objects for analysis.

## Current State

✅ **Container Parsers Implemented**: All three parsers (ELF, PE, Mach-O) successfully extract import/export metadata:
- \`ImportInfo\`: Symbol names, library names, addresses
- \`ExportInfo\`: Symbol names, addresses, ordinals
- Section metadata with full classification

🚧 **Classification Module Empty**: \`src/classification/mod.rs\` contains only a comment. Need to implement symbol processing logic.

## Requirements

### 4.2: Import Name Identification and Tagging
- Convert \`ImportInfo\` objects into \`FoundString\` with \`Tag::Import\`
- Set \`source: StringSource::ImportName\`
- Apply semantic classification (e.g., crypto APIs, network APIs)
- Boost relevance scores for security-relevant imports

### 4.3: Export Name Identification and Tagging  
- Convert \`ExportInfo\` objects into \`FoundString\` with \`Tag::Export\`
- Set \`source: StringSource::ExportName\`
- Demangle Rust symbols using \`rustc-demangle\`
- Identify entry points and special exports

### 4.4: Section Name Processing and Classification
- Treat section names as high-value strings
- Tag with relevant semantic categories
- Use section names to provide context for other strings

## Proposed Solution

### Implementation Structure

Create \`src/classification/symbols.rs\` module with:

\`\`\`rust
pub struct SymbolClassifier {
    crypto_apis: HashSet<String>,
    network_apis: HashSet<String>,
    file_apis: HashSet<String>,
}

impl SymbolClassifier {
    pub fn process_imports(imports: &[ImportInfo]) -> Vec<FoundString>;
    pub fn process_exports(exports: &[ExportInfo]) -> Vec<FoundString>;
    pub fn classify_symbol(name: &str) -> Vec<Tag>;
    pub fn demangle_rust_symbol(name: &str) -> Option<String>;
}
\`\`\`

### Key Features

1. **Import Processing**
   - Convert each \`ImportInfo\` to \`FoundString\`
   - Base score: +20 points (high value)
   - Additional tags based on API name patterns:
     - Crypto: \`CryptEncrypt\`, \`EVP_*\`, \`crypto_*\`
     - Network: \`socket\`, \`connect\`, \`WSA*\`, \`curl_*\`
     - File I/O: \`CreateFile\`, \`open\`, \`fopen\`
   - Preserve library information in metadata

2. **Export Processing**  
   - Convert each \`ExportInfo\` to \`FoundString\`
   - Attempt Rust symbol demangling
   - Identify special exports:
     - Entry points: \`main\`, \`DllMain\`, \`_start\`
     - Mangled Rust functions
   - Base score: +15 points

3. **Symbol Demangling**
   - Use \`rustc-demangle\` crate for Rust symbols
   - Preserve both mangled and demangled forms
   - Add context-specific tags (\`panic\`, \`alloc\`, etc.)

4. **Section Name Processing**
   - Extract section names from \`SectionInfo\`
   - High relevance score (+10)
   - Use for contextualizing other strings in same section

### API Design

\`\`\`rust
// Main entry point for symbol processing
pub fn extract_symbol_strings(container_info: &ContainerInfo) -> Vec<FoundString> {
    let mut strings = Vec::new();
    
    let classifier = SymbolClassifier::new();
    strings.extend(classifier.process_imports(&container_info.imports));
    strings.extend(classifier.process_exports(&container_info.exports));
    strings.extend(extract_section_names(&container_info.sections));
    
    strings
}
\`\`\`

## Test Requirements

Create \`tests/classification_symbols.rs\` with:

1. **Import Classification Tests**
   - Test crypto API detection (\`CryptEncrypt\`, \`AES_encrypt\`)
   - Test network API detection (\`socket\`, \`WSAStartup\`)
   - Verify Tag::Import applied correctly
   - Check library attribution preserved

2. **Export Classification Tests**
   - Test basic export tagging
   - Test entry point detection (\`main\`, \`DllMain\`)
   - Verify Tag::Export applied

3. **Rust Demangling Tests**
   - Test successful demangling of Rust symbols
   - Verify both forms preserved
   - Test context tag detection (panic, main, etc.)
   - Handle non-Rust symbols gracefully

4. **Section Name Tests**
   - Verify section names extracted as strings
   - Check appropriate scoring applied
   - Test all three formats (ELF, PE, Mach-O)

## Success Criteria

- [ ] \`SymbolClassifier\` implemented in \`src/classification/symbols.rs\`
- [ ] All imports converted to \`FoundString\` with \`Tag::Import\`
- [ ] All exports converted to \`FoundString\` with \`Tag::Export\`  
- [ ] Rust symbol demangling working with \`rustc-demangle\`
- [ ] Semantic API classification (crypto, network, file I/O)
- [ ] Section names processed as high-value strings
- [ ] Unit tests achieving >90% coverage
- [ ] Integration tests for all three formats
- [ ] Documentation with examples

## Dependencies

- ✅ Symbol Processing (container parsers extract symbols)
- 📦 \`rustc-demangle\` crate (add to Cargo.toml)

## Technical Notes

- Use lazy_static for compiled API pattern sets
- Preserve all original metadata (addresses, ordinals, library names)
- Scoring should be additive: base score + semantic boosts
- Handle edge cases: empty names, duplicate symbols, stripped binaries
- Consider memory efficiency with large symbol tables

## Example Output

\`\`\`json
{
  \"text\": \"CryptEncrypt\",
  \"encoding\": \"Ascii\",
  \"offset\": 0,
  \"section\": \".idata\",
  \"tags\": [\"import\", \"crypto\"],
  \"score\": 25,
  \"source\": \"ImportName\"
}
\`\`\`

## References

- Architecture docs: \`docs/src/architecture.md\` (Symbol Classification section)
- Classification docs: \`docs/src/classification.md\` (Symbol Classifier implementation)  
- Concept doc: \`concept.md\` (Demangling requirements)
- Related: Container parsing implementation (✅ complete)"

# Add additional labels
gh issue edit 20 --add-label "priority:medium,needs:implementation"

Length of output: 199

🏁 Script executed:

#!/bin/bash
# Check available labels in the repository
echo "=== Available Labels ==="
gh label list --limit 100

# Check if the issue was updated successfully
echo -e "\n=== Verify Issue Update ==="
gh issue view 20 --json title,body,labels | jq -r '.title'

Length of output: 1565

🏁 Script executed:

#!/bin/bash
# Add the priority:medium label (it exists in the repo)
gh issue edit 20 --add-label "priority:medium"

# Verify the full issue update
echo "=== Full Issue Details ==="
gh issue view 20 --json title,body,labels,assignees,milestone --jq '{title, assignees: [.assignees[].login], labels: [.labels[].name], milestone: .milestone.title}'

# Show a preview of the updated body
echo -e "\n=== Issue Body Preview (first 500 chars) ==="
gh issue view 20 --json body --jq '.body' | head -c 500
echo "..."

