{ "schema_version": 1, "date": "2026-10-27", "owner_scope": "b: localAgent/gateway/model providers/dependencies/image cache/CDP/service/observer/DSH/files/preview only", "target": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "method": { "route": "REA CLI execute-rizin-command → Cutter Rizin/rz-ghidra; sequential helper concurrency=1", "target_execution": false, "personal_profile_access": false, "external_research": "No usable external web result; pinned local primary sources used. No new runtime/channel decompile.", "labels_are_analyst_inferred": true, "complete_outputs": "rea-b-*.json preserve REA IDs, complete normalized stdout/stderr; b-*.txt are derived normalized stdout. No shared report/index writes." }, "coverage": { "new_record_count": 37, "successful_function_records": 34, "failed_decompilation_count": 1, "assembly_only_count": 1, "superseded_assembly_count": 1, "empty_stdout_count": 0, "unique_new_function_addresses": 35, "duplicate_function_addresses": [], "interpretation": "Counts describe selected records only, NOT all business functionality, whole DLL coverage, or independent recovered symbols.", "inherited_records_reused": 7 }, "chapters": [ { "category": "AI业务", "families": [ "B-AI-GATEWAY", "B-AI-PROVIDERS", "B-AI-DEPENDENCIES", "B-AI-IMAGES", "B-AI-CDP", "B-AI-OBSERVER", "B-AI-RUNTIME", "B-AI-DSH" ] }, { "category": "原生业务", "families": [ "B-NATIVE-FILES", "B-NATIVE-PREVIEW" ] } ], "findings": [ { "id": "B-AI-GATEWAY", "category": "AI业务", "family": "codex_local_agent.gateway", "title": "本地 Agent 推理网关", "status": "answered-representative-paths", "observed_technical_path": [ "本地 HTTP 路由函数读取 Host 和 authorization，比较 127.0.0.1:端口及 Bearer 凭据，失败返回 local_agent_access_denied。", "模型目录分支使用 ETag、X-Tabbit-Applied-Catalog-Revision 和 private,no-cache；推理分支检查模型是否已发布、JSON 对象、stream、parallel_tool_calls 和 tools 数组。", "Responses 分支有 0x2000001 边界（32 MiB 以内）和同一 loopback 连接不可重叠请求的检查；还调用请求隐私过滤路径，但过滤 helper 内部未恢复。", "令牌响应只在请求成功/HTTP 200/有正文条件满足后解析 accessToken、tokenType、expiresIn、scope、tokenJti，显式拒绝非法 JSON、字段或 scope 不完整。", "签名后的请求构造 /api/v1/local-agent-runtime/responses，Content-Type:application/json、Accept:text/event-stream、Accept-Encoding:identity、Idempotency-Key、X-Client-Request-Id、目录 revision/etag 头，并接入异步网络对象和回调。" ], "insertion_replacement": { "classification": "新增浏览器进程业务网关和 localhost HTTP 适配层", "certainty": "high", "evidence_basis": "本地路由、凭据、模型契约、独立服务关闭及远端请求构造均有函数级证据。", "replacement_claim": "没有证据证明替换 Chromium 网络栈；复用了异步网络/回调形状，但具体 URLLoader 类型仍是推断。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalAgent", "B-PAK-24500" ], "known_seams": [ "本地 HTTP → 模型目录/流式 Responses → 远端业务 API", "配置残留含 tabbit-local Responses provider 与 loopback token，但配置生成函数本次未恢复" ], "unresolved_seams": [ "启动服务器的监听 socket/线程具体类型未在本次函数中命名恢复", "安装密钥 PoP 算法和挑战签名 helper 未恢复", "BYOK 路由的完整远端认证路径未恢复", "目录和隐私过滤 helper 的全部语义及运行成功情况未知" ], "functions": [ { "label": "b-agent-loopback-router", "address": "0x1837844e0", "evidence_id": "ev_d0e9f6f9721184c0afdd7b5cf1f37f4890b7e420630f4ec2beaf58ab23f5a6f0", "analyst_label": "本地 HTTP 路由、凭据及 Responses 契约检查" }, { "label": "b-agent-gateway-2", "address": "0x183780d10", "evidence_id": "ev_f43ab2274db1d7d1e2a6fedb8ebb21a5cb47f4b7b977081a4756b2b86ac6d112", "analyst_label": "OnAgentTokenExchanged（令牌响应验证）" }, { "label": "b-agent-gateway-3", "address": "0x183789d20", "evidence_id": "ev_527019dd59f69f8c7779841af3b693011e1fb6717754ae09c3d40e1f7566a917", "analyst_label": "OnResponseRequestSigned（签名后发起 SSE）" }, { "label": "b-agent-gateway-1", "address": "0x18377a0e0", "evidence_id": "ev_a168d099545b014774f19b86a28a9e7f07cbc78b49bb8f8bdb14f2046b8f815a", "analyst_label": "Shutdown（业务网关关闭）" } ], "evidence_ids": [ "ev_d0e9f6f9721184c0afdd7b5cf1f37f4890b7e420630f4ec2beaf58ab23f5a6f0", "ev_f43ab2274db1d7d1e2a6fedb8ebb21a5cb47f4b7b977081a4756b2b86ac6d112", "ev_527019dd59f69f8c7779841af3b693011e1fb6717754ae09c3d40e1f7566a917", "ev_a168d099545b014774f19b86a28a9e7f07cbc78b49bb8f8bdb14f2046b8f815a" ] }, { "id": "B-AI-PROVIDERS", "category": "AI业务", "family": "codex_local_agent.model_providers", "title": "用户提供者、凭据与模型配置", "status": "partially-answered", "observed_technical_path": [ "成功回调处理 credential 与 models，具有 credential_encryption_unavailable、invalid_credential、provider_auth_required、credential_encryption_failed 错误分支。", "读写 tabbit.local_agent.providers 内的 encryptedCredential/credentialLabel，并关联 tabbit.local_agent.model、byok/ 模型命名与 defaultReset。", "Action 候选 0x18379a130 的 afij/datarefs 包含 list/save/delete/test/login 等操作和 baseUrl/api/enabledModels，但 stderr 的 Illegal op in iblock 使其不计为成功伪代码。" ], "insertion_replacement": { "classification": "新增 Profile 提供者配置与凭据适配模块", "certainty": "high-for-config-module; medium-for-full-dispatch", "evidence_basis": "成功持久化回调与失败/加密字段、首选项键绑定。", "replacement_claim": "没有 Chromium 默认实现被替换的直接证据；不能将错误字符串当作已证明的全部操作执行。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalAgent" ], "known_seams": [ "提供者凭据回调 → Profile 配置/选中模型", "网关路由中识别 byok/ 模型" ], "unresolved_seams": [ "凭据底层加密是否 OSCrypt/DPAPI、密钥生命周期和存储格式未证明", "完整 Action 分发失败", "供应商 URL 的 HTTPS/loopback 限制本次仅数据引用线索，不升级成已恢复控制流" ], "functions": [ { "label": "b-agent-provider-persist", "address": "0x18379d640", "evidence_id": "ev_398fd7432fd2bfb99c9a89e83d490d634037a333fb34f882ceb83a8d461c8d2e", "analyst_label": "提供者凭据及模型配置持久化回调" } ], "evidence_ids": [ "ev_398fd7432fd2bfb99c9a89e83d490d634037a333fb34f882ceb83a8d461c8d2e" ] }, { "id": "B-AI-DEPENDENCIES", "category": "AI业务", "family": "codex_local_agent.workspace_dependencies", "title": "工作区运行库与官方技能依赖安装", "status": "answered-core-installation-path", "observed_technical_path": [ "服务在失败时清理请求并写 failed 状态；DownloadAsset 回调衔接 installing / Install，状态机在函数中可见。", "安装读取 workspace-dependencies/installed.json 的 version/runtimeRoot/pluginsRoot；缺字段拒绝，另有 scoped_dir/installed.json.tmp/skill-bundles/tabbit-official 遗留路径回收。", "提交函数检查归档处于管理的 downloads/.part 路径、SHA-256 匹配；异常返回明确错误，创建暂存目录并分别处理 codex-primary-runtime 与 tabbit-official 两类归档。", "调用提取 helper 0x1837b33a0 后再调用元数据/路径验证 helper 0x1837ad980，验证失败不发布。之后有运行库与技能发布、暂存保留和安装提交的错误分支。", "写入 runtimeSha256/skillsSha256 等安装元数据，先形成 installed.json.tmp，再调用移动/替换形状的 helper 发布为 installed.json；这是事务式提交形状，原子性 syscall helper 未恢复。" ], "insertion_replacement": { "classification": "新增下载/安装状态机与受管依赖发布模块", "certainty": "high", "evidence_basis": "安装路径、归档身份验证、暂存/发布/提交控制流均可见。", "replacement_claim": "不是 Chromium 更新器替换的证据；当前恢复的是 Agent 工作区依赖业务。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalAgent" ], "known_seams": [ "异步下载状态 → 安装任务 → 归档提取/元数据验证 → runtime/skills 发布", "二进制残留有 load_workspace_dependencies JSON-RPC/MCP 接口，但其 handler 没有在本次展开" ], "unresolved_seams": [ "manifest 请求和 Range 分块下载候选只有定位线索，本次未恢复", "提取 helper 的防 zip-slip/symlink 实现未恢复，错误文案不等于已完成安全审计", "installed.json rename helper 的原子性和文件系统失败恢复未知", "来源清单版本等静态字符串不表示实际网络下载过" ], "functions": [ { "label": "b-agent-dependencies", "address": "0x1837a9340", "evidence_id": "ev_3ba5a2166f3ddab17eb6a36167b8c6d1ff1ee2e57b34efc63186a75a894584d1", "analyst_label": "Fail（失败状态转换）" }, { "label": "b-agent-dependencies-resolve", "address": "0x1837aa800", "evidence_id": "ev_ee1d8ddcd4ba57adfebfb64583eebe6dddf0cfad0ddca6df559e60cda2c53157", "analyst_label": "DownloadAsset / Install 连接点" }, { "label": "b-agent-installer", "address": "0x1837afc80", "evidence_id": "ev_0a6dc4c169c7899893301bf6abc0b38609ff55a2ed6dd2344064dc8f7fef11e2", "analyst_label": "读取 installed.json 并回收遗留路径" }, { "label": "b-agent-installer-commit", "address": "0x1837b1110", "evidence_id": "ev_328c1546ce91dbe4a679d7d8c88d095d8410e9165a0a9132d478f785ba8ac72c", "analyst_label": "校验归档、暂存、发布并提交安装元数据" } ], "evidence_ids": [ "ev_3ba5a2166f3ddab17eb6a36167b8c6d1ff1ee2e57b34efc63186a75a894584d1", "ev_ee1d8ddcd4ba57adfebfb64583eebe6dddf0cfad0ddca6df559e60cda2c53157", "ev_0a6dc4c169c7899893301bf6abc0b38609ff55a2ed6dd2344064dc8f7fef11e2", "ev_328c1546ce91dbe4a679d7d8c88d095d8410e9165a0a9132d478f785ba8ac72c" ] }, { "id": "B-AI-IMAGES", "category": "AI业务", "family": "codex_local_agent.image_cache", "title": "图像附件准备与解析/上传缓存", "status": "partially-answered", "observed_technical_path": [ "Prepare 查找按请求键管理的树形状态、构造请求对象和回调；不是 Chromium 图片解码器或 HTTP 全局缓存的恢复。", "响应匹配请求键和任务/请求对象，HTTP 200 且有正文时解析 uploadRequired、url、expiresIn。", "uploadRequired 为真且尚未上传时调用准备 helper 0x183795130 进入上传路径；URL 分支要求有效 URL、https 并检查 myqcloud.com 域名后缀边界。", "expiresIn 以整数有效性和区间检查约束；缓存状态中保留 URL/期限及上传状态，并形成 local_agent_image_cache 的 resolve/upload、body_bytes/status/elapsed_ms 日志。" ], "insertion_replacement": { "classification": "新增 Agent 附件缓存及对象存储上传适配", "certainty": "high-for-service; medium-for-full-upload", "evidence_basis": "独立请求状态及图像业务响应字段与控制分支。", "replacement_claim": "没有替换 Chromium 图像缓存/解码/渲染实现的证据。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalAgent" ], "known_seams": [ "请求准备 → 解析已有资源或转上传 → 缓存 URL/期限" ], "unresolved_seams": [ "上传 helper 和二进制 payload 处理未恢复", "缓存淘汰、磁盘持久化/内容哈希算法及并发行为未知", "对象存储域名约束不是实际访问记录" ], "functions": [ { "label": "b-agent-image-cache", "address": "0x183793c30", "evidence_id": "ev_ace620d0e4d91f321d90f1fd2f25e12c205a97810db0ca75b027b4c3448a7283", "analyst_label": "Prepare（请求键控与异步准备）" }, { "label": "b-agent-image-response", "address": "0x1837962b0", "evidence_id": "ev_1a09f12455b1340e6b2f586fa6eededb750f5d988095d7cc0eb249ff5615d90a", "analyst_label": "解析图像解析/上传响应与 URL/期限检查" } ], "evidence_ids": [ "ev_ace620d0e4d91f321d90f1fd2f25e12c205a97810db0ca75b027b4c3448a7283", "ev_1a09f12455b1340e6b2f586fa6eededb750f5d988095d7cc0eb249ff5615d90a" ] }, { "id": "B-AI-CDP", "category": "AI业务", "family": "local_agent.cdp_policy_and_dispatch", "title": "私有 CDP 桥与任务所有权策略", "status": "answered-bridge-and-policy-seam", "observed_technical_path": [ "CDP 分发 0x1837cb3c0 在 0x1837cbc99 直接调用 0x1837c88d0，并按返回值 1/2/3 分流；对齐汇编证明是实际 CALL，不是只有路径或字符串关联。", "策略读取任务/目标上下文：未拥有目标以 target_not_owned 拒绝；Page.bringToFront 在 preserve 模式出现 foreground_policy_preserve 拒绝。", "按命令长度和字节比较做 Browser/Target 命令限制，有 Browser.close 等禁止项、browser_command_denied 和 browser_command_not_allowlisted。完整 allowlist 不在这里重建，其他返回值可能用于合成命令。", "分发处理 targetId/sessionId 和 flat session；不支持非 flat，拒绝未知目标、已分离会话以及 raw 会话的 Browser/Target 命令；页面导航有目标 URL/导航 URL 校验分支。", "桥内部有 Synthetic command unavailable、protocolVersion/product/revision/userAgent/jsVersion 与窗口 bounds 构造，显示部分协议响应由桥合成；其 Chrome/154.0.8037.58 文本不能当作真实运行 Chromium revision 的独立验证。", "拒绝函数将 event=tabbit_dance.cdp_command_rejected、method/reason 和可选 taskId/targetId 序列化输出。" ], "insertion_replacement": { "classification": "新增私有自动化 CDP 桥、前置策略与部分协议响应代答", "certainty": "high", "evidence_basis": "直接 caller→policy CALL、分支返回值、会话处理和合成响应均在函数输出中。", "replacement_claim": "在自定义桥边界对部分命令做拦截/代答，不等于替换 Chromium DevTools 后端或浏览器引擎。" }, "packaged_alignment": [ "B-SCHEMA-tabCDPBridge", "B-JS-browser-service-channel.mjs", "B-JS-browser-transport.mjs" ], "known_seams": [ "CDP 私有帧 → 会话 dispatcher → 所有权/前台策略 → 合成或转发", "JS LogicalBrowserTransport 使用 browserSessionId/generation 与 pendingCdp 关联" ], "unresolved_seams": [ "全部允许命令名单/合成分支未逐项恢复", "最终 DevToolsAgentHost/浏览器对象虚调用尚未类型恢复", "tabCDPBridge extension API 与 runtime 私有 CDP 桥虽契约相近，但其注册函数和同一对象身份未证明", "不能用这里的硬编码协议版本回答全局 Chromium 是否被改动" ], "functions": [ { "label": "b-agent-cdp-dispatch", "address": "0x1837cb3c0", "evidence_id": "ev_0d08d67aea27114ec49e4d260821f0b2c7abb8408aa9ff319f3b1b402c710fbe", "analyst_label": "会话 CDP 分发、合成响应与策略接入" }, { "label": "b-agent-cdp-policy-check", "address": "0x1837c88d0", "evidence_id": "ev_3ab9acf42d61bc05a8a396f4f117494587386f5210dc0e0e3ad932f561578829", "analyst_label": "CDP 命令与所有权/前台策略检查" }, { "label": "b-agent-cdp-policy", "address": "0x1837c8ce0", "evidence_id": "ev_3c75e51a92835d327e3ff02283f2873a45a3bcf8e02180c00e04490911465c9f", "analyst_label": "CDP 拒绝事件日志；不是完整策略" }, { "label": "b-agent-caller-seams-aligned", "address": null, "evidence_id": "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd", "analyst_label": "对齐指令地址的直接调用及工作回调指针证明" } ], "evidence_ids": [ "ev_0d08d67aea27114ec49e4d260821f0b2c7abb8408aa9ff319f3b1b402c710fbe", "ev_3ab9acf42d61bc05a8a396f4f117494587386f5210dc0e0e3ad932f561578829", "ev_3c75e51a92835d327e3ff02283f2873a45a3bcf8e02180c00e04490911465c9f", "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd" ] }, { "id": "B-AI-OBSERVER", "category": "AI业务", "family": "local_agent.service_and_tab_strip_observer", "title": "页所有权管理与标签栏观察接入", "status": "answered-construction-and-group-change-seam", "observed_technical_path": [ "Agent 服务构造 0x1837dfd50 在 Profile/context 非空时分配 0x90 字节观察者，在 0x1837dfe0b 调用其构造 0x1837f9d30，并将观察者保存于服务对象 +0x120。", "观察者构造取得浏览器/Profile 关联对象，调用观察注册形状的 0x184948ed0 与浏览器枚举形状的 0x1812baa60；输出 tabbit_dance.tab_strip_observer_ready。原始 C++ 方法名未恢复。", "TabGroupedStateChanged 回调查询页记录，比较已有和新分组的 16 字节标识；当记录是受管页且组发生变化时，安排带上下文的异步工作 0x1837fb720。", "分组工作在 0x1837fb8a4 调用 ReleaseWebContentsInternal 0x1837e8aa0；后者查询/删除页记录、移除映射、释放受管内容对象，并更新关联任务/观察状态。" ], "insertion_replacement": { "classification": "新增服务持有观察者，通过浏览器/标签模型回调接入", "certainty": "high-for-object-seam; medium-for-exact-upstream-type", "evidence_basis": "服务直接创建持有观察者、分组回调和释放链有调用地址证据。", "replacement_claim": "支持 observer 插入，未证明替换 Chromium TabStripModel/标签栏实现；上游类型名称只能用于解释接缝。" }, "packaged_alignment": [ "B-JS-browser-service-channel.mjs", "B-SCHEMA-tabLocalAgent", "B-UPSTREAM-chrome_browser_main_extra_parts.h", "B-UPSTREAM-chrome_browser_main.cc" ], "known_seams": [ "Profile/context → LocalAgent 服务 → owned observer", "标签分组变化 → task 工作队列 → 释放页所有权" ], "unresolved_seams": [ "构造函数的 factory 注册 caller 尚未恢复", "BrowserList/TabStripModel 等虚表类型没有 PDB 证明", "从主循环 AddParts 到此服务的完整初始化链尚未连通", "用户实际拖拽分组触发行为没有执行观察" ], "functions": [ { "label": "b-agent-observer-owner", "address": "0x1837dfd50", "evidence_id": "ev_ab6dfec52dad0a0c69870f605a2ffdcc08bb2684faba55b4f8a9c5797648069f", "analyst_label": "Agent 服务构造并持有标签观察者" }, { "label": "b-agent-tab-observer-1", "address": "0x1837f9d30", "evidence_id": "ev_5ffb0782ca91c4ad727c4a87a49faa89d9a27bd4e382ec72869933f60868bee8", "analyst_label": "标签观察者构造和浏览器观察注册" }, { "label": "b-agent-tab-observer-2", "address": "0x1837fb540", "evidence_id": "ev_16709c4cbeaf80911fe46e59080187ff717ae99af00301f924e39073f7e2f030", "analyst_label": "TabGroupedStateChanged（分组状态变化回调）" }, { "label": "b-agent-service", "address": "0x1837e8aa0", "evidence_id": "ev_c92e5c45342b2e89cc5d5c785397b03a19dc8af03b430e6e096b5cbca98eeb5a", "analyst_label": "ReleaseWebContentsInternal（释放页所有权及映射）" }, { "label": "b-agent-caller-seams-aligned", "address": null, "evidence_id": "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd", "analyst_label": "对齐指令地址的直接调用及工作回调指针证明" } ], "evidence_ids": [ "ev_ab6dfec52dad0a0c69870f605a2ffdcc08bb2684faba55b4f8a9c5797648069f", "ev_5ffb0782ca91c4ad727c4a87a49faa89d9a27bd4e382ec72869933f60868bee8", "ev_16709c4cbeaf80911fe46e59080187ff717ae99af00301f924e39073f7e2f030", "ev_c92e5c45342b2e89cc5d5c785397b03a19dc8af03b430e6e096b5cbca98eeb5a", "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd" ] }, { "id": "B-AI-RUNTIME", "category": "AI业务", "family": "local_agent.browser_runtime_service", "title": "复用：Node 运行时私有命名管道和协议通道", "status": "answered-by-reused-evidence", "observed_technical_path": [ "旧原生 host 启动路径准备 state root、私有 transport、--browser-transport= descriptor、Windows job 与进程监视；启动错误是独立业务状态。", "旧私有 transport 创建 \\.\\pipe\\tabbit-runtime- 前缀的 Windows 命名管道。帧分发解析 version/kind/payload/generation/requestId/browserSessionId 和 hello/ready，拒绝超过 64 MiB、未知 kind 和缺少会话标识。", "打包 JS BrowserServiceChannel 使用协议版本 1、4 字节大端长度前缀、64 MiB 限制、hello/hello_ack 和 generation，并按 session/requestId 关联请求和 CDP。", "JS browser-runtime-service 从 --browser-transport= 创建 private stream，握手取得 configuration.stateRoot 后创建服务；这些是静态文件事实，本次没有启动。" ], "insertion_replacement": { "classification": "新增浏览器宿主 + 随包 Node 服务 + 私有版本化协议", "certainty": "high", "evidence_basis": "复用原生 transport/host/channel 与本次打包 JS 对齐。", "replacement_claim": "没有 Chromium IPC/Mojo 系统被整体替换的证据；这里有专属 transport，但 Chromium 其他 IPC 是否改动未调查。" }, "packaged_alignment": [ "B-JS-browser-runtime-service.mjs", "B-JS-browser-service-channel.mjs", "B-JS-browser-transport.mjs" ], "known_seams": [ "browser host → Windows named pipe / descriptor → packaged Node service", "同一协议承载浏览器会话/任务/自动化" ], "unresolved_seams": [ "旧失败 extra-parts 与 transport-frame-read 不作为成功伪代码", "协议所有 kind 的 handler 和启动主循环注册未全部恢复", "frame-write 旧输出只有 callback wrapper，不能声称已恢复完整写帧实现" ], "functions": [ { "label": "reuse-channel-dispatch", "address": "0x1837b9f90", "evidence_id": "ev_3703eb301523fe553ffffc308c2a098b0e92b722c51cbf50a50e5d1f54eb6b0c", "status": "completed-output", "behavior": "Private frame buffering and dispatch", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-channel-dispatch.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-channel-dispatch.txt", "rerun": false }, { "label": "reuse-extra-init", "address": "0x1837c5c40", "evidence_id": "ev_bb53514dbf26e51e2b6e50c8380549421f9ce74232a16b8556b0ac2a81ed451a", "status": "completed-output", "behavior": "MaybeInstallHostIntegration candidate", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-extra-init.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-extra-init.txt", "rerun": false }, { "label": "reuse-host-launch", "address": "0x1837bf640", "evidence_id": "ev_1d65fecef88321a0555234d4515d9b5a169f035634af24bf6b81f36e4a083cfa", "status": "completed-output", "behavior": "Browser Runtime Service startup path candidate", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-host-launch.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-host-launch.txt", "rerun": false }, { "label": "reuse-private-transport", "address": "0x1837fc860", "evidence_id": "ev_8e72d252af5ba8ed32751232481c17493338e524a738ac7d1b347a2d15f7b18f", "status": "completed-output", "behavior": "Private Windows named-pipe creation", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-private-transport.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-private-transport.txt", "rerun": false }, { "label": "reuse-transport-create", "address": "0x1837fdab0", "evidence_id": "ev_7e32fe74ef1e8f3a536a7ebb6897049e9310aeb1c00fa0cc0ca96acc5bc80a11", "status": "completed-output", "behavior": "Transport Start callback setup", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-create.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-create.txt", "rerun": false }, { "label": "reuse-transport-read", "address": "0x1837fe860", "evidence_id": "ev_0060dde16419bfb42735208a96a17618c0582ff5407d60ee3e684637297cd19b", "status": "completed-output", "behavior": "Transport Close/cleanup (initial seed label was read)", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-read.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-read.txt", "rerun": false }, { "label": "reuse-transport-write", "address": "0x1837fec00", "evidence_id": "ev_3868eeddfa09ba43642f3a0d3a6490f71ddab43601f3c18b43702b75abea5445", "status": "completed-output", "behavior": "Cancel and drain overlapped I/O (initial seed label was write)", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-write.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-write.txt", "rerun": false } ], "evidence_ids": [ "ev_3703eb301523fe553ffffc308c2a098b0e92b722c51cbf50a50e5d1f54eb6b0c", "ev_bb53514dbf26e51e2b6e50c8380549421f9ce74232a16b8556b0ac2a81ed451a", "ev_1d65fecef88321a0555234d4515d9b5a169f035634af24bf6b81f36e4a083cfa", "ev_8e72d252af5ba8ed32751232481c17493338e524a738ac7d1b347a2d15f7b18f", "ev_7e32fe74ef1e8f3a536a7ebb6897049e9310aeb1c00fa0cc0ca96acc5bc80a11", "ev_0060dde16419bfb42735208a96a17618c0582ff5407d60ee3e684637297cd19b", "ev_3868eeddfa09ba43642f3a0d3a6490f71ddab43601f3c18b43702b75abea5445" ] }, { "id": "B-AI-DSH", "category": "AI业务", "family": "dsh.process_and_service", "title": "DSH 本地工作服务基础设施", "status": "answered-command-and-lifecycle-path", "observed_technical_path": [ "DSH 有浏览器侧独立 service、process 状态和异步初始化/停止路径；最后 Profile 关闭清理待处理任务、重置服务状态并调用 process Stop。", "启动准备工作目录 workspace、logs、process.log/process.previous.log 和 DSH_HOME 环境，构造启动选项；具体 OS CreateProcess helper 类型本次未恢复。", "启动函数 0x183681bf0 在 0x1836821bb 调用命令构造 0x18a89a160；后者加入 --import 、web、--no-open、--host 127.0.0.1、--port 0。", "打包 lifecycle preload 监听 stdin 文本行 shutdown 或 EOF，幂等地输出 shutdown 日志并 process.emit(SIGTERM)。本次只读该 JS，不运行它。" ], "insertion_replacement": { "classification": "新增 DSH 子进程/服务管理及生命周期 preload", "certainty": "high", "evidence_basis": "命令参数、环境/日志、最后 Profile 关闭与 preload 脚本语义相互对应。", "replacement_claim": "没有 Chromium 进程服务或 DSH 内部实现被替换的直接证据；preload 注释声称不 patch 内部，仅能证明脚本本身未导入那些内部，不能证明所有 DSH 代码未改。" }, "packaged_alignment": [ "B-JS-dsh-lifecycle" ], "known_seams": [ "浏览器 service → process 管理 → Node preload + DSH web", "stdin shutdown / EOF → lifecycle → SIGTERM disposal" ], "unresolved_seams": [ "DSH 软件全名和版本未由 artifact metadata 确认", "安装/更新函数和下载协议仅候选线索，本次未展开", "Stop 工作 callback 内部 Windows 句柄写/关闭和超时强杀 helper 未恢复", "不将 DSH 按 Windows SCM 系统服务解释" ], "functions": [ { "label": "b-dsh-service", "address": "0x183683060", "evidence_id": "ev_f3bcaa68a32c01fc8934fdad20ee1c35b741b416af17d9d7a1a65a8882464b9e", "analyst_label": "DshService 构造及异步初始化" }, { "label": "b-dsh-launch", "address": "0x183681bf0", "evidence_id": "ev_201943f2ffa61aefb5ee43d4762049d04946d60e4724a9a832e36e9428e1e3f9", "analyst_label": "构造工作目录、日志、环境及启动选项" }, { "label": "b-dsh-command-builder", "address": "0x18a89a160", "evidence_id": "ev_cf5bf52d78bc3631354ddc7d53db7c2a259b4bc59519a3c78fe1fe30fb6573e6", "analyst_label": "DSH web 命令、localhost 参数及生命周期 preload" }, { "label": "b-dsh-process", "address": "0x18367f730", "evidence_id": "ev_37aa8e4b5d98c8cbde93766b97ec348ad59e2f570f53c1a74a75730c2bb15f7f", "analyst_label": "Stop（安排 DSH 停止）" }, { "label": "b-dsh-transport", "address": "0x183686240", "evidence_id": "ev_dada837f0ec915ec1a6b8f61c7472a60c0fbfc448a5ae61e956a8c1e6abe0d02", "analyst_label": "OnLastProfileClosed（最后 Profile 关闭）；不是 transport" }, { "label": "b-agent-caller-seams-aligned", "address": null, "evidence_id": "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd", "analyst_label": "对齐指令地址的直接调用及工作回调指针证明" } ], "evidence_ids": [ "ev_f3bcaa68a32c01fc8934fdad20ee1c35b741b416af17d9d7a1a65a8882464b9e", "ev_201943f2ffa61aefb5ee43d4762049d04946d60e4724a9a832e36e9428e1e3f9", "ev_cf5bf52d78bc3631354ddc7d53db7c2a259b4bc59519a3c78fe1fe30fb6573e6", "ev_37aa8e4b5d98c8cbde93766b97ec348ad59e2f570f53c1a74a75730c2bb15f7f", "ev_dada837f0ec915ec1a6b8f61c7472a60c0fbfc448a5ae61e956a8c1e6abe0d02", "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd" ] }, { "id": "B-NATIVE-FILES", "category": "原生业务", "family": "local_fs", "title": "来源绑定的本地文件操作 API", "status": "answered-representative-api-io-boundary", "observed_technical_path": [ "Schema tabLocalFS 提供 mount/unmount/getattr/access/statfs 及类 FUSE 的 open/create/read/write/fsync/readdir 等契约；这个命名不证明存在 FUSE 驱动或替换 OS 文件系统。", "read 原生 API 0x183812280 解析参数、取 BrowserContext/Profile 服务、安排异步响应，并在 0x183812422 直接调用 FuseRead 0x183823560。", "FuseRead/FuseWrite 校验 mount handle 与 origin，错误为 Invalid mount handle or origin；构造封装工作函数指针的异步 callback。读桥在 0x183823940 写入 worker 0x183823ad0。", "read worker 按文件句柄 fh 查找本地文件对象，按 offset 调用底层 helper，读取 size 最多 0x100000（1 MiB），返回实际字节数/errno；坏 fh=9，读错误=5 的结果字段可见。", "write worker 查 fh 和传入 buffer、offset，调用 0x185a5a820 文件写 helper；成功和 errno 映射可见，但该 helper 原始名称/系统调用尚未恢复。", "ValidatePath 拒绝绝对路径、NUL、traversal/escape；getattr 工作进一步检查规范化/符号链接目标是否仍在 mount 边界，拒绝 symlink escapes mount。", "Shutdown 清理 active_mounts/tracked_mount_handles；unmount 原生 API 与 FuseMkdir 也是本次已恢复路径，初始 seed 标签已经纠正。" ], "insertion_replacement": { "classification": "新增 browser extension API + Profile 文件服务 + 异步本地 I/O 工作模块", "certainty": "high", "evidence_basis": "native API → service → worker 的直接调用/函数指针及校验边界均可见。", "replacement_claim": "没有替换 Chromium File System Access、network file loader 或 OS 文件系统实现的证据；是另一套 tabLocalFS 契约。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalFS", "B-PAK-24500", "B-UPSTREAM-chrome_extensions_browser_api_provider.cc" ], "known_seams": [ "extension/web-page API 声明 → 原生 ExtensionFunction 形状 → Profile 服务 → callback worker", "权限 feature 声明中 web_page 需 delegated availability check，但其实际 allowlist 此范围未恢复" ], "unresolved_seams": [ "mount picker/drag/drop/token/RenderFrameHost 全部授权链未展开", "read/write 下层 base::File/Windows API helper 未逐项类型恢复", "符号链接 TOCTOU 与全部 reparse 类型保护未审计", "feature 注册实际 binder/provider caller 未恢复，不能宣称任意网页都可调用" ], "functions": [ { "label": "b-fs-api-read-real", "address": "0x183812280", "evidence_id": "ev_1580ec490a3ec31834ec419e4408fdbbe6d32a9d37d236f30696409d142ab816", "analyst_label": "read 原生 API 参数解析、服务获取及异步返回" }, { "label": "b-fs-api-read", "address": "0x18380e390", "evidence_id": "ev_4af1b7225ffa45d2bcb77fccf6c62d0e85b7375fcc8aaf016f268be61d8c960b", "analyst_label": "unmount 原生 API；不是 read" }, { "label": "b-fs-read-bridge", "address": "0x183823560", "evidence_id": "ev_21f54737192c69901294d7b9c9b1c57ec6999e355f4a1f479955352416ca9dd2", "analyst_label": "FuseRead（校验句柄来源并安排异步读）" }, { "label": "b-fs-read-worker", "address": "0x183823ad0", "evidence_id": "ev_230d4d9f3fa0bcda4571f20a4660a9a5a4527ea2e643264b31a2f37745f1e93e", "analyst_label": "按文件句柄和 offset 读；最大 1 MiB" }, { "label": "b-fs-write-bridge", "address": "0x183824110", "evidence_id": "ev_2f059e2f36282a64b32a0832aec5c3e11499b7987fb3a0299913d77259dbde90", "analyst_label": "FuseWrite（校验句柄来源并安排异步写）" }, { "label": "b-fs-write-worker", "address": "0x183824690", "evidence_id": "ev_fd7440eef50fadbd7de18cd706f3cdda8335d1d1ab01721909549d2e78244d5e", "analyst_label": "按文件句柄和 offset 写；错误映射" }, { "label": "b-fs-read", "address": "0x18381ed30", "evidence_id": "ev_56a6cee4fa66403f78732fca7f37e9bd42ceb6bbb4a09967ecf328dbe1188699", "analyst_label": "ValidatePath（路径校验）；不是 read" }, { "label": "b-fs-mount", "address": "0x1838152d0", "evidence_id": "ev_fac882f2e8049d43143881a235bb7951ebe9cd457071163a5c89e9b64f4f250e", "analyst_label": "getattr 工作函数及符号链接边界；不是 mount" }, { "label": "b-fs-path", "address": "0x183819180", "evidence_id": "ev_630ca1da1365a44bcf6cafeaa2c1265e92a253124ab39a299cc74fc7b242b2e9", "analyst_label": "Shutdown（服务关闭）；不是路径解析" }, { "label": "b-fs-write", "address": "0x1838203b0", "evidence_id": "ev_ce332c4225abd15ca106920ebc125d6d6d72c57a3bac8791c25dc853db62bd38", "analyst_label": "FuseMkdir（创建目录桥）；不是 write" }, { "label": "b-agent-caller-seams-aligned", "address": null, "evidence_id": "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd", "analyst_label": "对齐指令地址的直接调用及工作回调指针证明" } ], "evidence_ids": [ "ev_1580ec490a3ec31834ec419e4408fdbbe6d32a9d37d236f30696409d142ab816", "ev_4af1b7225ffa45d2bcb77fccf6c62d0e85b7375fcc8aaf016f268be61d8c960b", "ev_21f54737192c69901294d7b9c9b1c57ec6999e355f4a1f479955352416ca9dd2", "ev_230d4d9f3fa0bcda4571f20a4660a9a5a4527ea2e643264b31a2f37745f1e93e", "ev_2f059e2f36282a64b32a0832aec5c3e11499b7987fb3a0299913d77259dbde90", "ev_fd7440eef50fadbd7de18cd706f3cdda8335d1d1ab01721909549d2e78244d5e", "ev_56a6cee4fa66403f78732fca7f37e9bd42ceb6bbb4a09967ecf328dbe1188699", "ev_fac882f2e8049d43143881a235bb7951ebe9cd457071163a5c89e9b64f4f250e", "ev_630ca1da1365a44bcf6cafeaa2c1265e92a253124ab39a299cc74fc7b242b2e9", "ev_ce332c4225abd15ca106920ebc125d6d6d72c57a3bac8791c25dc853db62bd38", "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd" ] }, { "id": "B-NATIVE-PREVIEW", "category": "原生业务", "family": "tab_local_preview", "title": "本地文件预览数据源与系统默认打开入口", "status": "partially-answered", "observed_technical_path": [ "StartDataRequest 0x183696610 先调用请求分类/解析 helper 0x183696cd0/0x183696de0；失败通过 callback 返回空结果，成功获取 Profile 关联服务后进行分发。", "特殊 index.html 分支返回数据，其他路径构造异步请求/读取 callback；数据源具体 token/路径解析语义依赖未恢复 helper。", "Schema tabLocalFilePreview 有 token 下的 getFileInfo/readFile/writeFile/releaseToken，以及 getSystemOpenInfo/requestSetSystemDefault。", "PAK 60467 manifest 声明 tabLocalFilePreview 权限和 tab_local_file_preview 扩展名范围；PAK 60476 的设置 JS 确实调用 getSystemOpenInfo 和 requestSetSystemDefault、处理 lastError/状态。" ], "insertion_replacement": { "classification": "新增本地预览数据源及 extension API/设置 UI 接入", "certainty": "medium-high", "evidence_basis": "数据请求分发、API schema 和实际打包设置调用；URLDataSource 具体类型为语义推断。", "replacement_claim": "没有替换 Chromium file:// 网络加载器、PDF renderer 或文档渲染引擎的证据。" }, "packaged_alignment": [ "B-SCHEMA-tabLocalFilePreview", "B-PAK-60467", "B-PAK-60476" ], "known_seams": [ "自定义数据源 StartDataRequest → Profile 预览服务 → callback", "本地文件设置页面 → tabLocalFilePreview 系统打开 API" ], "unresolved_seams": [ "chrome:// URLDataSource 的 Add/注册 caller 未恢复", "token 来源/期限/跨页权限检查 helper 未恢复", "不同扩展名实际转换或渲染实现未由 manifest 证明", "默认应用实际 Windows registry/系统 UI 操作未恢复或执行" ], "functions": [ { "label": "b-fs-preview-source", "address": "0x183696610", "evidence_id": "ev_e2d499574ded223a15e75c25d416333dd080248c73fab22c2061ae5369911ee0", "analyst_label": "StartDataRequest（本地预览源分发）" } ], "evidence_ids": [ "ev_e2d499574ded223a15e75c25d416333dd080248c73fab22c2061ae5369911ee0" ] } ], "evidence": [ { "label": "b-agent-caller-seams-aligned", "analyst_label": "对齐指令地址的直接调用及工作回调指针证明", "label_is_original_symbol": false, "evidence_id": "ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd", "address": null, "function": null, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-caller-seams-aligned.json", "source_sha256": "b8e2e518f0e425085119d5504d7366f306f90ea194dcf5d09681b5ac55066b27", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-caller-seams-aligned.txt", "stdout_bytes": 2353, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "assembly-only-no-function-requested", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;pd 7 @ 0x1837cbc99;pd 7 @ 0x1837dfe0b;pd 7 @ 0x183812422;pd 7 @ 0x183823940;pd 7 @ 0x1837fb8a4;pd 7 @ 0x1836821bb", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;pd 7 @ 0x1837cbc99;pd 7 @ 0x1837dfe0b;pd 7 @ 0x183812422;pd 7 @ 0x183823940;pd 7 @ 0x1837fb8a4;pd 7 @ 0x1836821bb", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-caller-seams", "analyst_label": "局部汇编首次取窗，部分起始地址错位；已被对齐记录取代", "label_is_original_symbol": false, "evidence_id": "ev_550f235e7ac8d1ac6e9a35d59134c690657ada2c842429dc5a51495888e0892f", "address": null, "function": null, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-caller-seams.json", "source_sha256": "832e9e90de96d51ea354fb914ef33ee22ce4e1e81bbdbe541a2cdf3fc4c13f62", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-caller-seams.txt", "stdout_bytes": 3922, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "superseded-partially-misaligned-assembly", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;pd 12 @ 0x1837cbc80;pd 12 @ 0x1837dfe00;pd 12 @ 0x183812410;pd 12 @ 0x183823930;pd 12 @ 0x1837fb895;pd 12 @ 0x1836821a8", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;pd 12 @ 0x1837cbc80;pd 12 @ 0x1837dfe00;pd 12 @ 0x183812410;pd 12 @ 0x183823930;pd 12 @ 0x1837fb895;pd 12 @ 0x1836821a8", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-cdp-dispatch", "analyst_label": "会话 CDP 分发、合成响应与策略接入", "label_is_original_symbol": false, "evidence_id": "ev_0d08d67aea27114ec49e4d260821f0b2c7abb8408aa9ff319f3b1b402c710fbe", "address": "0x1837cb3c0", "function": { "address": "0x1837cb3c0", "size": 18944, "name": "fcn.1837cb3c0", "signature": "fcn.1837cb3c0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);", "callrefs": [ { "from": 6500955185, "to": 6529825440, "type": "CALL" }, { "from": 6500955219, "to": 6447834288, "type": "CALL" }, { "from": 6500955279, "to": 6447834288, "type": "CALL" }, { "from": 6500955431, "to": 6519178480, "type": "CALL" }, { "from": 6500955454, "to": 6529736720, "type": "CALL" }, { "from": 6500955521, "to": 6511512544, "type": "CALL" }, { "from": 6500955555, "to": 6464972032, "type": "CALL" }, { "from": 6500955649, "to": 6456090784, "type": "CALL" }, { "from": 6500955772, "to": 6500974016, "type": "CALL" }, { "from": 6500956118, "to": 6511512544, "type": "CALL" }, { "from": 6500956152, "to": 6511512544, "type": "CALL" }, { "from": 6500956196, "to": 6511512544, "type": "CALL" }, { "from": 6500956230, "to": 6511512544, "type": "CALL" }, { "from": 6500956264, "to": 6511512544, "type": "CALL" }, { "from": 6500956319, "to": 6500958515, "type": "CODE" }, { "from": 6500956496, "to": 6500960867, "type": "CODE" }, { "from": 6500956511, "to": 6500956553, "type": "CODE" }, { "from": 6500956521, "to": 6500956815, "type": "CODE" }, { "from": 6500956534, "to": 6537277856, "type": "CALL" }, { "from": 6500956833, "to": 6542434064, "type": "CALL" }, { "from": 6500956852, "to": 6582659264, "type": "CALL" }, { "from": 6500956872, "to": 6500979008, "type": "CALL" }, { "from": 6500957098, "to": 6500957151, "type": "CODE" }, { "from": 6500957111, "to": 6500956919, "type": "CODE" }, { "from": 6500957146, "to": 6447834288, "type": "CALL" }, { "from": 6500957337, "to": 6500944080, "type": "CALL" }, { "from": 6500957453, "to": 6500957474, "type": "CODE" }, { "from": 6500957504, "to": 6500957587, "type": "CODE" }, { "from": 6500957595, "to": 6542435920, "type": "CALL" }, { "from": 6500957653, "to": 6500958003, "type": "CODE" }, { "from": 6500957687, "to": 6514584544, "type": "CALL" }, { "from": 6500957847, "to": 6500958003, "type": "CODE" }, { "from": 6500958006, "to": 6500954032, "type": "CALL" }, { "from": 6500958369, "to": 6511512544, "type": "CALL" }, { "from": 6500958403, "to": 6511512544, "type": "CALL" }, { "from": 6500958447, "to": 6511512544, "type": "CALL" }, { "from": 6500958481, "to": 6511512544, "type": "CALL" }, { "from": 6500958515, "to": 6511512544, "type": "CALL" }, { "from": 6500958544, "to": 6511512544, "type": "CALL" }, { "from": 6500958639, "to": 6524603600, "type": "CALL" }, { "from": 6500958673, "to": 6511512544, "type": "CALL" }, { "from": 6500958678, "to": 6500958558, "type": "CODE" }, { "from": 6500958728, "to": 6500958764, "type": "CODE" }, { "from": 6500958734, "to": 6542434064, "type": "CALL" }, { "from": 6500958784, "to": 6583190128, "type": "CALL" }, { "from": 6500958913, "to": 6500958734, "type": "CODE" }, { "from": 6500958938, "to": 6500959118, "type": "CODE" }, { "from": 6500958972, "to": 6514584544, "type": "CALL" }, { "from": 6500959030, "to": 6514584544, "type": "CALL" }, { "from": 6500959082, "to": 6500981408, "type": "CALL" }, { "from": 6500959305, "to": 6500958003, "type": "CODE" }, { "from": 6500959329, "to": 6511513840, "type": "CALL" }, { "from": 6500959339, "to": 6500959863, "type": "CODE" }, { "from": 6500959355, "to": 6511513840, "type": "CALL" }, { "from": 6500959360, "to": 6500959624, "type": "CODE" }, { "from": 6500959399, "to": 6519178480, "type": "CALL" }, { "from": 6500959422, "to": 6529736720, "type": "CALL" }, { "from": 6500959489, "to": 6511512544, "type": "CALL" }, { "from": 6500959572, "to": 6456090784, "type": "CALL" }, { "from": 6500959770, "to": 6500974016, "type": "CALL" }, { "from": 6500960214, "to": 6511512544, "type": "CALL" }, { "from": 6500960248, "to": 6511512544, "type": "CALL" }, { "from": 6500960292, "to": 6511512544, "type": "CALL" }, { "from": 6500960326, "to": 6511512544, "type": "CALL" }, { "from": 6500960360, "to": 6511512544, "type": "CALL" }, { "from": 6500960407, "to": 6511512544, "type": "CALL" }, { "from": 6500960417, "to": 6500958520, "type": "CODE" }, { "from": 6500960432, "to": 6511513840, "type": "CALL" }, { "from": 6500960442, "to": 6500959899, "type": "CODE" }, { "from": 6500960472, "to": 6524603600, "type": "CALL" }, { "from": 6500960518, "to": 6511512544, "type": "CALL" }, { "from": 6500960523, "to": 6500960378, "type": "CODE" }, { "from": 6500960679, "to": 6500958003, "type": "CODE" }, { "from": 6500960703, "to": 6511512544, "type": "CALL" }, { "from": 6500960737, "to": 6511512544, "type": "CALL" }, { "from": 6500960781, "to": 6511512544, "type": "CALL" }, { "from": 6500960815, "to": 6511512544, "type": "CALL" }, { "from": 6500960849, "to": 6511512544, "type": "CALL" }, { "from": 6500960906, "to": 6500950496, "type": "CALL" }, { "from": 6500961227, "to": 6500960684, "type": "CODE" }, { "from": 6500961334, "to": 6500974016, "type": "CALL" }, { "from": 6500961690, "to": 6511512544, "type": "CALL" }, { "from": 6500961724, "to": 6511512544, "type": "CALL" }, { "from": 6500961768, "to": 6511512544, "type": "CALL" }, { "from": 6500961802, "to": 6511512544, "type": "CALL" }, { "from": 6500961837, "to": 6500956316, "type": "CODE" }, { "from": 6500961902, "to": 6500961942, "type": "CODE" }, { "from": 6500962013, "to": 6500974016, "type": "CALL" }, { "from": 6500962045, "to": 6500958045, "type": "CODE" }, { "from": 6500962161, "to": 6500962010, "type": "CODE" }, { "from": 6500962479, "to": 6500962514, "type": "CODE" }, { "from": 6500962586, "to": 6500958003, "type": "CODE" }, { "from": 6500962836, "to": 6529736720, "type": "CALL" }, { "from": 6500962903, "to": 6511512544, "type": "CALL" }, { "from": 6500962963, "to": 6457891536, "type": "CALL" }, { "from": 6500963037, "to": 6456090784, "type": "CALL" }, { "from": 6500963078, "to": 6457891536, "type": "CALL" }, { "from": 6500963094, "to": 6447082336, "type": "CALL" }, { "from": 6500963131, "to": 6445282400, "type": "CALL" }, { "from": 6500963162, "to": 6511512544, "type": "CALL" }, { "from": 6500963211, "to": 6457891536, "type": "CALL" }, { "from": 6500963341, "to": 6500974016, "type": "CALL" }, { "from": 6500963687, "to": 6511512544, "type": "CALL" }, { "from": 6500963721, "to": 6511512544, "type": "CALL" }, { "from": 6500963765, "to": 6511512544, "type": "CALL" }, { "from": 6500963799, "to": 6511512544, "type": "CALL" }, { "from": 6500963833, "to": 6511512544, "type": "CALL" }, { "from": 6500963880, "to": 6524603600, "type": "CALL" }, { "from": 