{"ok":true,"data":{"evidence_id":"ev_240faba52e44a605ae0af381a0f17ef87fddc5da32994bab41dc016d787f07d5","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183283a90;pdgo @ 0x183283a90;afij @ 0x183283a90","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183283a90;pdgo @ 0x183283a90;afij @ 0x183283a90","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x183283a90 |\r\n 0x183283a90 |// WARNING: Variable defined which should be unmapped: var_50h\r\n 0x183283a90 |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n 0x183283a90 |// WARNING: [rz-ghidra] Detected overlap for variable var_91h\r\n |\r\n 0x183283a90 |void fcn.183283a90(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t iVar1;\r\n | int64_t *piVar2;\r\n | int64_t iVar3;\r\n | int32_t *piVar4;\r\n | undefined8 uVar5;\r\n | code *pcVar6;\r\n | char cVar7;\r\n | undefined4 *puVar8;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStackY_78 [40];\r\n | int64_t var_50h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x183283aa3 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStackY_78;\r\n 0x183283ab5 | cVar7 = (*case.0x1841dcc6f.0)(arg2);\r\n 0x183283abd | if (cVar7 != '\\0') {\r\n 0x183283ac6 | fcn.183282620(var_50h);\r\n 0x183283ade | piVar2 = *(int64_t **)\r\n 0x183283ada | (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n 0x183283af4 | if ((piVar2 == (int64_t *)0x0) || (iVar3 = *piVar2, iVar3 == 0)) goto code_r0x000183283bd9;\r\n 0x183283afa | piVar4 = *(int32_t **)(arg1 + 0xe8);\r\n 0x183283b01 | uVar5 = *(undefined8 *)(arg1 + 0xf0);\r\n 0x183283b0b | if (piVar4 != (int32_t *)0x0) {\r\n 0x183283b12 | LOCK();\r\n 0x183283b12 | iVar1 = *piVar4;\r\n 0x183283b12 | *piVar4 = *piVar4 + 1;\r\n 0x183283b12 | UNLOCK();\r\n 0x183283b1c | if (iVar1 == 0x7fffffff) {\r\n 0x183283bdc | pcVar6 = (code *)swi(3);\r\n 0x183283bdc | (*pcVar6)();\r\n 0x183283bdc | return;\r\n | }\r\n | }\r\n 0x183283b27 | puVar8 = (undefined4 *)fcn.185f006b8(0x40);\r\n 0x183283b2f | *puVar8 = 1;\r\n 0x183283b3c | *(undefined8 *)(puVar8 + 2) = 0x1832818e0;\r\n 0x183283b47 | *(undefined8 *)(puVar8 + 4) = 0x182becc70;\r\n 0x183283b52 | *(undefined8 *)(puVar8 + 6) = 0x1832818a0;\r\n 0x183283b5d | *(code **)(puVar8 + 8) = fcn.183282620;\r\n 0x183283b61 | puVar8[10] = 0;\r\n 0x183283b68 | *(int32_t **)(puVar8 + 0xc) = piVar4;\r\n 0x183283b6c | *(undefined8 *)(puVar8 + 0xe) = uVar5;\r\n 0x183283b7e | fcn.184339cd0(&var_50h, 0x190124a80, 0x190124a30, 0x11a);\r\n 0x183283ba8 | var_30h = (int64_t)puVar8;\r\n 0x183283ba8 | (*case.0x1841dcc6f.0)(iVar3, &var_50h, &var_30h, 0);\r\n | }\r\n 0x183283bc0 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStackY_78)) {\r\n 0x183283bcb | return;\r\n | }\r\n 0x183283bd1 | fcn.185f05b40(var_28h ^ (uint64_t)auStackY_78);\r\n |code_r0x000183283bd9:\r\n 0x183283bd9 | pcVar6 = (code *)swi(3);\r\n 0x183283bd9 | (*pcVar6)();\r\n 0x183283bd9 | return;\r\n |}\r\n[{\"offset\":6495419024,\"name\":\"fcn.183283a90\",\"size\":333,\"is-pure\":false,\"realsz\":331,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":101,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":14,\"ebbs\":3,\"signature\":\"fcn.183283a90(int64_t arg1, int64_t arg2);\",\"minbound\":6495419024,\"maxbound\":6495419357,\"callrefs\":[{\"from\":6495419061,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495419078,\"to\":6495413792,\"type\":\"CALL\"},{\"from\":6495419175,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495419276,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6495419304,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495419348,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6495419036,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495419083,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495419189,\"to\":6495410400,\"type\":\"DATA\"},{\"from\":6495419200,\"to\":6488509552,\"type\":\"DATA\"},{\"from\":6495419211,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6495419222,\"to\":6495413792,\"type\":\"DATA\"},{\"from\":6495419248,\"to\":6712085120,\"type\":\"DATA\"},{\"from\":6495419255,\"to\":6712085040,\"type\":\"DATA\"},{\"from\":6495419318,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x183283a90 |\r\n 0x183283a90 |// WARNING: Variable defined which should be unmapped: var_50h\r\n 0x183283a90 |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n 0x183283a90 |// WARNING: [rz-ghidra] Detected overlap for variable var_91h\r\n |\r\n 0x183283a90 |void fcn.183283a90(int64_t arg1, int64_t arg2)\r\n |{\r\n | int32_t iVar1;\r\n | int64_t *piVar2;\r\n | int64_t iVar3;\r\n | int32_t *piVar4;\r\n | undefined8 uVar5;\r\n | code *pcVar6;\r\n | char cVar7;\r\n | undefined4 *puVar8;\r\n | int64_t unaff_GS_OFFSET;\r\n | undefined auStackY_78 [40];\r\n | int64_t var_50h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x183283aa3 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStackY_78;\r\n 0x183283ab5 | cVar7 = (*case.0x1841dcc6f.0)(arg2);\r\n 0x183283abd | if (cVar7 != '\\0') {\r\n 0x183283ac6 | fcn.183282620(var_50h);\r\n 0x183283ade | piVar2 = *(int64_t **)\r\n 0x183283ada | (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 0x3d8);\r\n 0x183283af4 | if ((piVar2 == (int64_t *)0x0) || (iVar3 = *piVar2, iVar3 == 0)) goto code_r0x000183283bd9;\r\n 0x183283afa | piVar4 = *(int32_t **)(arg1 + 0xe8);\r\n 0x183283b01 | uVar5 = *(undefined8 *)(arg1 + 0xf0);\r\n 0x183283b0b | if (piVar4 != (int32_t *)0x0) {\r\n 0x183283b12 | LOCK();\r\n 0x183283b12 | iVar1 = *piVar4;\r\n 0x183283b12 | *piVar4 = *piVar4 + 1;\r\n 0x183283b12 | UNLOCK();\r\n 0x183283b1c | if (iVar1 == 0x7fffffff) {\r\n 0x183283bdc | pcVar6 = (code *)swi(3);\r\n 0x183283bdc | (*pcVar6)();\r\n 0x183283bdc | return;\r\n | }\r\n | }\r\n 0x183283b27 | puVar8 = (undefined4 *)fcn.185f006b8(0x40);\r\n 0x183283b2f | *puVar8 = 1;\r\n 0x183283b3c | *(undefined8 *)(puVar8 + 2) = 0x1832818e0;\r\n 0x183283b47 | *(undefined8 *)(puVar8 + 4) = 0x182becc70;\r\n 0x183283b52 | *(undefined8 *)(puVar8 + 6) = 0x1832818a0;\r\n 0x183283b5d | *(code **)(puVar8 + 8) = fcn.183282620;\r\n 0x183283b61 | puVar8[10] = 0;\r\n 0x183283b68 | *(int32_t **)(puVar8 + 0xc) = piVar4;\r\n 0x183283b6c | *(undefined8 *)(puVar8 + 0xe) = uVar5;\r\n 0x183283b7e | fcn.184339cd0(&var_50h, 0x190124a80, 0x190124a30, 0x11a);\r\n 0x183283ba8 | var_30h = (int64_t)puVar8;\r\n 0x183283ba8 | (*case.0x1841dcc6f.0)(iVar3, &var_50h, &var_30h, 0);\r\n | }\r\n 0x183283bc0 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStackY_78)) {\r\n 0x183283bcb | return;\r\n | }\r\n 0x183283bd1 | fcn.185f05b40(var_28h ^ (uint64_t)auStackY_78);\r\n |code_r0x000183283bd9:\r\n 0x183283bd9 | pcVar6 = (code *)swi(3);\r\n 0x183283bd9 | (*pcVar6)();\r\n 0x183283bd9 | return;\r\n |}\r\n[{\"offset\":6495419024,\"name\":\"fcn.183283a90\",\"size\":333,\"is-pure\":false,\"realsz\":331,\"noreturn\":false,\"stackframe\":120,\"calltype\":\"ms\",\"cost\":101,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":14,\"ebbs\":3,\"signature\":\"fcn.183283a90(int64_t arg1, int64_t arg2);\",\"minbound\":6495419024,\"maxbound\":6495419357,\"callrefs\":[{\"from\":6495419061,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495419078,\"to\":6495413792,\"type\":\"CALL\"},{\"from\":6495419175,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495419276,\"to\":6512942288,\"type\":\"CALL\"},{\"from\":6495419304,\"to\":6740346544,\"type\":\"CALL\"},{\"from\":6495419348,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6495419036,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495419083,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495419189,\"to\":6495410400,\"type\":\"DATA\"},{\"from\":6495419200,\"to\":6488509552,\"type\":\"DATA\"},{\"from\":6495419211,\"to\":6495410336,\"type\":\"DATA\"},{\"from\":6495419222,\"to\":6495413792,\"type\":\"DATA\"},{\"from\":6495419248,\"to\":6712085120,\"type\":\"DATA\"},{\"from\":6495419255,\"to\":6712085040,\"type\":\"DATA\"},{\"from\":6495419318,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":3,\"nargs\":2,\"stackvars\":[{\"name\":\"var_50h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-80}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5046ms"}}