Length of output: 858

@unclesp1d3r I've successfully enhanced issue #20 with comprehensive details! Here's what was updated:

✅ Changes Made

Title

Before: Import/Export Classification
After: Implement Symbol Classification and Import/Export Tagging

Enhanced Body Content

Added detailed sections covering:

Current State Analysis
- Container parsers already extract all needed metadata (✅ implemented)
- Classification module is empty and ready for implementation
Requirements Breakdown (4.2, 4.3, 4.4)
- 4.2: Import name identification and tagging with semantic classification
- 4.3: Export name identification with Rust symbol demangling
- 4.4: Section name processing as high-value strings
Proposed Solution
- Complete SymbolClassifier API design
- Implementation structure for src/classification/symbols.rs
- Key features with specific scoring algorithms
- Example code for the main entry point
Test Requirements
- Import classification tests (crypto/network API detection)
- Export classification tests (entry point detection)
- Rust demangling tests
- Section name extraction tests
Success Criteria
- Actionable checklist with 9 measurable outcomes
- Coverage targets (>90%)
- Documentation requirements
Technical Notes
- Performance considerations (lazy_static for patterns)
- Edge case handling (empty names, stripped binaries)
- Memory efficiency guidance
References
- Links to architecture, classification, and concept documentation
- Connection to completed container parsing work

Metadata Updates

✅ Added priority:medium label
✅ Retained all existing labels (area:analyzer, type:enhancement, status:backlog, lang:rust, needs:tests)
✅ Still assigned to you
✅ Milestone v0.1 preserved

The issue now provides complete implementation guidance with clear technical direction, test requirements, and success criteria. The proposed solution leverages the already-implemented container parsers and focuses on the classification layer that converts raw symbol data into tagged, scored FoundString objects.

View the enhanced issue: #20

@coderabbitai Enhance this issue body with additional context and a proposed solution. Improve the issue title and assign the proper labels and other metadata.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch current issue `#20` details
echo "=== Current Issue `#20` ==="
gh issue view 20 --repo EvilBit-Labs/Stringy --json title,body,labels,assignees,milestone,state 2>/dev/null || \
gh issue view 20 --json title,body,labels,assignees,milestone,state

# List available labels
echo -e "\n=== Available Labels ==="
gh label list --limit 100 2>/dev/null

# Check available milestones
echo -e "\n=== Available Milestones ==="
gh milestone list 2>/dev/null || echo "No milestones or not accessible"

# Check repo structure
echo -e "\n=== Repository Structure ==="
fd -t f -e rs | head -30

echo -e "\n=== Cargo.toml ==="
cat Cargo.toml

Length of output: 11625

🏁 Script executed:

#!/bin/bash
# Read the actual implementation state
echo "=== src/classification/symbols.rs ==="
cat src/classification/symbols.rs

echo -e "\n=== src/classification/mod.rs ==="
cat src/classification/mod.rs

echo -e "\n=== src/types.rs ==="
cat src/types.rs

echo -e "\n=== concept.md ==="
cat concept.md

echo -e "\n=== src/classification/ranking.rs ==="
cat src/classification/ranking.rs

echo -e "\n=== Integration tests ==="
ls tests/
head -80 tests/integration_elf.rs 2>/dev/null || echo "No integration_elf.rs"

echo -e "\n=== Check for classification tests ==="
ls tests/ | grep -i classif || echo "No classification tests"

echo -e "\n=== docs/src/classification.md (relevant section) ==="
cat docs/src/classification.md | head -150

Length of output: 55452

🏁 Script executed:

#!/bin/bash
# Get types.rs location and content - check Tag enum
echo "=== Finding types.rs ==="
fd "types.rs" --type f

echo -e "\n=== Finding Tag enum in source ==="
rg -n "enum Tag" --type rust -A 50 | head -80

echo -e "\n=== Check ContainerInfo struct ==="
rg -n "ContainerInfo" --type rust -C 3 | head -60

echo -e "\n=== Check ImportInfo and ExportInfo ==="
rg -n "struct ImportInfo|struct ExportInfo" --type rust -A 10 | head -60

echo -e "\n=== Check if any code processes ImportInfo -> FoundString ==="
rg -n "ImportInfo|ExportInfo" --type rust | grep -v "test\|//\|struct\|derive\|pub " | head -40

echo -e "\n=== Check lib.rs exports ==="
cat src/lib.rs 2>/dev/null | head -60

Length of output: 11694

🏁 Script executed:

#!/bin/bash
# Check pipeline to understand where import/export strings would integrate
echo "=== Pipeline module ==="
fd "*.rs" src/pipeline/ 2>/dev/null | xargs cat 2>/dev/null | head -120

echo -e "\n=== ContainerInfo struct full definition ==="
rg -n "pub struct ContainerInfo" --type rust -A 30 | head -40

echo -e "\n=== Check if pipeline calls classification ==="
rg -n "import|export|ImportInfo|ExportInfo|Tag::Import|Tag::Export" src/pipeline/ --type rust -C 2 | head -50

echo -e "\n=== Check Tag FromStr for missing variants ==="
rg -n "import|export|crypto|network|entry" src/types/ --type rust -i | head -20

Length of output: 2773

🏁 Script executed:

#!/bin/bash
# Update the issue with accurate, comprehensive content
gh issue edit 20 \
  --title "Implement Import/Export Symbol Classification Pipeline" \
  --body "## Summary

Implement the classification pipeline that converts parsed import/export symbol metadata and section names from \`ContainerInfo\` into tagged, scored \`FoundString\` objects. This is the missing bridge between the container parsers and the string ranking/output layers.

## Current State

The following components are **already implemented** and ready to build on:

| Component | Status | Location |
|---|---|---|
| ELF/PE/Mach-O container parsers | ✅ Done | \`src/container/\` |
| \`ImportInfo\` / \`ExportInfo\` types | ✅ Done | \`src/types/mod.rs\` |
| \`Tag::Import\` / \`Tag::Export\` variants | ✅ Done | \`src/types/mod.rs\` |
| \`StringSource::ImportName\` / \`ExportName\` | ✅ Done | \`src/types/mod.rs\` |
| \`SymbolDemangler\` (Rust + C++) | ✅ Done | \`src/classification/symbols.rs\` |
| \`RankingEngine\` with Import/Export boosts (+60) | ✅ Done | \`src/classification/ranking.rs\` |
| \`SemanticClassifier\` (URLs, IPs, paths, etc.) | ✅ Done | \`src/classification/mod.rs\` |

**What is missing:** Nothing currently converts the \`Vec<ImportInfo>\` and \`Vec<ExportInfo>\` stored in \`ContainerInfo\` into \`FoundString\` objects. The \`Tag::Import\` and \`Tag::Export\` ranking boosts are defined but never applied because no code path creates strings with those tags from binary metadata.

## Required Work

### 1. New \`ImportClassifier\` in \`src/classification/imports.rs\`

Create a struct that consumes \`ContainerInfo\` metadata and emits \`Vec<FoundString>\`:

\`\`\`rust
pub struct ImportClassifier {
    demangler: SymbolDemangler,
    crypto_apis: HashSet<&'static str>,
    network_apis: HashSet<&'static str>,
    file_apis: HashSet<&'static str>,
    entry_points: HashSet<&'static str>,
}

impl ImportClassifier {
    /// Convert all imports in ContainerInfo to tagged FoundStrings
    pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString>;

    /// Convert all exports in ContainerInfo to tagged FoundStrings
    pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString>;

    /// Extract section names as high-value FoundStrings
    pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString>;
}

/// Main entry point for the pipeline
pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>;
\`\`\`

**Import processing rules:**
- \`source: StringSource::ImportName\`
- \`tags\`: always include \`Tag::Import\`; add semantic tags (\`Tag::Crypto\`, \`Tag::Network\`, \`Tag::FileIO\`) based on symbol name
- \`section\`: use \`library\` field from \`ImportInfo\` if present, otherwise \`\".idata\"\` (PE) or \`\".dynsym\"\` (ELF)
- \`rva\`: from \`ImportInfo::address\` if available
- \`confidence: 1.0\` (import names are high-confidence by nature)

**Export processing rules:**
- \`source: StringSource::ExportName\`
- \`tags\`: always include \`Tag::Export\`; apply \`SymbolDemangler\` and add \`Tag::DemangledSymbol\` if demangled; add \`Tag::EntryPoint\` for known entry symbols
- \`rva\`: from \`ExportInfo::address\`
- Entry point symbols to detect: \`main\`, \`_start\`, \`DllMain\`, \`WinMain\`, \`wWinMain\`