6500963922, "to": 6500963991, "type": "CODE" }, { "from": 6500963949, "to": 6524603600, "type": "CALL" }, { "from": 6500963995, "to": 6511512544, "type": "CALL" }, { "from": 6500964000, "to": 6500956286, "type": "CODE" }, { "from": 6500964017, "to": 6500957293, "type": "CODE" }, { "from": 6500964057, "to": 6500981408, "type": "CALL" }, { "from": 6500964154, "to": 6500964160, "type": "CODE" }, { "from": 6500964163, "to": 6542434064, "type": "CALL" }, { "from": 6500964255, "to": 6500964280, "type": "CODE" }, { "from": 6500964352, "to": 6500958003, "type": "CODE" }, { "from": 6500964364, "to": 6500964467, "type": "CODE" }, { "from": 6500964396, "to": 6500964575, "type": "CODE" }, { "from": 6500964432, "to": 6514584544, "type": "CALL" }, { "from": 6500964520, "to": 6526592128, "type": "CALL" }, { "from": 6500964562, "to": 6446063536, "type": "CALL" }, { "from": 6500964630, "to": 6500964756, "type": "CODE" }, { "from": 6500964657, "to": 6524603600, "type": "CALL" }, { "from": 6500964708, "to": 6511512544, "type": "CALL" }, { "from": 6500964713, "to": 6500964575, "type": "CODE" }, { "from": 6500964861, "to": 6500974016, "type": "CALL" }, { "from": 6500965217, "to": 6511512544, "type": "CALL" }, { "from": 6500965251, "to": 6511512544, "type": "CALL" }, { "from": 6500965295, "to": 6511512544, "type": "CALL" }, { "from": 6500965329, "to": 6511512544, "type": "CALL" }, { "from": 6500965363, "to": 6511512544, "type": "CALL" }, { "from": 6500965410, "to": 6524603600, "type": "CALL" }, { "from": 6500965456, "to": 6500958515, "type": "CODE" }, { "from": 6500965464, "to": 6500957103, "type": "CODE" }, { "from": 6500965475, "to": 6500957105, "type": "CODE" }, { "from": 6500965568, "to": 6542067384, "type": "CALL" }, { "from": 6500965584, "to": 6500965588, "type": "CODE" }, { "from": 6500965720, "to": 6500965735, "type": "CODE" }, { "from": 6500965730, "to": 6511513840, "type": "CALL" }, { "from": 6500965787, "to": 6542436672, "type": "CALL" }, { "from": 6500965833, "to": 6542436672, "type": "CALL" }, { "from": 6500965902, "to": 6549090144, "type": "CALL" }, { "from": 6500965920, "to": 6500966395, "type": "CODE" }, { "from": 6500965991, "to": 6500966009, "type": "CODE" }, { "from": 6500966004, "to": 6511513840, "type": "CALL" }, { "from": 6500966022, "to": 6549818240, "type": "CALL" }, { "from": 6500966071, "to": 6500965907, "type": "CODE" }, { "from": 6500966084, "to": 6511729936, "type": "CALL" }, { "from": 6500966094, "to": 6500966395, "type": "CODE" }, { "from": 6500966164, "to": 6500966395, "type": "CODE" }, { "from": 6500966206, "to": 6500966169, "type": "CODE" }, { "from": 6500966216, "to": 6511513840, "type": "CALL" }, { "from": 6500966226, "to": 6500966372, "type": "CODE" }, { "from": 6500966241, "to": 6511513840, "type": "CALL" }, { "from": 6500966251, "to": 6500966441, "type": "CODE" }, { "from": 6500966833, "to": 6511512544, "type": "CALL" }, { "from": 6500966867, "to": 6511512544, "type": "CALL" }, { "from": 6500966911, "to": 6511512544, "type": "CALL" }, { "from": 6500966945, "to": 6511512544, "type": "CALL" }, { "from": 6500966980, "to": 6500968767, "type": "CODE" }, { "from": 6500967097, "to": 6500954032, "type": "CALL" }, { "from": 6500967414, "to": 6500961232, "type": "CODE" }, { "from": 6500967579, "to": 6500966190, "type": "CODE" }, { "from": 6500967599, "to": 6511513840, "type": "CALL" }, { "from": 6500967604, "to": 6500967673, "type": "CODE" }, { "from": 6500967711, "to": 6455871936, "type": "CALL" }, { "from": 6500967749, "to": 6447834288, "type": "CALL" }, { "from": 6500967897, "to": 6471067168, "type": "CALL" }, { "from": 6500967951, "to": 6500968119, "type": "CODE" }, { "from": 6500967978, "to": 6500967816, "type": "CODE" }, { "from": 6500967993, "to": 6511513840, "type": "CALL" }, { "from": 6500967998, "to": 6500967816, "type": "CODE" }, { "from": 6500968022, "to": 6511513840, "type": "CALL" }, { "from": 6500968027, "to": 6500968114, "type": "CODE" }, { "from": 6500968051, "to": 6524603600, "type": "CALL" }, { "from": 6500968088, "to": 6511512544, "type": "CALL" }, { "from": 6500968098, "to": 6500968175, "type": "CODE" }, { "from": 6500968148, "to": 6511512544, "type": "CALL" }, { "from": 6500968586, "to": 6511512544, "type": "CALL" }, { "from": 6500968620, "to": 6511512544, "type": "CALL" }, { "from": 6500968664, "to": 6511512544, "type": "CALL" }, { "from": 6500968698, "to": 6511512544, "type": "CALL" }, { "from": 6500968732, "to": 6511512544, "type": "CALL" }, { "from": 6500968770, "to": 6500958515, "type": "CODE" }, { "from": 6500968782, "to": 6500957027, "type": "CODE" }, { "from": 6500968915, "to": 6500969085, "type": "CODE" }, { "from": 6500968935, "to": 6511513840, "type": "CALL" }, { "from": 6500968940, "to": 6500968912, "type": "CODE" }, { "from": 6500968974, "to": 6514584544, "type": "CALL" }, { "from": 6500969148, "to": 6515567520, "type": "CALL" }, { "from": 6500969182, "to": 6511512544, "type": "CALL" }, { "from": 6500969215, "to": 6500943344, "type": "CALL" }, { "from": 6500969538, "to": 6500969884, "type": "CODE" }, { "from": 6500969553, "to": 6511513840, "type": "CALL" }, { "from": 6500969558, "to": 6500969330, "type": "CODE" }, { "from": 6500969680, "to": 6500954032, "type": "CALL" }, { "from": 6500970031, "to": 6511512544, "type": "CALL" }, { "from": 6500970065, "to": 6511512544, "type": "CALL" }, { "from": 6500970109, "to": 6511512544, "type": "CALL" }, { "from": 6500970143, "to": 6511512544, "type": "CALL" }, { "from": 6500970181, "to": 6500971331, "type": "CODE" }, { "from": 6500970309, "to": 6500970479, "type": "CODE" }, { "from": 6500970329, "to": 6511513840, "type": "CALL" }, { "from": 6500970334, "to": 6500970306, "type": "CODE" }, { "from": 6500970371, "to": 6514584544, "type": "CALL" }, { "from": 6500970532, "to": 6515567520, "type": "CALL" }, { "from": 6500970576, "to": 6511512544, "type": "CALL" }, { "from": 6500970605, "to": 6500943344, "type": "CALL" }, { "from": 6500970622, "to": 6511396000, "type": "CALL" }, { "from": 6500970637, "to": 6500967495, "type": "CODE" }, { "from": 6500970712, "to": 6500970757, "type": "CODE" }, { "from": 6500970832, "to": 6500954032, "type": "CALL" }, { "from": 6500971185, "to": 6511512544, "type": "CALL" }, { "from": 6500971219, "to": 6511512544, "type": "CALL" }, { "from": 6500971263, "to": 6511512544, "type": "CALL" }, { "from": 6500971297, "to": 6511512544, "type": "CALL" }, { "from": 6500971331, "to": 6511512544, "type": "CALL" }, { "from": 6500971344, "to": 6511396000, "type": "CALL" }, { "from": 6500971349, "to": 6500958520, "type": "CODE" }, { "from": 6500971361, "to": 6500957063, "type": "CODE" }, { "from": 6500971418, "to": 6524601072, "type": "CALL" }, { "from": 6500971455, "to": 6524601072, "type": "CALL" }, { "from": 6500971495, "to": 6524601072, "type": "CALL" }, { "from": 6500971536, "to": 6524601072, "type": "CALL" }, { "from": 6500971577, "to": 6457891536, "type": "CALL" }, { "from": 6500971633, "to": 6524601072, "type": "CALL" }, { "from": 6500971666, "to": 6446063536, "type": "CALL" }, { "from": 6500971788, "to": 6500974016, "type": "CALL" }, { "from": 6500972144, "to": 6511512544, "type": "CALL" }, { "from": 6500972178, "to": 6511512544, "type": "CALL" }, { "from": 6500972222, "to": 6511512544, "type": "CALL" }, { "from": 6500972256, "to": 6511512544, "type": "CALL" }, { "from": 6500972290, "to": 6511512544, "type": "CALL" }, { "from": 6500972354, "to": 6524603600, "type": "CALL" }, { "from": 6500972365, "to": 6500965421, "type": "CODE" }, { "from": 6500972395, "to": 6524603600, "type": "CALL" }, { "from": 6500972441, "to": 6511512544, "type": "CALL" }, { "from": 6500972446, "to": 6500972308, "type": "CODE" }, { "from": 6500972459, "to": 6500980560, "type": "CALL" }, { "from": 6500972469, "to": 6500961187, "type": "CODE" }, { "from": 6500972484, "to": 6511513840, "type": "CALL" }, { "from": 6500972489, "to": 6500972611, "type": "CODE" }, { "from": 6500972539, "to": 6500972616, "type": "CODE" }, { "from": 6500972570, "to": 6514584544, "type": "CALL" }, { "from": 6500972946, "to": 6500958290, "type": "CODE" }, { "from": 6500972959, "to": 6500980560, "type": "CALL" }, { "from": 6500972969, "to": 6500958290, "type": "CODE" }, { "from": 6500972984, "to": 6511513840, "type": "CALL" }, { "from": 6500972989, "to": 6500973268, "type": "CODE" }, { "from": 6500973007, "to": 6511513840, "type": "CALL" }, { "from": 6500973012, "to": 6500973083, "type": "CODE" }, { "from": 6500973031, "to": 6500925920, "type": "CALL" }, { "from": 6500973192, "to": 6500974016, "type": "CALL" }, { "from": 6500973529, "to": 6500958290, "type": "CODE" }, { "from": 6500973542, "to": 6500980560, "type": "CALL" }, { "from": 6500973552, "to": 6500956049, "type": "CODE" }, { "from": 6500973565, "to": 6500980560, "type": "CALL" }, { "from": 6500973585, "to": 6500961621, "type": "CODE" }, { "from": 6500973598, "to": 6500980560, "type": "CALL" }, { "from": 6500973608, "to": 6500960142, "type": "CODE" }, { "from": 6500973629, "to": 6511730288, "type": "CALL" }, { "from": 6500973649, "to": 6500965917, "type": "CODE" }, { "from": 6500973675, "to": 6542067384, "type": "CALL" }, { "from": 6500973746, "to": 6549090144, "type": "CALL" }, { "from": 6500973751, "to": 6500965667, "type": "CODE" }, { "from": 6500973764, "to": 6500980560, "type": "CALL" }, { "from": 6500973774, "to": 6500965138, "type": "CODE" }, { "from": 6500973787, "to": 6500980560, "type": "CALL" }, { "from": 6500973800, "to": 6500968517, "type": "CODE" }, { "from": 6500973816, "to": 6511512544, "type": "CALL" }, { "from": 6500973821, "to": 6500966055, "type": "CODE" }, { "from": 6500973837, "to": 6500980560, "type": "CALL" }, { "from": 6500973847, "to": 6500966764, "type": "CODE" }, { "from": 6500973863, "to": 6542089024, "type": "CALL" }, { "from": 6500973876, "to": 6500980560, "type": "CALL" }, { "from": 6500973886, "to": 6500967374, "type": "CODE" }, { "from": 6500973899, "to": 6500980560, "type": "CALL" }, { "from": 6500973909, "to": 6500971116, "type": "CODE" }, { "from": 6500973922, "to": 6500980560, "type": "CALL" }, { "from": 6500973932, "to": 6500972065, "type": "CODE" }, { "from": 6500973945, "to": 6500980560, "type": "CALL" }, { "from": 6500973955, "to": 6500969962, "type": "CODE" }, { "from": 6500973968, "to": 6500980560, "type": "CALL" }, { "from": 6500973978, "to": 6500963618, "type": "CODE" }, { "from": 6500973983, "to": 6545792064, "type": "CALL" }, { "from": 6500973988, "to": 6543271376, "type": "CALL" }, { "from": 6500974001, "to": 6500974006, "type": "CODE" }, { "from": 6500974011, "to": 6500959046, "type": "CODE" } ], "datarefs": [ { "from": 6500955108, "to": 6740709440, "type": "DATA" }, { "from": 6500955156, "to": 6712172456, "type": "DATA" }, { "from": 6500955190, "to": 6715118800, "type": "DATA" }, { "from": 6500955250, "to": 6716731936, "type": "DATA" }, { "from": 6500955436, "to": 6723604368, "type": "DATA" }, { "from": 6500956387, "to": 6717276840, "type": "DATA" }, { "from": 6500956976, "to": 6723603912, "type": "DATA" }, { "from": 6500957120, "to": 6717270928, "type": "DATA" }, { "from": 6500957497, "to": 6723604768, "type": "DATA" }, { "from": 6500957537, "to": 6723603784, "type": "DATA" }, { "from": 6500957569, "to": 6723604624, "type": "DATA" }, { "from": 6500957576, "to": 6723604768, "type": "DATA" }, { "from": 6500957658, "to": 6723604496, "type": "DATA" }, { "from": 6500957775, "to": 6723604520, "type": "DATA" }, { "from": 6500957926, "to": 6723604520, "type": "DATA" }, { "from": 6500958569, "to": 6740709440, "type": "DATA" }, { "from": 6500958943, "to": 6723604384, "type": "DATA" }, { "from": 6500959001, "to": 6723604400, "type": "DATA" }, { "from": 6500959212, "to": 6723604440, "type": "DATA" }, { "from": 6500959219, "to": 6723604416, "type": "DATA" }, { "from": 6500959404, "to": 6723604480, "type": "DATA" }, { "from": 6500960607, "to": 6723604560, "type": "DATA" }, { "from": 6500962514, "to": 6723604848, "type": "DATA" }, { "from": 6500962623, "to": 6723603888, "type": "DATA" }, { "from": 6500962687, "to": 6723603936, "type": "DATA" }, { "from": 6500962740, "to": 6715272624, "type": "DATA" }, { "from": 6500962785, "to": 6715272629, "type": "DATA" }, { "from": 6500962804, "to": 6715272624, "type": "DATA" }, { "from": 6500962818, "to": 6713497952, "type": "DATA" }, { "from": 6500962927, "to": 6717232912, "type": "DATA" }, { "from": 6500962953, "to": 6713564312, "type": "DATA" }, { "from": 6500963008, "to": 6715376440, "type": "DATA" }, { "from": 6500963042, "to": 6713633560, "type": "DATA" }, { "from": 6500963068, "to": 6712105968, "type": "DATA" }, { "from": 6500963099, "to": 6717232928, "type": "DATA" }, { "from": 6500963167, "to": 6717232944, "type": "DATA" }, { "from": 6500963193, "to": 6712105968, "type": "DATA" }, { "from": 6500964280, "to": 6723604416, "type": "DATA" }, { "from": 6500964401, "to": 6723604384, "type": "DATA" }, { "from": 6500964525, "to": 6717275552, "type": "DATA" }, { "from": 6500967024, "to": 6723604912, "type": "DATA" }, { "from": 6500967468, "to": 6717265256, "type": "DATA" }, { "from": 6500967479, "to": 6717265261, "type": "DATA" }, { "from": 6500967688, "to": 6716731936, "type": "DATA" }, { "from": 6500967720, "to": 6717270928, "type": "DATA" }, { "from": 6500968942, "to": 6723604800, "type": "DATA" }, { "from": 6500969605, "to": 6723604816, "type": "DATA" }, { "from": 6500970336, "to": 6723604800, "type": "DATA" }, { "from": 6500970757, "to": 6723604880, "type": "DATA" }, { "from": 6500971386, "to": 6712480888, "type": "DATA" }, { "from": 6500971423, "to": 6712480884, "type": "DATA" }, { "from": 6500971460, "to": 6712479220, "type": "DATA" }, { "from": 6500971500, "to": 6712479228, "type": "DATA" }, { "from": 6500971541, "to": 6717277840, "type": "DATA" }, { "from": 6500971567, "to": 6712585036, "type": "DATA" }, { "from": 6500971598, "to": 6718039056, "type": "DATA" }, { "from": 6500971638, "to": 6712589080, "type": "DATA" }, { "from": 6500972541, "to": 6723604384, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-cdp-dispatch.json", "source_sha256": "cccd825f570511f3240d9cc93c6c3985f4d3f6b0a101b2dbe55f68f0cac2e61f", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-cdp-dispatch.txt", "stdout_bytes": 312185, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837cb3c0;pdgo @ 0x1837cb3c0;afij @ 0x1837cb3c0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837cb3c0;pdgo @ 0x1837cb3c0;afij @ 0x1837cb3c0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-cdp-policy-check", "analyst_label": "CDP 命令与所有权/前台策略检查", "label_is_original_symbol": false, "evidence_id": "ev_3ab9acf42d61bc05a8a396f4f117494587386f5210dc0e0e3ad932f561578829", "address": "0x1837c88d0", "function": { "address": "0x1837c88d0", "size": 1037, "name": "fcn.1837c88d0", "signature": "fcn.1837c88d0(int64_t arg1, int64_t arg2, int64_t arg4);", "callrefs": [ { "from": 6500944158, "to": 6500944414, "type": "CODE" }, { "from": 6500944274, "to": 6500944414, "type": "CODE" }, { "from": 6500944307, "to": 6500944309, "type": "CODE" }, { "from": 6500944307, "to": 6500944339, "type": "CODE" }, { "from": 6500944307, "to": 6500944382, "type": "CODE" }, { "from": 6500944307, "to": 6500944470, "type": "CODE" }, { "from": 6500944307, "to": 6500944510, "type": "CODE" }, { "from": 6500944307, "to": 6500944639, "type": "CODE" }, { "from": 6500944307, "to": 6500944774, "type": "CODE" }, { "from": 6500944307, "to": 6500944862, "type": "CODE" }, { "from": 6500944337, "to": 6500944367, "type": "CODE" }, { "from": 6500944418, "to": 6500945120, "type": "CALL" }, { "from": 6500944468, "to": 6500944428, "type": "CODE" }, { "from": 6500944505, "to": 6500944737, "type": "CODE" }, { "from": 6500944624, "to": 6500944428, "type": "CODE" }, { "from": 6500944634, "to": 6500944428, "type": "CODE" }, { "from": 6500944769, "to": 6500944414, "type": "CODE" }, { "from": 6500944857, "to": 6500944726, "type": "CODE" }, { "from": 6500945095, "to": 6500944611, "type": "CODE" }, { "from": 6500945111, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6500944087, "to": 6740709440, "type": "DATA" }, { "from": 6500944120, "to": 6723603744, "type": "DATA" }, { "from": 6500944242, "to": 6723603792, "type": "DATA" }, { "from": 6500944293, "to": 6723604144, "type": "DATA" }, { "from": 6500944382, "to": 6723604000, "type": "DATA" }, { "from": 6500944439, "to": 6740709440, "type": "DATA" }, { "from": 6500944536, "to": 6717276840, "type": "DATA" }, { "from": 6500944737, "to": 6723603976, "type": "DATA" }, { "from": 6500944997, "to": 6717273680, "type": "DATA" }, { "from": 6500945064, "to": 6717273704, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-cdp-policy-check.json", "source_sha256": "f3eb5528569d6f8d642a9eac98a2a118181427c7bbb78438a41b614ed5eced39", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-cdp-policy-check.txt", "stdout_bytes": 51225, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837c88d0;pdgo @ 0x1837c88d0;afij @ 0x1837c88d0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837c88d0;pdgo @ 0x1837c88d0;afij @ 0x1837c88d0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-cdp-policy", "analyst_label": "CDP 拒绝事件日志；不是完整策略", "label_is_original_symbol": false, "evidence_id": "ev_3c75e51a92835d327e3ff02283f2873a45a3bcf8e02180c00e04490911465c9f", "address": "0x1837c8ce0", "function": { "address": "0x1837c8ce0", "size": 768, "name": "fcn.1837c8ce0", "signature": "fcn.1837c8ce0(int64_t arg1, int64_t arg2, int64_t arg3);", "callrefs": [ { "from": 6500945196, "to": 6457891536, "type": "CALL" }, { "from": 6500945248, "to": 6456090784, "type": "CALL" }, { "from": 6500945293, "to": 6456090784, "type": "CALL" }, { "from": 6500945349, "to": 6456090784, "type": "CALL" }, { "from": 6500945405, "to": 6456090784, "type": "CALL" }, { "from": 6500945456, "to": 6471067168, "type": "CALL" }, { "from": 6500945535, "to": 6445650832, "type": "CALL" }, { "from": 6500945575, "to": 6524031184, "type": "CALL" }, { "from": 6500945594, "to": 6445656528, "type": "CALL" }, { "from": 6500945664, "to": 6511512544, "type": "CALL" }, { "from": 6500945718, "to": 6511975280, "type": "CALL" }, { "from": 6500945726, "to": 6518967168, "type": "CALL" }, { "from": 6500945758, "to": 6511512544, "type": "CALL" }, { "from": 6500945808, "to": 6524603600, "type": "CALL" }, { "from": 6500945845, "to": 6511512544, "type": "CALL" }, { "from": 6500945850, "to": 6500945773, "type": "CODE" }, { "from": 6500945877, "to": 6740346544, "type": "CALL" }, { "from": 6500945883, "to": 6500945707, "type": "CODE" } ], "datarefs": [ { "from": 6500945160, "to": 6715269024, "type": "DATA" }, { "from": 6500945186, "to": 6723604048, "type": "DATA" }, { "from": 6500945217, "to": 6715118800, "type": "DATA" }, { "from": 6500945268, "to": 6715090344, "type": "DATA" }, { "from": 6500945318, "to": 6720317508, "type": "DATA" }, { "from": 6500945374, "to": 6717270928, "type": "DATA" }, { "from": 6500945469, "to": 6742246848, "type": "DATA" }, { "from": 6500945482, "to": 6741126112, "type": "DATA" }, { "from": 6500945491, "to": 6742246856, "type": "DATA" }, { "from": 6500945505, "to": 6723604088, "type": "DATA" }, { "from": 6500945580, "to": 6710367816, "type": "DATA" }, { "from": 6500945606, "to": 6708900496, "type": "DATA" }, { "from": 6500945621, "to": 6708923712, "type": "DATA" }, { "from": 6500945677, "to": 6708923824, "type": "DATA" }, { "from": 6500945691, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-cdp-policy.json", "source_sha256": "27882f537998b637fe3626bc8cbb79bf2ba6c8d4a8ae026e8befe8387a691ab1", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-cdp-policy.txt", "stdout_bytes": 11948, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837c8ce0;pdgo @ 0x1837c8ce0;afij @ 0x1837c8ce0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837c8ce0;pdgo @ 0x1837c8ce0;afij @ 0x1837c8ce0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-dependencies-resolve", "analyst_label": "DownloadAsset / Install 连接点", "label_is_original_symbol": false, "evidence_id": "ev_ee1d8ddcd4ba57adfebfb64583eebe6dddf0cfad0ddca6df559e60cda2c53157", "address": "0x1837aa800", "function": { "address": "0x1837aa800", "size": 1230, "name": "fcn.1837aa800", "signature": "fcn.1837aa800(int64_t arg1);", "callrefs": [ { "from": 6500821114, "to": 6542067384, "type": "CALL" }, { "from": 6500821177, "to": 6542067384, "type": "CALL" }, { "from": 6500821243, "to": 6522337344, "type": "CALL" }, { "from": 6500821292, "to": 6512942288, "type": "CALL" }, { "from": 6500821311, "to": 6473606624, "type": "CALL" }, { "from": 6500821374, "to": 6500821248, "type": "CODE" }, { "from": 6500821401, "to": 6500821421, "type": "CODE" }, { "from": 6500821500, "to": 6740346544, "type": "CALL" }, { "from": 6500821567, "to": 6542067384, "type": "CALL" }, { "from": 6500821650, "to": 6542067384, "type": "CALL" }, { "from": 6500821718, "to": 6522337344, "type": "CALL" }, { "from": 6500821757, "to": 6500821817, "type": "CODE" }, { "from": 6500821773, "to": 6500821723, "type": "CODE" }, { "from": 6500821796, "to": 6500821850, "type": "CODE" }, { "from": 6500821812, "to": 6511513840, "type": "CALL" }, { "from": 6500821845, "to": 6522337344, "type": "CALL" }, { "from": 6500821885, "to": 6500821929, "type": "CODE" }, { "from": 6500821908, "to": 6500821965, "type": "CODE" }, { "from": 6500821924, "to": 6511513840, "type": "CALL" }, { "from": 6500821960, "to": 6522337344, "type": "CALL" }, { "from": 6500822007, "to": 6500822031, "type": "CODE" }, { "from": 6500822026, "to": 6511513840, "type": "CALL" }, { "from": 6500822067, "to": 6512942288, "type": "CALL" }, { "from": 6500822086, "to": 6618362160, "type": "CALL" }, { "from": 6500822091, "to": 6500821316, "type": "CODE" }, { "from": 6500822138, "to": 6442840976, "type": "CALL" }, { "from": 6500822151, "to": 6511512544, "type": "CALL" }, { "from": 6500822156, "to": 6500821515, "type": "CODE" }, { "from": 6500822188, "to": 6740346544, "type": "CALL" }, { "from": 6500822194, "to": 6500821515, "type": "CODE" }, { "from": 6500822207, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6500821007, "to": 6740709440, "type": "DATA" }, { "from": 6500821126, "to": 6500830832, "type": "DATA" }, { "from": 6500821137, "to": 6488510160, "type": "DATA" }, { "from": 6500821148, "to": 6511490512, "type": "DATA" }, { "from": 6500821187, "to": 6500831168, "type": "DATA" }, { "from": 6500821198, "to": 6488791120, "type": "DATA" }, { "from": 6500821264, "to": 6723595584, "type": "DATA" }, { "from": 6500821271, "to": 6723595216, "type": "DATA" }, { "from": 6500821324, "to": 6740709440, "type": "DATA" }, { "from": 6500821421, "to": 6715363848, "type": "DATA" }, { "from": 6500821432, "to": 6715363840, "type": "DATA" }, { "from": 6500821578, "to": 6500832272, "type": "DATA" }, { "from": 6500821589, "to": 6488510160, "type": "DATA" }, { "from": 6500821600, "to": 6511490512, "type": "DATA" }, { "from": 6500821664, "to": 6500832992, "type": "DATA" }, { "from": 6500821675, "to": 6500833072, "type": "DATA" }, { "from": 6500821690, "to": 6500847888, "type": "DATA" }, { "from": 6500822039, "to": 6715261168, "type": "DATA" }, { "from": 6500822046, "to": 6723595216, "type": "DATA" }, { "from": 6500822100, "to": 6537935408, "type": "DATA" }, { "from": 6500822129, "to": 6741126408, "type": "DATA" }, { "from": 6500822161, "to": 6488537376, "type": "DATA" }, { "from": 6500822173, "to": 6488537376, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-dependencies-resolve.json", "source_sha256": "37a6bfee1154d7a79aa9e17ae6e588510077a2fc950d9b12cc93a62a952f5594", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-dependencies-resolve.txt", "stdout_bytes": 18443, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837aa800;pdgo @ 0x1837aa800;afij @ 0x1837aa800", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837aa800;pdgo @ 0x1837aa800;afij @ 0x1837aa800", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-dependencies", "analyst_label": "Fail（失败状态转换）", "label_is_original_symbol": false, "evidence_id": "ev_3ba5a2166f3ddab17eb6a36167b8c6d1ff1ee2e57b34efc63186a75a894584d1", "address": "0x1837a9340", "function": { "address": "0x1837a9340", "size": 805, "name": "fcn.1837a9340", "signature": "fcn.1837a9340(int64_t arg1, int64_t arg2);", "callrefs": [ { "from": 6500815740, "to": 6464561680, "type": "CALL" }, { "from": 6500815890, "to": 6740346544, "type": "CALL" }, { "from": 6500815961, "to": 6512942288, "type": "CALL" }, { "from": 6500815991, "to": 6511423872, "type": "CALL" }, { "from": 6500816015, "to": 6542067384, "type": "CALL" }, { "from": 6500816141, "to": 6517399712, "type": "CALL" }, { "from": 6500816169, "to": 6511512544, "type": "CALL" }, { "from": 6500816228, "to": 6500815772, "type": "CODE" }, { "from": 6500816257, "to": 6511512544, "type": "CALL" }, { "from": 6500816276, "to": 6500815815, "type": "CODE" }, { "from": 6500816310, "to": 6740346544, "type": "CALL" }, { "from": 6500816316, "to": 6500816097, "type": "CODE" }, { "from": 6500816363, "to": 6442840976, "type": "CALL" }, { "from": 6500816376, "to": 6511512544, "type": "CALL" }, { "from": 6500816381, "to": 6500815905, "type": "CODE" }, { "from": 6500816413, "to": 6740346544, "type": "CALL" }, { "from": 6500816419, "to": 6500815905, "type": "CODE" }, { "from": 6500816441, "to": 6511512544, "type": "CALL" }, { "from": 6500816446, "to": 6500816097, "type": "CODE" }, { "from": 6500816461, "to": 6511512544, "type": "CALL" }, { "from": 6500816466, "to": 6500816433, "type": "CODE" }, { "from": 6500816476, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6500815697, "to": 6740709440, "type": "DATA" }, { "from": 6500815772, "to": 6717291816, "type": "DATA" }, { "from": 6500815783, "to": 6717291812, "type": "DATA" }, { "from": 6500815936, "to": 6716398076, "type": "DATA" }, { "from": 6500815943, "to": 6723595216, "type": "DATA" }, { "from": 6500815979, "to": 6741126408, "type": "DATA" }, { "from": 6500816026, "to": 6446192048, "type": "DATA" }, { "from": 6500816037, "to": 6488516144, "type": "DATA" }, { "from": 6500816048, "to": 6511490512, "type": "DATA" }, { "from": 6500816059, "to": 6500814432, "type": "DATA" }, { "from": 6500816182, "to": 6740709440, "type": "DATA" }, { "from": 6500816295, "to": 6488537248, "type": "DATA" }, { "from": 6500816325, "to": 6537935408, "type": "DATA" }, { "from": 6500816354, "to": 6741126408, "type": "DATA" }, { "from": 6500816386, "to": 6488537376, "type": "DATA" }, { "from": 6500816398, "to": 6488537376, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-dependencies.json", "source_sha256": "ec0a03abac40b8bd1e290a59461f13422953cc1886054a1fe193d3e36ec32f4d", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-dependencies.txt", "stdout_bytes": 11028, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837a9340;pdgo @ 0x1837a9340;afij @ 0x1837a9340", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837a9340;pdgo @ 0x1837a9340;afij @ 0x1837a9340", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-gateway-1", "analyst_label": "Shutdown（业务网关关闭）", "label_is_original_symbol": false, "evidence_id": "ev_a168d099545b014774f19b86a28a9e7f07cbc78b49bb8f8bdb14f2046b8f815a", "address": "0x18377a0e0", "function": { "address": "0x18377a0e0", "size": 1859, "name": "fcn.18377a0e0", "signature": "fcn.18377a0e0(int64_t arg1);", "callrefs": [ { "from": 6500622603, "to": 6500746608, "type": "CALL" }, { "from": 6500622628, "to": 6511479296, "type": "CALL" }, { "from": 6500622692, "to": 6533922976, "type": "CALL" }, { "from": 6500622722, "to": 6542067384, "type": "CALL" }, { "from": 6500622798, "to": 6500740880, "type": "CALL" }, { "from": 6500622831, "to": 6488918096, "type": "CALL" }, { "from": 6500622864, "to": 6464561680, "type": "CALL" }, { "from": 6500622897, "to": 6464561680, "type": "CALL" }, { "from": 6500622916, "to": 6500717840, "type": "CALL" }, { "from": 6500622945, "to": 6522894224, "type": "CALL" }, { "from": 6500622964, "to": 6500717936, "type": "CALL" }, { "from": 6500623012, "to": 6451609056, "type": "CALL" }, { "from": 6500623061, "to": 6500623094, "type": "CODE" }, { "from": 6500623068, "to": 6511512544, "type": "CALL" }, { "from": 6500623073, "to": 6500622791, "type": "CODE" }, { "from": 6500623082, "to": 6740346544, "type": "CALL" }, { "from": 6500623119, "to": 6500623078, "type": "CODE" }, { "from": 6500623215, "to": 6512942288, "type": "CALL" }, { "from": 6500623229, "to": 6500626080, "type": "CALL" }, { "from": 6500623276, "to": 6511512544, "type": "CALL" }, { "from": 6500623314, "to": 6511512544, "type": "CALL" }, { "from": 6500623392, "to": 6511512544, "type": "CALL" }, { "from": 6500623432, "to": 6500623450, "type": "CODE" }, { "from": 6500623438, "to": 6740346544, "type": "CALL" }, { "from": 6500623471, "to": 6500623434, "type": "CODE" }, { "from": 6500623489, "to": 6511512544, "type": "CALL" }, { "from": 6500623494, "to": 6500623925, "type": "CODE" }, { "from": 6500623531, "to": 6511512544, "type": "CALL" }, { "from": 6500623558, "to": 6451609056, "type": "CALL" }, { "from": 6500623570, "to": 6500717936, "type": "CALL" }, { "from": 6500623582, "to": 6500717840, "type": "CALL" }, { "from": 6500623615, "to": 6464561680, "type": "CALL" }, { "from": 6500623648, "to": 6464561680, "type": "CALL" }, { "from": 6500623681, "to": 6488918096, "type": "CALL" }, { "from": 6500623693, "to": 6517838976, "type": "CALL" }, { "from": 6500623740, "to": 6511512544, "type": "CALL" }, { "from": 6500623778, "to": 6511512544, "type": "CALL" }, { "from": 6500623799, "to": 6500662224, "type": "CALL" }, { "from": 6500623826, "to": 6511479296, "type": "CALL" }, { "from": 6500623874, "to": 6474554160, "type": "CALL" }, { "from": 6500623887, "to": 6511512544, "type": "CALL" }, { "from": 6500623907, "to": 6532074304, "type": "CALL" }, { "from": 6500623933, "to": 6511512544, "type": "CALL" }, { "from": 6500623964, "to": 6500721904, "type": "CALL" }, { "from": 6500623977, "to": 6511512544, "type": "CALL" }, { "from": 6500624008, "to": 6500791920, "type": "CALL" }, { "from": 6500624021, "to": 6511512544, "type": "CALL" }, { "from": 6500624044, "to": 6532074304, "type": "CALL" }, { "from": 6500624082, "to": 6511512544, "type": "CALL" }, { "from": 6500624123, "to": 6500622352, "type": "CALL" }, { "from": 6500624165, "to": 6740346544, "type": "CALL" }, { "from": 6500624200, "to": 6442840976, "type": "CALL" }, { "from": 6500624232, "to": 6442840976, "type": "CALL" }, { "from": 6500624257, "to": 6511479296, "type": "CALL" }, { "from": 6500624278, "to": 6442840976, "type": "CALL" }, { "from": 6500624350, "to": 6740346544, "type": "CALL" }, { "from": 6500624356, "to": 6500624119, "type": "CODE" }, { "from": 6500624374, "to": 6740346544, "type": "CALL" }, { "from": 6500624380, "to": 6500624103, "type": "CODE" }, { "from": 6500624394, "to": 6740346544, "type": "CALL" }, { "from": 6500624400, "to": 6500624300, "type": "CODE" }, { "from": 6500624410, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6500622579, "to": 6740709440, "type": "DATA" }, { "from": 6500623187, "to": 6713532920, "type": "DATA" }, { "from": 6500623194, "to": 6723585184, "type": "DATA" }, { "from": 6500624191, "to": 6741126408, "type": "DATA" }, { "from": 6500624223, "to": 6741126408, "type": "DATA" }, { "from": 6500624269, "to": 6741126408, "type": "DATA" }, { "from": 6500624308, "to": 6740709440, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-gateway-1.json", "source_sha256": "2eb45f7eacebbfd9c176d2a51546f2d41c30fcec97b2f3812a27336cb9095726", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-gateway-1.txt", "stdout_bytes": 22534, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18377a0e0;pdgo @ 0x18377a0e0;afij @ 0x18377a0e0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18377a0e0;pdgo @ 0x18377a0e0;afij @ 0x18377a0e0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-gateway-2", "analyst_label": "OnAgentTokenExchanged（令牌响应验证）", "label_is_original_symbol": false, "evidence_id": "ev_f43ab2274db1d7d1e2a6fedb8ebb21a5cb47f4b7b977081a4756b2b86ac6d112", "address": "0x183780d10", "function": { "address": "0x183780d10", "size": 4796, "name": "fcn.183780d10", "signature": "fcn.183780d10(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);", "callrefs": [ { "from": 6500650404, "to": 6500646688, "type": "CALL" }, { "from": 6500650489, "to": 6446103440, "type": "CALL" }, { "from": 6500650536, "to": 6514584544, "type": "CALL" }, { "from": 6500650581, "to": 6464561680, "type": "CALL" }, { "from": 6500650623, "to": 6511512544, "type": "CALL" }, { "from": 6500650655, "to": 6511512544, "type": "CALL" }, { "from": 6500650705, "to": 6500650885, "type": "CODE" }, { "from": 6500650721, "to": 6500650553, "type": "CODE" }, { "from": 6500650822, "to": 6531704832, "type": "CALL" }, { "from": 6500650854, "to": 6500651557, "type": "CODE" }, { "from": 6500650880, "to": 6500650885, "type": "CODE" }, { "from": 6500650926, "to": 6500650882, "type": "CODE" }, { "from": 6500651081, "to": 6511483504, "type": "CALL" }, { "from": 6500651115, "to": 6511512544, "type": "CALL" }, { "from": 6500651232, "to": 6740346544, "type": "CALL" }, { "from": 6500651251, "to": 6740346544, "type": "CALL" }, { "from": 6500651327, "to": 6511512544, "type": "CALL" }, { "from": 6500651362, "to": 6511512544, "type": "CALL" }, { "from": 6500651446, "to": 6511513840, "type": "CALL" }, { "from": 6500651451, "to": 6500651198, "type": "CODE" }, { "from": 6500651465, "to": 6740346544, "type": "CALL" }, { "from": 6500651471, "to": 6500651340, "type": "CODE" }, { "from": 6500651501, "to": 6524603600, "type": "CALL" }, { "from": 6500651547, "to": 6511512544, "type": "CALL" }, { "from": 6500651552, "to": 6500651298, "type": "CODE" }, { "from": 6500651619, "to": 6446103440, "type": "CALL" }, { "from": 6500651677, "to": 6447834288, "type": "CALL" }, { "from": 6500651736, "to": 6447834288, "type": "CALL" }, { "from": 6500651812, "to": 6529825440, "type": "CALL" }, { "from": 6500651865, "to": 6447834288, "type": "CALL" }, { "from": 6500651918, "to": 6447834288, "type": "CALL" }, { "from": 6500651993, "to": 6500652002, "type": "CODE" }, { "from": 6500652010, "to": 6526594288, "type": "CALL" }, { "from": 6500652144, "to": 6464561680, "type": "CALL" }, { "from": 6500652184, "to": 6500652371, "type": "CODE" }, { "from": 6500652384, "to": 6500653610, "type": "CODE" }, { "from": 6500652420, "to": 6511512544, "type": "CALL" }, { "from": 6500652452, "to": 6511512544, "type": "CALL" }, { "from": 6500652557, "to": 6740346544, "type": "CALL" }, { "from": 6500652576, "to": 6740346544, "type": "CALL" }, { "from": 6500652629, "to": 6500651327, "type": "CODE" }, { "from": 6500652664, "to": 6524603600, "type": "CALL" }, { "from": 6500652710, "to": 6511512544, "type": "CALL" }, { "from": 6500652720, "to": 6500652116, "type": "CODE" }, { "from": 6500652942, "to": 6522782224, "type": "CALL" }, { "from": 6500652987, "to": 6549240832, "type": "CALL" }, { "from": 6500652999, "to": 6500653170, "type": "CODE" }, { "from": 6500653023, "to": 6542434064, "type": "CALL" }, { "from": 6500653061, "to": 6500653008, "type": "CODE" }, { "from": 6500653069, "to": 6500653038, "type": "CODE" }, { "from": 6500653074, "to": 6500653081, "type": "CODE" }, { "from": 6500653131, "to": 6511512544, "type": "CALL" }, { "from": 6500653190, "to": 6542435920, "type": "CALL" }, { "from": 6500653239, "to": 6542067384, "type": "CALL" }, { "from": 6500653286, "to": 6500653312, "type": "CODE" }, { "from": 6500653291, "to": 6500653086, "type": "CODE" }, { "from": 6500653345, "to": 6542436672, "type": "CALL" }, { "from": 6500653420, "to": 6500653043, "type": "CODE" }, { "from": 6500653621, "to": 6531704832, "type": "CALL" }, { "from": 6500653721, "to": 6542067384, "type": "CALL" }, { "from": 6500653815, "to": 6512942288, "type": "CALL" }, { "from": 6500653907, "to": 6517399712, "type": "CALL" }, { "from": 6500653939, "to": 6500636032, "type": "CALL" }, { "from": 6500654005, "to": 6511512544, "type": "CALL" }, { "from": 6500654041, "to": 6511512544, "type": "CALL" }, { "from": 6500654046, "to": 6500652596, "type": "CODE" }, { "from": 6500654084, "to": 6740346544, "type": "CALL" }, { "from": 6500654093, "to": 6500653850, "type": "CODE" }, { "from": 6500654115, "to": 6511512544, "type": "CALL" }, { "from": 6500654120, "to": 6500654090, "type": "CODE" }, { "from": 6500654132, "to": 6511512544, "type": "CALL" }, { "from": 6500654137, "to": 6500654107, "type": "CODE" }, { "from": 6500654156, "to": 6511512544, "type": "CALL" }, { "from": 6500654161, "to": 6500652203, "type": "CODE" }, { "from": 6500654183, "to": 6511512544, "type": "CALL" }, { "from": 6500654188, "to": 6500652262, "type": "CODE" }, { "from": 6500654213, "to": 6511513840, "type": "CALL" }, { "from": 6500654218, "to": 6500654346, "type": "CODE" }, { "from": 6500654232, "to": 6511513840, "type": "CALL" }, { "from": 6500654237, "to": 6500654395, "type": "CODE" }, { "from": 6500654610, "to": 6500654709, "type": "CODE" }, { "from": 6500654627, "to": 6526594288, "type": "CALL" }, { "from": 6500654736, "to": 6518122064, "type": "CALL" }, { "from": 6500654759, "to": 6500652089, "type": "CODE" }, { "from": 6500654875, "to": 6511512544, "type": "CALL" }, { "from": 6500654880, "to": 6500654754, "type": "CODE" }, { "from": 6500654898, "to": 6511512544, "type": "CALL" }, { "from": 6500654903, "to": 6500654816, "type": "CODE" }, { "from": 6500654916, "to": 