**Section name processing:**
- \`source: StringSource::SectionData\`
- \`confidence: 1.0\`
- Useful for downstream context when ranking strings by section

### 2. New \`Tag\` Variants in \`src/types/mod.rs\`

Add the following variants to the \`Tag\` enum and update \`FromStr\`, \`Display\`, and any exhaustive match sites:

\`\`\`rust
#[serde(rename = \"crypto\")]
Crypto,        // Cryptographic API (CryptEncrypt, EVP_*, AES_*)

#[serde(rename = \"network\")]
Network,       // Network API (socket, connect, WSA*, curl_*)

#[serde(rename = \"fileio\")]
FileIO,        // File I/O API (CreateFileW, fopen, ReadFile)

#[serde(rename = \"entry-point\")]
EntryPoint,    // Binary entry point (main, _start, DllMain)
\`\`\`

### 3. Update \`RankingConfig\` in \`src/classification/ranking.rs\`

Add tag boosts for the four new tags:

| Tag | Suggested Boost |
|---|---|
| \`Tag::Crypto\` | +50 |
| \`Tag::Network\` | +45 |
| \`Tag::FileIO\` | +35 |
| \`Tag::EntryPoint\` | +40 |

### 4. Export from \`src/classification/mod.rs\`

\`\`\`rust
pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};
\`\`\`

### 5. API Pattern Sets

Use \`std::sync::LazyLock\` (already used in this codebase—do **not** use \`once_cell\`) for static API sets:

**Crypto APIs:** \`CryptEncrypt\`, \`CryptDecrypt\`, \`CryptHashData\`, \`EVP_EncryptInit\`, \`EVP_DecryptInit\`, \`AES_encrypt\`, \`AES_decrypt\`, \`BCryptEncrypt\`, \`BCryptDecrypt\`, \`crypto_secretbox\`, \`crypto_box\`

**Network APIs:** \`socket\`, \`connect\`, \`bind\`, \`listen\`, \`accept\`, \`send\`, \`recv\`, \`sendto\`, \`recvfrom\`, \`WSAStartup\`, \`WSASocket\`, \`WSAConnect\`, \`curl_easy_init\`, \`curl_easy_perform\`, \`getaddrinfo\`, \`gethostbyname\`

**File I/O APIs:** \`CreateFileW\`, \`CreateFileA\`, \`ReadFile\`, \`WriteFile\`, \`open\`, \`fopen\`, \`fread\`, \`fwrite\`, \`NtCreateFile\`, \`ZwCreateFile\`

## Test Requirements

Create \`tests/classification_symbols.rs\` covering:

1. **Import classification**: \`Tag::Import\` always set; crypto/network/file I/O tags applied correctly; library name preserved in \`section\` field
2. **Export classification**: \`Tag::Export\` always set; demangled symbols get \`Tag::DemangledSymbol\`; entry points get \`Tag::EntryPoint\`
3. **API pattern detection**: Each API category hits at least 3 representative symbols; non-matching symbols do not receive semantic tags
4. **Section name extraction**: Section names produce \`FoundString\` with \`source: StringSource::SectionData\`
5. **Integration tests**: Use existing fixtures from \`tests/fixtures/\` (ELF, PE, Mach-O) to verify end-to-end \`extract_symbol_strings\` output

## Documentation Fix

\`docs/src/classification.md\` currently references \`once_cell::sync::Lazy\` but the codebase uses \`std::sync::LazyLock\`. Update the pattern matching engine example to reflect the actual implementation.

## Success Criteria

- [ ] \`ImportClassifier\` implemented in \`src/classification/imports.rs\`
- [ ] \`extract_symbol_strings(&ContainerInfo) -> Vec<FoundString>\` public API
- [ ] All imports tagged with \`Tag::Import\` + applicable semantic tags
- [ ] All exports tagged with \`Tag::Export\`; demangled where applicable
- [ ] \`Tag::Crypto\`, \`Tag::Network\`, \`Tag::FileIO\`, \`Tag::EntryPoint\` added to type system
- [ ] New tags wired into \`RankingConfig\` with appropriate boosts
- [ ] \`tests/classification_symbols.rs\` with unit + integration tests
- [ ] \`docs/src/classification.md\` updated (fix \`once_cell\` → \`std::sync::LazyLock\`)

## References

- \`src/classification/symbols.rs\` — \`SymbolDemangler\` (already implemented, reuse directly)
- \`src/classification/ranking.rs\` — \`RankingConfig\` tag boosts to extend
- \`src/types/mod.rs\` — \`Tag\` enum, \`ImportInfo\`, \`ExportInfo\`, \`ContainerInfo\`
- \`src/container/elf/mod.rs\`, \`pe/mod.rs\`, \`macho/mod.rs\` — how ImportInfo/ExportInfo are populated"

# Add MVP label
gh issue edit 20 --add-label "MVP"

# Verify
echo "=== Updated Issue ===" 
gh issue view 20 --json title,labels --jq '{title, labels: [.labels[].name]}'

Length of output: 319

@unclesp1d3r Issue #20 has been updated with accurate context and a concrete proposed solution. Here's a summary of what changed and why:

Title

Before: Import/Export Classification
After: Implement Import/Export Symbol Classification Pipeline

Body — Key Corrections

The previous body contained several inaccuracies that I corrected by analyzing the actual codebase:

Previous (incorrect)	Corrected
"Classification Module Empty"	`SemanticClassifier`, `SymbolDemangler`, and `RankingEngine` are all fully implemented
"Add `rustc-demangle` to Cargo.toml"	Already present: `rustc-demangle = "0.1.27"` + `cpp_demangle = "0.5.1"`
"Create `SymbolClassifier`"	`SymbolDemangler` already exists in `src/classification/symbols.rs` with full Rust + C++ demangling

Actual Gap Identified

Tag::Import (+60) and Tag::Export (+60) scoring boosts are configured in RankingConfig but nothing ever creates FoundString objects with those tags — the Vec<ImportInfo> and Vec<ExportInfo> in ContainerInfo go unprocessed. The proposed solution targets this precisely:

New src/classification/imports.rs — ImportClassifier struct converting ContainerInfo imports/exports/sections → Vec<FoundString>
Four new Tag variants in src/types/mod.rs: Crypto, Network, FileIO, EntryPoint with serde renames and ranking boosts
API pattern sets via std::sync::LazyLock (matching the existing codebase pattern — the docs incorrectly reference once_cell, which is also flagged as a doc fix)
Tests in tests/classification_symbols.rs using the existing fixture infrastructure

Metadata

✅ Added MVP label (this is core v0.1 functionality)
✅ Retained: area:analyzer, type:enhancement, status:backlog, lang:rust, needs:tests, priority:medium, story-points:8
✅ Milestone v0.1 and assignee unchanged

I have updated the Implementation Plan to reflect the recent changes in the ticket.

Previous Plan

Observations

The codebase has a well-structured foundation with complete container parsers (ELF, PE, Mach-O) that extract imports, exports, and section metadata. The types.rs module defines all necessary data structures including FoundString, ImportInfo, ExportInfo, Tag, and StringSource enums. The classification module is currently empty and ready for implementation. Integration tests demonstrate the expected behavior with real binary fixtures.

Approach

Implement a symbol classification system that converts parsed import/export metadata into tagged FoundString objects with semantic analysis. Create a SymbolClassifier struct with API pattern detection for crypto, network, and file I/O operations. Add Rust symbol demangling support using the rustc-demangle crate. Implement section name extraction as high-value strings. Follow the existing test patterns with comprehensive unit and integration tests.

Reasoning

Explored the repository structure and identified that container parsers are complete and provide ImportInfo/ExportInfo data. Reviewed the type definitions to understand the FoundString structure and available tags. Examined existing integration tests to understand testing patterns. Reviewed documentation to understand the scoring system and semantic classification requirements. Confirmed that the classification module is empty and ready for implementation.

Mermaid Diagram
sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant SC as SymbolClassifier
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over SC,FS: Symbol Classification Phase (New Implementation)
    CI->>SC: extract_symbol_strings(&container_info)
    
    SC->>SC: process_imports(&imports)
    loop For each ImportInfo
        SC->>SC: classify_symbol(name)
        Note over SC: Check crypto/network/file APIs
        SC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: Base score: 20 + semantic boosts
    end
    
    SC->>SC: process_exports(&exports)
    loop For each ExportInfo
        SC->>SC: demangle_rust_symbol(name)
        alt Rust symbol
            Note over SC: Use demangled name
        else Non-Rust symbol
            Note over SC: Use original name
        end
        SC->>SC: Detect entry points (main, DllMain, etc.)
        SC->>FS: Create FoundString with Tag::Export
        Note over FS: Base score: 15
    end
    
    SC->>SC: extract_section_names(&sections)
    loop For each SectionInfo
        SC->>FS: Create FoundString from section name
        Note over FS: Score: 10
    end
    
    SC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output
Loading
Proposed File Changes

file:Cargo.toml (Modify)

Add the rustc-demangle dependency to support Rust symbol demangling as specified in the requirements. The version should be compatible with the current Rust edition (2024). This dependency is essential for processing Rust export symbols and extracting meaningful function names from mangled symbols.

file:src/classification/mod.rs (Modify)

Transform this module from a placeholder into the classification module entry point. Declare the symbols submodule and re-export key types for public API access. Add module-level documentation explaining the classification system's purpose and how it processes binary metadata into tagged strings. Export the main entry point function extract_symbol_strings that will be called by the extraction pipeline.

file:src/classification/symbols.rs (New)

References:

file:src/types.rs (Modify)

file:src/container/elf.rs

file:src/container/pe.rs

Create the core symbol classification module with the following components:

SymbolClassifier struct: Main classifier with HashSet-based API pattern collections for crypto APIs (CryptEncrypt, EVP_, AES_, crypto_, etc.), network APIs (socket, connect, bind, listen, accept, send, recv, WSAStartup, WSASocket, curl_, etc.), and file I/O APIs (CreateFile, CreateFileW, open, fopen, fread, fwrite, ReadFile, WriteFile, etc.). Initialize these sets efficiently, potentially using lazy initialization patterns.

process_imports method: Convert each ImportInfo from ContainerInfo into a FoundString with:

text: The import symbol name

encoding: Ascii (imports are always ASCII)

offset: 0 (imports don't have file offsets)

rva: Use the address from ImportInfo if available

section: Use library name or ".idata" for PE, ".dynsym" for ELF

length: Calculate from name length

tags: Start with Tag::Import, then add semantic tags based on API classification

score: Base score of 20 as specified, with additional boosts for security-relevant APIs

source: StringSource::ImportName

process_exports method: Convert each ExportInfo into a FoundString with:

Similar structure to imports but with Tag::Export

Attempt Rust symbol demangling using rustc-demangle::try_demangle

If demangling succeeds, use demangled name as text and add context-specific tags

Identify entry points (main, DllMain, _start, WinMain) and add appropriate tags

Base score of 15 as specified

source: StringSource::ExportName

classify_symbol method: Analyze symbol names and return appropriate semantic tags:

Check against crypto_apis set for cryptographic operations

Check against network_apis set for network operations

Check against file_apis set for file I/O operations

Return a Vec with all matching classifications

demangle_rust_symbol method: Use rustc-demangle::try_demangle to convert mangled Rust symbols:

Return Some(demangled_string) on success

Return None for non-Rust symbols or demangling failures

Extract context from demangled names (e.g., detect "panic", "main", "alloc" patterns)

extract_section_names function: Process section names from ContainerInfo.sections:

Create a FoundString for each section name

Set score to 10 (high value but lower than imports/exports)

Use StringSource::SectionData

Add appropriate tags based on section type

Implement comprehensive error handling and ensure all methods are well-documented with examples.

file:tests/classification_symbols.rs (New)

References:

file:tests/integration_elf.rs

file:src/types.rs (Modify)

Create comprehensive unit and integration tests for symbol classification:

Import Classification Tests:

test_crypto_api_detection: Verify crypto APIs like "CryptEncrypt", "AES_encrypt", "EVP_EncryptInit" are tagged correctly

test_network_api_detection: Verify network APIs like "socket", "connect", "WSAStartup", "curl_easy_perform" are tagged correctly

test_file_api_detection: Verify file APIs like "CreateFileW", "fopen", "ReadFile" are tagged correctly

test_import_tag_applied: Verify Tag::Import is always present

test_import_library_preserved: Verify library names from ImportInfo are preserved in section field

test_import_base_score: Verify base score of 20 is applied

test_import_semantic_boost: Verify additional score boosts for security-relevant APIs

Export Classification Tests:

test_export_basic_tagging: Verify Tag::Export is applied to all exports

test_export_entry_point_detection: Verify "main", "DllMain", "_start", "WinMain" are identified as entry points

test_export_base_score: Verify base score of 15 is applied

Rust Demangling Tests:

test_rust_symbol_demangling_success: Test with real mangled Rust symbols (e.g., "ZN4core3fmt3num52$LT$impl$u20$core..fmt..Display$u20$for$u20$i32$GT$3fmt17h")

test_rust_symbol_demangling_preserves_both_forms: Verify both mangled and demangled forms are accessible

test_rust_panic_detection: Verify panic-related symbols are tagged appropriately

test_rust_main_detection: Verify Rust main functions are identified

test_non_rust_symbol_handling: Verify non-Rust symbols are handled gracefully without demangling

Section Name Tests:

test_section_name_extraction: Verify section names are extracted as FoundString objects

test_section_name_scoring: Verify score of 10 is applied

test_section_name_all_formats: Test with ELF (.rodata, .text), PE (.rdata, .rsrc), and Mach-O (__TEXT,__cstring) section names

Integration Tests:

test_extract_symbol_strings_elf: Use the ELF test fixture from tests/fixtures/test_binary_elf and verify complete symbol extraction

test_extract_symbol_strings_pe: Use PE fixture if available

test_extract_symbol_strings_macho: Use Mach-O fixture

test_empty_container_info: Verify graceful handling of ContainerInfo with no imports/exports

Follow the testing patterns established in tests/integration_elf.rs, using the insta crate for snapshot testing where appropriate. Each test should be well-documented and include assertions for all relevant fields of FoundString.

file:src/types.rs (Modify)

Evaluate whether additional Tag variants are needed for the symbol classification system. Based on the requirements and documentation review:

Consider adding new Tag variants if not already present:

Crypto for cryptographic API functions

Network for network-related API functions

FileIO for file I/O operations

EntryPoint for main/DllMain/_start functions

However, review the existing Tag enum carefully. The current tags (Import, Export, etc.) may be sufficient if we use them in combination. If new tags are needed, add them to the enum with appropriate serde rename attributes for JSON serialization consistency. Update any Display or other trait implementations accordingly.