6542089024, "type": "CALL" }, { "from": 6500654948, "to": 6511512544, "type": "CALL" }, { "from": 6500654980, "to": 6511512544, "type": "CALL" }, { "from": 6500654993, "to": 6500653425, "type": "CODE" }, { "from": 6500655001, "to": 6542702416, "type": "CALL" }, { "from": 6500655025, "to": 6511512544, "type": "CALL" }, { "from": 6500655030, "to": 6500651271, "type": "CODE" }, { "from": 6500655043, "to": 6500654032, "type": "CODE" } ], "datarefs": [ { "from": 6500650295, "to": 6740709440, "type": "DATA" }, { "from": 6500650375, "to": 6723586048, "type": "DATA" }, { "from": 6500650502, "to": 6723586080, "type": "DATA" }, { "from": 6500650974, "to": 6712116220, "type": "DATA" }, { "from": 6500651035, "to": 6712107144, "type": "DATA" }, { "from": 6500651378, "to": 6740709440, "type": "DATA" }, { "from": 6500651640, "to": 6723589344, "type": "DATA" }, { "from": 6500651699, "to": 6723589360, "type": "DATA" }, { "from": 6500651767, "to": 6723590224, "type": "DATA" }, { "from": 6500651828, "to": 6712172672, "type": "DATA" }, { "from": 6500651884, "to": 6723589376, "type": "DATA" }, { "from": 6500651986, "to": 6723589392, "type": "DATA" }, { "from": 6500651995, "to": 6723589296, "type": "DATA" }, { "from": 6500652876, "to": 6712480876, "type": "DATA" }, { "from": 6500652992, "to": 6723589504, "type": "DATA" }, { "from": 6500653154, "to": 6723589528, "type": "DATA" }, { "from": 6500653735, "to": 6496572928, "type": "DATA" }, { "from": 6500653746, "to": 6488510160, "type": "DATA" }, { "from": 6500653757, "to": 6496570832, "type": "DATA" }, { "from": 6500653768, "to": 6500637776, "type": "DATA" }, { "from": 6500653787, "to": 6723586096, "type": "DATA" }, { "from": 6500653794, "to": 6723585184, "type": "DATA" }, { "from": 6500654069, "to": 6488537248, "type": "DATA" }, { "from": 6500654612, "to": 6723589528, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-gateway-2.json", "source_sha256": "84ac91a950269e4b10ce73a087edc9cfdb505371fd58805b7cb4450b87cc3a4b", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-gateway-2.txt", "stdout_bytes": 57485, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183780d10;pdgo @ 0x183780d10;afij @ 0x183780d10", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183780d10;pdgo @ 0x183780d10;afij @ 0x183780d10", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-gateway-3", "analyst_label": "OnResponseRequestSigned（签名后发起 SSE）", "label_is_original_symbol": false, "evidence_id": "ev_527019dd59f69f8c7779841af3b693011e1fb6717754ae09c3d40e1f7566a917", "address": "0x183789d20", "function": { "address": "0x183789d20", "size": 3783, "name": "fcn.183789d20", "signature": "fcn.183789d20(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_38h, int64_t arg_40h, int64_t arg_48h, int64_t arg_50h, int64_t arg_58h);", "callrefs": [ { "from": 6500687234, "to": 6500687244, "type": "CODE" }, { "from": 6500687256, "to": 6500687239, "type": "CODE" }, { "from": 6500687299, "to": 6511512544, "type": "CALL" }, { "from": 6500687322, "to": 6511512544, "type": "CALL" }, { "from": 6500687351, "to": 6511512544, "type": "CALL" }, { "from": 6500687376, "to": 6511512544, "type": "CALL" }, { "from": 6500687405, "to": 6511512544, "type": "CALL" }, { "from": 6500687419, "to": 6519296000, "type": "CALL" }, { "from": 6500687489, "to": 6544016480, "type": "CALL" }, { "from": 6500687515, "to": 6511512544, "type": "CALL" }, { "from": 6500687560, "to": 6500687595, "type": "CODE" }, { "from": 6500687585, "to": 6500687565, "type": "CODE" }, { "from": 6500687606, "to": 6500687590, "type": "CODE" }, { "from": 6500687685, "to": 6500673264, "type": "CALL" }, { "from": 6500687690, "to": 6500687273, "type": "CODE" }, { "from": 6500687711, "to": 6542067384, "type": "CALL" }, { "from": 6500687722, "to": 6525600096, "type": "CALL" }, { "from": 6500687761, "to": 6500618336, "type": "CALL" }, { "from": 6500687778, "to": 6514577840, "type": "CALL" }, { "from": 6500687791, "to": 6511396000, "type": "CALL" }, { "from": 6500687817, "to": 6500687835, "type": "CODE" }, { "from": 6500687911, "to": 6477997904, "type": "CALL" }, { "from": 6500687971, "to": 6515344192, "type": "CALL" }, { "from": 6500688047, "to": 6515344192, "type": "CALL" }, { "from": 6500688128, "to": 6515344192, "type": "CALL" }, { "from": 6500688202, "to": 6515344192, "type": "CALL" }, { "from": 6500688253, "to": 6500688307, "type": "CODE" }, { "from": 6500688269, "to": 6511729936, "type": "CALL" }, { "from": 6500688274, "to": 6500689220, "type": "CODE" }, { "from": 6500688284, "to": 6740346544, "type": "CALL" }, { "from": 6500688290, "to": 6500688717, "type": "CODE" }, { "from": 6500688353, "to": 6515344192, "type": "CALL" }, { "from": 6500688456, "to": 6515344192, "type": "CALL" }, { "from": 6500688559, "to": 6515344192, "type": "CALL" }, { "from": 6500688569, "to": 6542067384, "type": "CALL" }, { "from": 6500688588, "to": 6542434496, "type": "CALL" }, { "from": 6500688665, "to": 6740379656, "type": "CALL" }, { "from": 6500688890, "to": 6542434064, "type": "CALL" }, { "from": 6500689363, "to": 6542067384, "type": "CALL" }, { "from": 6500689481, "to": 6511512544, "type": "CALL" }, { "from": 6500689514, "to": 6512942288, "type": "CALL" }, { "from": 6500689561, "to": 6453036096, "type": "CALL" }, { "from": 6500689605, "to": 6464561680, "type": "CALL" }, { "from": 6500689640, "to": 6464561680, "type": "CALL" }, { "from": 6500689795, "to": 6468400960, "type": "CALL" }, { "from": 6500689867, "to": 6542067384, "type": "CALL" }, { "from": 6500689950, "to": 6612894160, "type": "CALL" }, { "from": 6500690022, "to": 6542067384, "type": "CALL" }, { "from": 6500690179, "to": 6542067384, "type": "CALL" }, { "from": 6500690263, "to": 6511647584, "type": "CALL" }, { "from": 6500690289, "to": 6628788720, "type": "CALL" }, { "from": 6500690294, "to": 6500687273, "type": "CODE" }, { "from": 6500690313, "to": 6511729936, "type": "CALL" }, { "from": 6500690318, "to": 6500689313, "type": "CODE" }, { "from": 6500690361, "to": 6500690174, "type": "CODE" }, { "from": 6500690428, "to": 6500673264, "type": "CALL" }, { "from": 6500690453, "to": 6500715696, "type": "CALL" }, { "from": 6500690466, "to": 6511512544, "type": "CALL" }, { "from": 6500690471, "to": 6500687273, "type": "CODE" }, { "from": 6500690490, "to": 6511512544, "type": "CALL" }, { "from": 6500690495, "to": 6500689473, "type": "CODE" }, { "from": 6500690533, "to": 6740346544, "type": "CALL" }, { "from": 6500690539, "to": 6500690119, "type": "CODE" }, { "from": 6500690555, "to": 6542089024, "type": "CALL" }, { "from": 6500690583, "to": 6511512544, "type": "CALL" }, { "from": 6500690588, "to": 6500688783, "type": "CODE" }, { "from": 6500690616, "to": 6511512544, "type": "CALL" }, { "from": 6500690621, "to": 6500688971, "type": "CODE" }, { "from": 6500690649, "to": 6511512544, "type": "CALL" }, { "from": 6500690654, "to": 6500689016, "type": "CODE" }, { "from": 6500690685, "to": 6511512544, "type": "CALL" }, { "from": 6500690690, "to": 6500689076, "type": "CODE" }, { "from": 6500690718, "to": 6511512544, "type": "CALL" }, { "from": 6500690723, "to": 6500688918, "type": "CODE" }, { "from": 6500690745, "to": 6511512544, "type": "CALL" }, { "from": 6500690750, "to": 6500690119, "type": "CODE" }, { "from": 6500690765, "to": 6511512544, "type": "CALL" }, { "from": 6500690770, "to": 6500690737, "type": "CODE" }, { "from": 6500690801, "to": 6511730288, "type": "CALL" }, { "from": 6500690806, "to": 6500689220, "type": "CODE" }, { "from": 6500690840, "to": 6511730288, "type": "CALL" }, { "from": 6500690845, "to": 6500689313, "type": "CODE" }, { "from": 6500690867, "to": 6511423872, "type": "CALL" }, { "from": 6500690872, "to": 6500689762, "type": "CODE" }, { "from": 6500690914, "to": 6500688709, "type": "CODE" } ], "datarefs": [ { "from": 6500687182, "to": 6740709440, "type": "DATA" }, { "from": 6500687435, "to": 6740709440, "type": "DATA" }, { "from": 6500687617, "to": 6723587560, "type": "DATA" }, { "from": 6500687643, "to": 6723587304, "type": "DATA" }, { "from": 6500687727, "to": 6723587520, "type": "DATA" }, { "from": 6500687916, "to": 6715434912, "type": "DATA" }, { "from": 6500687942, "to": 6712688112, "type": "DATA" }, { "from": 6500687976, "to": 6723587608, "type": "DATA" }, { "from": 6500688002, "to": 6712688024, "type": "DATA" }, { "from": 6500688052, "to": 6712688072, "type": "DATA" }, { "from": 6500688078, "to": 6712688088, "type": "DATA" }, { "from": 6500688171, "to": 6723587632, "type": "DATA" }, { "from": 6500688322, "to": 6723587648, "type": "DATA" }, { "from": 6500688425, "to": 6723587672, "type": "DATA" }, { "from": 6500688528, "to": 6723587704, "type": "DATA" }, { "from": 6500688624, "to": 6741125872, "type": "DATA" }, { "from": 6500688631, "to": 6537033840, "type": "DATA" }, { "from": 6500689375, "to": 6707911888, "type": "DATA" }, { "from": 6500689486, "to": 6723587728, "type": "DATA" }, { "from": 6500689493, "to": 6723585184, "type": "DATA" }, { "from": 6500689535, "to": 6723585640, "type": "DATA" }, { "from": 6500689673, "to": 6715434912, "type": "DATA" }, { "from": 6500689749, "to": 6741126408, "type": "DATA" }, { "from": 6500689878, "to": 6500715600, "type": "DATA" }, { "from": 6500689889, "to": 6488537456, "type": "DATA" }, { "from": 6500689900, "to": 6496570832, "type": "DATA" }, { "from": 6500689911, "to": 6500690928, "type": "DATA" }, { "from": 6500690033, "to": 6500715600, "type": "DATA" }, { "from": 6500690044, "to": 6488537456, "type": "DATA" }, { "from": 6500690055, "to": 6496570832, "type": "DATA" }, { "from": 6500690066, "to": 6500691344, "type": "DATA" }, { "from": 6500690366, "to": 6723587752, "type": "DATA" }, { "from": 6500690389, "to": 6723587800, "type": "DATA" }, { "from": 6500690514, "to": 6488537248, "type": "DATA" }, { "from": 6500690880, "to": 6742234664, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-gateway-3.json", "source_sha256": "872b59e04c30f804b6fd85ee8888d506bf4a1f4710d3dec3e2864ba37f1f3e2d", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-gateway-3.txt", "stdout_bytes": 51241, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183789d20;pdgo @ 0x183789d20;afij @ 0x183789d20", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183789d20;pdgo @ 0x183789d20;afij @ 0x183789d20", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-image-cache", "analyst_label": "Prepare（请求键控与异步准备）", "label_is_original_symbol": false, "evidence_id": "ev_ace620d0e4d91f321d90f1fd2f25e12c205a97810db0ca75b027b4c3448a7283", "address": "0x183793c30", "function": { "address": "0x183793c30", "size": 1648, "name": "fcn.183793c30", "signature": "fcn.183793c30(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_38h);", "callrefs": [ { "from": 6500727937, "to": 6500727942, "type": "CODE" }, { "from": 6500727963, "to": 6500727942, "type": "CODE" }, { "from": 6500728038, "to": 6740346544, "type": "CALL" }, { "from": 6500728056, "to": 6740346544, "type": "CALL" }, { "from": 6500728100, "to": 6511512544, "type": "CALL" }, { "from": 6500728129, "to": 6511512544, "type": "CALL" }, { "from": 6500728198, "to": 6740346544, "type": "CALL" }, { "from": 6500728204, "to": 6500728142, "type": "CODE" }, { "from": 6500728214, "to": 6511729936, "type": "CALL" }, { "from": 6500728281, "to": 6740346544, "type": "CALL" }, { "from": 6500728287, "to": 6500728504, "type": "CODE" }, { "from": 6500728335, "to": 6500728747, "type": "CODE" }, { "from": 6500728345, "to": 6542067384, "type": "CALL" }, { "from": 6500728560, "to": 6542067384, "type": "CALL" }, { "from": 6500728655, "to": 6512942288, "type": "CALL" }, { "from": 6500728722, "to": 6517399712, "type": "CALL" }, { "from": 6500728752, "to": 6542067384, "type": "CALL" }, { "from": 6500728834, "to": 6511647584, "type": "CALL" }, { "from": 6500728894, "to": 6542067384, "type": "CALL" }, { "from": 6500728970, "to": 6542067384, "type": "CALL" }, { "from": 6500729079, "to": 6512942288, "type": "CALL" }, { "from": 6500729089, "to": 6542067384, "type": "CALL" }, { "from": 6500729105, "to": 6542067384, "type": "CALL" }, { "from": 6500729167, "to": 6542067384, "type": "CALL" }, { "from": 6500729243, "to": 6511423872, "type": "CALL" }, { "from": 6500729277, "to": 6463429312, "type": "CALL" }, { "from": 6500729307, "to": 6500742128, "type": "CALL" }, { "from": 6500729312, "to": 6500728073, "type": "CODE" }, { "from": 6500729347, "to": 6740346544, "type": "CALL" }, { "from": 6500729353, "to": 6500728683, "type": "CODE" }, { "from": 6500729375, "to": 6511512544, "type": "CALL" }, { "from": 6500729380, "to": 6500728683, "type": "CODE" }, { "from": 6500729395, "to": 6511512544, "type": "CALL" }, { "from": 6500729400, "to": 6500729367, "type": "CODE" }, { "from": 6500729420, "to": 6511512544, "type": "CALL" }, { "from": 6500729425, "to": 6500728504, "type": "CODE" }, { "from": 6500729440, "to": 6511512544, "type": "CALL" }, { "from": 6500729445, "to": 6500729412, "type": "CODE" }, { "from": 6500729460, "to": 6542089024, "type": "CALL" }, { "from": 6500729494, "to": 6511512544, "type": "CALL" }, { "from": 6500729499, "to": 6500728073, "type": "CODE" } ], "datarefs": [ { "from": 6500727889, "to": 6740709440, "type": "DATA" }, { "from": 6500728153, "to": 6740709440, "type": "DATA" }, { "from": 6500728262, "to": 6488537248, "type": "DATA" }, { "from": 6500728411, "to": 6709836760, "type": "DATA" }, { "from": 6500728574, "to": 6500741840, "type": "DATA" }, { "from": 6500728585, "to": 6488537312, "type": "DATA" }, { "from": 6500728596, "to": 6496570832, "type": "DATA" }, { "from": 6500728607, "to": 6500729504, "type": "DATA" }, { "from": 6500728630, "to": 6722337944, "type": "DATA" }, { "from": 6500728637, "to": 6723590416, "type": "DATA" }, { "from": 6500728909, "to": 6500741984, "type": "DATA" }, { "from": 6500728920, "to": 6488537312, "type": "DATA" }, { "from": 6500728931, "to": 6496570832, "type": "DATA" }, { "from": 6500728942, "to": 6500729824, "type": "DATA" }, { "from": 6500728980, "to": 6496878368, "type": "DATA" }, { "from": 6500728991, "to": 6488537520, "type": "DATA" }, { "from": 6500729002, "to": 6511490512, "type": "DATA" }, { "from": 6500729013, "to": 6500722096, "type": "DATA" }, { "from": 6500729054, "to": 6722337944, "type": "DATA" }, { "from": 6500729061, "to": 6723590416, "type": "DATA" }, { "from": 6500729112, "to": 6462662976, "type": "DATA" }, { "from": 6500729123, "to": 6500745568, "type": "DATA" }, { "from": 6500729138, "to": 6500744496, "type": "DATA" }, { "from": 6500729177, "to": 6443185472, "type": "DATA" }, { "from": 6500729188, "to": 6496379968, "type": "DATA" }, { "from": 6500729203, "to": 6500744896, "type": "DATA" }, { "from": 6500729231, "to": 6741126408, "type": "DATA" }, { "from": 6500729260, "to": 6723590485, "type": "DATA" }, { "from": 6500729332, "to": 6488537248, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-image-cache.json", "source_sha256": "82e66a13eea6a576b58d1c8bbbfd4ef45442a93b84adc0e994028051a1784bb0", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-image-cache.txt", "stdout_bytes": 26639, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183793c30;pdgo @ 0x183793c30;afij @ 0x183793c30", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183793c30;pdgo @ 0x183793c30;afij @ 0x183793c30", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-image-response", "analyst_label": "解析图像解析/上传响应与 URL/期限检查", "label_is_original_symbol": false, "evidence_id": "ev_1a09f12455b1340e6b2f586fa6eededb750f5d988095d7cc0eb249ff5615d90a", "address": "0x1837962b0", "function": { "address": "0x1837962b0", "size": 2603, "name": "fcn.1837962b0", "signature": "fcn.1837962b0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);", "callrefs": [ { "from": 6500737784, "to": 6500737798, "type": "CODE" }, { "from": 6500737819, "to": 6500737826, "type": "CODE" }, { "from": 6500737839, "to": 6542434064, "type": "CALL" }, { "from": 6500737854, "to": 6500737793, "type": "CODE" }, { "from": 6500737900, "to": 6511512544, "type": "CALL" }, { "from": 6500737939, "to": 6511512544, "type": "CALL" }, { "from": 6500738040, "to": 6457891536, "type": "CALL" }, { "from": 6500738096, "to": 6457891536, "type": "CALL" }, { "from": 6500738158, "to": 6457891296, "type": "CALL" }, { "from": 6500738215, "to": 6524601072, "type": "CALL" }, { "from": 6500738261, "to": 6740379656, "type": "CALL" }, { "from": 6500738388, "to": 6500738424, "type": "CODE" }, { "from": 6500738393, "to": 6740346544, "type": "CALL" }, { "from": 6500738402, "to": 6500738313, "type": "CODE" }, { "from": 6500738458, "to": 6457891296, "type": "CALL" }, { "from": 6500738523, "to": 6445650832, "type": "CALL" }, { "from": 6500738576, "to": 6471067168, "type": "CALL" }, { "from": 6500738658, "to": 6524031184, "type": "CALL" }, { "from": 6500738683, "to": 6511512544, "type": "CALL" }, { "from": 6500738709, "to": 6445656528, "type": "CALL" }, { "from": 6500738774, "to": 6511512544, "type": "CALL" }, { "from": 6500738828, "to": 6511975280, "type": "CALL" }, { "from": 6500738836, "to": 6518967168, "type": "CALL" }, { "from": 6500738963, "to": 6446103440, "type": "CALL" }, { "from": 6500739017, "to": 6524006896, "type": "CALL" }, { "from": 6500739098, "to": 6447834288, "type": "CALL" }, { "from": 6500739163, "to": 6529825440, "type": "CALL" }, { "from": 6500739242, "to": 6515567520, "type": "CALL" }, { "from": 6500739267, "to": 6511396000, "type": "CALL" }, { "from": 6500739272, "to": 6500739293, "type": "CODE" }, { "from": 6500739316, "to": 6500735104, "type": "CALL" }, { "from": 6500739374, "to": 6524603600, "type": "CALL" }, { "from": 6500739411, "to": 6511512544, "type": "CALL" }, { "from": 6500739416, "to": 6500737877, "type": "CODE" }, { "from": 6500739443, "to": 6524603600, "type": "CALL" }, { "from": 6500739480, "to": 6511512544, "type": "CALL" }, { "from": 6500739485, "to": 6500739338, "type": "CODE" }, { "from": 6500739499, "to": 6500733232, "type": "CALL" }, { "from": 6500739504, "to": 6500739321, "type": "CODE" }, { "from": 6500739543, "to": 6511645120, "type": "CALL" }, { "from": 6500739593, "to": 6531391632, "type": "CALL" }, { "from": 6500739721, "to": 6542434272, "type": "CALL" }, { "from": 6500739765, "to": 6500739259, "type": "CODE" }, { "from": 6500739852, "to": 6529355056, "type": "CALL" }, { "from": 6500739879, "to": 6511396000, "type": "CALL" }, { "from": 6500739914, "to": 6511513840, "type": "CALL" }, { "from": 6500739919, "to": 6500739945, "type": "CODE" }, { "from": 6500740073, "to": 6500735104, "type": "CALL" }, { "from": 6500740111, "to": 6511512544, "type": "CALL" }, { "from": 6500740116, "to": 6500739321, "type": "CODE" }, { "from": 6500740130, "to": 6543545728, "type": "CALL" }, { "from": 6500740206, "to": 6500738632, "type": "CODE" }, { "from": 6500740236, "to": 6740346544, "type": "CALL" }, { "from": 6500740242, "to": 6500738817, "type": "CODE" }, { "from": 6500740281, "to": 6500738305, "type": "CODE" }, { "from": 6500740305, "to": 6511512544, "type": "CALL" }, { "from": 6500740310, "to": 6500740149, "type": "CODE" } ], "datarefs": [ { "from": 6500738003, "to": 6715269024, "type": "DATA" }, { "from": 6500738030, "to": 6723590520, "type": "DATA" }, { "from": 6500738045, "to": 6719218748, "type": "DATA" }, { "from": 6500738052, "to": 6712694288, "type": "DATA" }, { "from": 6500738071, "to": 6714838688, "type": "DATA" }, { "from": 6500738129, "to": 6723590208, "type": "DATA" }, { "from": 6500738184, "to": 6712261648, "type": "DATA" }, { "from": 6500738220, "to": 6741125872, "type": "DATA" }, { "from": 6500738227, "to": 6537033840, "type": "DATA" }, { "from": 6500738412, "to": 6712113264, "type": "DATA" }, { "from": 6500738424, "to": 6723590544, "type": "DATA" }, { "from": 6500738463, "to": 6742246848, "type": "DATA" }, { "from": 6500738476, "to": 6741126112, "type": "DATA" }, { "from": 6500738485, "to": 6742246856, "type": "DATA" }, { "from": 6500738499, "to": 6723590416, "type": "DATA" }, { "from": 6500738688, "to": 6710367816, "type": "DATA" }, { "from": 6500738722, "to": 6708900496, "type": "DATA" }, { "from": 6500738737, "to": 6708923712, "type": "DATA" }, { "from": 6500738787, "to": 6708923824, "type": "DATA" }, { "from": 6500738801, "to": 6742217808, "type": "DATA" }, { "from": 6500738975, "to": 6723590560, "type": "DATA" }, { "from": 6500739064, "to": 6712260636, "type": "DATA" }, { "from": 6500739127, "to": 6723590224, "type": "DATA" }, { "from": 6500739509, "to": 6715409368, "type": "DATA" }, { "from": 6500739556, "to": 6723590576, "type": "DATA" }, { "from": 6500740123, "to": 6712088560, "type": "DATA" }, { "from": 6500740158, "to": 6712128076, "type": "DATA" }, { "from": 6500740247, "to": 6742234664, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-image-response.json", "source_sha256": "afbd085c69a2fe4306b893c7d23174c4a7104d93d0fd1abfcf233287f675c1c5", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-image-response.txt", "stdout_bytes": 33639, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837962b0;pdgo @ 0x1837962b0;afij @ 0x1837962b0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837962b0;pdgo @ 0x1837962b0;afij @ 0x1837962b0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-installer-commit", "analyst_label": "校验归档、暂存、发布并提交安装元数据", "label_is_original_symbol": false, "evidence_id": "ev_328c1546ce91dbe4a679d7d8c88d095d8410e9165a0a9132d478f785ba8ac72c", "address": "0x1837b1110", "function": { "address": "0x1837b1110", "size": 8847, "name": "fcn.1837b1110", "signature": "fcn.1837b1110(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_38h, int64_t arg_3a8h);", "callrefs": [ { "from": 6500847987, "to": 6522337344, "type": "CALL" }, { "from": 6500848066, "to": 6522337344, "type": "CALL" }, { "from": 6500848152, "to": 6500848392, "type": "CODE" }, { "from": 6500848164, "to": 6511513840, "type": "CALL" }, { "from": 6500848169, "to": 6500848109, "type": "CODE" }, { "from": 6500848195, "to": 6500847992, "type": "CODE" }, { "from": 6500848214, "to": 6500848071, "type": "CODE" }, { "from": 6500848229, "to": 6511513840, "type": "CALL" }, { "from": 6500848234, "to": 6500848033, "type": "CODE" }, { "from": 6500848260, "to": 6542067384, "type": "CALL" }, { "from": 6500848319, "to": 6500848568, "type": "CODE" }, { "from": 6500848351, "to": 6511512544, "type": "CALL" }, { "from": 6500848364, "to": 6517433568, "type": "CALL" }, { "from": 6500848435, "to": 6453526016, "type": "CALL" }, { "from": 6500848481, "to": 6453526016, "type": "CALL" }, { "from": 6500848601, "to": 6542436672, "type": "CALL" }, { "from": 6500848754, "to": 6453526016, "type": "CALL" }, { "from": 6500848765, "to": 6529181184, "type": "CALL" }, { "from": 6500848781, "to": 6457113920, "type": "CALL" }, { "from": 6500848818, "to": 6511512544, "type": "CALL" }, { "from": 6500848852, "to": 6511512544, "type": "CALL" }, { "from": 6500848886, "to": 6511512544, "type": "CALL" }, { "from": 6500848920, "to": 6511512544, "type": "CALL" }, { "from": 6500848979, "to": 6454898800, "type": "CALL" }, { "from": 6500849067, "to": 6623495712, "type": "CALL" }, { "from": 6500849111, "to": 6543845488, "type": "CALL" }, { "from": 6500849194, "to": 6542434064, "type": "CALL" }, { "from": 6500849205, "to": 6500848327, "type": "CODE" }, { "from": 6500849239, "to": 6511512544, "type": "CALL" }, { "from": 6500849273, "to": 6511512544, "type": "CALL" }, { "from": 6500849307, "to": 6511512544, "type": "CALL" }, { "from": 6500849341, "to": 6511512544, "type": "CALL" }, { "from": 6500849351, "to": 6542067384, "type": "CALL" }, { "from": 6500849542, "to": 6475530272, "type": "CALL" }, { "from": 6500849620, "to": 6500850070, "type": "CODE" }, { "from": 6500849650, "to": 6524603600, "type": "CALL" }, { "from": 6500849696, "to": 6511512544, "type": "CALL" }, { "from": 6500849701, "to": 6500849577, "type": "CODE" }, { "from": 6500849711, "to": 6500850077, "type": "CODE" }, { "from": 6500849741, "to": 6524603600, "type": "CALL" }, { "from": 6500849787, "to": 6511512544, "type": "CALL" }, { "from": 6500849792, "to": 6500850031, "type": "CODE" }, { "from": 6500849805, "to": 6517433568, "type": "CALL" }, { "from": 6500849815, "to": 6535984016, "type": "CALL" }, { "from": 6500849825, "to": 6542067384, "type": "CALL" }, { "from": 6500849926, "to": 6542436672, "type": "CALL" }, { "from": 6500849992, "to": 6475530272, "type": "CALL" }, { "from": 6500850070, "to": 6511512544, "type": "CALL" }, { "from": 6500850106, "to": 6511512544, "type": "CALL" }, { "from": 6500850140, "to": 6511512544, "type": "CALL" }, { "from": 6500850174, "to": 6511512544, "type": "CALL" }, { "from": 6500850208, "to": 6511512544, "type": "CALL" }, { "from": 6500850276, "to": 6453526016, "type": "CALL" }, { "from": 6500850336, "to": 6453526016, "type": "CALL" }, { "from": 6500850373, "to": 6453526016, "type": "CALL" }, { "from": 6500850403, "to": 6511512544, "type": "CALL" }, { "from": 6500850418, "to": 6446849744, "type": "CALL" }, { "from": 6500850447, "to": 6446849744, "type": "CALL" }, { "from": 6500850465, "to": 6542067384, "type": "CALL" }, { "from": 6500850637, "to": 6475530272, "type": "CALL" }, { "from": 6500850712, "to": 6511512544, "type": "CALL" }, { "from": 6500850746, "to": 6511512544, "type": "CALL" }, { "from": 6500850780, "to": 6511512544, "type": "CALL" }, { "from": 6500850868, "to": 6524603600, "type": "CALL" }, { "from": 6500850914, "to": 6511512544, "type": "CALL" }, { "from": 6500850919, "to": 6500850676, "type": "CODE" }, { "from": 6500850949, "to": 6524603600, "type": "CALL" }, { "from": 6500850995, "to": 6511512544, "type": "CALL" }, { "from": 6500851000, "to": 6500851501, "type": "CODE" }, { "from": 6500851061, "to": 6624422672, "type": "CALL" }, { "from": 6500851164, "to": 6500856736, "type": "CALL" }, { "from": 6500851265, "to": 6500856736, "type": "CALL" }, { "from": 6500851283, "to": 6542067384, "type": "CALL" }, { "from": 6500851462, "to": 6475530272, "type": "CALL" }, { "from": 6500851541, "to": 6500851783, "type": "CODE" }, { "from": 6500851551, "to": 6542067384, "type": "CALL" }, { "from": 6500851712, "to": 6475530272, "type": "CALL" }, { "from": 6500851783, "to": 6511512544, "type": "CALL" }, { "from": 6500851796, "to": 6624422496, "type": "CALL" }, { "from": 6500851801, "to": 6500850717, "type": "CODE" }, { "from": 6500851831, "to": 6524603600, "type": "CALL" }, { "from": 6500851877, "to": 6511512544, "type": "CALL" }, { "from": 6500851882, "to": 6500851747, "type": "CODE" }, { "from": 6500851920, "to": 6453526016, "type": "CALL" }, { "from": 6500851958, "to": 6453526016, "type": "CALL" }, { "from": 6500851997, "to": 6500833664, "type": "CALL" }, { "from": 6500852047, "to": 6511512544, "type": "CALL" }, { "from": 6500852091, "to": 6511512544, "type": "CALL" }, { "from": 6500852110, "to": 6542067384, "type": "CALL" }, { "from": 6500852288, "to": 6475530272, "type": "CALL" }, { "from": 6500852363, "to": 6500851783, "type": "CODE" }, { "from": 6500852385, "to": 6524603600, "type": "CALL" }, { "from": 6500852423, "to": 6511512544, "type": "CALL" }, { "from": 6500852428, "to": 6500852018, "type": "CODE" }, { "from": 6500852458, "to": 6524603600, "type": "CALL" }, { "from": 6500852504, "to": 6511512544, "type": "CALL" }, { "from": 6500852509, "to": 6500852323, "type": "CODE" }, { "from": 6500852535, "to": 6542067384, "type": "CALL" }, { "from": 6500852589, "to": 6500852705, "type": "CODE" }, { "from": 6500852624, "to": 6535984912, "type": "CALL" }, { "from": 6500852747, "to": 6542436672, "type": "CALL" }, { "from": 6500852843, "to": 6511733920, "type": "CALL" }, { "from": 6500852920, "to": 6511512544, "type": "CALL" }, { "from": 6500852954, "to": 6511512544, "type": "CALL" }, { "from": 6500853033, "to": 6453526016, "type": "CALL" }, { "from": 6500853111, "to": 6453526016, "type": "CALL" }, { "from": 6500853154, "to": 6453526016, "type": "CALL" }, { "from": 6500853165, "to": 6624426384, "type": "CALL" }, { "from": 6500853197, "to": 6511512544, "type": "CALL" }, { "from": 6500853250, "to": 6624422816, "type": "CALL" }, { "from": 6500853301, "to": 6453526016, "type": "CALL" }, { "from": 6500853317, "to": 6624426384, "type": "CALL" }, { "from": 6500853349, "to": 6511512544, "type": "CALL" }, { "from": 6500853395, "to": 6624422816, "type": "CALL" }, { "from": 6500853458, "to": 6500833664, "type": "CALL" }, { "from": 6500853496, "to": 6500855580, "type": "CODE" }, { "from": 6500853506, "to": 6542067384, "type": "CALL" }, { "from": 6500853667, "to": 6475530272, "type": "CALL" }, { "from": 6500853745, "to": 6511512544, "type": "CALL" }, { "from": 6500853750, "to": 6500854254, "type": "CODE" }, { "from": 6500853780, "to": 6524603600, "type": "CALL" }, { "from": 6500853826, "to": 6511512544, "type": "CALL" }, { "from": 6500853831, "to": 6500853702, "type": "CODE" }, { "from": 6500853841, "to": 6542067384, "type": "CALL" }, { "from": 6500854016, "to": 6475530272, "type": "CALL" }, { "from": 6500854098, "to": 6511512544, "type": "CALL" }, { "from": 6500854103, "to": 6500854241, "type": "CODE" }, { "from": 6500854137, "to": 6511512544, "type": "CALL" }, { "from": 6500854191, "to": 6511512544, "type": "CALL" }, { "from": 6500854221, "to": 6624422496, "type": "CALL" }, { "from": 6500854249, "to": 6624422496, "type": "CALL" }, { "from": 6500854283, "to": 6511512544, "type": "CALL" }, { "from": 6500854317, "to": 6511512544, "type": "CALL" }, { "from": 6500854355, "to": 6500851783, "type": "CODE" }, { "from": 6500854365, "to": 6542067384, "type": "CALL" }, { "from": 6500854526, "to": 6475530272, "type": "CALL" }, { "from": 6500854608, "to": 6511512544, "type": "CALL" }, { "from": 6500854618, "to": 6500854241, "type": "CODE" }, { "from": 6500854648, "to": 6524603600, "type": "CALL" }, { "from": 6500854694, "to": 6511512544, "type": "CALL" }, { "from": 6500854704, "to": 6500854055, "type": "CODE" }, { "from": 6500854734, "to": 6524603600, "type": "CALL" }, { "from": 6500854780, "to": 6511512544, "type": "CALL" }, { "from": 6500854785, "to": 6500854569, "type": "CODE" }, { "from": 6500854815, "to": 6524603600, "type": "CALL" }, { "from": 6500854861, "to": 6500855131, "type": "CODE" }, { "from": 6500854871, "to": 6542067384, "type": "CALL" }, { "from": 6500855049, "to": 6475530272, "type": "CALL" }, { "from": 6500855131, "to": 6511512544, "type": "CALL" }, { "from": 6500855136, "to": 6500854213, "type": "CODE" }, { "from": 6500855166, "to": 6524603600, "type": "CALL" }, { "from": 6500855212, "to": 6511512544, "type": "CALL" }, { "from": 6500855217, "to": 6500855088, "type": "CODE" }, { "from": 6500855227, "to": 6542067384, "type": "CALL" }, { "from": 6500855415, "to": 6475530272, "type": "CALL" }, { "from": 6500855497, "to": 6500854191, "type": "CODE" }, { "from": 6500855527, "to": 6524603600, "type": "CALL" }, { "from": 6500855573, "to": 6511512544, "type": "CALL" }, { "from": 6500855578, "to": 6500855454, "type": "CODE" }, { "from": 6500855657, "to": 6456090784, "type": "CALL" }, { "from": 6500855749, "to": 6456090784, "type": "CALL" }, { "from": 6500855817, "to": 6471067168, "type": "CALL" }, { "from": 6500855926, "to": 6453526016, "type": "CALL" }, { "from": 6500855998, "to": 6469011872, "type": "CALL" }, { "from": 6500856052, "to": 6453526016, "type": "CALL" }, { "from": 6500856071, "to": 6457110720, "type": "CALL" }, { "from": 6500856103, "to": 6511512544, "type": "CALL" }, { "from": 6500856121, "to": 6542067384, "type": "CALL" }, { "from": 6500856294, "to": 6475530272, "type": "CALL" }, { "from": 6500856373, "to": 6511512544, "type": "CALL" }, { "from": 6500856378, "to": 6500854108, "type": "CODE" }, { "from": 6500856408, "to": 6524603600, "type": "CALL" }, { "from": 6500856454, "to": 6511512544, "type": "CALL" }, { "from": 6500856459, "to": 6500856333, "type": "CODE" }, { "from": 6500856508, "to": 6511512544, "type": "CALL" }, { "from": 6500856557, "to": 6511512544, "type": "CALL" }, { "from": 6500856590, "to": 6500844848, "type": "CALL" }, { "from": 6500856639, "to": 6500854108, "type": "CODE" }, { "from": 6500856655, "to": 6542089024, "type": "CALL" }, { "from": 6500856662, "to": 6542702416, "type": "CALL" }, { "from": 6500856725, "to": 6511512544, "type": "CALL" }, { "from": 6500856730, "to": 6500855870, "type": "CODE" } ], "datarefs": [ { "from": 6500847938, "to": 6740709440, "type": "DATA" }, { "from": 6500848392, "to": 6723597328, "type": "DATA" }, { "from": 6500848440, "to": 6718928168, "type": "DATA" }, { "from": 6500848619, "to": 6723597352, "type": "DATA" }, { "from": 6500848650, "to": 6723597356, "type": "DATA" }, { "from": 6500848660, "to": 6723597352, "type": "DATA" }, { "from": 6500849401, "to": 6723597616, "type": "DATA" }, { "from": 6500849435, "to": 6723597648, "type": "DATA" }, { "from": 6500849446, "to": 6723597632, "type": "DATA" }, { "from": 6500849457, "to": 6723597616, "type": "DATA" }, { "from": 6500849505, "to": 6712192108, "type": "DATA" }, { "from": 6500849878, "to": 6723597680, "type": "DATA" }, { "from": 6500849910, "to": 6723597680, "type": "DATA" }, { "from": 6500849955, "to": 6712192108, "type": "DATA" }, { "from": 6500850250, "to": 6723597328, "type": "DATA" }, { "from": 6500850296, "to": 6723597600, "type": "DATA" }, { "from": 6500850341, "to": 6723571184, "type": "DATA" }, { "from": 6500850515, "to": 6723597752, "type": "DATA" }, { "from": 6500850544, "to": 6723597783, "type": "DATA" }, { "from": 6500850555, "to": 6723597768, "type": "DATA" }, { "from": 6500850566, "to": 6723597752, "type": "DATA" }, { "from": 6500850600, "to": 6712192108, "type": "DATA" }, { "from": 6500850796, "to": 6740709440, "type": "DATA" }, { "from": 6500851027, "to": 6724139288, "type": "DATA" }, { "from": 6500851086, "to": 6723597832, "type": "DATA" }, { "from": 6500851113, "to": 6723597832, "type": "DATA" }, { "from": 6500851213, "to": 6723571191, "type": "DATA" }, { "from": 6500851232, "to": 6723571184, "type": "DATA" }, { "from": 6500851333, "to": 6723597856, "type": "DATA" }, { "from": 6500851362, "to": 6723597888, "type": "DATA" }, { "from": 6500851373, "to": 6723597872, "type": "DATA" }, { "from": 6500851384, "to": 6723597856, "type": "DATA" }, { "from": 6500851425, "to": 6712192108, "type": "DATA" }, { "from": 6500851601, "to": 6723597800, "type": "DATA" }, { "from": 6500851630, "to": 6723597809, "type": "DATA" }, { "from": 6500851641, "to": 6723597800, "type": "DATA" }, { "from": 6500851675, "to": 6712192108, "type": "DATA" }, { "from": 6500852160, "to": 6723597912, "type": "DATA" }, { "from": 6500852189, "to": 6723597944, "type": "DATA" }, { "from": 6500852200, "to": 6723597928, "type": "DATA" }, { "from": 6500852211, "to": 6723597912, "type": "DATA" }, { "from": 6500852251, "to": 6712192108, "type": "DATA" }, { "from": 6500852765, "to": 6712106840, "type": "DATA" }, { "from": 6500853556, "to": 6723597968, "type": "DATA" }, { "from": 6500853585, "to": 6723597984, "type": "DATA" }, { "from": 6500853596, "to": 6723597968, "type": "DATA" }, { "from": 6500853630, "to": 6712192108, "type": "DATA" }, { "from": 6500853891, "to": 6723598008, "type": "DATA" }, { "from": 6500853920, "to": 6723598024, "type": "DATA" }, { "from": 6500853931, "to": 6723598008, "type": "DATA" }, { "from": 6500853979, "to": 6712192108, "type": "DATA" }, { "from": 6500854415, "to": 6723598048, "type": "DATA" }, { "from": 6500854444, "to": 6723598062, "type": "DATA" }, { "from": 6500854455, "to": 6723598048, "type": "DATA" }, { "from": 6500854489, "to": 6712192108, "type": "DATA" }, { "from": 6500854931, "to": 6723598080, "type": "DATA" }, { "from": 6500854960, "to": 6723598096, "type": "DATA" }, { "from": 6500854971, "to": 6723598080, "type": "DATA" }, { "from": 6500855012, "to": 6712192108, "type": "DATA" }, { "from": 6500855287, "to": 6723597912, "type": "DATA" }, { "from": 6500855316, "to": 6723597944, "type": "DATA" }, { "from": 6500855327, "to": 6723597928, "type": "DATA" }, { "from": 6500855338, "to": 6723597912, "type": "DATA" }, { "from": 6500855378, "to": 6712192108, "type": "DATA" }, { "from": 6500855620, "to": 6723598120, "type": "DATA" }, { "from": 6500855720, "to": 6723598136, "type": "DATA" }, { "from": 6500855892, "to": 6723598152, "type": "DATA" }, { "from": 6500856007, "to": 6723597552, "type": "DATA" }, { "from": 6500856175, "to": 6723598176, "type": "DATA" }, { "from": 6500856204, "to": 6723598207, "type": "DATA" }, { "from": 6500856215, "to": 6723598192, "type": "DATA" }, { "from": 6500856226, "to": 6723598176, "type": "DATA" }, { "from": 6500856260, "to": 6712192108, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-installer-commit.json", "source_sha256": "293e7f6ad676c38d94b74da0be45562f98c1eda1c8f357da5576108f18108bfd", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-installer-commit.txt", "stdout_bytes": 136965, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837b1110;pdgo @ 0x1837b1110;afij @ 0x1837b1110", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837b1110;pdgo @ 0x1837b1110;afij @ 0x1837b1110", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-installer", "analyst_label": "读取 installed.json 并回收遗留路径", "label_is_original_symbol": false, "evidence_id": "ev_0a6dc4c169c7899893301bf6abc0b38609ff55a2ed6dd2344064dc8f7fef11e2", "address": "0x1837afc80", "function": { "address": "0x1837afc80", "size": 2217, "name": "fcn.1837afc80", "signature": "fcn.1837afc80(int64_t arg1, int64_t arg2, int64_t arg_58h, int64_t arg_238h);", "callrefs": [ { "from": 6500842708, "to": 6453526016, "type": "CALL" }, { "from": 