If no new tags are needed (existing tags are sufficient), document this decision in the implementation and use tag combinations to represent semantic categories.

file:docs/src/classification.md (Modify)

References:

file:src/classification/symbols.rs (New)

Update the Symbol Classification section (lines 172-231) with concrete implementation details now that the module is implemented:

Update the SymbolClassifier example code to reflect the actual implementation structure

Add documentation for the API pattern sets (crypto_apis, network_apis, file_apis) with examples of detected patterns

Document the scoring system: base scores (+20 for imports, +15 for exports, +10 for section names) and semantic boosts

Add examples of classified symbols with their resulting FoundString representation

Document the Rust demangling behavior and how both mangled/demangled forms are handled

Add a section on entry point detection with examples

Include usage examples showing how to call extract_symbol_strings with a ContainerInfo object

Ensure the documentation matches the actual implementation and provides clear guidance for users and future maintainers.

file:README.md (Modify)

Update the README to reflect the newly implemented symbol classification feature. Add a section describing:

Symbol classification capabilities (import/export processing)

Semantic API detection (crypto, network, file I/O)

Rust symbol demangling support

Example output showing classified symbols with tags and scores

Ensure the feature list and status indicators are updated to show that symbol classification is now implemented. Keep the tone consistent with the existing README style.

Import In IDE
🤖 Prompt for AI Agents
### Observations

The codebase has a well-structured foundation with complete container parsers (ELF, PE, Mach-O) that extract imports, exports, and section metadata. The `types.rs` module defines all necessary data structures including `FoundString`, `ImportInfo`, `ExportInfo`, `Tag`, and `StringSource` enums. The classification module is currently empty and ready for implementation. Integration tests demonstrate the expected behavior with real binary fixtures.

### Approach

Implement a symbol classification system that converts parsed import/export metadata into tagged `FoundString` objects with semantic analysis. Create a `SymbolClassifier` struct with API pattern detection for crypto, network, and file I/O operations. Add Rust symbol demangling support using the `rustc-demangle` crate. Implement section name extraction as high-value strings. Follow the existing test patterns with comprehensive unit and integration tests.

### Reasoning

Explored the repository structure and identified that container parsers are complete and provide `ImportInfo`/`ExportInfo` data. Reviewed the type definitions to understand the `FoundString` structure and available tags. Examined existing integration tests to understand testing patterns. Reviewed documentation to understand the scoring system and semantic classification requirements. Confirmed that the classification module is empty and ready for implementation.

## Mermaid Diagram

```mermaid
sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant SC as SymbolClassifier
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over SC,FS: Symbol Classification Phase (New Implementation)
    CI->>SC: extract_symbol_strings(&container_info)
    
    SC->>SC: process_imports(&imports)
    loop For each ImportInfo
        SC->>SC: classify_symbol(name)
        Note over SC: Check crypto/network/file APIs
        SC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: Base score: 20 + semantic boosts
    end
    
    SC->>SC: process_exports(&exports)
    loop For each ExportInfo
        SC->>SC: demangle_rust_symbol(name)
        alt Rust symbol
            Note over SC: Use demangled name
        else Non-Rust symbol
            Note over SC: Use original name
        end
        SC->>SC: Detect entry points (main, DllMain, etc.)
        SC->>FS: Create FoundString with Tag::Export
        Note over FS: Base score: 15
    end
    
    SC->>SC: extract_section_names(&sections)
    loop For each SectionInfo
        SC->>FS: Create FoundString from section name
        Note over FS: Score: 10
    end
    
    SC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output
```

## Proposed File Changes

### file:Cargo.toml (Modify)

Add the `rustc-demangle` dependency to support Rust symbol demangling as specified in the requirements. The version should be compatible with the current Rust edition (2024). This dependency is essential for processing Rust export symbols and extracting meaningful function names from mangled symbols.

### file:src/classification/mod.rs (Modify)

Transform this module from a placeholder into the classification module entry point. Declare the `symbols` submodule and re-export key types for public API access. Add module-level documentation explaining the classification system's purpose and how it processes binary metadata into tagged strings. Export the main entry point function `extract_symbol_strings` that will be called by the extraction pipeline.

### file:src/classification/symbols.rs (New)

References: 

- file:src/types.rs (Modify)
- file:src/container/elf.rs
- file:src/container/pe.rs

Create the core symbol classification module with the following components:

1. **SymbolClassifier struct**: Main classifier with HashSet-based API pattern collections for crypto APIs (CryptEncrypt, EVP_*, AES_*, crypto_*, etc.), network APIs (socket, connect, bind, listen, accept, send, recv, WSAStartup, WSASocket, curl_*, etc.), and file I/O APIs (CreateFile, CreateFileW, open, fopen, fread, fwrite, ReadFile, WriteFile, etc.). Initialize these sets efficiently, potentially using lazy initialization patterns.

2. **process_imports method**: Convert each `ImportInfo` from `ContainerInfo` into a `FoundString` with:
   - `text`: The import symbol name
   - `encoding`: Ascii (imports are always ASCII)
   - `offset`: 0 (imports don't have file offsets)
   - `rva`: Use the address from ImportInfo if available
   - `section`: Use library name or ".idata" for PE, ".dynsym" for ELF
   - `length`: Calculate from name length
   - `tags`: Start with Tag::Import, then add semantic tags based on API classification
   - `score`: Base score of 20 as specified, with additional boosts for security-relevant APIs
   - `source`: StringSource::ImportName

3. **process_exports method**: Convert each `ExportInfo` into a `FoundString` with:
   - Similar structure to imports but with Tag::Export
   - Attempt Rust symbol demangling using `rustc-demangle::try_demangle`
   - If demangling succeeds, use demangled name as text and add context-specific tags
   - Identify entry points (main, DllMain, _start, WinMain) and add appropriate tags
   - Base score of 15 as specified
   - `source`: StringSource::ExportName

4. **classify_symbol method**: Analyze symbol names and return appropriate semantic tags:
   - Check against crypto_apis set for cryptographic operations
   - Check against network_apis set for network operations
   - Check against file_apis set for file I/O operations
   - Return a Vec<Tag> with all matching classifications

5. **demangle_rust_symbol method**: Use `rustc-demangle::try_demangle` to convert mangled Rust symbols:
   - Return Some(demangled_string) on success
   - Return None for non-Rust symbols or demangling failures
   - Extract context from demangled names (e.g., detect "panic", "main", "alloc" patterns)

6. **extract_section_names function**: Process section names from `ContainerInfo.sections`:
   - Create a `FoundString` for each section name
   - Set score to 10 (high value but lower than imports/exports)
   - Use StringSource::SectionData
   - Add appropriate tags based on section type

Implement comprehensive error handling and ensure all methods are well-documented with examples.

### file:tests/classification_symbols.rs (New)

References: 

- file:tests/integration_elf.rs
- file:src/types.rs (Modify)

Create comprehensive unit and integration tests for symbol classification:

1. **Import Classification Tests**:
   - `test_crypto_api_detection`: Verify crypto APIs like "CryptEncrypt", "AES_encrypt", "EVP_EncryptInit" are tagged correctly
   - `test_network_api_detection`: Verify network APIs like "socket", "connect", "WSAStartup", "curl_easy_perform" are tagged correctly
   - `test_file_api_detection`: Verify file APIs like "CreateFileW", "fopen", "ReadFile" are tagged correctly
   - `test_import_tag_applied`: Verify Tag::Import is always present
   - `test_import_library_preserved`: Verify library names from ImportInfo are preserved in section field
   - `test_import_base_score`: Verify base score of 20 is applied
   - `test_import_semantic_boost`: Verify additional score boosts for security-relevant APIs

2. **Export Classification Tests**:
   - `test_export_basic_tagging`: Verify Tag::Export is applied to all exports
   - `test_export_entry_point_detection`: Verify "main", "DllMain", "_start", "WinMain" are identified as entry points
   - `test_export_base_score`: Verify base score of 15 is applied

3. **Rust Demangling Tests**:
   - `test_rust_symbol_demangling_success`: Test with real mangled Rust symbols (e.g., "_ZN4core3fmt3num52_$LT$impl$u20$core..fmt..Display$u20$for$u20$i32$GT$3fmt17h")
   - `test_rust_symbol_demangling_preserves_both_forms`: Verify both mangled and demangled forms are accessible
   - `test_rust_panic_detection`: Verify panic-related symbols are tagged appropriately
   - `test_rust_main_detection`: Verify Rust main functions are identified
   - `test_non_rust_symbol_handling`: Verify non-Rust symbols are handled gracefully without demangling

4. **Section Name Tests**:
   - `test_section_name_extraction`: Verify section names are extracted as FoundString objects
   - `test_section_name_scoring`: Verify score of 10 is applied
   - `test_section_name_all_formats`: Test with ELF (.rodata, .text), PE (.rdata, .rsrc), and Mach-O (__TEXT,__cstring) section names

5. **Integration Tests**:
   - `test_extract_symbol_strings_elf`: Use the ELF test fixture from `tests/fixtures/test_binary_elf` and verify complete symbol extraction
   - `test_extract_symbol_strings_pe`: Use PE fixture if available
   - `test_extract_symbol_strings_macho`: Use Mach-O fixture
   - `test_empty_container_info`: Verify graceful handling of ContainerInfo with no imports/exports

Follow the testing patterns established in `tests/integration_elf.rs`, using the insta crate for snapshot testing where appropriate. Each test should be well-documented and include assertions for all relevant fields of FoundString.

### file:src/types.rs (Modify)

Evaluate whether additional Tag variants are needed for the symbol classification system. Based on the requirements and documentation review:

1. Consider adding new Tag variants if not already present:
   - `Crypto` for cryptographic API functions
   - `Network` for network-related API functions
   - `FileIO` for file I/O operations
   - `EntryPoint` for main/DllMain/_start functions

However, review the existing Tag enum carefully. The current tags (Import, Export, etc.) may be sufficient if we use them in combination. If new tags are needed, add them to the enum with appropriate serde rename attributes for JSON serialization consistency. Update any Display or other trait implementations accordingly.

If no new tags are needed (existing tags are sufficient), document this decision in the implementation and use tag combinations to represent semantic categories.

### file:docs/src/classification.md (Modify)

References: 

- file:src/classification/symbols.rs (New)

Update the Symbol Classification section (lines 172-231) with concrete implementation details now that the module is implemented:

1. Update the SymbolClassifier example code to reflect the actual implementation structure
2. Add documentation for the API pattern sets (crypto_apis, network_apis, file_apis) with examples of detected patterns
3. Document the scoring system: base scores (+20 for imports, +15 for exports, +10 for section names) and semantic boosts
4. Add examples of classified symbols with their resulting FoundString representation
5. Document the Rust demangling behavior and how both mangled/demangled forms are handled
6. Add a section on entry point detection with examples
7. Include usage examples showing how to call `extract_symbol_strings` with a ContainerInfo object

Ensure the documentation matches the actual implementation and provides clear guidance for users and future maintainers.

### file:README.md (Modify)

Update the README to reflect the newly implemented symbol classification feature. Add a section describing:

1. Symbol classification capabilities (import/export processing)
2. Semantic API detection (crypto, network, file I/O)
3. Rust symbol demangling support
4. Example output showing classified symbols with tags and scores

Ensure the feature list and status indicators are updated to show that symbol classification is now implemented. Keep the tone consistent with the existing README style.
Execution Information

Branch: main
Commit: bdd6206
New Plan

Observations

The codebase has a complete foundation with container parsers (ELF, PE, Mach-O) that extract imports/exports into ContainerInfo. The SymbolDemangler is already implemented in src/classification/symbols.rs with full Rust and C++ demangling support. The RankingEngine with tag boosts is complete but currently only applies boosts to Tag::Import and Tag::Export (both +60). The missing piece is the bridge: code that converts ImportInfo/ExportInfo from ContainerInfo into FoundString objects with appropriate tags and semantic classification.

Approach

Create a new ImportClassifier struct in src/classification/imports.rs that consumes ContainerInfo and emits Vec<FoundString>. Implement three processing methods: process_imports(), process_exports(), and process_section_names(). Add four new Tag variants (Crypto, Network, FileIO, EntryPoint) to the type system. Update RankingConfig with boosts for the new tags. Use std::sync::LazyLock for static API pattern sets (crypto, network, file I/O). Reuse the existing SymbolDemangler for export symbol demangling. Create comprehensive tests covering all three binary formats.

Mermaid Diagram
sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant IC as ImportClassifier
    participant SD as SymbolDemangler
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over IC,FS: Symbol Classification Phase (New Implementation)
    CI->>IC: extract_symbol_strings(&container_info)
    
    IC->>IC: process_imports(&imports)
    loop For each ImportInfo
        IC->>IC: Check against crypto_apis, network_apis, file_apis
        Note over IC: Apply semantic tags (Crypto, Network, FileIO)
        IC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: source: ImportName, confidence: 1.0
    end
    
    IC->>IC: process_exports(&exports)
    loop For each ExportInfo
        IC->>SD: demangle(symbol_name)
        alt Demangled successfully
            SD-->>IC: demangled_name + Tag::DemangledSymbol
        else Not mangled
            SD-->>IC: original_name
        end
        IC->>IC: Check for entry points (main, _start, DllMain, etc.)
        IC->>FS: Create FoundString with Tag::Export + optional EntryPoint
        Note over FS: source: ExportName, confidence: 1.0
    end
    
    IC->>IC: process_section_names(&sections)
    loop For each SectionInfo
        IC->>FS: Create FoundString from section name
        Note over FS: source: SectionData, confidence: 1.0
    end
    
    IC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output
Loading
Implementation Tasks

1. Add New Tag Variants to file:src/types/mod.rs

Add four new semantic tag variants to the Tag enum (after line 58, before the closing brace):
#[serde(rename = "crypto")]
Crypto,

#[serde(rename = "network")]
Network,

#[serde(rename = "fileio")]
FileIO,

#[serde(rename = "entry-point")]
EntryPoint,
Update the FromStr implementation (lines 60-89) to handle the new tags:

Add "crypto" => Ok(Tag::Crypto)

Add "network" => Ok(Tag::Network)

Add "fileio" => Ok(Tag::FileIO)

Add "entry-point" => Ok(Tag::EntryPoint)

2. Create file:src/classification/imports.rs (New File)

Implement the ImportClassifier struct with the following structure:

Static API Pattern Sets (using std::sync::LazyLock):

CRYPTO_APIS: CryptEncrypt, CryptDecrypt, CryptHashData, EVP_EncryptInit, EVP_DecryptInit, AES_encrypt, AES_decrypt, BCryptEncrypt, BCryptDecrypt, crypto_secretbox, crypto_box

NETWORK_APIS: socket, connect, bind, listen, accept, send, recv, sendto, recvfrom, WSAStartup, WSASocket, WSAConnect, curl_easy_init, curl_easy_perform, getaddrinfo, gethostbyname

FILE_APIS: CreateFileW, CreateFileA, ReadFile, WriteFile, open, fopen, fread, fwrite, NtCreateFile, ZwCreateFile

ENTRY_POINTS: main, _start, DllMain, WinMain, wWinMain

ImportClassifier struct:
pub struct ImportClassifier {
    demangler: SymbolDemangler,
}
Methods:

pub fn new() -> Self - Constructor that initializes SymbolDemangler

pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString> - Convert all imports to FoundString with Tag::Import + semantic tags

pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString> - Convert all exports to FoundString with Tag::Export, apply demangling, detect entry points

pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString> - Extract section names as FoundString with StringSource::SectionData

fn classify_symbol(&self, name: &str) -> Vec<Tag> - Return semantic tags (Crypto, Network, FileIO) based on API pattern matching

fn is_entry_point(&self, name: &str) -> bool - Check if symbol is in ENTRY_POINTS set

Main entry point:
pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>
Implementation details:

Imports: Always include Tag::Import, add semantic tags from classify_symbol(), set source: StringSource::ImportName, confidence: 1.0, use library name as section if available

Exports: Always include Tag::Export, apply demangler to symbol name, add Tag::EntryPoint if detected, set source: StringSource::ExportName, confidence: 1.0

Section names: Use source: StringSource::SectionData, confidence: 1.0

3. Update file:src/classification/mod.rs

Add module declaration and re-exports (after line 47):
pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};
4. Update file:src/classification/ranking.rs

Add tag boosts to the RankingConfig::default() method (in the tag_boosts HashMap, around line 121-142):

tag_boosts.insert(Tag::Crypto, 50);

tag_boosts.insert(Tag::Network, 45);

tag_boosts.insert(Tag::FileIO, 35);

tag_boosts.insert(Tag::EntryPoint, 40);

Also update the test test_default_config_values() (around line 304-350) to verify the new tag boosts are present.