6500842750, "to": 6453526016, "type": "CALL" }, { "from": 6500842766, "to": 6500833296, "type": "CALL" }, { "from": 6500842797, "to": 6511512544, "type": "CALL" }, { "from": 6500842827, "to": 6511512544, "type": "CALL" }, { "from": 6500842869, "to": 6447834288, "type": "CALL" }, { "from": 6500842908, "to": 6447834288, "type": "CALL" }, { "from": 6500842941, "to": 6447834288, "type": "CALL" }, { "from": 6500843017, "to": 6513233600, "type": "CALL" }, { "from": 6500843062, "to": 6513233600, "type": "CALL" }, { "from": 6500843094, "to": 6500833664, "type": "CALL" }, { "from": 6500843118, "to": 6511512544, "type": "CALL" }, { "from": 6500843152, "to": 6511512544, "type": "CALL" }, { "from": 6500843157, "to": 6500843257, "type": "CODE" }, { "from": 6500843184, "to": 6524603600, "type": "CALL" }, { "from": 6500843230, "to": 6511512544, "type": "CALL" }, { "from": 6500843235, "to": 6500843270, "type": "CODE" }, { "from": 6500843314, "to": 6453526016, "type": "CALL" }, { "from": 6500843322, "to": 6457113920, "type": "CALL" }, { "from": 6500843354, "to": 6542434496, "type": "CALL" }, { "from": 6500843376, "to": 6470543728, "type": "CALL" }, { "from": 6500843403, "to": 6454127600, "type": "CALL" }, { "from": 6500843480, "to": 6500843822, "type": "CODE" }, { "from": 6500843498, "to": 6511512544, "type": "CALL" }, { "from": 6500843503, "to": 6500843768, "type": "CODE" }, { "from": 6500843530, "to": 6445650832, "type": "CALL" }, { "from": 6500843556, "to": 6524031184, "type": "CALL" }, { "from": 6500843567, "to": 6480750288, "type": "CALL" }, { "from": 6500843590, "to": 6445656528, "type": "CALL" }, { "from": 6500843676, "to": 6511512544, "type": "CALL" }, { "from": 6500843728, "to": 6511975280, "type": "CALL" }, { "from": 6500843741, "to": 6518967168, "type": "CALL" }, { "from": 6500843752, "to": 6454127600, "type": "CALL" }, { "from": 6500843825, "to": 6457113920, "type": "CALL" }, { "from": 6500843867, "to": 6535538512, "type": "CALL" }, { "from": 6500843921, "to": 6525678304, "type": "CALL" }, { "from": 6500843984, "to": 6512724096, "type": "CALL" }, { "from": 6500844030, "to": 6511512544, "type": "CALL" }, { "from": 6500844061, "to": 6511512544, "type": "CALL" }, { "from": 6500844080, "to": 6535984016, "type": "CALL" }, { "from": 6500844133, "to": 6500843508, "type": "CODE" }, { "from": 6500844168, "to": 6511512544, "type": "CALL" }, { "from": 6500844212, "to": 6453526016, "type": "CALL" }, { "from": 6500844222, "to": 6535984016, "type": "CALL" }, { "from": 6500844252, "to": 6511512544, "type": "CALL" }, { "from": 6500844265, "to": 6454127456, "type": "CALL" }, { "from": 6500844303, "to": 6500844848, "type": "CALL" }, { "from": 6500844346, "to": 6447834288, "type": "CALL" }, { "from": 6500844394, "to": 6513233600, "type": "CALL" }, { "from": 6500844407, "to": 6500846576, "type": "CALL" }, { "from": 6500844437, "to": 6511512544, "type": "CALL" }, { "from": 6500844496, "to": 6453526016, "type": "CALL" }, { "from": 6500844504, "to": 6457113920, "type": "CALL" }, { "from": 6500844546, "to": 6447834288, "type": "CALL" }, { "from": 6500844594, "to": 6513233600, "type": "CALL" }, { "from": 6500844641, "to": 6453526016, "type": "CALL" }, { "from": 6500844652, "to": 6500846576, "type": "CALL" }, { "from": 6500844676, "to": 6511512544, "type": "CALL" }, { "from": 6500844710, "to": 6511512544, "type": "CALL" }, { "from": 6500844744, "to": 6511512544, "type": "CALL" }, { "from": 6500844769, "to": 6511512544, "type": "CALL" }, { "from": 6500844830, "to": 6740346544, "type": "CALL" }, { "from": 6500844836, "to": 6500843720, "type": "CODE" } ], "datarefs": [ { "from": 6500842671, "to": 6723597328, "type": "DATA" }, { "from": 6500842713, "to": 6723597552, "type": "DATA" }, { "from": 6500842832, "to": 6712256456, "type": "DATA" }, { "from": 6500842877, "to": 6723597568, "type": "DATA" }, { "from": 6500842916, "to": 6723597584, "type": "DATA" }, { "from": 6500843511, "to": 6723598448, "type": "DATA" }, { "from": 6500843549, "to": 6723598520, "type": "DATA" }, { "from": 6500843572, "to": 6710367816, "type": "DATA" }, { "from": 6500843607, "to": 6708900496, "type": "DATA" }, { "from": 6500843622, "to": 6708923712, "type": "DATA" }, { "from": 6500843681, "to": 6708923824, "type": "DATA" }, { "from": 6500843704, "to": 6742217808, "type": "DATA" }, { "from": 6500843834, "to": 6723598432, "type": "DATA" }, { "from": 6500844093, "to": 6742246848, "type": "DATA" }, { "from": 6500844106, "to": 6741126112, "type": "DATA" }, { "from": 6500844119, "to": 6742246856, "type": "DATA" }, { "from": 6500844173, "to": 6723598152, "type": "DATA" }, { "from": 6500844325, "to": 6723597568, "type": "DATA" }, { "from": 6500844464, "to": 6723597600, "type": "DATA" }, { "from": 6500844525, "to": 6723597584, "type": "DATA" }, { "from": 6500844599, "to": 6723571184, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-installer.json", "source_sha256": "1fd2b9fa7021006cf3d7fe702b495e4442850c8a51ad2200d0a1e8ffcad1d952", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-installer.txt", "stdout_bytes": 27158, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837afc80;pdgo @ 0x1837afc80;afij @ 0x1837afc80", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837afc80;pdgo @ 0x1837afc80;afij @ 0x1837afc80", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-loopback-router", "analyst_label": "本地 HTTP 路由、凭据及 Responses 契约检查", "label_is_original_symbol": false, "evidence_id": "ev_d0e9f6f9721184c0afdd7b5cf1f37f4890b7e420630f4ec2beaf58ab23f5a6f0", "address": "0x1837844e0", "function": { "address": "0x1837844e0", "size": 41593522, "name": "fcn.1837844e0", "signature": "fcn.1837844e0(int64_t arg1, int64_t arg2, int64_t arg3);", "callrefs": [ { "from": 6459079767, "to": 6511634672, "type": "CALL" }, { "from": 6459079834, "to": 6511512544, "type": "CALL" }, { "from": 6459079839, "to": 6459079784, "type": "CODE" }, { "from": 6459079849, "to": 6542089024, "type": "CALL" }, { "from": 6459079872, "to": 6511512544, "type": "CALL" }, { "from": 6459079877, "to": 6459079778, "type": "CODE" }, { "from": 6459079897, "to": 6511512544, "type": "CALL" }, { "from": 6459079902, "to": 6459079790, "type": "CODE" }, { "from": 6500664719, "to": 6512842352, "type": "CALL" }, { "from": 6500664798, "to": 6467786960, "type": "CALL" }, { "from": 6500664856, "to": 6500664922, "type": "CODE" }, { "from": 6500664875, "to": 6500665093, "type": "CODE" }, { "from": 6500664911, "to": 6542434064, "type": "CALL" }, { "from": 6500664956, "to": 6511512544, "type": "CALL" }, { "from": 6500664990, "to": 6511512544, "type": "CALL" }, { "from": 6500665151, "to": 6511483504, "type": "CALL" }, { "from": 6500665260, "to": 6467786960, "type": "CALL" }, { "from": 6500665391, "to": 6511512544, "type": "CALL" }, { "from": 6500665433, "to": 6511512544, "type": "CALL" }, { "from": 6500665467, "to": 6511512544, "type": "CALL" }, { "from": 6500665472, "to": 6500665476, "type": "CODE" }, { "from": 6500665505, "to": 6511512544, "type": "CALL" }, { "from": 6500665587, "to": 6500673264, "type": "CALL" }, { "from": 6500665649, "to": 6459079728, "type": "CODE" }, { "from": 6500665662, "to": 6500868416, "type": "CALL" }, { "from": 6500665667, "to": 6500665592, "type": "CODE" }, { "from": 6500665677, "to": 6500665693, "type": "CODE" }, { "from": 6500665704, "to": 6542434272, "type": "CALL" }, { "from": 6500665963, "to": 6500665587, "type": "CODE" }, { "from": 6500666117, "to": 6446103440, "type": "CALL" }, { "from": 6500666174, "to": 6524007984, "type": "CALL" }, { "from": 6500666252, "to": 6500666262, "type": "CODE" }, { "from": 6500666277, "to": 6500666257, "type": "CODE" }, { "from": 6500666300, "to": 6500666310, "type": "CODE" }, { "from": 6500666321, "to": 6500666305, "type": "CODE" }, { "from": 6500666357, "to": 6500666371, "type": "CODE" }, { "from": 6500666386, "to": 6500666362, "type": "CODE" }, { "from": 6500666434, "to": 6500746880, "type": "CALL" }, { "from": 6500666538, "to": 6446103440, "type": "CALL" }, { "from": 6500666543, "to": 6500667648, "type": "CODE" }, { "from": 6500666650, "to": 6467786960, "type": "CALL" }, { "from": 6500666728, "to": 6500666768, "type": "CODE" }, { "from": 6500666757, "to": 6542434064, "type": "CALL" }, { "from": 6500666792, "to": 6511512544, "type": "CALL" }, { "from": 6500666826, "to": 6511512544, "type": "CALL" }, { "from": 6500666975, "to": 6445284496, "type": "CALL" }, { "from": 6500667061, "to": 6445284496, "type": "CALL" }, { "from": 6500667121, "to": 6445284496, "type": "CALL" }, { "from": 6500667187, "to": 6459541808, "type": "CALL" }, { "from": 6500667230, "to": 6511513840, "type": "CALL" }, { "from": 6500667248, "to": 6500676240, "type": "CALL" }, { "from": 6500667261, "to": 6445283808, "type": "CALL" }, { "from": 6500667266, "to": 6500667448, "type": "CODE" }, { "from": 6500667340, "to": 6500673264, "type": "CALL" }, { "from": 6500667372, "to": 6500667448, "type": "CODE" }, { "from": 6500667443, "to": 6500673264, "type": "CALL" }, { "from": 6500667476, "to": 6517426816, "type": "CALL" }, { "from": 6500667492, "to": 6511512544, "type": "CALL" }, { "from": 6500667497, "to": 6500665592, "type": "CODE" }, { "from": 6500667570, "to": 6624433408, "type": "CALL" }, { "from": 6500667702, "to": 6443410976, "type": "CALL" }, { "from": 6500667763, "to": 6444824624, "type": "CALL" }, { "from": 6500667871, "to": 6445284496, "type": "CALL" }, { "from": 6500667965, "to": 6471067168, "type": "CALL" }, { "from": 6500668085, "to": 6445284032, "type": "CALL" }, { "from": 6500668165, "to": 6459541808, "type": "CALL" }, { "from": 6500668208, "to": 6511513840, "type": "CALL" }, { "from": 6500668226, "to": 6500676240, "type": "CALL" }, { "from": 6500668239, "to": 6445283808, "type": "CALL" }, { "from": 6500668244, "to": 6500667345, "type": "CODE" }, { "from": 6500668263, "to": 6500667017, "type": "CODE" }, { "from": 6500668284, "to": 6500666506, "type": "CODE" }, { "from": 6500668316, "to": 6500668345, "type": "CODE" }, { "from": 6500668379, "to": 6500667332, "type": "CODE" }, { "from": 6500668392, "to": 6500669327, "type": "CODE" }, { "from": 6500668417, "to": 6542067384, "type": "CALL" }, { "from": 6500668485, "to": 6511647584, "type": "CALL" }, { "from": 6500668494, "to": 6500668518, "type": "CODE" }, { "from": 6500668523, "to": 6542067384, "type": "CALL" }, { "from": 6500668631, "to": 6542436672, "type": "CALL" }, { "from": 6500668654, "to": 6500676624, "type": "CALL" }, { "from": 6500668709, "to": 6542067384, "type": "CALL" }, { "from": 6500668811, "to": 6526592128, "type": "CALL" }, { "from": 6500668829, "to": 6519178480, "type": "CALL" }, { "from": 6500668852, "to": 6529736720, "type": "CALL" }, { "from": 6500668906, "to": 6500779200, "type": "CALL" }, { "from": 6500668944, "to": 6511512544, "type": "CALL" }, { "from": 6500668952, "to": 6500669884, "type": "CODE" }, { "from": 6500668984, "to": 6500668960, "type": "CODE" }, { "from": 6500669005, "to": 6500668989, "type": "CODE" }, { "from": 6500669042, "to": 6500668969, "type": "CODE" }, { "from": 6500669067, "to": 6500669047, "type": "CODE" }, { "from": 6500669088, "to": 6500668994, "type": "CODE" }, { "from": 6500669129, "to": 6500753056, "type": "CALL" }, { "from": 6500669197, "to": 6524006896, "type": "CALL" }, { "from": 6500669239, "to": 6500669052, "type": "CODE" }, { "from": 6500669313, "to": 6500669879, "type": "CODE" }, { "from": 6500669388, "to": 6500669871, "type": "CODE" }, { "from": 6500669417, "to": 6447428352, "type": "CALL" }, { "from": 6500669499, "to": 6500669879, "type": "CODE" }, { "from": 6500669508, "to": 6500670041, "type": "CODE" }, { "from": 6500669540, "to": 6526594288, "type": "CALL" }, { "from": 6500669628, "to": 6500673264, "type": "CALL" }, { "from": 6500669662, "to": 6511512544, "type": "CALL" }, { "from": 6500669700, "to": 6511512544, "type": "CALL" }, { "from": 6500669705, "to": 6500669884, "type": "CODE" }, { "from": 6500669799, "to": 6500669879, "type": "CODE" }, { "from": 6500669879, "to": 6500673264, "type": "CALL" }, { "from": 6500669940, "to": 6524603600, "type": "CALL" }, { "from": 6500669982, "to": 6500667488, "type": "CODE" }, { "from": 6500670094, "to": 6446103440, "type": "CALL" }, { "from": 6500670148, "to": 6447834288, "type": "CALL" }, { "from": 6500670222, "to": 6524006896, "type": "CALL" }, { "from": 6500670290, "to": 6524006896, "type": "CALL" }, { "from": 6500670369, "to": 6500670428, "type": "CODE" }, { "from": 6500670375, "to": 6500670317, "type": "CODE" }, { "from": 6500670383, "to": 6500670423, "type": "CODE" }, { "from": 6500670404, "to": 6542434064, "type": "CALL" }, { "from": 6500670446, "to": 6500670389, "type": "CODE" }, { "from": 6500670473, "to": 6524603600, "type": "CALL" }, { "from": 6500670519, "to": 6511512544, "type": "CALL" }, { "from": 6500670527, "to": 6500670591, "type": "CODE" }, { "from": 6500670536, "to": 6500670545, "type": "CODE" }, { "from": 6500670553, "to": 6526594288, "type": "CALL" }, { "from": 6500670664, "to": 6446103440, "type": "CALL" }, { "from": 6500670718, "to": 6455871936, "type": "CALL" }, { "from": 6500670790, "to": 6471067168, "type": "CALL" }, { "from": 6500670821, "to": 6526594288, "type": "CALL" }, { "from": 6500670868, "to": 6511512544, "type": "CALL" }, { "from": 6500670902, "to": 6500671057, "type": "CODE" }, { "from": 6500670937, "to": 6524603600, "type": "CALL" }, { "from": 6500670983, "to": 6511512544, "type": "CALL" }, { "from": 6500670996, "to": 6500671084, "type": "CODE" }, { "from": 6500671221, "to": 6467786960, "type": "CALL" }, { "from": 6500671262, "to": 6511512544, "type": "CALL" }, { "from": 6500671326, "to": 6536215600, "type": "CALL" }, { "from": 6500671380, "to": 6511512544, "type": "CALL" }, { "from": 6500671460, "to": 6535984912, "type": "CALL" }, { "from": 6500671653, "to": 6500680960, "type": "CALL" }, { "from": 6500671687, "to": 6511512544, "type": "CALL" }, { "from": 6500671728, "to": 6511512544, "type": "CALL" }, { "from": 6500671759, "to": 6511512544, "type": "CALL" }, { "from": 6500671764, "to": 6500669633, "type": "CODE" }, { "from": 6500671793, "to": 6511513840, "type": "CALL" }, { "from": 6500671798, "to": 6500671508, "type": "CODE" }, { "from": 6500671872, "to": 6500673264, "type": "CALL" }, { "from": 6500671902, "to": 6500671699, "type": "CODE" }, { "from": 6500671923, "to": 6500672101, "type": "CODE" }, { "from": 6500672059, "to": 6445284496, "type": "CALL" }, { "from": 6500672145, "to": 6445284496, "type": "CALL" }, { "from": 6500672205, "to": 6445284496, "type": "CALL" }, { "from": 6500672304, "to": 6445284032, "type": "CALL" }, { "from": 6500672358, "to": 6459541808, "type": "CALL" }, { "from": 6500672382, "to": 6500673050, "type": "CODE" }, { "from": 6500672401, "to": 6500672270, "type": "CODE" }, { "from": 6500672413, "to": 6500670545, "type": "CODE" }, { "from": 6500672480, "to": 6500670545, "type": "CODE" }, { "from": 6500672533, "to": 6465812496, "type": "CALL" }, { "from": 6500672583, "to": 6443410976, "type": "CALL" }, { "from": 6500672674, "to": 6500670561, "type": "CODE" }, { "from": 6500672686, "to": 6500670545, "type": "CODE" }, { "from": 6500672711, "to": 6511729936, "type": "CALL" }, { "from": 6500672716, "to": 6500670561, "type": "CODE" }, { "from": 6500672746, "to": 6524603600, "type": "CALL" }, { "from": 6500672792, "to": 6511512544, "type": "CALL" }, { "from": 6500672797, "to": 6500667645, "type": "CODE" }, { "from": 6500672827, "to": 6524603600, "type": "CALL" }, { "from": 6500672873, "to": 6511512544, "type": "CALL" }, { "from": 6500672878, "to": 6500667448, "type": "CODE" }, { "from": 6500672902, "to": 6511512544, "type": "CALL" }, { "from": 6500672907, "to": 6500668104, "type": "CODE" }, { "from": 6500672923, "to": 6517426816, "type": "CALL" }, { "from": 6500672941, "to": 6511512544, "type": "CALL" }, { "from": 6500672946, "to": 6500667628, "type": "CODE" }, { "from": 6500672960, "to": 6500666201, "type": "CODE" }, { "from": 6500672976, "to": 6542089024, "type": "CALL" }, { "from": 6500672987, "to": 6500665365, "type": "CODE" }, { "from": 6500673027, "to": 6511730288, "type": "CALL" }, { "from": 6500673032, "to": 6500670561, "type": "CODE" }, { "from": 6500673042, "to": 6500672984, "type": "CODE" }, { "from": 6500673074, "to": 6500667235, "type": "CODE" }, { "from": 6500673174, "to": 6500668040, "type": "CODE" }, { "from": 6500673203, "to": 6500668213, "type": "CODE" }, { "from": 6500673240, "to": 6511512544, "type": "CALL" }, { "from": 6500673245, "to": 6500673089, "type": "CODE" } ], "datarefs": [ { "from": 6459079736, "to": 6740709440, "type": "DATA" }, { "from": 6459079798, "to": 6740709440, "type": "DATA" }, { "from": 6500664579, "to": 6740709440, "type": "DATA" }, { "from": 6500664660, "to": 6536805536, "type": "DATA" }, { "from": 6500664690, "to": 6723586792, "type": "DATA" }, { "from": 6500664737, "to": 6712142572, "type": "DATA" }, { "from": 6500665029, "to": 6717200800, "type": "DATA" }, { "from": 6500665181, "to": 6717995160, "type": "DATA" }, { "from": 6500665220, "to": 6717995165, "type": "DATA" }, { "from": 6500665239, "to": 6717995160, "type": "DATA" }, { "from": 6500665519, "to": 6723586600, "type": "DATA" }, { "from": 6500665545, "to": 6723586648, "type": "DATA" }, { "from": 6500665603, "to": 6740709440, "type": "DATA" }, { "from": 6500665825, "to": 6715492944, "type": "DATA" }, { "from": 6500665835, "to": 6715492946, "type": "DATA" }, { "from": 6500665901, "to": 6723586712, "type": "DATA" }, { "from": 6500665924, "to": 6723586760, "type": "DATA" }, { "from": 6500665979, "to": 6717987280, "type": "DATA" }, { "from": 6500666140, "to": 6712256868, "type": "DATA" }, { "from": 6500666209, "to": 6723575844, "type": "DATA" }, { "from": 6500666218, "to": 6723575848, "type": "DATA" }, { "from": 6500666575, "to": 6717982672, "type": "DATA" }, { "from": 6500666602, "to": 6717982677, "type": "DATA" }, { "from": 6500666621, "to": 6717982672, "type": "DATA" }, { "from": 6500666946, "to": 6723586340, "type": "DATA" }, { "from": 6500667032, "to": 6723586352, "type": "DATA" }, { "from": 6500667066, "to": 6723586880, "type": "DATA" }, { "from": 6500667092, "to": 6717684432, "type": "DATA" }, { "from": 6500667271, "to": 6723586904, "type": "DATA" }, { "from": 6500667298, "to": 6723586856, "type": "DATA" }, { "from": 6500667374, "to": 6723586808, "type": "DATA" }, { "from": 6500667401, "to": 6723586856, "type": "DATA" }, { "from": 6500667541, "to": 6717173124, "type": "DATA" }, { "from": 6500667665, "to": 6717173124, "type": "DATA" }, { "from": 6500667819, "to": 6723586984, "type": "DATA" }, { "from": 6500667845, "to": 6717684432, "type": "DATA" }, { "from": 6500667876, "to": 6715434912, "type": "DATA" }, { "from": 6500668289, "to": 6723586960, "type": "DATA" }, { "from": 6500668318, "to": 6723586936, "type": "DATA" }, { "from": 6500668345, "to": 6723586856, "type": "DATA" }, { "from": 6500668588, "to": 6723587072, "type": "DATA" }, { "from": 6500668615, "to": 6723587072, "type": "DATA" }, { "from": 6500668723, "to": 6500713472, "type": "DATA" }, { "from": 6500668734, "to": 6488537312, "type": "DATA" }, { "from": 6500668745, "to": 6496570832, "type": "DATA" }, { "from": 6500668756, "to": 6500676960, "type": "DATA" }, { "from": 6500668834, "to": 6723586776, "type": "DATA" }, { "from": 6500669152, "to": 6712481032, "type": "DATA" }, { "from": 6500669244, "to": 6723575608, "type": "DATA" }, { "from": 6500669271, "to": 6723590360, "type": "DATA" }, { "from": 6500669327, "to": 6723587008, "type": "DATA" }, { "from": 6500669354, "to": 6723587040, "type": "DATA" }, { "from": 6500669430, "to": 6723575584, "type": "DATA" }, { "from": 6500669457, "to": 6723590288, "type": "DATA" }, { "from": 6500669525, "to": 6723589792, "type": "DATA" }, { "from": 6500669586, "to": 6723587040, "type": "DATA" }, { "from": 6500669730, "to": 6723587256, "type": "DATA" }, { "from": 6500669757, "to": 6723587304, "type": "DATA" }, { "from": 6500669810, "to": 6723587200, "type": "DATA" }, { "from": 6500669837, "to": 6723587040, "type": "DATA" }, { "from": 6500670111, "to": 6712256868, "type": "DATA" }, { "from": 6500670177, "to": 6712481032, "type": "DATA" }, { "from": 6500670248, "to": 6723589880, "type": "DATA" }, { "from": 6500670529, "to": 6723589904, "type": "DATA" }, { "from": 6500670538, "to": 6723589840, "type": "DATA" }, { "from": 6500670681, "to": 6723589728, "type": "DATA" }, { "from": 6500670806, "to": 6723589744, "type": "DATA" }, { "from": 6500671143, "to": 6723587328, "type": "DATA" }, { "from": 6500671803, "to": 6723587352, "type": "DATA" }, { "from": 6500671830, "to": 6723587040, "type": "DATA" }, { "from": 6500672030, "to": 6723586340, "type": "DATA" }, { "from": 6500672116, "to": 6723586352, "type": "DATA" }, { "from": 6500672150, "to": 6723586880, "type": "DATA" }, { "from": 6500672176, "to": 6717684432, "type": "DATA" }, { "from": 6500672210, "to": 6715434912, "type": "DATA" }, { "from": 6500672406, "to": 6723589952, "type": "DATA" }, { "from": 6500672473, "to": 6723590000, "type": "DATA" }, { "from": 6500672499, "to": 6715110672, "type": "DATA" }, { "from": 6500672679, "to": 6723590064, "type": "DATA" }, { "from": 6500673101, "to": 6712128076, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-loopback-router.json", "source_sha256": "c47985de208b0d268ac9e2241ed64b9609626a2b2d09a28242a74a929ff0abb4", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-loopback-router.txt", "stdout_bytes": 132616, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837844e0;pdgo @ 0x1837844e0;afij @ 0x1837844e0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837844e0;pdgo @ 0x1837844e0;afij @ 0x1837844e0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-model-providers", "analyst_label": "Action 候选；反编译失败，仅元数据和数据引用", "label_is_original_symbol": false, "evidence_id": "ev_85fbf7c4c924e753a1ca2f774b2cf8f75f4f383f66143dc0b49c2036bc5cdd41", "address": "0x18379a130", "function": { "address": "0x18379a130", "size": 13567, "name": "fcn.18379a130", "signature": "fcn.18379a130(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg_28h);", "callrefs": [ { "from": 6500753831, "to": 6542067384, "type": "CALL" }, { "from": 6500754011, "to": 6740346544, "type": "CALL" }, { "from": 6500754029, "to": 6740346544, "type": "CALL" }, { "from": 6500754092, "to": 6500754494, "type": "CODE" }, { "from": 6500754124, "to": 6500752304, "type": "CALL" }, { "from": 6500754173, "to": 6740346544, "type": "CALL" }, { "from": 6500754191, "to": 6740346544, "type": "CALL" }, { "from": 6500754254, "to": 6500754494, "type": "CODE" }, { "from": 6500754417, "to": 6740346544, "type": "CALL" }, { "from": 6500754435, "to": 6740346544, "type": "CALL" }, { "from": 6500754494, "to": 6511512544, "type": "CALL" }, { "from": 6500754522, "to": 6511512544, "type": "CALL" }, { "from": 6500754581, "to": 6740346544, "type": "CALL" }, { "from": 6500754587, "to": 6500754544, "type": "CODE" }, { "from": 6500754610, "to": 6524603600, "type": "CALL" }, { "from": 6500754643, "to": 6511512544, "type": "CALL" }, { "from": 6500754648, "to": 6500754535, "type": "CODE" }, { "from": 6500754675, "to": 6524603600, "type": "CALL" }, { "from": 6500754721, "to": 6511512544, "type": "CALL" }, { "from": 6500754726, "to": 6500754458, "type": "CODE" }, { "from": 6500754746, "to": 6511513840, "type": "CALL" }, { "from": 6500754751, "to": 6500754929, "type": "CODE" }, { "from": 6500754772, "to": 6500754929, "type": "CODE" }, { "from": 6500754859, "to": 6447834288, "type": "CALL" }, { "from": 6500754891, "to": 6447834288, "type": "CALL" }, { "from": 6500754976, "to": 6500754978, "type": "CODE" }, { "from": 6500754976, "to": 6500755056, "type": "CODE" }, { "from": 6500754976, "to": 6500755101, "type": "CODE" }, { "from": 6500754976, "to": 6500755314, "type": "CODE" }, { "from": 6500754976, "to": 6500755353, "type": "CODE" }, { "from": 6500755051, "to": 6500755349, "type": "CODE" }, { "from": 6500755096, "to": 6500755349, "type": "CODE" }, { "from": 6500755170, "to": 6542067384, "type": "CALL" }, { "from": 6500755304, "to": 6500753440, "type": "CALL" }, { "from": 6500755309, "to": 6500755781, "type": "CODE" }, { "from": 6500755372, "to": 6447428352, "type": "CALL" }, { "from": 6500755429, "to": 6500755431, "type": "CODE" }, { "from": 6500755429, "to": 6500755518, "type": "CODE" }, { "from": 6500755429, "to": 6500755826, "type": "CODE" }, { "from": 6500755429, "to": 6500755868, "type": "CODE" }, { "from": 6500755429, "to": 6500756174, "type": "CODE" }, { "from": 6500755429, "to": 6500757284, "type": "CODE" }, { "from": 6500755429, "to": 6500763035, "type": "CODE" }, { "from": 6500755513, "to": 6500755868, "type": "CODE" }, { "from": 6500755542, "to": 6500755868, "type": "CODE" }, { "from": 6500755699, "to": 6740346544, "type": "CALL" }, { "from": 6500755717, "to": 6740346544, "type": "CALL" }, { "from": 6500755776, "to": 6511512544, "type": "CALL" }, { "from": 6500755821, "to": 6500754494, "type": "CODE" }, { "from": 6500756007, "to": 6740346544, "type": "CALL" }, { "from": 6500756025, "to": 6740346544, "type": "CALL" }, { "from": 6500756088, "to": 6500755776, "type": "CODE" }, { "from": 6500756118, "to": 6524603600, "type": "CALL" }, { "from": 6500756164, "to": 6511512544, "type": "CALL" }, { "from": 6500756169, "to": 6500755740, "type": "CODE" }, { "from": 6500756220, "to": 6542067384, "type": "CALL" }, { "from": 6500756323, "to": 6447834288, "type": "CALL" }, { "from": 6500756365, "to": 6447834288, "type": "CALL" }, { "from": 6500756442, "to": 6455871936, "type": "CALL" }, { "from": 6500756452, "to": 6542067384, "type": "CALL" }, { "from": 6500756608, "to": 6475530592, "type": "CALL" }, { "from": 6500756645, "to": 6624433168, "type": "CALL" }, { "from": 6500756752, "to": 6500774608, "type": "CALL" }, { "from": 6500756807, "to": 6511512544, "type": "CALL" }, { "from": 6500756850, "to": 6740346544, "type": "CALL" }, { "from": 6500756899, "to": 6500755776, "type": "CODE" }, { "from": 6500756928, "to": 6511513840, "type": "CALL" }, { "from": 6500756933, "to": 6500756730, "type": "CODE" }, { "from": 6500756969, "to": 6511512544, "type": "CALL" }, { "from": 6500756974, "to": 6500756420, "type": "CODE" }, { "from": 6500756996, "to": 6511513840, "type": "CALL" }, { "from": 6500757001, "to": 6500756411, "type": "CODE" }, { "from": 6500757017, "to": 6535984912, "type": "CALL" }, { "from": 6500757022, "to": 6500756373, "type": "CODE" }, { "from": 6500757049, "to": 6524603600, "type": "CALL" }, { "from": 6500757086, "to": 6511512544, "type": "CALL" }, { "from": 6500757091, "to": 6500756771, "type": "CODE" }, { "from": 6500757115, "to": 6500755781, "type": "CODE" }, { "from": 6500757145, "to": 6524603600, "type": "CALL" }, { "from": 6500757191, "to": 6511512544, "type": "CALL" }, { "from": 6500757196, "to": 6500756048, "type": "CODE" }, { "from": 6500757228, "to": 6524603600, "type": "CALL" }, { "from": 6500757274, "to": 6511512544, "type": "CALL" }, { "from": 6500757279, "to": 6500757557, "type": "CODE" }, { "from": 6500757380, "to": 6500755868, "type": "CODE" }, { "from": 6500757428, "to": 6500777456, "type": "CALL" }, { "from": 6500757516, "to": 6740346544, "type": "CALL" }, { "from": 6500757534, "to": 6740346544, "type": "CALL" }, { "from": 6500757597, "to": 6500755776, "type": "CODE" }, { "from": 6500757640, "to": 6500757653, "type": "CODE" }, { "from": 6500757667, "to": 6500757677, "type": "CODE" }, { "from": 6500757690, "to": 6542434064, "type": "CALL" }, { "from": 6500757705, "to": 6500757648, "type": "CODE" }, { "from": 6500757710, "to": 6500757722, "type": "CODE" }, { "from": 6500757715, "to": 6500757726, "type": "CODE" }, { "from": 6500757762, "to": 6447834288, "type": "CALL" }, { "from": 6500757923, "to": 6740346544, "type": "CALL" }, { "from": 6500757941, "to": 6740346544, "type": "CALL" }, { "from": 6500758000, "to": 6500755776, "type": "CODE" }, { "from": 6500758030, "to": 6524603600, "type": "CALL" }, { "from": 6500758076, "to": 6511512544, "type": "CALL" }, { "from": 6500758081, "to": 6500757960, "type": "CODE" }, { "from": 6500758110, "to": 6524603600, "type": "CALL" }, { "from": 6500758150, "to": 6511512544, "type": "CALL" }, { "from": 6500758160, "to": 6500758524, "type": "CODE" }, { "from": 6500758182, "to": 6542067384, "type": "CALL" }, { "from": 6500758218, "to": 6500758674, "type": "CODE" }, { "from": 6500758256, "to": 6545851008, "type": "CALL" }, { "from": 6500758315, "to": 6455871936, "type": "CALL" }, { "from": 6500758409, "to": 6475530592, "type": "CALL" }, { "from": 6500758460, "to": 6471067168, "type": "CALL" }, { "from": 6500758710, "to": 6542436672, "type": "CALL" }, { "from": 6500758766, "to": 6542067384, "type": "CALL" }, { "from": 6500758906, "to": 6512942288, "type": "CALL" }, { "from": 6500758943, "to": 6457304048, "type": "CALL" }, { "from": 6500759025, "to": 6740346544, "type": "CALL" }, { "from": 6500759044, "to": 6740346544, "type": "CALL" }, { "from": 6500759099, "to": 6511512544, "type": "CALL" }, { "from": 6500759118, "to": 6500790960, "type": "CALL" }, { "from": 6500759131, "to": 6511512544, "type": "CALL" }, { "from": 6500759176, "to": 6500755776, "type": "CODE" }, { "from": 6500759206, "to": 6524603600, "type": "CALL" }, { "from": 6500759252, "to": 6511512544, "type": "CALL" }, { "from": 6500759262, "to": 6500759063, "type": "CODE" }, { "from": 6500759280, "to": 6500759319, "type": "CODE" }, { "from": 6500759294, "to": 6520862464, "type": "CALL" }, { "from": 6500759349, "to": 6542434064, "type": "CALL" }, { "from": 6500759358, "to": 6500759282, "type": "CODE" }, { "from": 6500759368, "to": 6500759338, "type": "CODE" }, { "from": 6500759408, "to": 6500759454, "type": "CODE" }, { "from": 6500759435, "to": 6500777456, "type": "CALL" }, { "from": 6500759468, "to": 6500759410, "type": "CODE" }, { "from": 6500759495, "to": 6524603600, "type": "CALL" }, { "from": 6500759541, "to": 6511512544, "type": "CALL" }, { "from": 6500759546, "to": 6500754052, "type": "CODE" }, { "from": 6500759576, "to": 6524603600, "type": "CALL" }, { "from": 6500759622, "to": 6511512544, "type": "CALL" }, { "from": 6500759627, "to": 6500754214, "type": "CODE" }, { "from": 6500759653, "to": 6500759914, "type": "CODE" }, { "from": 6500759684, "to": 6524007984, "type": "CALL" }, { "from": 6500759721, "to": 6524007984, "type": "CALL" }, { "from": 6500759755, "to": 6524007984, "type": "CALL" }, { "from": 6500759794, "to": 6524007984, "type": "CALL" }, { "from": 6500759836, "to": 6443410976, "type": "CALL" }, { "from": 6500759873, "to": 6443410976, "type": "CALL" }, { "from": 6500759951, "to": 6542434272, "type": "CALL" }, { "from": 6500760128, "to": 6500760475, "type": "CODE" }, { "from": 6500760141, "to": 6511396000, "type": "CALL" }, { "from": 6500760283, "to": 6740346544, "type": "CALL" }, { "from": 6500760301, "to": 6740346544, "type": "CALL" }, { "from": 6500760360, "to": 6500754494, "type": "CODE" }, { "from": 6500760389, "to": 6500760024, "type": "CODE" }, { "from": 6500760419, "to": 6524603600, "type": "CALL" }, { "from": 6500760465, "to": 6511512544, "type": "CALL" }, { "from": 6500760470, "to": 6500760320, "type": "CODE" }, { "from": 6500760609, "to": 6515567520, "type": "CALL" }, { "from": 6500760715, "to": 6511645120, "type": "CALL" }, { "from": 6500760780, "to": 6500760811, "type": "CODE" }, { "from": 6500760855, "to": 6524007984, "type": "CALL" }, { "from": 6500760881, "to": 6500760801, "type": "CODE" }, { "from": 6500760995, "to": 6500761038, "type": "CODE" }, { "from": 6500761011, "to": 6542434064, "type": "CALL" }, { "from": 6500761094, "to": 6524007984, "type": "CALL" }, { "from": 6500761152, "to": 6500760997, "type": "CODE" }, { "from": 6500761176, "to": 6511513840, "type": "CALL" }, { "from": 6500761181, "to": 6500755277, "type": "CODE" }, { "from": 6500761198, "to": 6511512544, "type": "CALL" }, { "from": 6500761203, "to": 6500761264, "type": "CODE" }, { "from": 6500761323, "to": 6511512544, "type": "CALL" }, { "from": 6500761328, "to": 6500761976, "type": "CODE" }, { "from": 6500761367, "to": 6740346544, "type": "CALL" }, { "from": 6500761402, "to": 6524007200, "type": "CALL" }, { "from": 6500761413, "to": 6526592128, "type": "CALL" }, { "from": 6500761464, "to": 6455871936, "type": "CALL" }, { "from": 6500761491, "to": 6740346544, "type": "CALL" }, { "from": 6500761564, "to": 6447968000, "type": "CALL" }, { "from": 6500761628, "to": 6500759324, "type": "CODE" }, { "from": 6500761780, "to": 6740346544, "type": "CALL" }, { "from": 6500761798, "to": 6740346544, "type": "CALL" }, { "from": 6500761857, "to": 6500762421, "type": "CODE" }, { "from": 6500761887, "to": 6524603600, "type": "CALL" }, { "from": 6500761933, "to": 6511512544, "type": "CALL" }, { "from": 6500761938, "to": 6500761817, "type": "CODE" }, { "from": 6500761952, "to": 6511513840, "type": "CALL" }, { "from": 6500761957, "to": 6500762070, "type": "CODE" }, { "from": 6500762007, "to": 6740346544, "type": "CALL" }, { "from": 6500762042, "to": 6512481968, "type": "CALL" }, { "from": 6500762172, "to": 6500752304, "type": "CALL" }, { "from": 6500762209, "to": 6475529648, "type": "CALL" }, { "from": 6500762295, "to": 6740346544, "type": "CALL" }, { "from": 6500762313, "to": 6740346544, "type": "CALL" }, { "from": 6500762372, "to": 6511512544, "type": "CALL" }, { "from": 6500762421, "to": 6511512544, "type": "CALL" }, { "from": 6500762462, "to": 6524603600, "type": "CALL" }, { "from": 6500762499, "to": 6500755776, "type": "CODE" }, { "from": 6500762522, "to": 6500753056, "type": "CALL" }, { "from": 6500762549, "to": 6740346544, "type": "CALL" }, { "from": 6500762592, "to": 6536691232, "type": "CALL" }, { "from": 6500762622, "to": 6447968000, "type": "CALL" }, { "from": 6500762630, "to": 6500762142, "type": "CODE" }, { "from": 6500762660, "to": 6524603600, "type": "CALL" }, { "from": 6500762706, "to": 6511512544, "type": "CALL" }, { "from": 6500762711, "to": 6500762336, "type": "CODE" }, { "from": 6500762741, "to": 6524603600, "type": "CALL" }, { "from": 6500762787, "to": 6511512544, "type": "CALL" }, { "from": 6500762792, "to": 6500762394, "type": "CODE" }, { "from": 6500762818, "to": 6511729936, "type": "CALL" }, { "from": 6500762863, "to": 6511512544, "type": "CALL" }, { "from": 6500762868, "to": 6500763895, "type": "CODE" }, { "from": 6500762898, "to": 6524603600, "type": "CALL" }, { "from": 6500762944, "to": 6511512544, "type": "CALL" }, { "from": 6500762949, "to": 6500763547, "type": "CODE" }, { "from": 6500762979, "to": 6524603600, "type": "CALL" }, { "from": 6500763025, "to": 6511512544, "type": "CALL" }, { "from": 6500763030, "to": 6500763279, "type": "CODE" }, { "from": 6500763238, "to": 6740346544, "type": "CALL" }, { "from": 6500763256, "to": 6740346544, "type": "CALL" }, { "from": 6500763319, "to": 6500755776, "type": "CODE" }, { "from": 6500763329, "to": 6542067384, "type": "CALL" }, { "from": 6500763506, "to": 6740346544, "type": "CALL" }, { "from": 6500763524, "to": 6740346544, "type": "CALL" }, { "from": 6500763587, "to": 6500755776, "type": "CODE" }, { "from": 6500763604, "to": 6511513840, "type": "CALL" }, { "from": 6500763609, "to": 6500763726, "type": "CODE" }, { "from": 6500763634, "to": 6740346544, "type": "CALL" }, { "from": 6500763698, "to": 6512481968, "type": "CALL" }, { "from": 6500763765, "to": 6536215600, "type": "CALL" }, { "from": 6500763816, "to": 6511512544, "type": "CALL" }, { "from": 6500763841, "to": 6535984912, "type": "CALL" }, { "from": 6500763942, "to": 6536691232, "type": "CALL" }, { "from": 6500763969, "to": 6447968000, "type": "CALL" }, { "from": 6500764005, "to": 6535984912, "type": "CALL" }, { "from": 6500764101, "to": 6500616272, "type": "CALL" }, { "from": 6500764166, "to": 6542067384, "type": "CALL" }, { "from": 6500764314, "to": 6487939808, "type": "CALL" }, { "from": 6500764386, "to": 6475530592, "type": "CALL" }, { "from": 6500764419, "to": 6447834288, "type": "CALL" }, { "from": 6500764455, "to": 6447834288, "type": "CALL" }, { "from": 6500764490, "to": 6500764770, "type": "CODE" }, { "from": 6500764511, "to": 6511513840, "type": "CALL" }, { "from": 6500764516, "to": 6500764262, "type": "CODE" }, { "from": 6500764539, "to": 6511513840, "type": "CALL" }, { "from": 6500764582, "to": 6511512544, "type": "CALL" }, { "from": 6500764587, "to": 6500764055, "type": "CODE" }, { "from": 6500764614, "to": 6524603600, "type": "CALL" }, { "from": 6500764651, "to": 6511512544, "type": "CALL" }, { "from": 6500764656, "to": 6500764120, "type": "CODE" }, { "from": 6500764673, "to": 6511513840, "type": "CALL" }, { "from": 6500764678, "to": 6500764770, "type": "CODE" }, { "from": 6500764704, "to": 6511513840, "type": "CALL" }, { "from": 6500764709, "to": 6500764920, "type": "CODE" }, { "from": 6500764799, "to": 6475530272, "type": "CALL" }, { "from": 6500764832, "to": 6624433168, "type": "CALL" }, { "from": 6500764942, "to": 6500774608, "type": "CALL" }, { "from": 6500764980, "to": 6511512544, "type": "CALL" }, { "from": 6500765109, "to": 6475530592, "type": "CALL" }, { "from": 6500765188, "to": 6740346544, "type": "CALL" }, { "from": 6500765206, "to": 6740346544, "type": "CALL" }, { "from": 6500765265, "to": 6511512544, "type": "CALL" }, { "from": 6500765320, "to": 6511512544, "type": "CALL" }, { "from": 6500765356, "to": 6500755776, "type": "CODE" }, { "from": 6500765383, "to": 6524603600, "type": "CALL" }, { "from": 6500765420, "to": 