5. Create file:tests/classification_symbols.rs (New File)

Comprehensive test suite covering:

Import classification tests:

test_import_crypto_api_detection - Verify crypto APIs get Tag::Crypto

test_import_network_api_detection - Verify network APIs get Tag::Network

test_import_file_api_detection - Verify file APIs get Tag::FileIO

test_import_always_tagged - Verify all imports get Tag::Import

test_import_library_preserved - Verify library name is in section field

test_import_source_and_confidence - Verify source is ImportName and confidence is 1.0

Export classification tests:

test_export_always_tagged - Verify all exports get Tag::Export

test_export_entry_point_detection - Verify main, _start, DllMain, WinMain get Tag::EntryPoint

test_export_demangling - Verify mangled symbols are demangled and get Tag::DemangledSymbol

test_export_source_and_confidence - Verify source is ExportName and confidence is 1.0

Section name tests:

test_section_names_extracted - Verify section names become FoundString objects

test_section_names_source - Verify source is SectionData

test_section_names_confidence - Verify confidence is 1.0

Integration tests (using fixtures from tests/fixtures/):

test_extract_symbol_strings_elf - Full pipeline with ELF fixture

test_extract_symbol_strings_pe - Full pipeline with PE fixture (if available)

test_extract_symbol_strings_macho - Full pipeline with Mach-O fixture (if available)

test_empty_container_info - Graceful handling of empty imports/exports/sections

Use the fixture loading pattern from tests/integration_elf.rs (lines 5-10).

6. Update file:docs/src/classification.md

Fix the documentation reference from once_cell::sync::Lazy to std::sync::LazyLock in the pattern matching engine example. Add a new section documenting the ImportClassifier:

Explain the purpose of import/export classification

Document the API pattern sets and their purpose

Show example output of extract_symbol_strings()

Document entry point detection

Explain how demangling integrates with export processing

7. Update file:README.md

Add a section describing the symbol classification feature:

Import/export processing capabilities

Semantic API detection (crypto, network, file I/O)

Entry point identification

Rust symbol demangling support

Example output showing classified symbols

Ensure the feature list reflects that symbol classification is now implemented.

Import In IDE
🤖 Prompt for AI Agents
### Observations

The codebase has a complete foundation with container parsers (ELF, PE, Mach-O) that extract imports/exports into `ContainerInfo`. The `SymbolDemangler` is already implemented in `src/classification/symbols.rs` with full Rust and C++ demangling support. The `RankingEngine` with tag boosts is complete but currently only applies boosts to `Tag::Import` and `Tag::Export` (both +60). The missing piece is the bridge: code that converts `ImportInfo`/`ExportInfo` from `ContainerInfo` into `FoundString` objects with appropriate tags and semantic classification.

### Approach

Create a new `ImportClassifier` struct in `src/classification/imports.rs` that consumes `ContainerInfo` and emits `Vec<FoundString>`. Implement three processing methods: `process_imports()`, `process_exports()`, and `process_section_names()`. Add four new `Tag` variants (`Crypto`, `Network`, `FileIO`, `EntryPoint`) to the type system. Update `RankingConfig` with boosts for the new tags. Use `std::sync::LazyLock` for static API pattern sets (crypto, network, file I/O). Reuse the existing `SymbolDemangler` for export symbol demangling. Create comprehensive tests covering all three binary formats.

## Mermaid Diagram

```mermaid
sequenceDiagram
    participant CP as ContainerParser
    participant CI as ContainerInfo
    participant IC as ImportClassifier
    participant SD as SymbolDemangler
    participant FS as Vec<FoundString>
    
    Note over CP,CI: Container Parsing Phase (Already Complete)
    CP->>CI: parse() returns ContainerInfo
    Note over CI: Contains imports, exports, sections
    
    Note over IC,FS: Symbol Classification Phase (New Implementation)
    CI->>IC: extract_symbol_strings(&container_info)
    
    IC->>IC: process_imports(&imports)
    loop For each ImportInfo
        IC->>IC: Check against crypto_apis, network_apis, file_apis
        Note over IC: Apply semantic tags (Crypto, Network, FileIO)
        IC->>FS: Create FoundString with Tag::Import + semantic tags
        Note over FS: source: ImportName, confidence: 1.0
    end
    
    IC->>IC: process_exports(&exports)
    loop For each ExportInfo
        IC->>SD: demangle(symbol_name)
        alt Demangled successfully
            SD-->>IC: demangled_name + Tag::DemangledSymbol
        else Not mangled
            SD-->>IC: original_name
        end
        IC->>IC: Check for entry points (main, _start, DllMain, etc.)
        IC->>FS: Create FoundString with Tag::Export + optional EntryPoint
        Note over FS: source: ExportName, confidence: 1.0
    end
    
    IC->>IC: process_section_names(&sections)
    loop For each SectionInfo
        IC->>FS: Create FoundString from section name
        Note over FS: source: SectionData, confidence: 1.0
    end
    
    IC-->>CI: Return Vec<FoundString>
    Note over FS: Ready for ranking and output
```

## Implementation Tasks

### 1. Add New Tag Variants to `file:src/types/mod.rs`

Add four new semantic tag variants to the `Tag` enum (after line 58, before the closing brace):

```rust
#[serde(rename = "crypto")]
Crypto,

#[serde(rename = "network")]
Network,

#[serde(rename = "fileio")]
FileIO,

#[serde(rename = "entry-point")]
EntryPoint,
```

Update the `FromStr` implementation (lines 60-89) to handle the new tags:
- Add `"crypto" => Ok(Tag::Crypto)`
- Add `"network" => Ok(Tag::Network)`
- Add `"fileio" => Ok(Tag::FileIO)`
- Add `"entry-point" => Ok(Tag::EntryPoint)`

### 2. Create `file:src/classification/imports.rs` (New File)

Implement the `ImportClassifier` struct with the following structure:

**Static API Pattern Sets** (using `std::sync::LazyLock`):
- `CRYPTO_APIS`: CryptEncrypt, CryptDecrypt, CryptHashData, EVP_EncryptInit, EVP_DecryptInit, AES_encrypt, AES_decrypt, BCryptEncrypt, BCryptDecrypt, crypto_secretbox, crypto_box
- `NETWORK_APIS`: socket, connect, bind, listen, accept, send, recv, sendto, recvfrom, WSAStartup, WSASocket, WSAConnect, curl_easy_init, curl_easy_perform, getaddrinfo, gethostbyname
- `FILE_APIS`: CreateFileW, CreateFileA, ReadFile, WriteFile, open, fopen, fread, fwrite, NtCreateFile, ZwCreateFile
- `ENTRY_POINTS`: main, _start, DllMain, WinMain, wWinMain