6511512544, "type": "CALL" }, { "from": 6500765425, "to": 6500764999, "type": "CODE" }, { "from": 6500765452, "to": 6524603600, "type": "CALL" }, { "from": 6500765489, "to": 6511512544, "type": "CALL" }, { "from": 6500765494, "to": 6500765284, "type": "CODE" }, { "from": 6500765524, "to": 6524603600, "type": "CALL" }, { "from": 6500765570, "to": 6511512544, "type": "CALL" }, { "from": 6500765575, "to": 6500765229, "type": "CODE" }, { "from": 6500765591, "to": 6500765617, "type": "CODE" }, { "from": 6500765642, "to": 6511735152, "type": "CALL" }, { "from": 6500765651, "to": 6597107904, "type": "CALL" }, { "from": 6500765664, "to": 6511512544, "type": "CALL" }, { "from": 6500765669, "to": 6500765954, "type": "CODE" }, { "from": 6500765699, "to": 6524603600, "type": "CALL" }, { "from": 6500765745, "to": 6511512544, "type": "CALL" }, { "from": 6500765750, "to": 6500766110, "type": "CODE" }, { "from": 6500765791, "to": 6545851008, "type": "CALL" }, { "from": 6500765860, "to": 6526592128, "type": "CALL" }, { "from": 6500765894, "to": 6465812496, "type": "CALL" }, { "from": 6500765941, "to": 6465812496, "type": "CALL" }, { "from": 6500766069, "to": 6740346544, "type": "CALL" }, { "from": 6500766087, "to": 6740346544, "type": "CALL" }, { "from": 6500766146, "to": 6511512544, "type": "CALL" }, { "from": 6500766193, "to": 6524603600, "type": "CALL" }, { "from": 6500766235, "to": 6500762495, "type": "CODE" }, { "from": 6500766379, "to": 6740346544, "type": "CALL" }, { "from": 6500766397, "to": 6740346544, "type": "CALL" }, { "from": 6500766456, "to": 6500755776, "type": "CODE" }, { "from": 6500766486, "to": 6524603600, "type": "CALL" }, { "from": 6500766532, "to": 6511512544, "type": "CALL" }, { "from": 6500766537, "to": 6500766416, "type": "CODE" }, { "from": 6500766542, "to": 6740346544, "type": "CALL" }, { "from": 6500766548, "to": 6500755781, "type": "CODE" }, { "from": 6500766590, "to": 6511645120, "type": "CALL" }, { "from": 6500766774, "to": 6500760133, "type": "CODE" }, { "from": 6500766791, "to": 6500766801, "type": "CODE" }, { "from": 6500766834, "to": 6500760133, "type": "CODE" }, { "from": 6500766862, "to": 6511396000, "type": "CALL" }, { "from": 6500766912, "to": 6542067384, "type": "CALL" }, { "from": 6500767033, "to": 6500753440, "type": "CALL" }, { "from": 6500767038, "to": 6500754499, "type": "CODE" }, { "from": 6500767075, "to": 6511730288, "type": "CALL" }, { "from": 6500767080, "to": 6500762823, "type": "CODE" }, { "from": 6500767110, "to": 6543545728, "type": "CALL" }, { "from": 6500767139, "to": 6500759983, "type": "CODE" }, { "from": 6500767170, "to": 6542753360, "type": "CALL" }, { "from": 6500767182, "to": 6542753360, "type": "CALL" }, { "from": 6500767193, "to": 6542702416, "type": "CALL" }, { "from": 6500767262, "to": 6511512544, "type": "CALL" }, { "from": 6500767267, "to": 6500758510, "type": "CODE" } ], "datarefs": [ { "from": 6500753791, "to": 6715116816, "type": "DATA" }, { "from": 6500753887, "to": 6723591480, "type": "DATA" }, { "from": 6500753916, "to": 6723591480, "type": "DATA" }, { "from": 6500754271, "to": 6723591464, "type": "DATA" }, { "from": 6500754795, "to": 6722309428, "type": "DATA" }, { "from": 6500754830, "to": 6712172456, "type": "DATA" }, { "from": 6500754962, "to": 6723592244, "type": "DATA" }, { "from": 6500754991, "to": 6712106800, "type": "DATA" }, { "from": 6500755003, "to": 6712106804, "type": "DATA" }, { "from": 6500755027, "to": 6717993284, "type": "DATA" }, { "from": 6500755038, "to": 6717993288, "type": "DATA" }, { "from": 6500755113, "to": 6722409452, "type": "DATA" }, { "from": 6500755184, "to": 6500781504, "type": "DATA" }, { "from": 6500755195, "to": 6496672176, "type": "DATA" }, { "from": 6500755206, "to": 6496570832, "type": "DATA" }, { "from": 6500755217, "to": 6500773280, "type": "DATA" }, { "from": 6500755327, "to": 6718381312, "type": "DATA" }, { "from": 6500755337, "to": 6718381320, "type": "DATA" }, { "from": 6500755415, "to": 6723592276, "type": "DATA" }, { "from": 6500755530, "to": 6716197176, "type": "DATA" }, { "from": 6500755559, "to": 6723590288, "type": "DATA" }, { "from": 6500755594, "to": 6723590301, "type": "DATA" }, { "from": 6500755609, "to": 6723590288, "type": "DATA" }, { "from": 6500755880, "to": 6723591712, "type": "DATA" }, { "from": 6500755915, "to": 6723591712, "type": "DATA" }, { "from": 6500756187, "to": 6718381312, "type": "DATA" }, { "from": 6500756197, "to": 6718381320, "type": "DATA" }, { "from": 6500756238, "to": 6706951120, "type": "DATA" }, { "from": 6500756294, "to": 6717231776, "type": "DATA" }, { "from": 6500756466, "to": 6500782512, "type": "DATA" }, { "from": 6500756477, "to": 6500783280, "type": "DATA" }, { "from": 6500756488, "to": 6511490512, "type": "DATA" }, { "from": 6500756577, "to": 6712262740, "type": "DATA" }, { "from": 6500756613, "to": 6715262400, "type": "DATA" }, { "from": 6500756875, "to": 6545635632, "type": "DATA" }, { "from": 6500757296, "to": 6717218980, "type": "DATA" }, { "from": 6500757306, "to": 6717218984, "type": "DATA" }, { "from": 6500757326, "to": 6717993284, "type": "DATA" }, { "from": 6500757336, "to": 6717993288, "type": "DATA" }, { "from": 6500757352, "to": 6717173124, "type": "DATA" }, { "from": 6500757362, "to": 6717173128, "type": "DATA" }, { "from": 6500757733, "to": 6717218980, "type": "DATA" }, { "from": 6500757796, "to": 6723591552, "type": "DATA" }, { "from": 6500757831, "to": 6723591552, "type": "DATA" }, { "from": 6500758289, "to": 6715437472, "type": "DATA" }, { "from": 6500758728, "to": 6712087500, "type": "DATA" }, { "from": 6500758780, "to": 6500782288, "type": "DATA" }, { "from": 6500758791, "to": 6500782400, "type": "DATA" }, { "from": 6500758802, "to": 6511490512, "type": "DATA" }, { "from": 6500758813, "to": 6500791104, "type": "DATA" }, { "from": 6500758878, "to": 6717886544, "type": "DATA" }, { "from": 6500758885, "to": 6723591648, "type": "DATA" }, { "from": 6500758911, "to": 6742242256, "type": "DATA" }, { "from": 6500758933, "to": 6723591642, "type": "DATA" }, { "from": 6500759658, "to": 6712172456, "type": "DATA" }, { "from": 6500759692, "to": 6712172464, "type": "DATA" }, { "from": 6500759729, "to": 6723591792, "type": "DATA" }, { "from": 6500759765, "to": 6712258620, "type": "DATA" }, { "from": 6500759807, "to": 6717173124, "type": "DATA" }, { "from": 6500759844, "to": 6723590616, "type": "DATA" }, { "from": 6500759944, "to": 6723579872, "type": "DATA" }, { "from": 6500760158, "to": 6723590264, "type": "DATA" }, { "from": 6500760193, "to": 6723590264, "type": "DATA" }, { "from": 6500760681, "to": 6715409368, "type": "DATA" }, { "from": 6500760822, "to": 6712172456, "type": "DATA" }, { "from": 6500761067, "to": 6712172456, "type": "DATA" }, { "from": 6500761373, "to": 6723233416, "type": "DATA" }, { "from": 6500761645, "to": 6723591512, "type": "DATA" }, { "from": 6500761680, "to": 6723591512, "type": "DATA" }, { "from": 6500762013, "to": 6720256624, "type": "DATA" }, { "from": 6500762112, "to": 6723575844, "type": "DATA" }, { "from": 6500762122, "to": 6723575848, "type": "DATA" }, { "from": 6500762177, "to": 6723591536, "type": "DATA" }, { "from": 6500762558, "to": 6712105968, "type": "DATA" }, { "from": 6500763047, "to": 6718148564, "type": "DATA" }, { "from": 6500763056, "to": 6718148568, "type": "DATA" }, { "from": 6500763099, "to": 6723591576, "type": "DATA" }, { "from": 6500763385, "to": 6723591592, "type": "DATA" }, { "from": 6500763414, "to": 6723591603, "type": "DATA" }, { "from": 6500763425, "to": 6723591592, "type": "DATA" }, { "from": 6500763611, "to": 6741850168, "type": "DATA" }, { "from": 6500763669, "to": 6723233784, "type": "DATA" }, { "from": 6500764180, "to": 6500781696, "type": "DATA" }, { "from": 6500764191, "to": 6496449792, "type": "DATA" }, { "from": 6500764202, "to": 6511490512, "type": "DATA" }, { "from": 6500764281, "to": 6712262740, "type": "DATA" }, { "from": 6500764307, "to": 6718148564, "type": "DATA" }, { "from": 6500764355, "to": 6715509752, "type": "DATA" }, { "from": 6500764394, "to": 6723591624, "type": "DATA" }, { "from": 6500764723, "to": 6723591636, "type": "DATA" }, { "from": 6500764804, "to": 6715262400, "type": "DATA" }, { "from": 6500765083, "to": 6716731936, "type": "DATA" }, { "from": 6500765865, "to": 6712481092, "type": "DATA" }, { "from": 6500765907, "to": 6712192108, "type": "DATA" }, { "from": 6500766252, "to": 6723591552, "type": "DATA" }, { "from": 6500766287, "to": 6723591552, "type": "DATA" }, { "from": 6500766553, "to": 6715409360, "type": "DATA" }, { "from": 6500766707, "to": 6712687008, "type": "DATA" }, { "from": 6500766719, "to": 6712687016, "type": "DATA" }, { "from": 6500766744, "to": 6717683880, "type": "DATA" }, { "from": 6500766756, "to": 6717683888, "type": "DATA" }, { "from": 6500766804, "to": 6723431420, "type": "DATA" }, { "from": 6500766814, "to": 6723431424, "type": "DATA" }, { "from": 6500766923, "to": 6500781312, "type": "DATA" }, { "from": 6500766934, "to": 6500247088, "type": "DATA" }, { "from": 6500766945, "to": 6496570832, "type": "DATA" }, { "from": 6500766956, "to": 6500767296, "type": "DATA" }, { "from": 6500767103, "to": 6712088560, "type": "DATA" }, { "from": 6500767163, "to": 6712084152, "type": "DATA" }, { "from": 6500767175, "to": 6712084184, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-model-providers.json", "source_sha256": "19afd6a8ee3b2a767ab026ab58abf2ad7f92117c1fdf4a3dec631cce64bba6fa", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-model-providers.txt", "stdout_bytes": 45052, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nGhidra Decompiler Error: Conditional execution: Illegal op in iblock\r\n", "status": "failed-decompilation", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18379a130;pdgo @ 0x18379a130;afij @ 0x18379a130", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18379a130;pdgo @ 0x18379a130;afij @ 0x18379a130", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-observer-owner", "analyst_label": "Agent 服务构造并持有标签观察者", "label_is_original_symbol": false, "evidence_id": "ev_ab6dfec52dad0a0c69870f605a2ffdcc08bb2684faba55b4f8a9c5797648069f", "address": "0x1837dfd50", "function": { "address": "0x1837dfd50", "size": 236, "name": "fcn.1837dfd50", "signature": "fcn.1837dfd50(int64_t arg1, int64_t arg2);", "callrefs": [ { "from": 6501039488, "to": 6511423872, "type": "CALL" }, { "from": 6501039517, "to": 6542434496, "type": "CALL" }, { "from": 6501039550, "to": 6542067384, "type": "CALL" }, { "from": 6501039610, "to": 6542067384, "type": "CALL" }, { "from": 6501039627, "to": 6501145904, "type": "CALL" }, { "from": 6501039656, "to": 6501155120, "type": "CALL" } ], "datarefs": [ { "from": 6501039453, "to": 6707913208, "type": "DATA" }, { "from": 6501039476, "to": 6741126408, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-observer-owner.json", "source_sha256": "f20d214041ad3cbcb33cc7b803b9a0a7b3defb34de6052c0dde1deccc47bb693", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-observer-owner.txt", "stdout_bytes": 3510, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837dfd50;pdgo @ 0x1837dfd50;afij @ 0x1837dfd50", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837dfd50;pdgo @ 0x1837dfd50;afij @ 0x1837dfd50", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-provider-persist", "analyst_label": "提供者凭据及模型配置持久化回调", "label_is_original_symbol": false, "evidence_id": "ev_398fd7432fd2bfb99c9a89e83d490d634037a333fb34f882ceb83a8d461c8d2e", "address": "0x18379d640", "function": { "address": "0x18379d640", "size": 5973, "name": "fcn.18379d640", "signature": "fcn.18379d640(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_30h, int64_t arg_38h, int64_t arg_47h);", "callrefs": [ { "from": 6500767412, "to": 6500767422, "type": "CODE" }, { "from": 6500767426, "to": 6500767473, "type": "CODE" }, { "from": 6500767445, "to": 6542434064, "type": "CALL" }, { "from": 6500767491, "to": 6500767432, "type": "CODE" }, { "from": 6500767576, "to": 6458655680, "type": "CALL" }, { "from": 6500767627, "to": 6500768225, "type": "CODE" }, { "from": 6500767647, "to": 6542067384, "type": "CALL" }, { "from": 6500767820, "to": 6740346544, "type": "CALL" }, { "from": 6500767838, "to": 6740346544, "type": "CALL" }, { "from": 6500767890, "to": 6511512544, "type": "CALL" }, { "from": 6500767932, "to": 6491075136, "type": "CALL" }, { "from": 6500768001, "to": 6740346544, "type": "CALL" }, { "from": 6500768007, "to": 6500767913, "type": "CODE" }, { "from": 6500768031, "to": 6524603600, "type": "CALL" }, { "from": 6500768067, "to": 6511512544, "type": "CALL" }, { "from": 6500768072, "to": 6500767904, "type": "CODE" }, { "from": 6500768102, "to": 6524603600, "type": "CALL" }, { "from": 6500768148, "to": 6511512544, "type": "CALL" }, { "from": 6500768153, "to": 6500767861, "type": "CODE" }, { "from": 6500768164, "to": 6517427136, "type": "CALL" }, { "from": 6500768180, "to": 6542435920, "type": "CALL" }, { "from": 6500768202, "to": 6524601328, "type": "CALL" }, { "from": 6500768210, "to": 6517426608, "type": "CALL" }, { "from": 6500768249, "to": 6542435920, "type": "CALL" }, { "from": 6500768270, "to": 6525627664, "type": "CALL" }, { "from": 6500768280, "to": 6500768158, "type": "CODE" }, { "from": 6500768344, "to": 6443410976, "type": "CALL" }, { "from": 6500768429, "to": 6500768617, "type": "CODE" }, { "from": 6500768440, "to": 6517427136, "type": "CALL" }, { "from": 6500768456, "to": 6542435920, "type": "CALL" }, { "from": 6500768478, "to": 6524601328, "type": "CALL" }, { "from": 6500768486, "to": 6517426608, "type": "CALL" }, { "from": 6500768539, "to": 6542435920, "type": "CALL" }, { "from": 6500768558, "to": 6525627664, "type": "CALL" }, { "from": 6500768568, "to": 6500768434, "type": "CODE" }, { "from": 6500768584, "to": 6462063728, "type": "CALL" }, { "from": 6500768639, "to": 6500768501, "type": "CODE" }, { "from": 6500768669, "to": 6524603600, "type": "CALL" }, { "from": 6500768715, "to": 6511512544, "type": "CALL" }, { "from": 6500768720, "to": 6500768602, "type": "CODE" }, { "from": 6500768731, "to": 6500767464, "type": "CODE" }, { "from": 6500768761, "to": 6524603600, "type": "CALL" }, { "from": 6500768807, "to": 6511512544, "type": "CALL" }, { "from": 6500768812, "to": 6500769528, "type": "CODE" }, { "from": 6500768832, "to": 6511513840, "type": "CALL" }, { "from": 6500768837, "to": 6500768998, "type": "CODE" }, { "from": 6500768887, "to": 6445826592, "type": "CALL" }, { "from": 6500768903, "to": 6445354896, "type": "CALL" }, { "from": 6500768960, "to": 6447834288, "type": "CALL" }, { "from": 6500769032, "to": 6740346544, "type": "CALL" }, { "from": 6500769067, "to": 6524007200, "type": "CALL" }, { "from": 6500769118, "to": 6523198896, "type": "CALL" }, { "from": 6500769192, "to": 6447008784, "type": "CALL" }, { "from": 6500769250, "to": 6471067168, "type": "CALL" }, { "from": 6500769487, "to": 6740346544, "type": "CALL" }, { "from": 6500769505, "to": 6740346544, "type": "CALL" }, { "from": 6500769557, "to": 6511512544, "type": "CALL" }, { "from": 6500769601, "to": 6511512544, "type": "CALL" }, { "from": 6500769635, "to": 6511512544, "type": "CALL" }, { "from": 6500769688, "to": 6517426608, "type": "CALL" }, { "from": 6500769693, "to": 6500767895, "type": "CODE" }, { "from": 6500769709, "to": 6517426816, "type": "CALL" }, { "from": 6500769725, "to": 6511512544, "type": "CALL" }, { "from": 6500769730, "to": 6500769653, "type": "CODE" }, { "from": 6500769757, "to": 6524603600, "type": "CALL" }, { "from": 6500769803, "to": 6511512544, "type": "CALL" }, { "from": 6500769808, "to": 6500769666, "type": "CODE" }, { "from": 6500769970, "to": 6740346544, "type": "CALL" }, { "from": 6500769988, "to": 6740346544, "type": "CALL" }, { "from": 6500770040, "to": 6500769601, "type": "CODE" }, { "from": 6500770070, "to": 6524603600, "type": "CALL" }, { "from": 6500770116, "to": 6511512544, "type": "CALL" }, { "from": 6500770121, "to": 6500770007, "type": "CODE" }, { "from": 6500770161, "to": 6524007984, "type": "CALL" }, { "from": 6500770197, "to": 6524007984, "type": "CALL" }, { "from": 6500770261, "to": 6456090784, "type": "CALL" }, { "from": 6500770295, "to": 6524007984, "type": "CALL" }, { "from": 6500770359, "to": 6456090784, "type": "CALL" }, { "from": 6500770415, "to": 6542067384, "type": "CALL" }, { "from": 6500770591, "to": 6740346544, "type": "CALL" }, { "from": 6500770609, "to": 6740346544, "type": "CALL" }, { "from": 6500770661, "to": 6500769601, "type": "CODE" }, { "from": 6500770691, "to": 6524603600, "type": "CALL" }, { "from": 6500770737, "to": 6511512544, "type": "CALL" }, { "from": 6500770742, "to": 6500770628, "type": "CODE" }, { "from": 6500770759, "to": 6511513840, "type": "CALL" }, { "from": 6500770764, "to": 6500771223, "type": "CODE" }, { "from": 6500770824, "to": 6445022656, "type": "CALL" }, { "from": 6500770863, "to": 6445282400, "type": "CALL" }, { "from": 6500770893, "to": 6511512544, "type": "CALL" }, { "from": 6500770937, "to": 6740346544, "type": "CALL" }, { "from": 6500770974, "to": 6524007200, "type": "CALL" }, { "from": 6500770985, "to": 6526592128, "type": "CALL" }, { "from": 6500771043, "to": 6446063536, "type": "CALL" }, { "from": 6500771062, "to": 6740346544, "type": "CALL" }, { "from": 6500771124, "to": 6447968000, "type": "CALL" }, { "from": 6500771150, "to": 6740346544, "type": "CALL" }, { "from": 6500771185, "to": 6512481968, "type": "CALL" }, { "from": 6500771343, "to": 6500752304, "type": "CALL" }, { "from": 6500771377, "to": 6475529648, "type": "CALL" }, { "from": 6500771454, "to": 6740346544, "type": "CALL" }, { "from": 6500771472, "to": 6740346544, "type": "CALL" }, { "from": 6500771521, "to": 6511512544, "type": "CALL" }, { "from": 6500771572, "to": 6511512544, "type": "CALL" }, { "from": 6500771666, "to": 6500753056, "type": "CALL" }, { "from": 6500771693, "to": 6740346544, "type": "CALL" }, { "from": 6500771739, "to": 6536691232, "type": "CALL" }, { "from": 6500771769, "to": 6447968000, "type": "CALL" }, { "from": 6500771777, "to": 6500771311, "type": "CODE" }, { "from": 6500771804, "to": 6524603600, "type": "CALL" }, { "from": 6500771844, "to": 6511512544, "type": "CALL" }, { "from": 6500771849, "to": 6500771492, "type": "CODE" }, { "from": 6500771879, "to": 6524603600, "type": "CALL" }, { "from": 6500771925, "to": 6511512544, "type": "CALL" }, { "from": 6500771930, "to": 6500771594, "type": "CODE" }, { "from": 6500771960, "to": 6524603600, "type": "CALL" }, { "from": 6500772006, "to": 6511512544, "type": "CALL" }, { "from": 6500772011, "to": 6500771543, "type": "CODE" }, { "from": 6500772040, "to": 6536220336, "type": "CALL" }, { "from": 6500772074, "to": 6500772110, "type": "CODE" }, { "from": 6500772183, "to": 6447834288, "type": "CALL" }, { "from": 6500772252, "to": 6447834288, "type": "CALL" }, { "from": 6500772445, "to": 6445282400, "type": "CALL" }, { "from": 6500772485, "to": 6511512544, "type": "CALL" }, { "from": 6500772537, "to": 6511512544, "type": "CALL" }, { "from": 6500772542, "to": 6500770387, "type": "CODE" }, { "from": 6500772554, "to": 6500772355, "type": "CODE" }, { "from": 6500772563, "to": 6500772578, "type": "CODE" }, { "from": 6500772754, "to": 6542436672, "type": "CALL" }, { "from": 6500772783, "to": 6511733920, "type": "CALL" }, { "from": 6500772855, "to": 6511733920, "type": "CALL" }, { "from": 6500772923, "to": 6445282400, "type": "CALL" }, { "from": 6500772956, "to": 6511512544, "type": "CALL" }, { "from": 6500773005, "to": 6511512544, "type": "CALL" }, { "from": 6500773039, "to": 6511512544, "type": "CALL" }, { "from": 6500773077, "to": 6500772485, "type": "CODE" }, { "from": 6500773087, "to": 6500769601, "type": "CODE" }, { "from": 6500773103, "to": 6542089024, "type": "CALL" }, { "from": 6500773122, "to": 6542753360, "type": "CALL" }, { "from": 6500773134, "to": 6542753360, "type": "CALL" }, { "from": 6500773146, "to": 6500767381, "type": "CODE" }, { "from": 6500773192, "to": 6500769335, "type": "CODE" }, { "from": 6500773206, "to": 6546093472, "type": "CALL" }, { "from": 6500773230, "to": 6511512544, "type": "CALL" }, { "from": 6500773264, "to": 6500769335, "type": "CODE" } ], "datarefs": [ { "from": 6500767337, "to": 6740709440, "type": "DATA" }, { "from": 6500767542, "to": 6717713200, "type": "DATA" }, { "from": 6500767596, "to": 6723591848, "type": "DATA" }, { "from": 6500767697, "to": 6723591736, "type": "DATA" }, { "from": 6500767726, "to": 6723591752, "type": "DATA" }, { "from": 6500767737, "to": 6723591736, "type": "DATA" }, { "from": 6500767948, "to": 6740709440, "type": "DATA" }, { "from": 6500768310, "to": 6717173124, "type": "DATA" }, { "from": 6500768390, "to": 6723591976, "type": "DATA" }, { "from": 6500768850, "to": 6717173124, "type": "DATA" }, { "from": 6500768931, "to": 6712172456, "type": "DATA" }, { "from": 6500769038, "to": 6723233416, "type": "DATA" }, { "from": 6500769347, "to": 6723592056, "type": "DATA" }, { "from": 6500769382, "to": 6723592056, "type": "DATA" }, { "from": 6500769825, "to": 6723590312, "type": "DATA" }, { "from": 6500769865, "to": 6723590326, "type": "DATA" }, { "from": 6500769880, "to": 6723590312, "type": "DATA" }, { "from": 6500770132, "to": 6723590592, "type": "DATA" }, { "from": 6500770266, "to": 6723592112, "type": "DATA" }, { "from": 6500770465, "to": 6723592128, "type": "DATA" }, { "from": 6500770499, "to": 6723592140, "type": "DATA" }, { "from": 6500770510, "to": 6723592128, "type": "DATA" }, { "from": 6500770829, "to": 6723590592, "type": "DATA" }, { "from": 6500770951, "to": 6723233416, "type": "DATA" }, { "from": 6500771156, "to": 6720256624, "type": "DATA" }, { "from": 6500771283, "to": 6723575844, "type": "DATA" }, { "from": 6500771292, "to": 6723575848, "type": "DATA" }, { "from": 6500771348, "to": 6723591536, "type": "DATA" }, { "from": 6500771702, "to": 6712105968, "type": "DATA" }, { "from": 6500772146, "to": 6712256604, "type": "DATA" }, { "from": 6500772218, "to": 6712085576, "type": "DATA" }, { "from": 6500772348, "to": 6723592096, "type": "DATA" }, { "from": 6500772411, "to": 6723592112, "type": "DATA" }, { "from": 6500772547, "to": 6723592080, "type": "DATA" }, { "from": 6500772767, "to": 6716691368, "type": "DATA" }, { "from": 6500772889, "to": 6723592112, "type": "DATA" }, { "from": 6500773115, "to": 6712084152, "type": "DATA" }, { "from": 6500773127, "to": 6712084184, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-provider-persist.json", "source_sha256": "45645293bb3d2ba410a3763caa955033b8fa37c2d89be7305c63c98cbec3ae42", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-provider-persist.txt", "stdout_bytes": 79146, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18379d640;pdgo @ 0x18379d640;afij @ 0x18379d640", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18379d640;pdgo @ 0x18379d640;afij @ 0x18379d640", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-service", "analyst_label": "ReleaseWebContentsInternal（释放页所有权及映射）", "label_is_original_symbol": false, "evidence_id": "ev_c92e5c45342b2e89cc5d5c785397b03a19dc8af03b430e6e096b5cbca98eeb5a", "address": "0x1837e8aa0", "function": { "address": "0x1837e8aa0", "size": 1571, "name": "fcn.1837e8aa0", "signature": "fcn.1837e8aa0(int64_t arg1, int64_t arg2);", "callrefs": [ { "from": 6501075710, "to": 6501075733, "type": "CODE" }, { "from": 6501075750, "to": 6501075712, "type": "CODE" }, { "from": 6501075755, "to": 6501075760, "type": "CODE" }, { "from": 6501075783, "to": 6511512544, "type": "CALL" }, { "from": 6501075788, "to": 6501075814, "type": "CODE" }, { "from": 6501075880, "to": 6511513840, "type": "CALL" }, { "from": 6501075885, "to": 6501075948, "type": "CODE" }, { "from": 6501075971, "to": 6456889328, "type": "CALL" }, { "from": 6501075985, "to": 6512708384, "type": "CALL" }, { "from": 6501076084, "to": 6462089824, "type": "CALL" }, { "from": 6501076095, "to": 6501079664, "type": "CALL" }, { "from": 6501076211, "to": 6501076358, "type": "CODE" }, { "from": 6501076239, "to": 6511512544, "type": "CALL" }, { "from": 6501076244, "to": 6501076278, "type": "CODE" }, { "from": 6501076246, "to": 6442840976, "type": "CALL" }, { "from": 6501076344, "to": 6501112368, "type": "CALL" }, { "from": 6501076378, "to": 6501076246, "type": "CODE" }, { "from": 6501076386, "to": 6501076411, "type": "CODE" }, { "from": 6501076448, "to": 6501076505, "type": "CODE" }, { "from": 6501076461, "to": 6511512544, "type": "CALL" }, { "from": 6501076484, "to": 6442840976, "type": "CALL" }, { "from": 6501076536, "to": 6501112368, "type": "CALL" }, { "from": 6501076547, "to": 6501076450, "type": "CODE" }, { "from": 6501076606, "to": 6520594992, "type": "CALL" }, { "from": 6501076616, "to": 6458504880, "type": "CALL" }, { "from": 6501076696, "to": 6512942288, "type": "CALL" }, { "from": 6501076725, "to": 6740346544, "type": "CALL" }, { "from": 6501076746, "to": 6501147680, "type": "CALL" }, { "from": 6501076781, "to": 6501076804, "type": "CODE" }, { "from": 6501076820, "to": 6501076783, "type": "CODE" }, { "from": 6501076897, "to": 6501076907, "type": "CODE" }, { "from": 6501076915, "to": 6501076921, "type": "CODE" }, { "from": 6501076921, "to": 6542434064, "type": "CALL" }, { "from": 6501076942, "to": 6501082032, "type": "CALL" }, { "from": 6501077009, "to": 6501107616, "type": "CALL" }, { "from": 6501077069, "to": 6501144608, "type": "CALL" }, { "from": 6501077145, "to": 6501070480, "type": "CALL" }, { "from": 6501077160, "to": 6501075760, "type": "CODE" }, { "from": 6501077178, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6501075641, "to": 6740709440, "type": "DATA" }, { "from": 6501075825, "to": 6740709440, "type": "DATA" }, { "from": 6501076053, "to": 6501141216, "type": "DATA" }, { "from": 6501076369, "to": 6741126408, "type": "DATA" }, { "from": 6501076475, "to": 6741126408, "type": "DATA" }, { "from": 6501076599, "to": 6722809064, "type": "DATA" }, { "from": 6501076621, "to": 6741832416, "type": "DATA" }, { "from": 6501076668, "to": 6723611288, "type": "DATA" }, { "from": 6501076675, "to": 6723611208, "type": "DATA" }, { "from": 6501076709, "to": 6501139120, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-service.json", "source_sha256": "68ea94daf8e24feff7737f58d3300d0c3496e26fcd645334062375da96cb47dc", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-service.txt", "stdout_bytes": 20607, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837e8aa0;pdgo @ 0x1837e8aa0;afij @ 0x1837e8aa0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837e8aa0;pdgo @ 0x1837e8aa0;afij @ 0x1837e8aa0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-tab-observer-1", "analyst_label": "标签观察者构造和浏览器观察注册", "label_is_original_symbol": false, "evidence_id": "ev_5ffb0782ca91c4ad727c4a87a49faa89d9a27bd4e382ec72869933f60868bee8", "address": "0x1837f9d30", "function": { "address": "0x1837f9d30", "size": 707, "name": "fcn.1837f9d30", "signature": "fcn.1837f9d30(int64_t arg1, int64_t arg2, int64_t arg3);", "callrefs": [ { "from": 6501145942, "to": 6542067384, "type": "CALL" }, { "from": 6501146055, "to": 6511423872, "type": "CALL" }, { "from": 6501146082, "to": 6511423872, "type": "CALL" }, { "from": 6501146119, "to": 6542067384, "type": "CALL" }, { "from": 6501146174, "to": 6456889328, "type": "CALL" }, { "from": 6501146188, "to": 6512708384, "type": "CALL" }, { "from": 6501146231, "to": 6511423872, "type": "CALL" }, { "from": 6501146270, "to": 6519295696, "type": "CALL" }, { "from": 6501146311, "to": 6462089824, "type": "CALL" }, { "from": 6501146376, "to": 6445650832, "type": "CALL" }, { "from": 6501146402, "to": 6524031184, "type": "CALL" }, { "from": 6501146421, "to": 6445656528, "type": "CALL" }, { "from": 6501146488, "to": 6511512544, "type": "CALL" }, { "from": 6501146535, "to": 6511975280, "type": "CALL" }, { "from": 6501146543, "to": 6518967168, "type": "CALL" }, { "from": 6501146572, "to": 6442840976, "type": "CALL" }, { "from": 6501146577, "to": 6501146255, "type": "CODE" }, { "from": 6501146603, "to": 6740346544, "type": "CALL" }, { "from": 6501146609, "to": 6501146524, "type": "CODE" } ], "datarefs": [ { "from": 6501145927, "to": 6708096840, "type": "DATA" }, { "from": 6501146006, "to": 6707914400, "type": "DATA" }, { "from": 6501146016, "to": 6707914448, "type": "DATA" }, { "from": 6501146043, "to": 6741126408, "type": "DATA" }, { "from": 6501146070, "to": 6741126408, "type": "DATA" }, { "from": 6501146219, "to": 6741126408, "type": "DATA" }, { "from": 6501146242, "to": 6741126408, "type": "DATA" }, { "from": 6501146283, "to": 6501154272, "type": "DATA" }, { "from": 6501146316, "to": 6742246848, "type": "DATA" }, { "from": 6501146329, "to": 6741126112, "type": "DATA" }, { "from": 6501146338, "to": 6742246856, "type": "DATA" }, { "from": 6501146352, "to": 6723611680, "type": "DATA" }, { "from": 6501146386, "to": 6723611744, "type": "DATA" }, { "from": 6501146407, "to": 6710367816, "type": "DATA" }, { "from": 6501146433, "to": 6708900496, "type": "DATA" }, { "from": 6501146445, "to": 6708923712, "type": "DATA" }, { "from": 6501146498, "to": 6708923824, "type": "DATA" }, { "from": 6501146512, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-tab-observer-1.json", "source_sha256": "9856ad515482ad1168d87917e83818df26f7c11d81a5bf04a87f569f2d9c8f01", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-tab-observer-1.txt", "stdout_bytes": 11286, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837f9d30;pdgo @ 0x1837f9d30;afij @ 0x1837f9d30", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837f9d30;pdgo @ 0x1837f9d30;afij @ 0x1837f9d30", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-agent-tab-observer-2", "analyst_label": "TabGroupedStateChanged（分组状态变化回调）", "label_is_original_symbol": false, "evidence_id": "ev_16709c4cbeaf80911fe46e59080187ff717ae99af00301f924e39073f7e2f030", "address": "0x1837fb540", "function": { "address": "0x1837fb540", "size": 474, "name": "fcn.1837fb540", "signature": "fcn.1837fb540(int64_t arg1, int64_t arg4, int64_t arg_28h);", "callrefs": [ { "from": 6501152118, "to": 6740346544, "type": "CALL" }, { "from": 6501152134, "to": 6501063216, "type": "CALL" }, { "from": 6501152257, "to": 6740346544, "type": "CALL" }, { "from": 6501152302, "to": 6542067384, "type": "CALL" }, { "from": 6501152423, "to": 6512942288, "type": "CALL" }, { "from": 6501152451, "to": 6740346544, "type": "CALL" }, { "from": 6501152499, "to": 6501152127, "type": "CODE" }, { "from": 6501152514, "to": 6511512544, "type": "CALL" }, { "from": 6501152519, "to": 6501152467, "type": "CODE" }, { "from": 6501152529, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6501152087, "to": 6740709440, "type": "DATA" }, { "from": 6501152195, "to": 6741832416, "type": "DATA" }, { "from": 6501152316, "to": 6501154112, "type": "DATA" }, { "from": 6501152327, "to": 6489230992, "type": "DATA" }, { "from": 6501152338, "to": 6495410336, "type": "DATA" }, { "from": 6501152349, "to": 6501152544, "type": "DATA" }, { "from": 6501152395, "to": 6723611864, "type": "DATA" }, { "from": 6501152402, "to": 6723611680, "type": "DATA" }, { "from": 6501152475, "to": 6740709440, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-agent-tab-observer-2.json", "source_sha256": "fc7f7d19d35902140e83d38447e3e04cefc9ed19972e21b543bd0cbb4b4b76e4", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-agent-tab-observer-2.txt", "stdout_bytes": 9332, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1837fb540;pdgo @ 0x1837fb540;afij @ 0x1837fb540", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1837fb540;pdgo @ 0x1837fb540;afij @ 0x1837fb540", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-dsh-command-builder", "analyst_label": "DSH web 命令、localhost 参数及生命周期 preload", "label_is_original_symbol": false, "evidence_id": "ev_cf5bf52d78bc3631354ddc7d53db7c2a259b4bc59519a3c78fe1fe30fb6573e6", "address": "0x18a89a160", "function": { "address": "0x18a89a160", "size": 596, "name": "fcn.18a89a160", "signature": "fcn.18a89a160(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4);", "callrefs": [ { "from": 6619242925, "to": 6542067384, "type": "CALL" }, { "from": 6619242993, "to": 6450560704, "type": "CALL" }, { "from": 6619243027, "to": 6624627728, "type": "CALL" }, { "from": 6619243072, "to": 6453526016, "type": "CALL" }, { "from": 6619243088, "to": 6626688560, "type": "CALL" }, { "from": 6619243119, "to": 6511512544, "type": "CALL" }, { "from": 6619243135, "to": 6522230240, "type": "CALL" }, { "from": 6619243175, "to": 6624627728, "type": "CALL" }, { "from": 6619243183, "to": 6511396000, "type": "CALL" }, { "from": 6619243194, "to": 6624627888, "type": "CALL" }, { "from": 6619243225, "to": 6624627728, "type": "CALL" }, { "from": 6619243257, "to": 6624627728, "type": "CALL" }, { "from": 6619243289, "to": 6624627728, "type": "CALL" }, { "from": 6619243316, "to": 6624627728, "type": "CALL" }, { "from": 6619243343, "to": 6624627728, "type": "CALL" }, { "from": 6619243374, "to": 6624627728, "type": "CALL" }, { "from": 6619243437, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6619242880, "to": 6740709440, "type": "DATA" }, { "from": 6619242998, "to": 6723510912, "type": "DATA" }, { "from": 6619243032, "to": 6723510880, "type": "DATA" }, { "from": 6619243199, "to": 6719229008, "type": "DATA" }, { "from": 6619243230, "to": 6723510928, "type": "DATA" }, { "from": 6619243262, "to": 6723510940, "type": "DATA" }, { "from": 6619243294, "to": 6717683880, "type": "DATA" }, { "from": 6619243321, "to": 6723510948, "type": "DATA" }, { "from": 6619243348, "to": 6712103832, "type": "DATA" }, { "from": 6619243390, "to": 6740709440, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-dsh-command-builder.json", "source_sha256": "d5ae898e2632055036774ab92b536ebba6fd74a19d92c1da953d33234c5e695e", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-dsh-command-builder.txt", "stdout_bytes": 8648, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18a89a160;pdgo @ 0x18a89a160;afij @ 0x18a89a160", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18a89a160;pdgo @ 0x18a89a160;afij @ 0x18a89a160", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-dsh-launch", "analyst_label": "构造工作目录、日志、环境及启动选项", "label_is_original_symbol": false, "evidence_id": "ev_201943f2ffa61aefb5ee43d4762049d04946d60e4724a9a832e36e9428e1e3f9", "address": "0x183681bf0", "function": { "address": "0x183681bf0", "size": 3614, "name": "fcn.183681bf0", "signature": "fcn.183681bf0(int64_t arg1, int64_t arg2, int64_t arg_108h);", "callrefs": [ { "from": 6499605788, "to": 6499656928, "type": "CALL" }, { "from": 6499605806, "to": 6542067384, "type": "CALL" }, { "from": 6499605856, "to": 6452472976, "type": "CALL" }, { "from": 6499605918, "to": 6453526016, "type": "CALL" }, { "from": 6499605967, "to": 6453526016, "type": "CALL" }, { "from": 6499605977, "to": 6446849744, "type": "CALL" }, { "from": 6499605996, "to": 6446849744, "type": "CALL" }, { "from": 6499606045, "to": 6511512544, "type": "CALL" }, { "from": 6499606079, "to": 6511512544, "type": "CALL" }, { "from": 6499606092, "to": 6499604768, "type": "CALL" }, { "from": 6499606105, "to": 6511512544, "type": "CALL" }, { "from": 6499606110, "to": 6499606119, "type": "CODE" }, { "from": 6499606139, "to": 6511512544, "type": "CALL" }, { "from": 6499606173, "to": 6511512544, "type": "CALL" }, { "from": 6499606207, "to": 6511512544, "type": "CALL" }, { "from": 6499606241, "to": 6511512544, "type": "CALL" }, { "from": 6499606279, "to": 6511512544, "type": "CALL" }, { "from": 6499606313, "to": 6511512544, "type": "CALL" }, { "from": 6499606347, "to": 6511512544, "type": "CALL" }, { "from": 6499606420, "to": 6511512544, "type": "CALL" }, { "from": 6499606425, "to": 6499606480, "type": "CODE" }, { "from": 6499606469, "to": 6453526016, "type": "CALL" }, { "from": 6499606563, "to": 6453526016, "type": "CALL" }, { "from": 6499606571, "to": 6443224192, "type": "CALL" }, { "from": 6499606594, "to": 6457110720, "type": "CALL" }, { "from": 6499606639, "to": 6454898800, "type": "CALL" }, { "from": 6499606650, "to": 6448830656, "type": "CALL" }, { "from": 6499606658, "to": 6517433568, "type": "CALL" }, { "from": 6499606727, "to": 6511512544, "type": "CALL" }, { "from": 6499606732, "to": 6499606016, "type": "CODE" }, { "from": 6499606752, "to": 6456000224, "type": "CALL" }, { "from": 6499606765, "to": 6466681856, "type": "CALL" }, { "from": 6499606770, "to": 6499606694, "type": "CODE" }, { "from": 6499606774, "to": 6499606781, "type": "CODE" }, { "from": 6499606801, "to": 6523198208, "type": "CALL" }, { "from": 6499606836, "to": 6740346544, "type": "CALL" }, { "from": 6499606842, "to": 6499606744, "type": "CODE" }, { "from": 6499606861, "to": 6499607376, "type": "CODE" }, { "from": 6499606891, "to": 6499607063, "type": "CODE" }, { "from": 6499606904, "to": 6499607180, "type": "CODE" }, { "from": 6499606971, "to": 6619242848, "type": "CALL" }, { "from": 6499607016, "to": 6542434496, "type": "CALL" }, { "from": 6499607058, "to": 6454999952, "type": "CALL" }, { "from": 6499607082, "to": 6499688352, "type": "CALL" }, { "from": 6499607106, "to": 6471210304, "type": "CALL" }, { "from": 6499607191, "to": 6471210304, "type": "CALL" }, { "from": 6499607318, "to": 6499609696, "type": "CALL" }, { "from": 6499607371, "to": 6454999952, "type": "CALL" }, { "from": 6499607405, "to": 6511512544, "type": "CALL" }, { "from": 