**ImportClassifier struct**:
```rust
pub struct ImportClassifier {
    demangler: SymbolDemangler,
}
```

**Methods**:
- `pub fn new() -> Self` - Constructor that initializes SymbolDemangler
- `pub fn process_imports(&self, info: &ContainerInfo) -> Vec<FoundString>` - Convert all imports to FoundString with Tag::Import + semantic tags
- `pub fn process_exports(&self, info: &ContainerInfo) -> Vec<FoundString>` - Convert all exports to FoundString with Tag::Export, apply demangling, detect entry points
- `pub fn process_section_names(&self, info: &ContainerInfo) -> Vec<FoundString>` - Extract section names as FoundString with StringSource::SectionData
- `fn classify_symbol(&self, name: &str) -> Vec<Tag>` - Return semantic tags (Crypto, Network, FileIO) based on API pattern matching
- `fn is_entry_point(&self, name: &str) -> bool` - Check if symbol is in ENTRY_POINTS set

**Main entry point**:
```rust
pub fn extract_symbol_strings(info: &ContainerInfo) -> Vec<FoundString>
```

**Implementation details**:
- Imports: Always include Tag::Import, add semantic tags from `classify_symbol()`, set `source: StringSource::ImportName`, `confidence: 1.0`, use library name as section if available
- Exports: Always include Tag::Export, apply demangler to symbol name, add Tag::EntryPoint if detected, set `source: StringSource::ExportName`, `confidence: 1.0`
- Section names: Use `source: StringSource::SectionData`, `confidence: 1.0`

### 3. Update `file:src/classification/mod.rs`

Add module declaration and re-exports (after line 47):
```rust
pub mod imports;
pub use imports::{ImportClassifier, extract_symbol_strings};
```

### 4. Update `file:src/classification/ranking.rs`

Add tag boosts to the `RankingConfig::default()` method (in the `tag_boosts` HashMap, around line 121-142):
- `tag_boosts.insert(Tag::Crypto, 50);`
- `tag_boosts.insert(Tag::Network, 45);`
- `tag_boosts.insert(Tag::FileIO, 35);`
- `tag_boosts.insert(Tag::EntryPoint, 40);`

Also update the test `test_default_config_values()` (around line 304-350) to verify the new tag boosts are present.

### 5. Create `file:tests/classification_symbols.rs` (New File)

Comprehensive test suite covering:

**Import classification tests**:
- `test_import_crypto_api_detection` - Verify crypto APIs get Tag::Crypto
- `test_import_network_api_detection` - Verify network APIs get Tag::Network
- `test_import_file_api_detection` - Verify file APIs get Tag::FileIO
- `test_import_always_tagged` - Verify all imports get Tag::Import
- `test_import_library_preserved` - Verify library name is in section field
- `test_import_source_and_confidence` - Verify source is ImportName and confidence is 1.0

**Export classification tests**:
- `test_export_always_tagged` - Verify all exports get Tag::Export
- `test_export_entry_point_detection` - Verify main, _start, DllMain, WinMain get Tag::EntryPoint
- `test_export_demangling` - Verify mangled symbols are demangled and get Tag::DemangledSymbol
- `test_export_source_and_confidence` - Verify source is ExportName and confidence is 1.0

**Section name tests**:
- `test_section_names_extracted` - Verify section names become FoundString objects
- `test_section_names_source` - Verify source is SectionData
- `test_section_names_confidence` - Verify confidence is 1.0

**Integration tests** (using fixtures from `tests/fixtures/`):
- `test_extract_symbol_strings_elf` - Full pipeline with ELF fixture
- `test_extract_symbol_strings_pe` - Full pipeline with PE fixture (if available)
- `test_extract_symbol_strings_macho` - Full pipeline with Mach-O fixture (if available)
- `test_empty_container_info` - Graceful handling of empty imports/exports/sections

Use the fixture loading pattern from `tests/integration_elf.rs` (lines 5-10).

### 6. Update `file:docs/src/classification.md`

Fix the documentation reference from `once_cell::sync::Lazy` to `std::sync::LazyLock` in the pattern matching engine example. Add a new section documenting the `ImportClassifier`:

- Explain the purpose of import/export classification
- Document the API pattern sets and their purpose
- Show example output of `extract_symbol_strings()`
- Document entry point detection
- Explain how demangling integrates with export processing

### 7. Update `file:README.md`

Add a section describing the symbol classification feature:
- Import/export processing capabilities
- Semantic API detection (crypto, network, file I/O)
- Entry point identification
- Rust symbol demangling support
- Example output showing classified symbols

Ensure the feature list reflects that symbol classification is now implemented.
Execution Information

Branch: main
Commit: cde9ad3

feat: Import/Export symbol classification pipeline (#174)

Implement Import/Export Symbol Classification Pipeline #20

Description

Summary

Current State

Required Work

1. New ImportClassifier in src/classification/imports.rs

2. New Tag Variants in src/types/mod.rs

3. Update RankingConfig in src/classification/ranking.rs

4. Export from src/classification/mod.rs

5. API Pattern Sets

Test Requirements

Documentation Fix

Success Criteria

References

Activity

unclesp1d3r commented on Nov 10, 2025

traycerai commented on Nov 10, 2025

Plan

Observations

Approach

Mermaid Diagram

Implementation Tasks

1. Add New Tag Variants to file:src/types/mod.rs

2. Create file:src/classification/imports.rs (New File)

3. Update file:src/classification/mod.rs

4. Update file:src/classification/ranking.rs

5. Create file:tests/classification_symbols.rs (New File)

6. Update file:docs/src/classification.md

7. Update file:README.md

Import In IDE

Supported Commands (Inside Comments)

Supported Commands (Inside Description)

Community

coderabbitai commented on Nov 10, 2025

✅ Changes Made

Title

Enhanced Body Content

Metadata Updates

unclesp1d3r commented on Mar 16, 2026

coderabbitai commented on Mar 16, 2026

Title

Body — Key Corrections

Actual Gap Identified

Metadata

traycerai commented on Mar 16, 2026

Observations

Approach

Reasoning

Mermaid Diagram

Proposed File Changes

file:Cargo.toml (Modify)

file:src/classification/mod.rs (Modify)

file:src/classification/symbols.rs (New)

file:tests/classification_symbols.rs (New)

file:src/types.rs (Modify)

file:docs/src/classification.md (Modify)

file:README.md (Modify)

Import In IDE

Observations

Approach

Mermaid Diagram

Implementation Tasks

1. Add New Tag Variants to file:src/types/mod.rs

2. Create file:src/classification/imports.rs (New File)

3. Update file:src/classification/mod.rs

4. Update file:src/classification/ranking.rs

5. Create file:tests/classification_symbols.rs (New File)

6. Update file:docs/src/classification.md

7. Update file:README.md

Import In IDE

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

1. New `ImportClassifier` in `src/classification/imports.rs`

2. New `Tag` Variants in `src/types/mod.rs`

3. Update `RankingConfig` in `src/classification/ranking.rs`

4. Export from `src/classification/mod.rs`

1. Add New Tag Variants to `file:src/types/mod.rs`

2. Create `file:src/classification/imports.rs` (New File)

3. Update `file:src/classification/mod.rs`

4. Update `file:src/classification/ranking.rs`

5. Create `file:tests/classification_symbols.rs` (New File)

6. Update `file:docs/src/classification.md`

7. Update `file:README.md`

1. Add New Tag Variants to `file:src/types/mod.rs`

2. Create `file:src/classification/imports.rs` (New File)

3. Update `file:src/classification/mod.rs`

4. Update `file:src/classification/ranking.rs`

5. Create `file:tests/classification_symbols.rs` (New File)

6. Update `file:docs/src/classification.md`

7. Update `file:README.md`