6499607467, "to": 6740377600, "type": "CALL" }, { "from": 6499607498, "to": 6740378384, "type": "CALL" }, { "from": 6499607516, "to": 6523198208, "type": "CALL" }, { "from": 6499607523, "to": 6740380040, "type": "CALL" }, { "from": 6499607551, "to": 6740378384, "type": "CALL" }, { "from": 6499607598, "to": 6523198208, "type": "CALL" }, { "from": 6499607605, "to": 6740380040, "type": "CALL" }, { "from": 6499607623, "to": 6740380024, "type": "CALL" }, { "from": 6499607633, "to": 6740377568, "type": "CALL" }, { "from": 6499607654, "to": 6740378384, "type": "CALL" }, { "from": 6499607703, "to": 6523198208, "type": "CALL" }, { "from": 6499607710, "to": 6740380040, "type": "CALL" }, { "from": 6499607741, "to": 6542434496, "type": "CALL" }, { "from": 6499607798, "to": 6740380032, "type": "CALL" }, { "from": 6499608062, "to": 6457864288, "type": "CALL" }, { "from": 6499608086, "to": 6477601248, "type": "CALL" }, { "from": 6499608117, "to": 6511512544, "type": "CALL" }, { "from": 6499608136, "to": 6463672240, "type": "CALL" }, { "from": 6499608144, "to": 6443184912, "type": "CALL" }, { "from": 6499608187, "to": 6499606781, "type": "CODE" }, { "from": 6499608197, "to": 6499606781, "type": "CODE" }, { "from": 6499608220, "to": 6455000096, "type": "CALL" }, { "from": 6499608225, "to": 6499607376, "type": "CODE" }, { "from": 6499608233, "to": 6499607529, "type": "CODE" }, { "from": 6499608241, "to": 6499607521, "type": "CODE" }, { "from": 6499608246, "to": 6523198208, "type": "CALL" }, { "from": 6499608285, "to": 6740346544, "type": "CALL" }, { "from": 6499608299, "to": 6499607583, "type": "CODE" }, { "from": 6499608304, "to": 6523198208, "type": "CALL" }, { "from": 6499608343, "to": 6740346544, "type": "CALL" }, { "from": 6499608361, "to": 6499607688, "type": "CODE" }, { "from": 6499608368, "to": 6740378496, "type": "CALL" }, { "from": 6499608384, "to": 6740378584, "type": "CALL" }, { "from": 6499608411, "to": 6740346544, "type": "CALL" }, { "from": 6499608422, "to": 6458454272, "type": "CALL" }, { "from": 6499608432, "to": 6499606820, "type": "CODE" }, { "from": 6499608441, "to": 6499608422, "type": "CODE" }, { "from": 6499608454, "to": 6542089024, "type": "CALL" }, { "from": 6499608544, "to": 6542067384, "type": "CALL" }, { "from": 6499608603, "to": 6542436672, "type": "CALL" }, { "from": 6499608669, "to": 6511512544, "type": "CALL" }, { "from": 6499608679, "to": 6499607913, "type": "CODE" }, { "from": 6499608759, "to": 6542067384, "type": "CALL" }, { "from": 6499608810, "to": 6542436672, "type": "CALL" }, { "from": 6499608862, "to": 6511512544, "type": "CALL" }, { "from": 6499608877, "to": 6499607986, "type": "CODE" }, { "from": 6499608884, "to": 6740378496, "type": "CALL" }, { "from": 6499608900, "to": 6740378584, "type": "CALL" }, { "from": 6499608927, "to": 6740346544, "type": "CALL" }, { "from": 6499608938, "to": 6458454272, "type": "CALL" }, { "from": 6499608943, "to": 6499608269, "type": "CODE" }, { "from": 6499608952, "to": 6499608938, "type": "CODE" }, { "from": 6499608956, "to": 6740378496, "type": "CALL" }, { "from": 6499608972, "to": 6740378584, "type": "CALL" }, { "from": 6499608995, "to": 6740346544, "type": "CALL" }, { "from": 6499609006, "to": 6458454272, "type": "CALL" }, { "from": 6499609011, "to": 6499608327, "type": "CODE" }, { "from": 6499609020, "to": 6499609006, "type": "CODE" }, { "from": 6499609056, "to": 6624396544, "type": "CALL" }, { "from": 6499609061, "to": 6499608122, "type": "CODE" }, { "from": 6499609066, "to": 6545792064, "type": "CALL" }, { "from": 6499609071, "to": 6543271376, "type": "CALL" }, { "from": 6499609079, "to": 6499608552, "type": "CODE" }, { "from": 6499609086, "to": 6499608420, "type": "CODE" }, { "from": 6499609093, "to": 6499608936, "type": "CODE" }, { "from": 6499609100, "to": 6499609004, "type": "CODE" } ], "datarefs": [ { "from": 6499605518, "to": 6740709440, "type": "DATA" }, { "from": 6499605881, "to": 6722745488, "type": "DATA" }, { "from": 6499605938, "to": 6715268440, "type": "DATA" }, { "from": 6499606363, "to": 6740709440, "type": "DATA" }, { "from": 6499606427, "to": 6723510960, "type": "DATA" }, { "from": 6499606529, "to": 6723510976, "type": "DATA" }, { "from": 6499606806, "to": 6742480216, "type": "DATA" }, { "from": 6499606820, "to": 6742480216, "type": "DATA" }, { "from": 6499607208, "to": 6723511000, "type": "DATA" }, { "from": 6499607235, "to": 6723511000, "type": "DATA" }, { "from": 6499607289, "to": 6712114780, "type": "DATA" }, { "from": 6499607410, "to": 6723511040, "type": "DATA" }, { "from": 6499607429, "to": 6723511024, "type": "DATA" }, { "from": 6499608255, "to": 6742480216, "type": "DATA" }, { "from": 6499608269, "to": 6742480216, "type": "DATA" }, { "from": 6499608313, "to": 6742480216, "type": "DATA" }, { "from": 6499608327, "to": 6742480216, "type": "DATA" }, { "from": 6499608374, "to": 6729744864, "type": "DATA" }, { "from": 6499608399, "to": 6491546928, "type": "DATA" }, { "from": 6499608890, "to": 6729744864, "type": "DATA" }, { "from": 6499608915, "to": 6491546928, "type": "DATA" }, { "from": 6499608962, "to": 6729744864, "type": "DATA" }, { "from": 6499608983, "to": 6491546928, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-dsh-launch.json", "source_sha256": "08762e3aec2810f3f3bdf8d777a8cfcf764aaf7373dde8d8273dbfb3df74686e", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-dsh-launch.txt", "stdout_bytes": 51843, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183681bf0;pdgo @ 0x183681bf0;afij @ 0x183681bf0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183681bf0;pdgo @ 0x183681bf0;afij @ 0x183681bf0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-dsh-process", "analyst_label": "Stop（安排 DSH 停止）", "label_is_original_symbol": false, "evidence_id": "ev_37aa8e4b5d98c8cbde93766b97ec348ad59e2f570f53c1a74a75730c2bb15f7f", "address": "0x18367f730", "function": { "address": "0x18367f730", "size": 833, "name": "fcn.18367f730", "signature": "fcn.18367f730(int64_t arg1, int64_t arg2);", "callrefs": [ { "from": 6499596181, "to": 6511512544, "type": "CALL" }, { "from": 6499596186, "to": 6499596229, "type": "CODE" }, { "from": 6499596197, "to": 6740346544, "type": "CALL" }, { "from": 6499596203, "to": 6499596173, "type": "CODE" }, { "from": 6499596210, "to": 6511512544, "type": "CALL" }, { "from": 6499596215, "to": 6499596385, "type": "CODE" }, { "from": 6499596223, "to": 6740346544, "type": "CALL" }, { "from": 6499596236, "to": 6522894224, "type": "CALL" }, { "from": 6499596248, "to": 6522894224, "type": "CALL" }, { "from": 6499596269, "to": 6535891568, "type": "CALL" }, { "from": 6499596316, "to": 6542067384, "type": "CALL" }, { "from": 6499596525, "to": 6542067384, "type": "CALL" }, { "from": 6499596602, "to": 6542067384, "type": "CALL" }, { "from": 6499596705, "to": 6512942288, "type": "CALL" }, { "from": 6499596722, "to": 6531880336, "type": "CALL" }, { "from": 6499596741, "to": 6532074304, "type": "CALL" }, { "from": 6499596746, "to": 6499596756, "type": "CODE" }, { "from": 6499596751, "to": 6499601456, "type": "CALL" }, { "from": 6499596806, "to": 6740346544, "type": "CALL" }, { "from": 6499596812, "to": 6499596764, "type": "CODE" }, { "from": 6499596822, "to": 6542089024, "type": "CALL" }, { "from": 6499596834, "to": 6542069736, "type": "CALL" }, { "from": 6499596874, "to": 6453059232, "type": "CALL" }, { "from": 6499596896, "to": 6542069628, "type": "CALL" }, { "from": 6499596901, "to": 6499596447, "type": "CODE" } ], "datarefs": [ { "from": 6499596098, "to": 6740709440, "type": "DATA" }, { "from": 6499596152, "to": 6537934960, "type": "DATA" }, { "from": 6499596410, "to": 6742178384, "type": "DATA" }, { "from": 6499596416, "to": 6741832416, "type": "DATA" }, { "from": 6499596447, "to": 6742178376, "type": "DATA" }, { "from": 6499596537, "to": 6496572928, "type": "DATA" }, { "from": 6499596548, "to": 6488510160, "type": "DATA" }, { "from": 6499596559, "to": 6496570832, "type": "DATA" }, { "from": 6499596570, "to": 6499601456, "type": "DATA" }, { "from": 6499596609, "to": 6467941616, "type": "DATA" }, { "from": 6499596620, "to": 6499609520, "type": "DATA" }, { "from": 6499596631, "to": 6511490512, "type": "DATA" }, { "from": 6499596642, "to": 6499601856, "type": "DATA" }, { "from": 6499596677, "to": 6713531992, "type": "DATA" }, { "from": 6499596684, "to": 6723511048, "type": "DATA" }, { "from": 6499596772, "to": 6740709440, "type": "DATA" }, { "from": 6499596827, "to": 6742178384, "type": "DATA" }, { "from": 6499596839, "to": 6742178384, "type": "DATA" }, { "from": 6499596852, "to": 6742242256, "type": "DATA" }, { "from": 6499596859, "to": 6723512473, "type": "DATA" }, { "from": 6499596882, "to": 6742178376, "type": "DATA" }, { "from": 6499596889, "to": 6742178384, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-dsh-process.json", "source_sha256": "a5c2e67ba3f13d60622a2102fdbec77839e4c5db084a084255d9d828ee7a0007", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-dsh-process.txt", "stdout_bytes": 12609, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18367f730;pdgo @ 0x18367f730;afij @ 0x18367f730", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18367f730;pdgo @ 0x18367f730;afij @ 0x18367f730", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-dsh-service", "analyst_label": "DshService 构造及异步初始化", "label_is_original_symbol": false, "evidence_id": "ev_f3bcaa68a32c01fc8934fdad20ee1c35b741b416af17d9d7a1a65a8882464b9e", "address": "0x183683060", "function": { "address": "0x183683060", "size": 870, "name": "fcn.183683060", "signature": "fcn.183683060(int64_t arg1, int64_t arg2);", "callrefs": [ { "from": 6499611009, "to": 6542067384, "type": "CALL" }, { "from": 6499611174, "to": 6542067384, "type": "CALL" }, { "from": 6499611248, "to": 6542067384, "type": "CALL" }, { "from": 6499611327, "to": 6522337344, "type": "CALL" }, { "from": 6499611368, "to": 6512942288, "type": "CALL" }, { "from": 6499611387, "to": 6475343664, "type": "CALL" }, { "from": 6499611406, "to": 6532074304, "type": "CALL" }, { "from": 6499611427, "to": 6511512544, "type": "CALL" }, { "from": 6499611486, "to": 6499611332, "type": "CODE" }, { "from": 6499611499, "to": 6542089024, "type": "CALL" }, { "from": 6499611511, "to": 6542069736, "type": "CALL" }, { "from": 6499611551, "to": 6453059232, "type": "CALL" }, { "from": 6499611573, "to": 6542069628, "type": "CALL" }, { "from": 6499611578, "to": 6499611096, "type": "CODE" } ], "datarefs": [ { "from": 6499610738, "to": 6740709440, "type": "DATA" }, { "from": 6499610942, "to": 6709836760, "type": "DATA" }, { "from": 6499611059, "to": 6742178384, "type": "DATA" }, { "from": 6499611065, "to": 6741832416, "type": "DATA" }, { "from": 6499611096, "to": 6742178376, "type": "DATA" }, { "from": 6499611186, "to": 6499632400, "type": "DATA" }, { "from": 6499611197, "to": 6488510160, "type": "DATA" }, { "from": 6499611208, "to": 6496570832, "type": "DATA" }, { "from": 6499611219, "to": 6499611600, "type": "DATA" }, { "from": 6499611258, "to": 6443242560, "type": "DATA" }, { "from": 6499611269, "to": 6488787248, "type": "DATA" }, { "from": 6499611280, "to": 6511490512, "type": "DATA" }, { "from": 6499611291, "to": 6499682976, "type": "DATA" }, { "from": 6499611340, "to": 6723511184, "type": "DATA" }, { "from": 6499611347, "to": 6723511144, "type": "DATA" }, { "from": 6499611440, "to": 6740709440, "type": "DATA" }, { "from": 6499611504, "to": 6742178384, "type": "DATA" }, { "from": 6499611516, "to": 6742178384, "type": "DATA" }, { "from": 6499611529, "to": 6742242256, "type": "DATA" }, { "from": 6499611536, "to": 6723512473, "type": "DATA" }, { "from": 6499611559, "to": 6742178376, "type": "DATA" }, { "from": 6499611566, "to": 6742178384, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-dsh-service.json", "source_sha256": "4011579819c7d06f3b608280bc3cf909e1d0fbee5fa10a1fbc82dc12f0bb039c", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-dsh-service.txt", "stdout_bytes": 12986, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183683060;pdgo @ 0x183683060;afij @ 0x183683060", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183683060;pdgo @ 0x183683060;afij @ 0x183683060", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-dsh-transport", "analyst_label": "OnLastProfileClosed（最后 Profile 关闭）；不是 transport", "label_is_original_symbol": false, "evidence_id": "ev_dada837f0ec915ec1a6b8f61c7472a60c0fbfc448a5ae61e956a8c1e6abe0d02", "address": "0x183686240", "function": { "address": "0x183686240", "size": 696, "name": "fcn.183686240", "signature": "fcn.183686240(int64_t arg1);", "callrefs": [ { "from": 6499623571, "to": 6499623624, "type": "CODE" }, { "from": 6499623583, "to": 6511512544, "type": "CALL" }, { "from": 6499623588, "to": 6499623608, "type": "CODE" }, { "from": 6499623595, "to": 6511512544, "type": "CALL" }, { "from": 6499623637, "to": 6511396000, "type": "CALL" }, { "from": 6499623656, "to": 6499623600, "type": "CODE" }, { "from": 6499623700, "to": 6522894224, "type": "CALL" }, { "from": 6499623725, "to": 6511396000, "type": "CALL" }, { "from": 6499623755, "to": 6542067384, "type": "CALL" }, { "from": 6499623837, "to": 6499596080, "type": "CALL" }, { "from": 6499623959, "to": 6542067384, "type": "CALL" }, { "from": 6499624032, "to": 6512942288, "type": "CALL" }, { "from": 6499624049, "to": 6531880336, "type": "CALL" }, { "from": 6499624076, "to": 6532074304, "type": "CALL" }, { "from": 6499624081, "to": 6499623842, "type": "CODE" }, { "from": 6499624096, "to": 6542089024, "type": "CALL" }, { "from": 6499624108, "to": 6542069736, "type": "CALL" }, { "from": 6499624148, "to": 6453059232, "type": "CALL" }, { "from": 6499624170, "to": 6542069628, "type": "CALL" }, { "from": 6499624175, "to": 6499623913, "type": "CODE" } ], "datarefs": [ { "from": 6499623500, "to": 6740709440, "type": "DATA" }, { "from": 6499623769, "to": 6455944992, "type": "DATA" }, { "from": 6499623780, "to": 6499634416, "type": "DATA" }, { "from": 6499623791, "to": 6511490512, "type": "DATA" }, { "from": 6499623802, "to": 6499623360, "type": "DATA" }, { "from": 6499623850, "to": 6740709440, "type": "DATA" }, { "from": 6499623876, "to": 6742178384, "type": "DATA" }, { "from": 6499623882, "to": 6741832416, "type": "DATA" }, { "from": 6499623913, "to": 6742178376, "type": "DATA" }, { "from": 6499623970, "to": 6446028352, "type": "DATA" }, { "from": 6499623981, "to": 6454368560, "type": "DATA" }, { "from": 6499624004, "to": 6723511264, "type": "DATA" }, { "from": 6499624011, "to": 6723511144, "type": "DATA" }, { "from": 6499624101, "to": 6742178384, "type": "DATA" }, { "from": 6499624113, "to": 6742178384, "type": "DATA" }, { "from": 6499624126, "to": 6742242256, "type": "DATA" }, { "from": 6499624133, "to": 6723512473, "type": "DATA" }, { "from": 6499624156, "to": 6742178376, "type": "DATA" }, { "from": 6499624163, "to": 6742178384, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-dsh-transport.json", "source_sha256": "4802db4179793d78e897ba5eef79fd04094e6e0869625d560ddc47b692832032", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-dsh-transport.txt", "stdout_bytes": 10444, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183686240;pdgo @ 0x183686240;afij @ 0x183686240", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183686240;pdgo @ 0x183686240;afij @ 0x183686240", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-api-read-real", "analyst_label": "read 原生 API 参数解析、服务获取及异步返回", "label_is_original_symbol": false, "evidence_id": "ev_1580ec490a3ec31834ec419e4408fdbbe6d32a9d37d236f30696409d142ab816", "address": "0x183812280", "function": { "address": "0x183812280", "size": 864, "name": "fcn.183812280", "signature": "fcn.183812280(int64_t arg1, int64_t arg2, int64_t arg_bfh);", "callrefs": [ { "from": 6501245651, "to": 6502350352, "type": "CALL" }, { "from": 6501245685, "to": 6501356784, "type": "CALL" }, { "from": 6501245699, "to": 6512708384, "type": "CALL" }, { "from": 6501245747, "to": 6542067384, "type": "CALL" }, { "from": 6501245839, "to": 6532014096, "type": "CALL" }, { "from": 6501245847, "to": 6522230240, "type": "CALL" }, { "from": 6501245887, "to": 6511396000, "type": "CALL" }, { "from": 6501245986, "to": 6501315936, "type": "CALL" }, { "from": 6501246017, "to": 6511512544, "type": "CALL" }, { "from": 6501246075, "to": 6511512544, "type": "CALL" }, { "from": 6501246135, "to": 6511513840, "type": "CALL" }, { "from": 6501246140, "to": 6501245879, "type": "CODE" }, { "from": 6501246236, "to": 6587959616, "type": "CALL" }, { "from": 6501246281, "to": 6587967968, "type": "CALL" }, { "from": 6501246294, "to": 6501246029, "type": "CODE" }, { "from": 6501246304, "to": 6542067384, "type": "CALL" }, { "from": 6501246408, "to": 6501246230, "type": "CODE" }, { "from": 6501246426, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6501245580, "to": 6740709440, "type": "DATA" }, { "from": 6501245758, "to": 6501255344, "type": "DATA" }, { "from": 6501245769, "to": 6496176416, "type": "DATA" }, { "from": 6501245780, "to": 6511490512, "type": "DATA" }, { "from": 6501245791, "to": 6501246448, "type": "DATA" }, { "from": 6501246091, "to": 6740709440, "type": "DATA" }, { "from": 6501246157, "to": 6716742096, "type": "DATA" }, { "from": 6501246192, "to": 6716742112, "type": "DATA" }, { "from": 6501246249, "to": 6587963136, "type": "DATA" }, { "from": 6501246274, "to": 6545109024, "type": "DATA" }, { "from": 6501246351, "to": 6723614416, "type": "DATA" }, { "from": 6501246376, "to": 6723614431, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-api-read-real.json", "source_sha256": "b43b901892525d5a491d8e0e374539c4db14cdc4d63d74f44a232bcb642dad34", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-api-read-real.txt", "stdout_bytes": 12092, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183812280;pdgo @ 0x183812280;afij @ 0x183812280", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183812280;pdgo @ 0x183812280;afij @ 0x183812280", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-api-read", "analyst_label": "unmount 原生 API；不是 read", "label_is_original_symbol": false, "evidence_id": "ev_4af1b7225ffa45d2bcb77fccf6c62d0e85b7375fcc8aaf016f268be61d8c960b", "address": "0x18380e390", "function": { "address": "0x18380e390", "size": 1538, "name": "fcn.18380e390", "signature": "fcn.18380e390(int64_t arg1, int64_t arg2, int64_t arg_1ffh);", "callrefs": [ { "from": 6501229529, "to": 6502310480, "type": "CALL" }, { "from": 6501229563, "to": 6501356784, "type": "CALL" }, { "from": 6501229577, "to": 6512708384, "type": "CALL" }, { "from": 6501229646, "to": 6445650832, "type": "CALL" }, { "from": 6501229672, "to": 6524031184, "type": "CALL" }, { "from": 6501229693, "to": 6524031184, "type": "CALL" }, { "from": 6501229714, "to": 6524031184, "type": "CALL" }, { "from": 6501229752, "to": 6501223616, "type": "CALL" }, { "from": 6501229786, "to": 6524031184, "type": "CALL" }, { "from": 6501229807, "to": 6524031184, "type": "CALL" }, { "from": 6501229833, "to": 6532014096, "type": "CALL" }, { "from": 6501229841, "to": 6522230240, "type": "CALL" }, { "from": 6501229869, "to": 6501229888, "type": "CODE" }, { "from": 6501229883, "to": 6511513840, "type": "CALL" }, { "from": 6501229896, "to": 6511396000, "type": "CALL" }, { "from": 6501229929, "to": 6524031184, "type": "CALL" }, { "from": 6501229954, "to": 6511512544, "type": "CALL" }, { "from": 6501229985, "to": 6511512544, "type": "CALL" }, { "from": 6501229998, "to": 6447366432, "type": "CALL" }, { "from": 6501230008, "to": 6542067384, "type": "CALL" }, { "from": 6501230113, "to": 6501230206, "type": "CODE" }, { "from": 6501230212, "to": 6587959616, "type": "CALL" }, { "from": 6501230226, "to": 6587960272, "type": "CALL" }, { "from": 6501230277, "to": 6511512544, "type": "CALL" }, { "from": 6501230382, "to": 6445650832, "type": "CALL" }, { "from": 6501230408, "to": 6524031184, "type": "CALL" }, { "from": 6501230429, "to": 6524031184, "type": "CALL" }, { "from": 6501230467, "to": 6501223616, "type": "CALL" }, { "from": 6501230501, "to": 6524031184, "type": "CALL" }, { "from": 6501230522, "to": 6524031184, "type": "CALL" }, { "from": 6501230548, "to": 6532014096, "type": "CALL" }, { "from": 6501230556, "to": 6522230240, "type": "CALL" }, { "from": 6501230584, "to": 6501230603, "type": "CODE" }, { "from": 6501230598, "to": 6511513840, "type": "CALL" }, { "from": 6501230611, "to": 6511396000, "type": "CALL" }, { "from": 6501230644, "to": 6524031184, "type": "CALL" }, { "from": 6501230676, "to": 6511512544, "type": "CALL" }, { "from": 6501230714, "to": 6511512544, "type": "CALL" }, { "from": 6501230727, "to": 6447366432, "type": "CALL" }, { "from": 6501230750, "to": 6532014096, "type": "CALL" }, { "from": 6501230758, "to": 6522230240, "type": "CALL" }, { "from": 6501230792, "to": 6501230814, "type": "CODE" }, { "from": 6501230809, "to": 6511513840, "type": "CALL" }, { "from": 6501230822, "to": 6511396000, "type": "CALL" }, { "from": 6501230863, "to": 6501290672, "type": "CALL" }, { "from": 6501230903, "to": 6511512544, "type": "CALL" }, { "from": 6501230936, "to": 6457900480, "type": "CALL" }, { "from": 6501230946, "to": 6485318848, "type": "CALL" }, { "from": 6501230965, "to": 6587962400, "type": "CALL" }, { "from": 6501230970, "to": 6501230217, "type": "CODE" }, { "from": 6501230988, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6501229470, "to": 6740709440, "type": "DATA" }, { "from": 6501229585, "to": 6742246848, "type": "DATA" }, { "from": 6501229619, "to": 6723614288, "type": "DATA" }, { "from": 6501229659, "to": 6720303740, "type": "DATA" }, { "from": 6501229677, "to": 6723614776, "type": "DATA" }, { "from": 6501229698, "to": 6723615400, "type": "DATA" }, { "from": 6501229791, "to": 6723615368, "type": "DATA" }, { "from": 6501230049, "to": 6723614416, "type": "DATA" }, { "from": 6501230078, "to": 6723614431, "type": "DATA" }, { "from": 6501230089, "to": 6723614416, "type": "DATA" }, { "from": 6501230127, "to": 6716742096, "type": "DATA" }, { "from": 6501230162, "to": 6716742112, "type": "DATA" }, { "from": 6501230182, "to": 6716742096, "type": "DATA" }, { "from": 6501230293, "to": 6740709440, "type": "DATA" }, { "from": 6501230335, "to": 6741126112, "type": "DATA" }, { "from": 6501230344, "to": 6742246856, "type": "DATA" }, { "from": 6501230358, "to": 6723614288, "type": "DATA" }, { "from": 6501230395, "to": 6720303740, "type": "DATA" }, { "from": 6501230413, "to": 6723614832, "type": "DATA" }, { "from": 6501230506, "to": 6723615368, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-api-read.json", "source_sha256": "a5b8047a28d0fcce3b97af5cb4bff6de15a5065e846f0e14e55d897a12fa5965", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-api-read.txt", "stdout_bytes": 20911, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18380e390;pdgo @ 0x18380e390;afij @ 0x18380e390", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18380e390;pdgo @ 0x18380e390;afij @ 0x18380e390", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-mount", "analyst_label": "getattr 工作函数及符号链接边界；不是 mount", "label_is_original_symbol": false, "evidence_id": "ev_fac882f2e8049d43143881a235bb7951ebe9cd457071163a5c89e9b64f4f250e", "address": "0x1838152d0", "function": { "address": "0x1838152d0", "size": 1917, "name": "fcn.1838152d0", "signature": "fcn.1838152d0(int64_t arg1, int64_t arg2, int64_t arg3);", "callrefs": [ { "from": 6501257959, "to": 6501257104, "type": "CALL" }, { "from": 6501258027, "to": 6740378272, "type": "CALL" }, { "from": 6501258070, "to": 6464588400, "type": "CALL" }, { "from": 6501258197, "to": 6501258226, "type": "CODE" }, { "from": 6501258207, "to": 6501258226, "type": "CODE" }, { "from": 6501258304, "to": 6501258333, "type": "CODE" }, { "from": 6501258314, "to": 6501258333, "type": "CODE" }, { "from": 6501258391, "to": 6501259624, "type": "CODE" }, { "from": 6501258396, "to": 6740378384, "type": "CALL" }, { "from": 6501258404, "to": 6454900080, "type": "CALL" }, { "from": 6501258472, "to": 6445650832, "type": "CALL" }, { "from": 6501258495, "to": 6524031184, "type": "CALL" }, { "from": 6501258516, "to": 6524031184, "type": "CALL" }, { "from": 6501258535, "to": 6501259856, "type": "CALL" }, { "from": 6501258566, "to": 6524031184, "type": "CALL" }, { "from": 6501258587, "to": 6524031184, "type": "CALL" }, { "from": 6501258597, "to": 6446762512, "type": "CALL" }, { "from": 6501258633, "to": 6501258871, "type": "CODE" }, { "from": 6501258638, "to": 6740378384, "type": "CALL" }, { "from": 6501258646, "to": 6454900080, "type": "CALL" }, { "from": 6501258714, "to": 6445650832, "type": "CALL" }, { "from": 6501258737, "to": 6524031184, "type": "CALL" }, { "from": 6501258758, "to": 6524031184, "type": "CALL" }, { "from": 6501258777, "to": 6501259856, "type": "CALL" }, { "from": 6501258808, "to": 6524031184, "type": "CALL" }, { "from": 6501258829, "to": 6524031184, "type": "CALL" }, { "from": 6501258839, "to": 6446762512, "type": "CALL" }, { "from": 6501258871, "to": 6511512544, "type": "CALL" }, { "from": 6501258894, "to": 6445656528, "type": "CALL" }, { "from": 6501258962, "to": 6511512544, "type": "CALL" }, { "from": 6501259013, "to": 6511975280, "type": "CALL" }, { "from": 6501259021, "to": 6518967168, "type": "CALL" }, { "from": 6501259103, "to": 6501257392, "type": "CALL" }, { "from": 6501259108, "to": 6501259602, "type": "CODE" }, { "from": 6501259150, "to": 6445650832, "type": "CALL" }, { "from": 6501259173, "to": 6524031184, "type": "CALL" }, { "from": 6501259194, "to": 6524031184, "type": "CALL" }, { "from": 6501259215, "to": 6524031184, "type": "CALL" }, { "from": 6501259234, "to": 6501259856, "type": "CALL" }, { "from": 6501259265, "to": 6524031184, "type": "CALL" }, { "from": 6501259300, "to": 6511512544, "type": "CALL" }, { "from": 6501259323, "to": 6445656528, "type": "CALL" }, { "from": 6501259384, "to": 6511512544, "type": "CALL" }, { "from": 6501259435, "to": 6511975280, "type": "CALL" }, { "from": 6501259443, "to": 6518967168, "type": "CALL" }, { "from": 6501259467, "to": 6542067384, "type": "CALL" }, { "from": 6501259584, "to": 6501257392, "type": "CALL" }, { "from": 6501259597, "to": 6511512544, "type": "CALL" }, { "from": 6501259708, "to": 6501259602, "type": "CODE" }, { "from": 6501259753, "to": 6501259624, "type": "CODE" }, { "from": 6501259774, "to": 6501259624, "type": "CODE" }, { "from": 6501259806, "to": 6740346544, "type": "CALL" }, { "from": 6501259812, "to": 6501259424, "type": "CODE" }, { "from": 6501259842, "to": 6740346544, "type": "CALL" }, { "from": 6501259848, "to": 6501259002, "type": "CODE" } ], "datarefs": [ { "from": 6501258199, "to": 6706266480, "type": "DATA" }, { "from": 6501258213, "to": 6712113264, "type": "DATA" }, { "from": 6501258306, "to": 6706266480, "type": "DATA" }, { "from": 6501258320, "to": 6712113264, "type": "DATA" }, { "from": 6501258378, "to": 6712113264, "type": "DATA" }, { "from": 6501258424, "to": 6723620844, "type": "DATA" }, { "from": 6501258435, "to": 6742246848, "type": "DATA" }, { "from": 6501258448, "to": 6723615496, "type": "DATA" }, { "from": 6501258482, "to": 6720303740, "type": "DATA" }, { "from": 6501258500, "to": 6723615712, "type": "DATA" }, { "from": 6501258571, "to": 6723615680, "type": "DATA" }, { "from": 6501258666, "to": 6723620844, "type": "DATA" }, { "from": 6501258677, "to": 6742246848, "type": "DATA" }, { "from": 6501258690, "to": 6723615496, "type": "DATA" }, { "from": 6501258724, "to": 6720303740, "type": "DATA" }, { "from": 6501258742, "to": 6723615640, "type": "DATA" }, { "from": 6501258813, "to": 6723615680, "type": "DATA" }, { "from": 6501258876, "to": 6710367816, "type": "DATA" }, { "from": 6501258907, "to": 6708900496, "type": "DATA" }, { "from": 6501258919, "to": 6708923712, "type": "DATA" }, { "from": 6501258972, "to": 6708923824, "type": "DATA" }, { "from": 6501258986, "to": 6742217808, "type": "DATA" }, { "from": 6501259045, "to": 6723615688, "type": "DATA" }, { "from": 6501259081, "to": 6723615688, "type": "DATA" }, { "from": 6501259113, "to": 6742246848, "type": "DATA" }, { "from": 6501259126, "to": 6723615496, "type": "DATA" }, { "from": 6501259160, "to": 6720303740, "type": "DATA" }, { "from": 6501259178, "to": 6723615552, "type": "DATA" }, { "from": 6501259199, "to": 6719731404, "type": "DATA" }, { "from": 6501259305, "to": 6710367816, "type": "DATA" }, { "from": 6501259336, "to": 6708900496, "type": "DATA" }, { "from": 6501259348, "to": 6708923712, "type": "DATA" }, { "from": 6501259394, "to": 6708923824, "type": "DATA" }, { "from": 6501259408, "to": 6742217808, "type": "DATA" }, { "from": 6501259517, "to": 6723615608, "type": "DATA" }, { "from": 6501259548, "to": 6723615620, "type": "DATA" }, { "from": 6501259559, "to": 6723615608, "type": "DATA" }, { "from": 6501259670, "to": 6712149512, "type": "DATA" }, { "from": 6501259745, "to": 6706266480, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-mount.json", "source_sha256": "8293e582e038ee5550db7c0d5c67dc1a169131d94320303460c2a05345a5a465", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-mount.txt", "stdout_bytes": 24613, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1838152d0;pdgo @ 0x1838152d0;afij @ 0x1838152d0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1838152d0;pdgo @ 0x1838152d0;afij @ 0x1838152d0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-path", "analyst_label": "Shutdown（服务关闭）；不是路径解析", "label_is_original_symbol": false, "evidence_id": "ev_630ca1da1365a44bcf6cafeaa2c1265e92a253124ab39a299cc74fc7b242b2e9", "address": "0x183819180", "function": { "address": "0x183819180", "size": 595, "name": "fcn.183819180", "signature": "fcn.183819180(int64_t arg1);", "callrefs": [ { "from": 6501274065, "to": 6445650832, "type": "CALL" }, { "from": 6501274091, "to": 6524031184, "type": "CALL" }, { "from": 6501274112, "to": 6524031184, "type": "CALL" }, { "from": 6501274124, "to": 6462379168, "type": "CALL" }, { "from": 6501274145, "to": 6524031184, "type": "CALL" }, { "from": 6501274157, "to": 6462379168, "type": "CALL" }, { "from": 6501274176, "to": 6445656528, "type": "CALL" }, { "from": 6501274240, "to": 6511512544, "type": "CALL" }, { "from": 6501274291, "to": 6511975280, "type": "CALL" }, { "from": 6501274299, "to": 6518967168, "type": "CALL" }, { "from": 6501274332, "to": 6501339488, "type": "CALL" }, { "from": 6501274351, "to": 6501351456, "type": "CALL" }, { "from": 6501274381, "to": 6501351056, "type": "CALL" }, { "from": 6501274402, "to": 6501351280, "type": "CALL" }, { "from": 6501274427, "to": 6501274592, "type": "CALL" }, { "from": 6501274448, "to": 6542067384, "type": "CALL" }, { "from": 6501274533, "to": 6511512544, "type": "CALL" }, { "from": 6501274538, "to": 6501274509, "type": "CODE" }, { "from": 6501274568, "to": 6740346544, "type": "CALL" }, { "from": 6501274574, "to": 6501274280, "type": "CODE" } ], "datarefs": [ { "from": 6501274005, "to": 6742246848, "type": "DATA" }, { "from": 6501274018, "to": 6741126112, "type": "DATA" }, { "from": 6501274027, "to": 6742246856, "type": "DATA" }, { "from": 6501274041, "to": 6723615496, "type": "DATA" }, { "from": 6501274075, "to": 6720303740, "type": "DATA" }, { "from": 6501274096, "to": 6723616856, "type": "DATA" }, { "from": 6501274129, "to": 6723616896, "type": "DATA" }, { "from": 6501274162, "to": 6710367816, "type": "DATA" }, { "from": 6501274188, "to": 6708900496, "type": "DATA" }, { "from": 6501274200, "to": 6708923712, "type": "DATA" }, { "from": 6501274250, "to": 6708923824, "type": "DATA" }, { "from": 6501274264, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-path.json", "source_sha256": "30f9d8b49729ffd0c990d442b1d82528463630cb8610b07d84dd2292faf25d27", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-path.txt", "stdout_bytes": 7849, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183819180;pdgo @ 0x183819180;afij @ 0x183819180", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183819180;pdgo @ 0x183819180;afij @ 0x183819180", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-preview-source", "analyst_label": "StartDataRequest（本地预览源分发）", "label_is_original_symbol": false, "evidence_id": "ev_e2d499574ded223a15e75c25d416333dd080248c73fab22c2061ae5369911ee0", "address": "0x183696610", "function": { "address": "0x183696610", "size": 1724, "name": "fcn.183696610", "signature": "fcn.183696610(int64_t arg1, int64_t arg2, int64_t arg4);", "callrefs": [ { "from": 6499690055, "to": 6499691728, "type": "CALL" }, { "from": 6499690109, "to": 6499692000, "type": "CALL" }, { "from": 6499690133, "to": 6481026848, "type": "CALL" }, { "from": 6499690147, "to": 6512708384, "type": "CALL" }, { "from": 6499690212, "to": 6499709184, "type": "CALL" }, { "from": 6499690267, "to": 6740346544, "type": "CALL" }, { "from": 6499690285, "to": 6740346544, "type": "CALL" }, { "from": 6499690355, "to": 6511512544, "type": "CALL" }, { "from": 6499690387, "to": 6511512544, "type": "CALL" }, { "from": 6499690419, "to": 6511512544, "type": "CALL" }, { "from": 6499690424, "to": 6499690504, "type": "CODE" }, { "from": 6499690466, "to": 6740346544, "type": "CALL" }, { "from": 6499690484, "to": 6740346544, "type": "CALL" }, { "from": 6499690540, "to": 6511512544, "type": "CALL" }, { "from": 6499690585, "to": 6511512544, "type": "CALL" }, { "from": 6499690590, "to": 6499690833, "type": "CODE" }, { "from": 6499690600, "to": 6542067384, "type": "CALL" }, { "from": 6499690613, "to": 6542067384, "type": "CALL" }, { "from": 6499690677, "to": 6542436672, "type": "CALL" }, { "from": 6499690795, "to": 6740346544, "type": "CALL" }, { "from": 6499690813, "to": 6740346544, "type": "CALL" }, { "from": 6499690903, "to": 6740346544, "type": "CALL" }, { "from": 6499690909, "to": 6499690841, "type": "CODE" }, { "from": 6499690995, "to": 6542067384, "type": "CALL" }, { "from": 6499691073, "to": 6542067384, "type": "CALL" }, { "from": 6499691129, "to": 6499698464, "type": "CALL" }, { "from": 6499691198, "to": 6512942288, "type": "CALL" }, { "from": 6499691208, "to": 6542067384, "type": "CALL" }, { "from": 6499691228, "to": 6542067384, "type": "CALL" }, { "from": 6499691298, "to": 6542067384, "type": "CALL" }, { "from": 6499691374, "to": 6511423872, "type": "CALL" }, { "from": 6499691414, "to": 6463429312, "type": "CALL" }, { "from": 6499691419, "to": 6499690305, "type": "CODE" }, { "from": 6499691435, "to": 6511513840, "type": "CALL" }, { "from": 6499691440, "to": 6499691173, "type": "CODE" }, { "from": 6499691461, "to": 6610248464, "type": "CALL" }, { "from": 6499691512, "to": 6740346544, "type": "CALL" }, { "from": 6499691530, "to": 6740346544, "type": "CALL" }, { "from": 6499691558, "to": 6499690296, "type": "CODE" }, { "from": 6499691584, "to": 6740346544, "type": "CALL" }, { "from": 6499691590, "to": 6499690305, "type": "CODE" }, { "from": 6499691606, "to": 6542089024, "type": "CALL" }, { "from": 6499691643, "to": 6740346544, "type": "CALL" }, { "from": 6499691649, "to": 6499690833, "type": "CODE" }, { "from": 6499691678, "to": 6740346544, "type": "CALL" }, { "from": 6499691684, "to": 6499690504, "type": "CODE" }, { "from": 6499691713, "to": 6740346544, "type": "CALL" }, { "from": 6499691719, "to": 6499691550, "type": "CODE" } ], "datarefs": [ { "from": 6499690034, "to": 6740709440, "type": "DATA" }, { "from": 6499690126, "to": 6742178400, "type": "DATA" }, { "from": 6499690634, "to": 6723513488, "type": "DATA" }, { "from": 6499690661, "to": 6723513488, "type": "DATA" }, { "from": 6499690693, "to": 6710332144, "type": "DATA" }, { "from": 6499690852, "to": 6740709440, "type": "DATA" }, { "from": 6499690960, "to": 6718095440, "type": "DATA" }, { "from": 6499690971, "to": 6718095448, "type": "DATA" }, { "from": 6499691010, "to": 6499696464, "type": "DATA" }, { "from": 6499691021, "to": 6495420080, "type": "DATA" }, { "from": 6499691032, "to": 6511490512, "type": "DATA" }, { "from": 6499691043, "to": 6499693392, "type": "DATA" }, { "from": 6499691083, "to": 6499696656, "type": "DATA" }, { "from": 6499691094, "to": 6499696800, "type": "DATA" }, { "from": 6499691109, "to": 6499704752, "type": "DATA" }, { "from": 6499691173, "to": 6722694264, "type": "DATA" }, { "from": 6499691180, "to": 6723513584, "type": "DATA" }, { "from": 6499691240, "to": 6462662976, "type": "DATA" }, { "from": 6499691251, "to": 6499697824, "type": "DATA" }, { "from": 6499691266, "to": 6499696960, "type": "DATA" }, { "from": 6499691308, "to": 6443185472, "type": "DATA" }, { "from": 6499691319, "to": 6496379968, "type": "DATA" }, { "from": 6499691334, "to": 6499697312, "type": "DATA" }, { "from": 6499691362, "to": 6741126408, "type": "DATA" }, { "from": 6499691394, "to": 6723513564, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-preview-source.json", "source_sha256": "e781db3d2cd2002cff0bad3ac8490d9b41b82b0805b331fd9d4f871a123206aa", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-preview-source.txt", "stdout_bytes": 25056, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183696610;pdgo @ 0x183696610;afij @ 0x183696610", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183696610;pdgo @ 0x183696610;afij @ 0x183696610", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-read-bridge", "analyst_label": "FuseRead（校验句柄来源并安排异步读）", "label_is_original_symbol": false, "evidence_id": "ev_21f54737192c69901294d7b9c9b1c57ec6999e355f4a1f479955352416ca9dd2", "address": "0x183823560", "function": { "address": "0x183823560", "size": 1392, "name": "fcn.183823560", "signature": "fcn.183823560(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_38h);", "callrefs": [ { "from": 6501316039, "to": 6445650832, "type": "CALL" }, { "from": 6501316062, "to": 6524031184, "type": "CALL" }, { "from": 6501316083, "to": 6524031184, "type": "CALL" }, { "from": 6501316102, "to": 6501223616, "type": "CALL" }, { "from": 6501316133, "to": 6524031184, "type": "CALL" }, { "from": 6501316154, "to": 6524031184, "type": "CALL" }, { "from": 6501316185, "to": 6524031184, "type": "CALL" }, { "from": 6501316206, "to": 6524031184, "type": "CALL" }, { "from": 6501316217, "to": 6462379168, "type": "CALL" }, { "from": 6501316238, "to": 6524031184, "type": "CALL" }, { "from": 6501316249, "to": 6524048128, "type": "CALL" }, { "from": 6501316270, "to": 6524031184, "type": "CALL" }, { "from": 6501316280, "to": 6530586256, "type": "CALL" }, { "from": 6501316315, "to": 6511512544, "type": "CALL" }, { "from": 6501316339, "to": 6445656528, "type": "CALL" }, { "from": 6501316400, "to": 6511512544, "type": "CALL" }, { "from": 6501316455, "to": 6511975280, "type": "CALL" }, { "from": 6501316463, "to": 6518967168, "type": "CALL" }, { "from": 6501316505, "to": 6501294352, "type": "CALL" }, { "from": 6501316523, "to": 6542067384, "type": "CALL" }, { "from": 6501316671, "to": 6740346544, "type": "CALL" }, { "from": 6501316689, "to": 6740346544, "type": "CALL" }, { "from": 6501316743, "to": 6511512544, "type": "CALL" }, { "from": 6501316748, "to": 6501317194, "type": "CODE" }, { "from": 6501316784, "to": 6542067384, "type": "CALL" }, { "from": 6501316875, "to": 6511423872, "type": "CALL" }, { "from": 6501316885, "to": 6542067384, "type": "CALL" }, { "from": 6501316987, "to": 6512942288, "type": "CALL" }, { "from": 6501316997, "to": 6542067384, "type": "CALL" }, { "from": 6501317017, "to": 6542067384, "type": "CALL" }, { "from": 6501317080, "to": 6542067384, "type": "CALL" }, { "from": 6501317147, "to": 6511423872, "type": "CALL" }, { "from": 6501317181, "to": 6463429312, "type": "CALL" }, { "from": 6501317214, "to": 6511512544, "type": "CALL" }, { "from": 6501317257, "to": 6740346544, "type": "CALL" }, { "from": 6501317263, "to": 6501317228, "type": "CODE" }, { "from": 6501317279, "to": 6511512544, "type": "CALL" }, { "from": 6501317284, "to": 6501316712, "type": "CODE" }, { "from": 6501317317, "to": 6740346544, "type": "CALL" }, { "from": 6501317323, "to": 6501316444, "type": "CODE" } ], "datarefs": [ { "from": 6501315982, "to": 6742246848, "type": "DATA" }, { "from": 6501315995, "to": 6741126112, "type": "DATA" }, { "from": 6501316004, "to": 6742246856, "type": "DATA" }, { "from": 6501316018, "to": 6723615496, "type": "DATA" }, { "from": 6501316049, "to": 6720303740, "type": "DATA" }, { "from": 6501316067, "to": 6723618088, "type": "DATA" }, { "from": 6501316138, "to": 6723615368, "type": "DATA" }, { "from": 6501316190, "to": 6723618128, "type": "DATA" }, { "from": 6501316222, "to": 6712262456, "type": "DATA" }, { "from": 6501316254, "to": 6713565508, "type": "DATA" }, { "from": 6501316320, "to": 6710367816, "type": "DATA" }, { "from": 6501316352, "to": 6708900496, "type": "DATA" }, { "from": 6501316364, "to": 6708923712, "type": "DATA" }, { "from": 6501316413, "to": 6708923824, "type": "DATA" }, { "from": 6501316428, "to": 6742217808, "type": "DATA" }, { "from": 6501316570, "to": 6723617688, "type": "DATA" }, { "from": 6501316599, "to": 6723617702, "type": "DATA" }, { "from": 6501316610, "to": 6723617688, "type": "DATA" }, { "from": 6501316798, "to": 6501344976, "type": "DATA" }, { "from": 6501316809, "to": 6495420080, "type": "DATA" }, { "from": 6501316820, "to": 6511490512, "type": "DATA" }, { "from": 6501316863, "to": 6741126408, "type": "DATA" }, { "from": 6501316902, "to": 6501345696, "type": "DATA" }, { "from": 6501316913, "to": 6490195952, "type": "DATA" }, { "from": 6501316928, "to": 6501317328, "type": "DATA" }, { "from": 6501316962, "to": 6723618144, "type": "DATA" }, { "from": 6501316969, "to": 6723615496, "type": "DATA" }, { "from": 6501317025, "to": 6462662976, "type": "DATA" }, { "from": 6501317036, "to": 6501354544, "type": "DATA" }, { "from": 6501317051, "to": 6501353984, "type": "DATA" }, { "from": 6501317091, "to": 6443185472, "type": "DATA" }, { "from": 6501317102, "to": 6496379968, "type": "DATA" }, { "from": 6501317117, "to": 6501354224, "type": "DATA" }, { "from": 6501317135, "to": 6741126408, "type": "DATA" }, { "from": 6501317164, "to": 6723618133, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-read-bridge.json", "source_sha256": "cd2c42b76c3656e9b9e39e89e3dabe69c19682c73e6b2361cd199012b397e9bc", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-read-bridge.txt", "stdout_bytes": 18525, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183823560;pdgo @ 0x183823560;afij @ 0x183823560", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183823560;pdgo @ 0x183823560;afij @ 0x183823560", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-read-worker", "analyst_label": "按文件句柄和 offset 读；最大 1 MiB", "label_is_original_symbol": false, "evidence_id": "ev_230d4d9f3fa0bcda4571f20a4660a9a5a4527ea2e643264b31a2f37745f1e93e", "address": "0x183823ad0", "function": { "address": "0x183823ad0", "size": 1599, "name": "fcn.183823ad0", "signature": "fcn.183823ad0(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);", "callrefs": [ { "from": 6501317359, "to": 6740380256, "type": "CALL" }, { "from": 6501317394, "to": 6501317405, "type": "CODE" }, { "from": 6501317417, "to": 6501317400, "type": "CODE" }, { "from": 6501317458, "to": 6501318408, "type": "CODE" }, { "from": 6501317503, "to": 6445650832, "type": "CALL" }, { "from": 6501317529, "to": 6524031184, "type": "CALL" }, { "from": 6501317550, "to": 6524031184, "type": "CALL" }, { "from": 6501317561, "to": 6462379168, "type": "CALL" }, { "from": 6501317582, "to": 6524031184, "type": "CALL" }, { "from": 6501317593, "to": 6524048128, "type": "CALL" }, { "from": 6501317614, "to": 6524031184, "type": "CALL" }, { "from": 6501317625, "to": 6530586256, "type": "CALL" }, { "from": 6501317644, "to": 6445656528, "type": "CALL" }, { "from": 6501317712, "to": 6511512544, "type": "CALL" }, { "from": 6501317763, "to": 6511975280, "type": "CALL" }, { "from": 6501317771, "to": 6518967168, "type": "CALL" }, { "from": 6501317800, "to": 6740379744, "type": "CALL" }, { "from": 6501317886, "to": 6445650832, "type": "CALL" }, { "from": 6501317912, "to": 6524031184, "type": "CALL" }, { "from": 6501317933, "to": 6524031184, "type": "CALL" }, { "from": 6501317944, "to": 6462379168, "type": "CALL" }, { "from": 6501317965, "to": 6524031184, "type": "CALL" }, { "from": 6501317976, "to": 6530586256, "type": "CALL" }, { "from": 6501317997, "to": 6524031184, "type": "CALL" }, { "from": 6501318007, "to": 6530586256, "type": "CALL" }, { "from": 6501318028, "to": 6445656528, "type": "CALL" }, { "from": 6501318096, "to": 6511512544, "type": "CALL" }, { "from": 6501318147, "to": 6511975280, "type": "CALL" }, { "from": 6501318155, "to": 6518967168, "type": "CALL" }, { "from": 6501318166, "to": 6542067384, "type": "CALL" }, { "from": 6501318194, "to": 6542434496, "type": "CALL" }, { "from": 6501318215, "to": 6453223840, "type": "CALL" }, { "from": 6501318279, "to": 6542067384, "type": "CALL" }, { "from": 6501318319, "to": 6542434496, "type": "CALL" }, { "from": 6501318333, "to": 6542436672, "type": "CALL" }, { "from": 6501318349, "to": 6511512544, "type": "CALL" }, { "from": 6501318378, "to": 6501317797, "type": "CODE" }, { "from": 6501318393, "to": 6512700960, "type": "CALL" }, { "from": 6501318398, "to": 6501317373, "type": "CODE" }, { "from": 6501318406, "to": 6501318360, "type": "CODE" }, { "from": 6501318411, "to": 6501318199, "type": "CODE" }, { "from": 6501318441, "to": 6740346544, "type": "CALL" }, { "from": 6501318447, "to": 6501317752, "type": "CODE" }, { "from": 6501318489, "to": 6445650832, "type": "CALL" }, { "from": 6501318515, "to": 6524031184, "type": "CALL" }, { "from": 6501318536, "to": 6524031184, "type": "CALL" }, { "from": 6501318547, "to": 6462379168, "type": "CALL" }, { "from": 6501318568, "to": 6524031184, "type": "CALL" }, { "from": 6501318579, "to": 6524048128, "type": "CALL" }, { "from": 6501318600, "to": 6524031184, "type": "CALL" }, { "from": 6501318610, "to": 6530586256, "type": "CALL" }, { "from": 6501318631, "to": 6524031184, "type": "CALL" }, { "from": 6501318644, "to": 6446762512, "type": "CALL" }, { "from": 6501318665, "to": 6445656528, "type": "CALL" }, { "from": 6501318734, "to": 6511512544, "type": "CALL" }, { "from": 6501318781, "to": 6511975280, "type": "CALL" }, { "from": 6501318789, "to": 6518967168, "type": "CALL" }, { "from": 6501318845, "to": 6511512544, "type": "CALL" }, { "from": 6501318850, "to": 6501317797, "type": "CODE" }, { "from": 6501318880, "to": 6740346544, "type": "CALL" }, { "from": 6501318886, "to": 6501318136, "type": "CODE" }, { "from": 6501318916, "to": 6740346544, "type": "CALL" }, { "from": 6501318922, "to": 6501318770, "type": "CODE" } ], "datarefs": [ { "from": 6501317463, "to": 6742246848, "type": "DATA" }, { "from": 6501317476, "to": 6723615496, "type": "DATA" }, { "from": 6501317513, "to": 6720303740, "type": "DATA" }, { "from": 6501317534, "to": 6723619848, "type": "DATA" }, { "from": 6501317566, "to": 6712262456, "type": "DATA" }, { "from": 6501317598, "to": 6713565508, "type": "DATA" }, { "from": 6501317630, "to": 6710367816, "type": "DATA" }, { "from": 6501317656, "to": 6708900496, "type": "DATA" }, { "from": 6501317668, "to": 6708923712, "type": "DATA" }, { "from": 6501317722, "to": 6708923824, "type": "DATA" }, { "from": 6501317736, "to": 6742217808, "type": "DATA" }, { "from": 6501317829, "to": 6742246848, "type": "DATA" }, { "from": 6501317842, "to": 6741126112, "type": "DATA" }, { "from": 6501317851, "to": 6742246856, "type": "DATA" }, { "from": 6501317865, "to": 6723615496, "type": "DATA" }, { "from": 6501317896, "to": 6720303740, "type": "DATA" }, { "from": 6501317917, "to": 6723619888, "type": "DATA" }, { "from": 6501317949, "to": 6723619928, "type": "DATA" }, { "from": 6501317981, "to": 6723619944, "type": "DATA" }, { "from": 6501318012, "to": 6710367816, "type": "DATA" }, { "from": 6501318040, "to": 6708900496, "type": "DATA" }, { "from": 6501318052, "to": 6708923712, "type": "DATA" }, { "from": 6501318106, "to": 6708923824, "type": "DATA" }, { "from": 6501318120, "to": 6742217808, "type": "DATA" }, { "from": 6501318383, "to": 6724150288, "type": "DATA" }, { "from": 6501318452, "to": 6742246848, "type": "DATA" }, { "from": 6501318465, "to": 6723615496, "type": "DATA" }, { "from": 6501318499, "to": 6720303740, "type": "DATA" }, { "from": 6501318520, "to": 6723619960, "type": "DATA" }, { "from": 6501318552, "to": 6712262456, "type": "DATA" }, { "from": 6501318584, "to": 6713565508, "type": "DATA" }, { "from": 6501318615, "to": 6723615680, "type": "DATA" }, { "from": 6501318649, "to": 6710367816, "type": "DATA" }, { "from": 6501318678, "to": 6708900496, "type": "DATA" }, { "from": 6501318690, "to": 6708923712, "type": "DATA" }, { "from": 6501318744, "to": 6708923824, "type": "DATA" }, { "from": 6501318758, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-read-worker.json", "source_sha256": "0e44264c5ceb15e34ea307f840aad56fea81c71bcc1922db9717cd5a741d181e", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-read-worker.txt", "stdout_bytes": 21648, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183823ad0;pdgo @ 0x183823ad0;afij @ 0x183823ad0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183823ad0;pdgo @ 0x183823ad0;afij @ 0x183823ad0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-read", "analyst_label": "ValidatePath（路径校验）；不是 read", "label_is_original_symbol": false, "evidence_id": "ev_56a6cee4fa66403f78732fca7f37e9bd42ceb6bbb4a09967ecf328dbe1188699", "address": "0x18381ed30", "function": { "address": "0x18381ed30", "size": 2916, "name": "fcn.18381ed30", "signature": "fcn.18381ed30(int64_t arg1, int64_t arg2, int64_t arg3);", "callrefs": [ { "from": 6501297559, "to": 6542434272, "type": "CALL" }, { "from": 6501297571, "to": 6501297669, "type": "CODE" }, { "from": 6501297604, "to": 6501297569, "type": "CODE" }, { "from": 6501297651, "to": 6454999952, "type": "CALL" }, { "from": 6501297656, "to": 6501298217, "type": "CODE" }, { "from": 6501297683, "to": 6501297661, "type": "CODE" }, { "from": 6501297817, "to": 6501298492, "type": "CODE" }, { "from": 6501297833, "to": 6511513840, "type": "CALL" }, { "from": 6501297838, "to": 6501297770, "type": "CODE" }, { "from": 6501297856, "to": 6501298217, "type": "CODE" }, { "from": 6501297901, "to": 6445650832, "type": "CALL" }, { "from": 6501297927, "to": 6524031184, "type": "CALL" }, { "from": 6501297948, "to": 6524031184, "type": "CALL" }, { "from": 6501297969, "to": 6524031184, "type": "CALL" }, { "from": 6501297988, "to": 6501293936, "type": "CALL" }, { "from": 6501298019, "to": 6524031184, "type": "CALL" }, { "from": 6501298051, "to": 6511512544, "type": "CALL" }, { "from": 6501298077, "to": 6445656528, "type": "CALL" }, { "from": 6501298148, "to": 6511512544, "type": "CALL" }, { "from": 6501298202, "to": 6511975280, "type": "CALL" }, { "from": 6501298210, "to": 6518967168, "type": "CALL" }, { "from": 6501298282, "to": 6454999952, "type": "CALL" }, { "from": 6501298314, "to": 6511512544, "type": "CALL" }, { "from": 6501298319, "to": 6501298217, "type": "CODE" }, { "from": 6501298336, "to": 6501298287, "type": "CODE" }, { "from": 6501298393, "to": 6542436672, "type": "CALL" }, { "from": 6501298429, "to": 6511512544, "type": "CALL" }, { "from": 6501298579, "to": 6542067384, "type": "CALL" }, { "from": 6501298624, "to": 6501298354, "type": "CODE" }, { "from": 6501298637, "to": 6501298646, "type": "CODE" }, { "from": 6501298652, "to": 6455000096, "type": "CALL" }, { "from": 6501298657, "to": 6501298217, "type": "CODE" }, { "from": 6501298701, "to": 6542434272, "type": "CALL" }, { "from": 6501298768, "to": 6445650832, "type": "CALL" }, { "from": 6501298794, "to": 6524031184, "type": "CALL" }, { "from": 6501298815, "to": 6524031184, "type": "CALL" }, { "from": 6501298836, "to": 6524031184, "type": "CALL" }, { "from": 6501298857, "to": 6501293936, "type": "CALL" }, { "from": 6501298888, "to": 6524031184, "type": "CALL" }, { "from": 6501298923, "to": 6511512544, "type": "CALL" }, { "from": 6501298949, "to": 6445656528, "type": "CALL" }, { "from": 6501299020, "to": 6511512544, "type": "CALL" }, { "from": 6501299074, "to": 6511975280, "type": "CALL" }, { "from": 6501299082, "to": 6518967168, "type": "CALL" }, { "from": 6501299089, "to": 6501298287, "type": "CODE" }, { "from": 6501299137, "to": 6513233600, "type": "CALL" }, { "from": 6501299197, "to": 6536562960, "type": "CALL" }, { "from": 6501299231, "to": 6511512544, "type": "CALL" }, { "from": 6501299263, "to": 6459494464, "type": "CALL" }, { "from": 6501299280, "to": 6529181184, "type": "CALL" }, { "from": 6501299338, "to": 6454999952, "type": "CALL" }, { "from": 6501299367, "to": 6511512544, "type": "CALL" }, { "from": 6501299372, "to": 6501298287, "type": "CODE" }, { "from": 6501299439, "to": 6445650832, "type": "CALL" }, { "from": 6501299465, "to": 6524031184, "type": "CALL" }, { "from": 6501299486, "to": 6524031184, "type": "CALL" }, { "from": 6501299507, "to": 6524031184, "type": "CALL" }, { "from": 6501299528, "to": 6501293936, "type": "CALL" }, { "from": 6501299559, "to": 6524031184, "type": "CALL" }, { "from": 6501299594, "to": 6511512544, "type": "CALL" }, { "from": 6501299620, "to": 6445656528, "type": "CALL" }, { "from": 6501299688, "to": 6501298148, "type": "CODE" }, { "from": 6501299710, "to": 6501299343, "type": "CODE" }, { "from": 6501299723, "to": 6501299732, "type": "CODE" }, { "from": 6501299735, "to": 6455000096, "type": "CALL" }, { "from": 6501299740, "to": 6501298287, "type": "CODE" }, { "from": 6501299785, "to": 6445650832, "type": "CALL" }, { "from": 6501299811, "to": 6524031184, "type": "CALL" }, { "from": 6501299829, "to": 6501298812, "type": "CODE" }, { "from": 6501299874, "to": 6445650832, "type": "CALL" }, { "from": 6501299900, "to": 6524031184, "type": "CALL" }, { "from": 6501299921, "to": 6524031184, "type": "CALL" }, { "from": 6501299942, "to": 6524031184, "type": "CALL" }, { "from": 6501299958, "to": 6501293936, "type": "CALL" }, { "from": 6501299993, "to": 6524031184, "type": "CALL" }, { "from": 6501300034, "to": 6511512544, "type": "CALL" }, { "from": 6501300060, "to": 6445656528, "type": "CALL" }, { "from": 6501300131, "to": 6511512544, "type": "CALL" }, { "from": 6501300185, "to": 6511975280, "type": "CALL" }, { "from": 6501300193, "to": 6518967168, "type": "CALL" }, { "from": 6501300200, "to": 6501299343, "type": "CODE" }, { "from": 6501300226, "to": 6455000096, "type": "CALL" }, { "from": 6501300231, "to": 6501299343, "type": "CODE" }, { "from": 6501300238, "to": 6542702416, "type": "CALL" }, { "from": 6501300268, "to": 6740346544, "type": "CALL" }, { "from": 6501300274, "to": 6501298191, "type": "CODE" }, { "from": 6501300304, "to": 6740346544, "type": "CALL" }, { "from": 6501300310, "to": 6501299063, "type": "CODE" }, { "from": 6501300326, "to": 6449318512, "type": "CALL" }, { "from": 6501300331, "to": 6501299268, "type": "CODE" }, { "from": 6501300361, "to": 6740346544, "type": "CALL" }, { "from": 6501300367, "to": 6501300174, "type": "CODE" } ], "datarefs": [ { "from": 6501297576, "to": 6712114924, "type": "DATA" }, { "from": 6501297861, "to": 6742246848, "type": "DATA" }, { "from": 6501297874, "to": 6723615496, "type": "DATA" }, { "from": 6501297914, "to": 6720303740, "type": "DATA" }, { "from": 6501297932, "to": 6723619024, "type": "DATA" }, { "from": 6501297953, "to": 6723615436, "type": "DATA" }, { "from": 6501298056, "to": 6710367816, "type": "DATA" }, { "from": 6501298090, "to": 6708900496, "type": "DATA" }, { "from": 6501298105, "to": 6708923712, "type": "DATA" }, { "from": 6501298161, "to": 6708923824, "type": "DATA" }, { "from": 6501298175, "to": 6742217808, "type": "DATA" }, { "from": 6501298728, "to": 6742246848, "type": "DATA" }, { "from": 6501298741, "to": 6723615496, "type": "DATA" }, { "from": 6501298781, "to": 6720303740, "type": "DATA" }, { "from": 6501298799, "to": 6723619080, "type": "DATA" }, { "from": 6501298820, "to": 6723615436, "type": "DATA" }, { "from": 6501298928, "to": 6710367816, "type": "DATA" }, { "from": 6501298962, "to": 6708900496, "type": "DATA" }, { "from": 6501298977, "to": 6708923712, "type": "DATA" }, { "from": 6501299033, "to": 6708923824, "type": "DATA" }, { "from": 6501299047, "to": 6742217808, "type": "DATA" }, { "from": 6501299236, "to": 6742246932, "type": "DATA" }, { "from": 6501299399, "to": 6742246848, "type": "DATA" }, { "from": 6501299412, "to": 6723615496, "type": "DATA" }, { "from": 6501299452, "to": 6720303740, "type": "DATA" }, { "from": 6501299470, "to": 6723618976, "type": "DATA" }, { "from": 6501299491, "to": 6723615436, "type": "DATA" }, { "from": 6501299599, "to": 6710367816, "type": "DATA" }, { "from": 6501299633, "to": 6708900496, "type": "DATA" }, { "from": 6501299648, "to": 6708923712, "type": "DATA" }, { "from": 6501299745, "to": 6742246848, "type": "DATA" }, { "from": 6501299758, "to": 6723615496, "type": "DATA" }, { "from": 6501299798, "to": 6720303740, "type": "DATA" }, { "from": 6501299816, "to": 6723619024, "type": "DATA" }, { "from": 6501299834, "to": 6742246848, "type": "DATA" }, { "from": 6501299847, "to": 6723615496, "type": "DATA" }, { "from": 6501299887, "to": 6720303740, "type": "DATA" }, { "from": 6501299905, "to": 6723619128, "type": "DATA" }, { "from": 6501299926, "to": 6723615436, "type": "DATA" }, { "from": 6501300039, "to": 6710367816, "type": "DATA" }, { "from": 6501300073, "to": 6708900496, "type": "DATA" }, { "from": 6501300088, "to": 6708923712, "type": "DATA" }, { "from": 6501300144, "to": 6708923824, "type": "DATA" }, { "from": 6501300158, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-read.json", "source_sha256": "ea01ccd78edf292ec2749e41ef9f34b9f06757cf233220e006b68585658f0d08", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-read.txt", "stdout_bytes": 42137, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x18381ed30;pdgo @ 0x18381ed30;afij @ 0x18381ed30", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x18381ed30;pdgo @ 0x18381ed30;afij @ 0x18381ed30", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-write-bridge", "analyst_label": "FuseWrite（校验句柄来源并安排异步写）", "label_is_original_symbol": false, "evidence_id": "ev_2f059e2f36282a64b32a0832aec5c3e11499b7987fb3a0299913d77259dbde90", "address": "0x183824110", "function": { "address": "0x183824110", "size": 1397, "name": "fcn.183824110", "signature": "fcn.183824110(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_38h);", "callrefs": [ { "from": 6501319036, "to": 6445650832, "type": "CALL" }, { "from": 6501319059, "to": 6524031184, "type": "CALL" }, { "from": 6501319080, "to": 6524031184, "type": "CALL" }, { "from": 6501319099, "to": 6501223616, "type": "CALL" }, { "from": 6501319130, "to": 6524031184, "type": "CALL" }, { "from": 6501319151, "to": 6524031184, "type": "CALL" }, { "from": 6501319179, "to": 6524031184, "type": "CALL" }, { "from": 6501319200, "to": 6524031184, "type": "CALL" }, { "from": 6501319211, "to": 6462379168, "type": "CALL" }, { "from": 6501319232, "to": 6524031184, "type": "CALL" }, { "from": 6501319243, "to": 6524048128, "type": "CALL" }, { "from": 6501319264, "to": 6524031184, "type": "CALL" }, { "from": 6501319275, "to": 6462379168, "type": "CALL" }, { "from": 6501319310, "to": 6511512544, "type": "CALL" }, { "from": 6501319334, "to": 6445656528, "type": "CALL" }, { "from": 6501319396, "to": 6511512544, "type": "CALL" }, { "from": 6501319449, "to": 6511975280, "type": "CALL" }, { "from": 6501319457, "to": 6518967168, "type": "CALL" }, { "from": 6501319499, "to": 6501294352, "type": "CALL" }, { "from": 6501319517, "to": 6542067384, "type": "CALL" }, { "from": 6501319664, "to": 6740346544, "type": "CALL" }, { "from": 6501319682, "to": 6740346544, "type": "CALL" }, { "from": 6501319719, "to": 6511512544, "type": "CALL" }, { "from": 6501319724, "to": 6501320174, "type": "CODE" }, { "from": 6501319741, "to": 6542067384, "type": "CALL" }, { "from": 6501319832, "to": 6511423872, "type": "CALL" }, { "from": 6501319842, "to": 6542067384, "type": "CALL" }, { "from": 6501319971, "to": 6512942288, "type": "CALL" }, { "from": 6501319981, "to": 6542067384, "type": "CALL" }, { "from": 6501319997, "to": 6542067384, "type": "CALL" }, { "from": 6501320060, "to": 6542067384, "type": "CALL" }, { "from": 6501320127, "to": 6511423872, "type": "CALL" }, { "from": 6501320161, "to": 6463429312, "type": "CALL" }, { "from": 6501320194, "to": 6511512544, "type": "CALL" }, { "from": 6501320259, "to": 6740346544, "type": "CALL" }, { "from": 6501320265, "to": 6501320216, "type": "CODE" }, { "from": 6501320279, "to": 6511512544, "type": "CALL" }, { "from": 6501320284, "to": 6501320207, "type": "CODE" }, { "from": 6501320314, "to": 6740346544, "type": "CALL" }, { "from": 6501320320, "to": 6501319438, "type": "CODE" } ], "datarefs": [ { "from": 6501318967, "to": 6742246848, "type": "DATA" }, { "from": 6501318980, "to": 6741126112, "type": "DATA" }, { "from": 6501318989, "to": 6742246856, "type": "DATA" }, { "from": 6501319015, "to": 6723615496, "type": "DATA" }, { "from": 6501319046, "to": 6720303740, "type": "DATA" }, { "from": 6501319064, "to": 6723618160, "type": "DATA" }, { "from": 6501319135, "to": 6723615368, "type": "DATA" }, { "from": 6501319184, "to": 6723618128, "type": "DATA" }, { "from": 6501319216, "to": 6712262456, "type": "DATA" }, { "from": 6501319248, "to": 6713565508, "type": "DATA" }, { "from": 6501319315, "to": 6710367816, "type": "DATA" }, { "from": 6501319347, "to": 6708900496, "type": "DATA" }, { "from": 6501319359, "to": 6708923712, "type": "DATA" }, { "from": 6501319406, "to": 6708923824, "type": "DATA" }, { "from": 6501319422, "to": 6742217808, "type": "DATA" }, { "from": 6501319564, "to": 6723617688, "type": "DATA" }, { "from": 6501319601, "to": 6723617702, "type": "DATA" }, { "from": 6501319612, "to": 6723617688, "type": "DATA" }, { "from": 6501319755, "to": 6501345760, "type": "DATA" }, { "from": 6501319766, "to": 6495420080, "type": "DATA" }, { "from": 6501319777, "to": 6511490512, "type": "DATA" }, { "from": 6501319820, "to": 6741126408, "type": "DATA" }, { "from": 6501319859, "to": 6501346208, "type": "DATA" }, { "from": 6501319870, "to": 6501346336, "type": "DATA" }, { "from": 6501319885, "to": 6501320336, "type": "DATA" }, { "from": 6501319946, "to": 6723618208, "type": "DATA" }, { "from": 6501319953, "to": 6723615496, "type": "DATA" }, { "from": 6501320005, "to": 6462662976, "type": "DATA" }, { "from": 6501320016, "to": 6501354880, "type": "DATA" }, { "from": 6501320031, "to": 6462666160, "type": "DATA" }, { "from": 6501320071, "to": 6443185472, "type": "DATA" }, { "from": 6501320082, "to": 6496379968, "type": "DATA" }, { "from": 6501320097, "to": 6501354720, "type": "DATA" }, { "from": 6501320115, "to": 6741126408, "type": "DATA" }, { "from": 6501320144, "to": 6723618198, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-write-bridge.json", "source_sha256": "efda3fe898354db061548b026ae9c233051bd3ebdd0327a79cdb623f9dc91a43", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-write-bridge.txt", "stdout_bytes": 18738, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183824110;pdgo @ 0x183824110;afij @ 0x183824110", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183824110;pdgo @ 0x183824110;afij @ 0x183824110", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-write-worker", "analyst_label": "按文件句柄和 offset 写；错误映射", "label_is_original_symbol": false, "evidence_id": "ev_fd7440eef50fadbd7de18cd706f3cdda8335d1d1ab01721909549d2e78244d5e", "address": "0x183824690", "function": { "address": "0x183824690", "size": 945, "name": "fcn.183824690", "signature": "fcn.183824690(int64_t arg1, int64_t arg2, int64_t arg3, int64_t arg4, int64_t arg_28h);", "callrefs": [ { "from": 6501320367, "to": 6740380256, "type": "CALL" }, { "from": 6501320402, "to": 6501320412, "type": "CODE" }, { "from": 6501320424, "to": 6501320407, "type": "CODE" }, { "from": 6501320458, "to": 6537193504, "type": "CALL" }, { "from": 6501320473, "to": 6501320799, "type": "CODE" }, { "from": 6501320523, "to": 6445650832, "type": "CALL" }, { "from": 6501320549, "to": 6524031184, "type": "CALL" }, { "from": 6501320570, "to": 6524031184, "type": "CALL" }, { "from": 6501320581, "to": 6462379168, "type": "CALL" }, { "from": 6501320602, "to": 6524031184, "type": "CALL" }, { "from": 6501320613, "to": 6524048128, "type": "CALL" }, { "from": 6501320634, "to": 6524031184, "type": "CALL" }, { "from": 6501320646, "to": 6462379168, "type": "CALL" }, { "from": 6501320666, "to": 6445656528, "type": "CALL" }, { "from": 6501320737, "to": 6511512544, "type": "CALL" }, { "from": 6501320784, "to": 6511975280, "type": "CALL" }, { "from": 6501320792, "to": 6518967168, "type": "CALL" }, { "from": 6501320807, "to": 6740379744, "type": "CALL" }, { "from": 6501320846, "to": 6512700960, "type": "CALL" }, { "from": 6501320851, "to": 6501320381, "type": "CODE" }, { "from": 6501320877, "to": 6740346544, "type": "CALL" }, { "from": 6501320883, "to": 6501320773, "type": "CODE" }, { "from": 6501320934, "to": 6445650832, "type": "CALL" }, { "from": 6501320960, "to": 6524031184, "type": "CALL" }, { "from": 6501320981, "to": 6524031184, "type": "CALL" }, { "from": 6501320992, "to": 6462379168, "type": "CALL" }, { "from": 6501321013, "to": 6524031184, "type": "CALL" }, { "from": 6501321024, "to": 6524048128, "type": "CALL" }, { "from": 6501321045, "to": 6524031184, "type": "CALL" }, { "from": 6501321057, "to": 6462379168, "type": "CALL" }, { "from": 6501321078, "to": 6524031184, "type": "CALL" }, { "from": 6501321091, "to": 6446762512, "type": "CALL" }, { "from": 6501321111, "to": 6445656528, "type": "CALL" }, { "from": 6501321182, "to": 6511512544, "type": "CALL" }, { "from": 6501321229, "to": 6511975280, "type": "CALL" }, { "from": 6501321237, "to": 6518967168, "type": "CALL" }, { "from": 6501321247, "to": 6501320797, "type": "CODE" }, { "from": 6501321273, "to": 6740346544, "type": "CALL" }, { "from": 6501321279, "to": 6501321218, "type": "CODE" } ], "datarefs": [ { "from": 6501320483, "to": 6742246848, "type": "DATA" }, { "from": 6501320496, "to": 6723615496, "type": "DATA" }, { "from": 6501320533, "to": 6720303740, "type": "DATA" }, { "from": 6501320554, "to": 6723620016, "type": "DATA" }, { "from": 6501320586, "to": 6712262456, "type": "DATA" }, { "from": 6501320618, "to": 6713565508, "type": "DATA" }, { "from": 6501320651, "to": 6710367816, "type": "DATA" }, { "from": 6501320679, "to": 6708900496, "type": "DATA" }, { "from": 6501320691, "to": 6708923712, "type": "DATA" }, { "from": 6501320747, "to": 6708923824, "type": "DATA" }, { "from": 6501320761, "to": 6742217808, "type": "DATA" }, { "from": 6501320836, "to": 6724150288, "type": "DATA" }, { "from": 6501320894, "to": 6742246848, "type": "DATA" }, { "from": 6501320907, "to": 6723615496, "type": "DATA" }, { "from": 6501320944, "to": 6720303740, "type": "DATA" }, { "from": 6501320965, "to": 6723620056, "type": "DATA" }, { "from": 6501320997, "to": 6712262456, "type": "DATA" }, { "from": 6501321029, "to": 6713565508, "type": "DATA" }, { "from": 6501321062, "to": 6723615680, "type": "DATA" }, { "from": 6501321096, "to": 6710367816, "type": "DATA" }, { "from": 6501321124, "to": 6708900496, "type": "DATA" }, { "from": 6501321136, "to": 6708923712, "type": "DATA" }, { "from": 6501321192, "to": 6708923824, "type": "DATA" }, { "from": 6501321206, "to": 6742217808, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-write-worker.json", "source_sha256": "012a23ac05fa457a1301d1127eb1c954d4dca4342e0eeffea010a8b6e262ab8f", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-write-worker.txt", "stdout_bytes": 12698, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x183824690;pdgo @ 0x183824690;afij @ 0x183824690", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x183824690;pdgo @ 0x183824690;afij @ 0x183824690", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] }, { "label": "b-fs-write", "analyst_label": "FuseMkdir（创建目录桥）；不是 write", "label_is_original_symbol": false, "evidence_id": "ev_ce332c4225abd15ca106920ebc125d6d6d72c57a3bac8791c25dc853db62bd38", "address": "0x1838203b0", "function": { "address": "0x1838203b0", "size": 952, "name": "fcn.1838203b0", "signature": "fcn.1838203b0(int64_t arg3, int64_t arg4, int64_t arg_28h, int64_t arg_30h, int64_t arg_78h);", "callrefs": [ { "from": 6501303299, "to": 6501294352, "type": "CALL" }, { "from": 6501303327, "to": 6542067384, "type": "CALL" }, { "from": 6501303455, "to": 6740346544, "type": "CALL" }, { "from": 6501303473, "to": 6740346544, "type": "CALL" }, { "from": 6501303503, "to": 6501304013, "type": "CODE" }, { "from": 6501303533, "to": 6501297456, "type": "CALL" }, { "from": 6501303648, "to": 6740346544, "type": "CALL" }, { "from": 6501303666, "to": 6740346544, "type": "CALL" }, { "from": 6501303703, "to": 6511512544, "type": "CALL" }, { "from": 6501303708, "to": 6501303993, "type": "CODE" }, { "from": 6501303730, "to": 6501303889, "type": "CODE" }, { "from": 6501303740, "to": 6542067384, "type": "CALL" }, { "from": 6501303809, "to": 6542067384, "type": "CALL" }, { "from": 6501303884, "to": 6522337344, "type": "CALL" }, { "from": 6501303924, "to": 6522337344, "type": "CALL" }, { "from": 6501303965, "to": 6512942288, "type": "CALL" }, { "from": 6501303988, "to": 6496868480, "type": "CALL" }, { "from": 6501304013, "to": 6511512544, "type": "CALL" }, { "from": 6501304044, "to": 6511512544, "type": "CALL" }, { "from": 6501304113, "to": 6740346544, "type": "CALL" }, { "from": 6501304119, "to": 6501304057, "type": "CODE" }, { "from": 6501304141, "to": 6501303929, "type": "CODE" }, { "from": 6501304157, "to": 6542089024, "type": "CALL" } ], "datarefs": [ { "from": 6501303261, "to": 6740709440, "type": "DATA" }, { "from": 6501303368, "to": 6723617688, "type": "DATA" }, { "from": 6501303397, "to": 6723617702, "type": "DATA" }, { "from": 6501303408, "to": 6723617688, "type": "DATA" }, { "from": 6501303555, "to": 6723617720, "type": "DATA" }, { "from": 6501303752, "to": 6501342368, "type": "DATA" }, { "from": 6501303763, "to": 6495420080, "type": "DATA" }, { "from": 6501303774, "to": 6511490512, "type": "DATA" }, { "from": 6501303822, "to": 6501342560, "type": "DATA" }, { "from": 6501303833, "to": 6501341936, "type": "DATA" }, { "from": 6501303848, "to": 6501262512, "type": "DATA" }, { "from": 6501303937, "to": 6723617872, "type": "DATA" }, { "from": 6501303944, "to": 6723615496, "type": "DATA" }, { "from": 6501303970, "to": 6723617863, "type": "DATA" }, { "from": 6501304068, "to": 6740709440, "type": "DATA" } ] }, "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\rea-b-fs-write.json", "source_sha256": "ddfc1badec4c64dbbf08572ab58fa276815df63b81a0c57c8be84bb18361b392", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-fs-write.txt", "stdout_bytes": 14039, "stderr": "WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n", "status": "successful-pseudocode-with-provider-warnings", "empty_stdout": false, "exit_code": 0, "output_truncated": false, "artifact_changed": false, "artifact_sha256_after": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c", "subject": { "name": "Tabbit.dll", "digest": { "sha256": "a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c" }, "local_path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "format": "unknown", "architecture": null }, "parameters": { "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll", "command": "e scr.color=0;af @ 0x1838203b0;pdgo @ 0x1838203b0;afij @ 0x1838203b0", "provider_executable": "C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe", "command_arguments": [ "-N", "-q", "-c", "e scr.color=0;af @ 0x1838203b0;pdgo @ 0x1838203b0;afij @ 0x1838203b0", "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll" ] }, "authority": "shipped-artifact", "provider_limits": [ "The executable version and supported formats are reported as unknown because no reliable version probe was performed.", "A non-zero process exit is preserved as an observed command result.", "Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.", "When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call." ], "limits": [ "REA stdout is authoritative; ok=true alone does not establish decompilation success.", "afij callrefs/datarefs come from local function analysis; indirect/vtable targets and whole-program coverage are incomplete.", "Overlapping variables or collapsed arguments are provider warnings; inferred C++ types and labels are not original source symbols." ] } ], "reused_evidence": [ { "label": "reuse-channel-dispatch", "address": "0x1837b9f90", "evidence_id": "ev_3703eb301523fe553ffffc308c2a098b0e92b722c51cbf50a50e5d1f54eb6b0c", "status": "completed-output", "behavior": "Private frame buffering and dispatch", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-channel-dispatch.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-channel-dispatch.txt", "rerun": false }, { "label": "reuse-extra-init", "address": "0x1837c5c40", "evidence_id": "ev_bb53514dbf26e51e2b6e50c8380549421f9ce74232a16b8556b0ac2a81ed451a", "status": "completed-output", "behavior": "MaybeInstallHostIntegration candidate", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-extra-init.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-extra-init.txt", "rerun": false }, { "label": "reuse-host-launch", "address": "0x1837bf640", "evidence_id": "ev_1d65fecef88321a0555234d4515d9b5a169f035634af24bf6b81f36e4a083cfa", "status": "completed-output", "behavior": "Browser Runtime Service startup path candidate", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-host-launch.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-host-launch.txt", "rerun": false }, { "label": "reuse-private-transport", "address": "0x1837fc860", "evidence_id": "ev_8e72d252af5ba8ed32751232481c17493338e524a738ac7d1b347a2d15f7b18f", "status": "completed-output", "behavior": "Private Windows named-pipe creation", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-private-transport.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-private-transport.txt", "rerun": false }, { "label": "reuse-transport-create", "address": "0x1837fdab0", "evidence_id": "ev_7e32fe74ef1e8f3a536a7ebb6897049e9310aeb1c00fa0cc0ca96acc5bc80a11", "status": "completed-output", "behavior": "Transport Start callback setup", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-create.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-create.txt", "rerun": false }, { "label": "reuse-transport-read", "address": "0x1837fe860", "evidence_id": "ev_0060dde16419bfb42735208a96a17618c0582ff5407d60ee3e684637297cd19b", "status": "completed-output", "behavior": "Transport Close/cleanup (initial seed label was read)", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-read.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-read.txt", "rerun": false }, { "label": "reuse-transport-write", "address": "0x1837fec00", "evidence_id": "ev_3868eeddfa09ba43642f3a0d3a6490f71ddab43601f3c18b43702b75abea5445", "status": "completed-output", "behavior": "Cancel and drain overlapped I/O (initial seed label was write)", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-write.json", "stdout_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\native-transport-write.txt", "rerun": false } ], "excluded_prior_records": [ { "label": "reuse-excluded-extra-parts", "evidence_id": "ev_2c6a1c9d316ef1f47314bc4827502df88cc56cd174728f07d4f5372633c2e23b", "address": null, "behavior": "Decompiler failed; not successful pseudocode", "reason": "failed decompile; not counted", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-extra-parts.json" }, { "label": "reuse-excluded-transport-frame-read", "evidence_id": "ev_5870e1db372ce1c310280a7a93df6749326ffb17ee17b44acd3a737f0cae2dd8", "address": null, "behavior": "Decompiler failed; not successful pseudocode", "reason": "failed decompile; not counted", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-frame-read.json" }, { "label": "reuse-excluded-transport-frame-write", "evidence_id": "ev_21f98a696d9cd8b116aedde61e8ce6d7a1c59439205b61cee96720e34bd89535", "address": "0x1837ff7a0", "behavior": "Callback wrapper, not a recovered frame writer", "reason": "callback wrapper, not recovered frame writer", "source_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\rea-rizin-transport-frame-write.json" } ], "static_alignment": [ { "local_evidence_id": "B-SCHEMA-tabLocalAgent", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\tabLocalAgent.api-schema.json", "sha256": "1827cf20b74c4ab4ad9e7253e9b24d7ea1d3c218427f674f9b55c85b34ef2f85", "namespace": "tabLocalAgent", "functions": [ { "name": "openProject", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "projectId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "openTaskInProject", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "projectId": { "type": "string" }, "taskId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "newTaskInProject", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "projectId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "openProjectDirectory", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "projectId": { "type": "string" }, "inSystem": { "type": "boolean", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "fileAction", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "taskId": { "type": "string" }, "path": { "type": "string", "optional": true }, "attachmentId": { "type": "string", "optional": true }, "action": { "type": "string" }, "appPath": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "ensureDefaultProject", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "selectProject", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "ensureProject", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "path": { "type": "string" }, "displayName": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "listProjects", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "updateProject", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "projectId": { "type": "string" }, "displayName": { "type": "string", "optional": true }, "pinned": { "type": "boolean", "optional": true }, "color": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "listTasks", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "putTask", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "task": { "type": "object", "properties": { "id": { "type": "string" }, "projectId": { "type": "string", "optional": true }, "title": { "type": "string", "optional": true }, "threadId": { "type": "string", "optional": true }, "settings": { "type": "object", "optional": true, "additionalProperties": { "type": "any" } } }, "additionalProperties": { "type": "any" } }, "createOnly": { "type": "boolean", "optional": true }, "firstSend": { "type": "boolean", "optional": true }, "importExisting": { "type": "boolean", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "archiveTask", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "taskId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "restoreTask", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "taskId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "getTaskSnapshot", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "taskId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "getStatus", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "status", "$ref": "tabLocalAgent.Status" } ] } }, { "name": "createManagedWorkspace", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "name": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "workspace", "type": "object", "properties": { "path": { "type": "string" }, "displayName": { "type": "string" } } } ] } }, { "name": "listLocalThreads", "type": "function", "parameters": [ { "name": "options", "type": "object", "optional": true, "properties": { "cursor": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "threads": { "type": "array", "items": { "$ref": "tabLocalAgent.LocalThreadSummary" } }, "nextCursor": { "type": "string", "optional": true } } } ] } }, { "name": "readLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "workingDirectory": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "thread", "$ref": "tabLocalAgent.LocalThread" } ] } }, { "name": "createLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "optional": true, "properties": { "surfaceId": { "type": "string", "optional": true }, "taskId": { "type": "string", "optional": true }, "settings": { "$ref": "tabLocalAgent.TaskSettings", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "threadId": { "type": "string" } } } ] } }, { "name": "persistFileAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "data": { "type": "binary" }, "fileName": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ] } }, { "name": "resolveDroppedFileAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "fileSystemName": { "type": "string" }, "fileSystemPath": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ] } }, { "name": "resolveClipboardFileAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "fileName": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ] } }, { "name": "releaseFileAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "released", "type": "boolean" } ] } }, { "name": "persistImageAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "data": { "type": "binary" }, "mimeType": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ] } }, { "name": "releaseImageAttachment", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "attachmentId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "released", "type": "boolean" } ] } }, { "name": "startTask", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "surfaceId": { "type": "string", "optional": true }, "threadId": { "type": "string" }, "expectedTurnId": { "type": "string", "optional": true }, "clientMessageId": { "type": "string" }, "text": { "type": "string" }, "images": { "type": "array", "items": { "$ref": "tabLocalAgent.TaskImageInput" }, "optional": true }, "files": { "type": "array", "items": { "$ref": "tabLocalAgent.TaskFileInput" }, "optional": true }, "skills": { "type": "array", "items": { "$ref": "tabLocalAgent.TaskSkillInput" }, "optional": true }, "settings": { "$ref": "tabLocalAgent.TaskSettings", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "taskId": { "type": "string" }, "turnTiming": { "$ref": "tabLocalAgent.TurnTiming", "optional": true } } } ] } }, { "name": "interruptTask", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "taskId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "interrupted", "type": "boolean" } ] } }, { "name": "listPendingServerRequests", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "surfaceId": { "type": "string" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "requests", "type": "array", "items": { "$ref": "tabLocalAgent.ServerRequest" } } ] } }, { "name": "respondToServerRequest", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "surfaceId": { "type": "string" }, "requestId": { "type": "string" }, "result": { "type": "object", "additionalProperties": { "type": "any" } } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } }, { "name": "getSettingsPreferences", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "preferences", "$ref": "tabLocalAgent.SettingsPreferences" } ] } }, { "name": "updateSettingsPreferences", "type": "function", "parameters": [ { "name": "updates", "type": "object", "properties": { "enabled": { "type": "boolean", "optional": true }, "model": { "type": "string", "optional": true }, "reasoningEffort": { "type": "string", "optional": true }, "reasoningVisibility": { "$ref": "tabLocalAgent.ReasoningVisibility", "optional": true }, "collaborationMode": { "type": "string", "optional": true }, "serviceTier": { "type": "string", "optional": true }, "personality": { "type": "string", "optional": true }, "permissionProfile": { "type": "string", "optional": true }, "permissionMode": { "type": "string", "optional": true }, "workingDirectory": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "preferences", "$ref": "tabLocalAgent.SettingsPreferences" } ] } }, { "name": "getSettingsCatalog", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "catalog", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "reloadUserConfig", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "accepted": { "type": "boolean" }, "version": { "type": "string", "optional": true } } } ] } }, { "name": "getAccountUsage", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "account": { "type": "object", "additionalProperties": { "type": "any" } }, "rateLimits": { "type": "object", "additionalProperties": { "type": "any" } }, "usage": { "type": "object", "additionalProperties": { "type": "any" } } } } ] } }, { "name": "renameLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "name": { "type": "string" }, "workingDirectory": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } }, { "name": "forkLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "workingDirectory": { "type": "string", "optional": true }, "taskId": { "type": "string", "optional": true }, "beforeTurnId": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "threadId": { "type": "string" } } } ] } }, { "name": "archiveLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "workingDirectory": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } }, { "name": "deleteLocalThread", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "workingDirectory": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } }, { "name": "getExperimentalFeatures", "type": "function", "parameters": [ { "name": "options", "type": "object", "optional": true, "properties": { "threadId": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "setExperimentalFeature", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "name": { "type": "string" }, "enabled": { "type": "boolean" } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } }, { "name": "getMcpServerStatus", "type": "function", "parameters": [ { "name": "options", "type": "object", "optional": true, "properties": { "threadId": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "getSkills", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "getApps", "type": "function", "parameters": [ { "name": "options", "type": "object", "optional": true, "properties": { "threadId": { "type": "string", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "getRuntimeDiagnostics", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "additionalProperties": { "type": "any" } } ] } }, { "name": "updateThreadSettings", "type": "function", "parameters": [ { "name": "options", "type": "object", "properties": { "threadId": { "type": "string" }, "settings": { "type": "object", "additionalProperties": { "type": "any" } } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "accepted", "type": "boolean" } ] } } ], "events": [ { "name": "onIndexChanged", "type": "function", "parameters": [ { "name": "event", "type": "object", "additionalProperties": { "type": "any" } } ] }, { "name": "onRuntimeStateChanged", "type": "function", "parameters": [ { "name": "state", "$ref": "tabLocalAgent.RuntimeStateChanged" } ] }, { "name": "onTaskEvent", "type": "function", "parameters": [ { "name": "event", "$ref": "tabLocalAgent.TaskEvent" } ] }, { "name": "onServerRequest", "type": "function", "parameters": [ { "name": "request", "$ref": "tabLocalAgent.ServerRequest" } ] }, { "name": "onServerRequestResolved", "type": "function", "parameters": [ { "name": "resolved", "$ref": "tabLocalAgent.ServerRequestResolved" } ] }, { "name": "onThreadSettingsUpdated", "type": "function", "parameters": [ { "name": "updated", "$ref": "tabLocalAgent.ThreadSettingsUpdated" } ] }, { "name": "onAppsUpdated", "type": "function", "parameters": [ { "name": "updated", "$ref": "tabLocalAgent.AppsUpdated" } ] } ], "types": [ { "id": "tabLocalAgent.RuntimeState", "type": "string", "enum": [ "stopped", "starting", "ready", "failed" ] }, { "id": "tabLocalAgent.BrowserAutomationState", "type": "string", "enum": [ "available", "unsupported" ] }, { "id": "tabLocalAgent.TaskEventType", "type": "string", "enum": [ "started", "progress_update", "agent_message_started", "agent_message_delta", "agent_message_completed", "activity_update", "tool_status", "completed", "failed", "interrupted" ] }, { "id": "tabLocalAgent.LocalMessageRole", "type": "string", "enum": [ "user", "assistant" ] }, { "id": "tabLocalAgent.LocalMessagePhase", "type": "string", "enum": [ "commentary", "final_answer" ] }, { "id": "tabLocalAgent.Status", "type": "object", "properties": { "enabled": { "type": "boolean" }, "featureEnabled": { "type": "boolean" }, "runtimeState": { "$ref": "tabLocalAgent.RuntimeState" }, "runtimeReady": { "type": "boolean" }, "inferenceReady": { "type": "boolean" }, "supportsImages": { "type": "boolean" }, "supportsTurnSteer": { "type": "boolean" }, "supportsPromptEdit": { "type": "boolean" }, "supportsSkillInputs": { "type": "boolean" }, "supportsProjects": { "type": "boolean" }, "fileActionCapabilities": { "type": "object", "optional": true, "properties": { "listOpenWithApps": { "type": "boolean" }, "openWithApp": { "type": "boolean" }, "openWith": { "type": "boolean" } } }, "runtimeGeneration": { "type": "number" }, "backgroundCommandState": { "type": "string", "optional": true }, "browserAutomation": { "$ref": "tabLocalAgent.BrowserAutomationState" }, "appServerPid": { "type": "integer", "optional": true }, "runtimeError": { "type": "string", "optional": true }, "inferenceError": { "type": "string", "optional": true }, "error": { "type": "string", "optional": true }, "workspaceDependencies": { "type": "object", "optional": true, "properties": { "phase": { "type": "string" }, "version": { "type": "string" }, "downloadedBytes": { "type": "number" }, "totalBytes": { "type": "number" }, "error": { "type": "string" } } } } }, { "id": "tabLocalAgent.RuntimeStateChanged", "type": "object", "properties": { "runtimeState": { "$ref": "tabLocalAgent.RuntimeState" }, "runtimeReady": { "type": "boolean" }, "inferenceReady": { "type": "boolean" }, "runtimeGeneration": { "type": "number" }, "backgroundCommandState": { "type": "string", "optional": true }, "runtimeError": { "type": "string", "optional": true }, "inferenceError": { "type": "string", "optional": true }, "error": { "type": "string", "optional": true } } }, { "id": "tabLocalAgent.TaskEvent", "type": "object", "properties": { "taskId": { "type": "string" }, "sequence": { "type": "number", "optional": true }, "surfaceId": { "type": "string", "optional": true }, "runtimeGeneration": { "type": "number", "optional": true }, "threadId": { "type": "string" }, "type": { "$ref": "tabLocalAgent.TaskEventType" }, "delta": { "type": "string", "optional": true }, "message": { "type": "string", "optional": true }, "method": { "type": "string", "optional": true }, "terminalReason": { "type": "string", "optional": true }, "backgroundCommandState": { "type": "string", "optional": true }, "details": { "type": "object", "optional": true, "additionalProperties": { "type": "any" } } } }, { "id": "tabLocalAgent.ServerRequest", "type": "object", "properties": { "requestId": { "type": "string" }, "method": { "type": "string" }, "owned": { "type": "boolean", "optional": true }, "surfaceId": { "type": "string", "optional": true }, "params": { "type": "object", "optional": true, "additionalProperties": { "type": "any" } } } }, { "id": "tabLocalAgent.ServerRequestResolved", "type": "object", "properties": { "requestId": { "type": "string" } } }, { "id": "tabLocalAgent.PermissionMode", "type": "string", "enum": [ "danger_full_access", "workspace_write", "auto_review", "read_only", "inherit" ] }, { "id": "tabLocalAgent.TaskPermissionPreset", "type": "string", "enum": [ "read_only", "project", "auto_review", "full_access", "advanced" ] }, { "id": "tabLocalAgent.ReasoningVisibility", "type": "string", "enum": [ "hidden", "summary", "full" ] }, { "id": "tabLocalAgent.TaskSettings", "type": "object", "properties": { "workingDirectory": { "type": "string" }, "permissionPreset": { "$ref": "tabLocalAgent.TaskPermissionPreset" }, "permissionProfile": { "type": "string", "optional": true }, "networkAccess": { "type": "boolean", "optional": true }, "model": { "type": "string", "optional": true }, "reasoningEffort": { "type": "string", "optional": true }, "collaborationMode": { "type": "string", "optional": true }, "serviceTier": { "type": "string", "optional": true }, "personality": { "type": "string", "optional": true } } }, { "id": "tabLocalAgent.TaskImageInput", "type": "object", "properties": { "attachmentId": { "type": "string" } } }, { "id": "tabLocalAgent.TaskSkillInput", "type": "object", "properties": { "name": { "type": "string" }, "path": { "type": "string" } } }, { "id": "tabLocalAgent.TaskFileInput", "type": "object", "properties": { "attachmentId": { "type": "string" } } }, { "id": "tabLocalAgent.SettingsPreferences", "type": "object", "properties": { "enabled": { "type": "boolean" }, "model": { "type": "string" }, "reasoningEffort": { "type": "string" }, "reasoningVisibility": { "$ref": "tabLocalAgent.ReasoningVisibility" }, "collaborationMode": { "type": "string" }, "serviceTier": { "type": "string" }, "personality": { "type": "string" }, "permissionProfile": { "type": "string" }, "permissionMode": { "$ref": "tabLocalAgent.PermissionMode" }, "workingDirectory": { "type": "string" } } }, { "id": "tabLocalAgent.ThreadSettingsUpdated", "type": "object", "properties": { "threadId": { "type": "string" }, "threadSettings": { "type": "object", "additionalProperties": { "type": "any" } } } }, { "id": "tabLocalAgent.AppsUpdated", "type": "object", "properties": { "data": { "type": "array", "items": { "type": "object", "additionalProperties": { "type": "any" } } } } }, { "id": "tabLocalAgent.LocalThreadSummary", "type": "object", "properties": { "threadId": { "type": "string" }, "name": { "type": "string", "optional": true }, "preview": { "type": "string" }, "createdAt": { "type": "number" }, "updatedAt": { "type": "number" } } }, { "id": "tabLocalAgent.TurnTiming", "type": "object", "properties": { "startedAt": { "type": "number", "optional": true }, "completedAt": { "type": "number", "optional": true }, "durationMs": { "type": "number", "optional": true } } }, { "id": "tabLocalAgent.LocalMessage", "type": "object", "properties": { "id": { "type": "string" }, "turnId": { "type": "string", "optional": true }, "turnTiming": { "$ref": "tabLocalAgent.TurnTiming", "optional": true }, "clientUserMessageId": { "type": "string", "optional": true }, "role": { "$ref": "tabLocalAgent.LocalMessageRole" }, "content": { "type": "string" }, "phase": { "$ref": "tabLocalAgent.LocalMessagePhase", "optional": true }, "activity": { "type": "object", "optional": true, "additionalProperties": { "type": "any" } } } }, { "id": "tabLocalAgent.LocalThread", "type": "object", "properties": { "threadId": { "type": "string" }, "name": { "type": "string", "optional": true }, "preview": { "type": "string" }, "createdAt": { "type": "number" }, "updatedAt": { "type": "number" }, "messages": { "type": "array", "items": { "$ref": "tabLocalAgent.LocalMessage" } } } } ], "provenance_limit": "Reused prior extracted schema; this record hashes the retained extraction, not a fresh DLL offset proof." }, { "local_evidence_id": "B-SCHEMA-tabLocalFS", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\tabLocalFS.api-schema.json", "sha256": "e3dfd71de01ceefd76cbd6589c415ce992c046945ba082df36a6f1c990e883e2", "namespace": "tabLocalFS", "functions": [ { "name": "mount", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "mount", "$ref": "tabLocalFS.MountInfo", "optional": true } ] } }, { "name": "mountDroppedDirectory", "type": "function", "parameters": [ { "name": "fileSystemName", "type": "string" }, { "name": "fileSystemPath", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "mount", "$ref": "tabLocalFS.MountInfo" } ] } }, { "name": "getMounts", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "mounts", "type": "array", "items": { "$ref": "tabLocalFS.MountInfo" } } ] } }, { "name": "unmount", "type": "function", "parameters": [ { "name": "handle", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "getattr", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "attr", "$ref": "tabLocalFS.FileAttr" } ] } }, { "name": "access", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "mask", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "errorCode", "type": "integer" } ] } }, { "name": "statfs", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "stat", "$ref": "tabLocalFS.StatVfs" } ] } }, { "name": "mkdir", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "mode", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "unlink", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "rmdir", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "rename", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "oldPath", "type": "string" }, { "name": "newPath", "type": "string" }, { "name": "flags", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "truncate", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "size", "type": "number" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "utimens", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "atime", "$ref": "tabLocalFS.Timespec" }, { "name": "mtime", "$ref": "tabLocalFS.Timespec" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "open", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "flags", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "fh", "$ref": "tabLocalFS.FileHandleInfo" } ] } }, { "name": "create", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" }, { "name": "mode", "type": "integer" }, { "name": "flags", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "fh", "$ref": "tabLocalFS.FileHandleInfo" } ] } }, { "name": "read", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" }, { "name": "offset", "type": "number" }, { "name": "size", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "data", "type": "binary" } ] } }, { "name": "write", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" }, { "name": "offset", "type": "number" }, { "name": "data", "type": "binary" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "written", "type": "integer" } ] } }, { "name": "flush", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "release", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "fsync", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" }, { "name": "dataOnly", "type": "boolean" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } }, { "name": "opendir", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "path", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "fh", "$ref": "tabLocalFS.FileHandleInfo" } ] } }, { "name": "readdir", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" }, { "name": "offset", "type": "number" }, { "name": "plus", "type": "boolean" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "$ref": "tabLocalFS.ReaddirResult" } ] } }, { "name": "releasedir", "type": "function", "parameters": [ { "name": "handle", "type": "string" }, { "name": "fh", "type": "number" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "success", "type": "boolean" } ] } } ], "events": [ { "name": "onMountChanged", "type": "function", "parameters": [] } ], "types": [ { "id": "tabLocalFS.MountInfo", "type": "object", "properties": { "handle": { "type": "string" }, "displayName": { "type": "string" }, "path": { "type": "string" } } }, { "id": "tabLocalFS.Timespec", "type": "object", "properties": { "sec": { "type": "number" }, "nsec": { "type": "integer" } } }, { "id": "tabLocalFS.FileAttr", "type": "object", "properties": { "ino": { "type": "number" }, "size": { "type": "number" }, "blocks": { "type": "number" }, "atime": { "$ref": "tabLocalFS.Timespec" }, "mtime": { "$ref": "tabLocalFS.Timespec" }, "ctime": { "$ref": "tabLocalFS.Timespec" }, "mode": { "type": "integer" }, "nlink": { "type": "integer" }, "uid": { "type": "integer" }, "gid": { "type": "integer" }, "rdev": { "type": "integer" }, "blksize": { "type": "integer" } } }, { "id": "tabLocalFS.StatVfs", "type": "object", "properties": { "bsize": { "type": "number" }, "frsize": { "type": "number" }, "blocks": { "type": "number" }, "bfree": { "type": "number" }, "bavail": { "type": "number" }, "files": { "type": "number" }, "ffree": { "type": "number" }, "namemax": { "type": "number" } } }, { "id": "tabLocalFS.FileHandleInfo", "type": "object", "properties": { "fh": { "type": "number" }, "flags": { "type": "integer" }, "directIo": { "type": "boolean" }, "keepCache": { "type": "boolean" } } }, { "id": "tabLocalFS.DirEntry", "type": "object", "properties": { "name": { "type": "string" }, "attr": { "$ref": "tabLocalFS.FileAttr" }, "offset": { "type": "number" } } }, { "id": "tabLocalFS.ReaddirResult", "type": "object", "properties": { "entries": { "type": "array", "items": { "$ref": "tabLocalFS.DirEntry" } }, "hasMore": { "type": "boolean" } } } ], "provenance_limit": "Reused prior extracted schema; this record hashes the retained extraction, not a fresh DLL offset proof." }, { "local_evidence_id": "B-SCHEMA-tabLocalFilePreview", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\tabLocalFilePreview.api-schema.json", "sha256": "3b936f8bc578f91f3e214502cfb852096c5465eceda15f5a1090de781e216435", "namespace": "tabLocalFilePreview", "functions": [ { "name": "getFileInfo", "type": "function", "parameters": [ { "name": "token", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "info", "$ref": "tabLocalFilePreview.FileInfo" } ] } }, { "name": "readFile", "type": "function", "parameters": [ { "name": "token", "type": "string" }, { "name": "offset", "type": "number" }, { "name": "size", "type": "integer" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "data", "type": "binary" } ] } }, { "name": "writeFile", "type": "function", "parameters": [ { "name": "token", "type": "string" }, { "name": "data", "type": "binary" }, { "name": "options", "$ref": "tabLocalFilePreview.WriteOptions", "optional": true } ], "returns_async": { "name": "callback", "parameters": [ { "name": "written", "type": "integer" } ] } }, { "name": "releaseToken", "type": "function", "parameters": [ { "name": "token", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "released", "type": "boolean" } ] } }, { "name": "getSystemOpenInfo", "type": "function", "parameters": [ { "name": "extensions", "type": "array", "items": { "type": "string" } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "infos", "type": "array", "items": { "$ref": "tabLocalFilePreview.SystemOpenInfo" } } ] } }, { "name": "requestSetSystemDefault", "type": "function", "parameters": [ { "name": "extension", "type": "string" } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "$ref": "tabLocalFilePreview.SetSystemDefaultResult" } ] } } ], "types": [ { "id": "tabLocalFilePreview.FileInfo", "type": "object", "properties": { "name": { "type": "string" }, "extension": { "type": "string" }, "size": { "type": "number" }, "writable": { "type": "boolean" }, "expiresAt": { "type": "number" } } }, { "id": "tabLocalFilePreview.WriteOptions", "type": "object", "properties": { "replace": { "type": "boolean", "optional": true } } }, { "id": "tabLocalFilePreview.SystemOpenState", "type": "string", "enum": [ "default", "not_default", "unknown" ] }, { "id": "tabLocalFilePreview.SetSystemDefaultResult", "type": "string", "enum": [ "requested", "opened_settings", "unsupported", "failed" ] }, { "id": "tabLocalFilePreview.SystemOpenInfo", "type": "object", "properties": { "extension": { "type": "string" }, "state": { "$ref": "tabLocalFilePreview.SystemOpenState" }, "handlerName": { "type": "string", "optional": true }, "canSetDefault": { "type": "boolean" } } } ], "provenance_limit": "Reused prior extracted schema; this record hashes the retained extraction, not a fresh DLL offset proof." }, { "local_evidence_id": "B-SCHEMA-tabCDPBridge", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\tabCDPBridge.api-schema.json", "sha256": "07e00ba3913393fb55d63c671f50cb9ea45931799c8db710c7ff98e0b91bf87a", "namespace": "tabCDPBridge", "functions": [ { "name": "connect", "type": "function", "parameters": [ { "name": "target", "type": "object", "properties": { "targetId": { "type": "string", "optional": true }, "tabId": { "type": "integer", "optional": true } } } ], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "connectionId": { "type": "string" } } } ] } }, { "name": "connectToBrowser", "type": "function", "parameters": [], "returns_async": { "name": "callback", "parameters": [ { "name": "result", "type": "object", "properties": { "connectionId": { "type": "string" } } } ] } }, { "name": "send", "type": "function", "parameters": [ { "name": "connectionId", "type": "string" }, { "name": "message", "type": "object", "additionalProperties": { "type": "any" } } ] }, { "name": "disconnect", "type": "function", "parameters": [ { "name": "connectionId", "type": "string" } ] } ], "events": [ { "name": "onMessage", "type": "function", "parameters": [ { "name": "connectionId", "type": "string" }, { "name": "message", "type": "object", "additionalProperties": { "type": "any" } } ] }, { "name": "onDisconnect", "type": "function", "parameters": [ { "name": "connectionId", "type": "string" }, { "name": "reason", "type": "string" } ] } ], "provenance_limit": "Reused prior extracted schema; this record hashes the retained extraction, not a fresh DLL offset proof." }, { "local_evidence_id": "B-JS-browser-service-channel.mjs", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\TabbitDance\\runtime\\src\\browser-service-channel.mjs", "sha256": "275b3f8ee77011269188df5f422f375dfb9d2429ab84beeb717f8d447da4084b", "bytes": 14195, "execution": false }, { "local_evidence_id": "B-JS-browser-transport.mjs", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\TabbitDance\\runtime\\src\\browser-transport.mjs", "sha256": "7e99c645aa21b096bdabc84e051c5a4cb06f079f77ca9bbf6959a31a2667d453", "bytes": 5246, "execution": false }, { "local_evidence_id": "B-JS-browser-runtime-service.mjs", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\TabbitDance\\runtime\\src\\browser-runtime-service.mjs", "sha256": "2665d69b4257358751592bfbc3d2bbc6cb18e633e58845aabc6609534c01c450", "bytes": 1883, "execution": false }, { "local_evidence_id": "B-JS-isolated-task-session.mjs", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\TabbitDance\\runtime\\src\\isolated-task-session.mjs", "sha256": "b9f555ffc280e24c92b04e742678708c23ba3454ac1e0974bf7015d6bbfc349c", "bytes": 10730, "execution": false }, { "local_evidence_id": "B-JS-dsh-lifecycle", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\TabbitDance\\tabbit-dsh-lifecycle.mjs", "sha256": "841d17a264698c99dbc51f6d72d1c8538c88b611e0dfa64768a9231066fe1a23", "execution": false }, { "local_evidence_id": "B-PAK-24500", "source": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\resources.pak", "source_sha256": "9b8e0ea03f6f0d2d30f93c4fe0b7576f4773b5fc882224a0a6e9ba507b5e7ee3", "resource_id": 24500, "id": 24500, "offset": 14758537, "stored_bytes": 6725, "decoded_bytes": 50974, "compression": "gzip", "sha256": "22e27fb829d5d2f08b72cd9194db8c21540ab94232f2daae61f01af33337f651", "decoded_sha256": "8da1a71e23c777dbadbb3674e399ce3454ab5afd08a62037f0d3eaa4489d93b6", "full_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-pak-24500.txt", "execution": false }, { "local_evidence_id": "B-PAK-60467", "source": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\resources.pak", "source_sha256": "9b8e0ea03f6f0d2d30f93c4fe0b7576f4773b5fc882224a0a6e9ba507b5e7ee3", "resource_id": 60467, "id": 60467, "offset": 26713307, "stored_bytes": 2274, "decoded_bytes": 10054, "compression": "gzip", "sha256": "485579c4e23c5183675f995b80f2fb22618e2e325ce34d53c66dbf14701cf807", "decoded_sha256": "95efc4dc957f2714e29bf13ec45d9c686da51131e248e6c97fc1aea922a2f37c", "full_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-pak-60467.txt", "execution": false }, { "local_evidence_id": "B-PAK-60476", "source": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\resources.pak", "source_sha256": "9b8e0ea03f6f0d2d30f93c4fe0b7576f4773b5fc882224a0a6e9ba507b5e7ee3", "resource_id": 60476, "id": 60476, "offset": 27137638, "stored_bytes": 41455, "decoded_bytes": 183107, "compression": "gzip", "sha256": "dc92e2ba551bfffde8c31bc5237b2c790d40da19a7c0ccbb4e5c16991d981821", "decoded_sha256": "4110957e25c73dfce7750a3411a9a0f812a5060df1abb82bd0c274c0cbb9b0cd", "full_text_file": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\business-research\\evidence\\b-pak-60476.txt", "execution": false }, { "local_evidence_id": "B-UPSTREAM-chrome_browser_main_extra_parts.h", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\chrome_browser_main_extra_parts.h", "sha256": "a378a6661c2af455e70130cfe32083fdc261fb558378e1fba9ff2fa0b60487ed", "provenance_meta": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\chrome_browser_main_extra_parts.h.meta.json", "role": "Pinned primary reference. Establishes upstream seam vocabulary, not Tabbit binary identity or whole-source equivalence." }, { "local_evidence_id": "B-UPSTREAM-chrome_browser_main.cc", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\chrome_browser_main.cc", "sha256": "c358e37fadef2f51fc0ff6f07ca735041ced6a12559bb9c784200cfc35a5dc87", "provenance_meta": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\chrome_browser_main.cc.meta.json", "role": "Pinned primary reference. Establishes upstream seam vocabulary, not Tabbit binary identity or whole-source equivalence." }, { "local_evidence_id": "B-UPSTREAM-chrome_extensions_browser_api_provider.cc", "path": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\extensions\\chrome_extensions_browser_api_provider.cc", "sha256": "0fad6a5840469c98f1f57bdd0d7d40dec8d011fde9857d83bd0919c67578d7f2", "provenance_meta": "C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\research-output\\evidence\\gn-upstream\\chromium\\chrome\\browser\\extensions\\chrome_extensions_browser_api_provider.cc.meta.json", "role": "Pinned primary reference. Establishes upstream seam vocabulary, not Tabbit binary identity or whole-source equivalence." } ], "record_corrections": [ { "labels": [ "b-fs-mount", "b-fs-path", "b-fs-read", "b-fs-write", "b-fs-api-read", "b-dsh-transport" ], "reason": "Initial seed labels are misleading. Use analyst_label and real afij address, not filename to identify behavior." }, { "labels": [ "b-agent-caller-seams" ], "reason": "Partial windows start mid-instruction. Replaced by b-agent-caller-seams-aligned; no business claim cites original misaligned window." }, { "labels": [ "b-agent-model-providers" ], "reason": "ok=true/exit 0 but stderr has Ghidra Decompiler Error: Conditional execution: Illegal op in iblock. afij is available; no successful pseudocode." } ], "tail_jump_boundary": { "observed_new_direct_scan_jumps": 0, "statement": "No selected E9 candidate became a function-replacement claim. Callback pointers, CFG/vtable calls and empty xref scans do not establish a body or absence; prior callback wrapper excluded as frame writer." }, "overall_classification": "所分配范围主要由新增浏览器服务、Profile 配置、extension API、观察者和专属 transport 组成。CDP 桥内有策略拦截和合成响应；这只说明桥边界的协议代答，不证明 Chromium 内核替换，也不证明整个 Chromium 未改动。", "limitations": [ "No PDB/source symbols recovered; source-path strings are provenance/location clues only.", "Function boundaries/callers are local Rizin/.pdata observations; optimized funclets, partial output and indirect calls limit completeness.", "Native engine string scanning skips large regions; independent PE decoding/scans cover only selected instruction shapes and byte regions.", "No original Chromium source diff or whole-binary equivalence comparison, so replacements elsewhere remain unknown.", "Static paths do not demonstrate execution, installation, request success or current network service state." ] }