{"ok":true,"data":{"evidence_id":"ev_1eca38de0ac7d025cba590d11f5db8d594d3adcd1d42ec027be3121e69d6d8a2","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183599ff0;pdgo @ 0x183599ff0;afij @ 0x183599ff0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183599ff0;pdgo @ 0x183599ff0;afij @ 0x183599ff0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x183599ff0    |\r\n    0x183599ff0    |// WARNING: [rz-ghidra] Detected overlap for variable var_71h\r\n    0x183599ff0    |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n                   |\r\n    0x183599ff0    |void fcn.183599ff0(int64_t arg1, int64_t arg2, int64_t arg_38h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    undefined auStack_68 [32];\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x18359a006    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n    0x18359a013    |    piVar3 = (int32_t *)fcn.185f006b8(0x70);\r\n    0x18359a01b    |    piVar3[0x18] = 0;\r\n    0x18359a01b    |    piVar3[0x19] = 0;\r\n    0x18359a01b    |    piVar3[0x1a] = 0;\r\n    0x18359a01b    |    piVar3[0x1b] = 0;\r\n    0x18359a01f    |    piVar3[0] = 0;\r\n    0x18359a01f    |    piVar3[1] = 0;\r\n    0x18359a01f    |    piVar3[2] = 0;\r\n    0x18359a01f    |    piVar3[3] = 0;\r\n    0x18359a022    |    piVar3[4] = 0;\r\n    0x18359a022    |    piVar3[5] = 0;\r\n    0x18359a022    |    piVar3[6] = 0;\r\n    0x18359a022    |    piVar3[7] = 0;\r\n    0x18359a026    |    piVar3[8] = 0;\r\n    0x18359a026    |    piVar3[9] = 0;\r\n    0x18359a026    |    piVar3[10] = 0;\r\n    0x18359a026    |    piVar3[0xb] = 0;\r\n    0x18359a02a    |    piVar3[0xc] = 0;\r\n    0x18359a02a    |    piVar3[0xd] = 0;\r\n    0x18359a02a    |    piVar3[0xe] = 0;\r\n    0x18359a02a    |    piVar3[0xf] = 0;\r\n    0x18359a02e    |    piVar3[0x10] = 0;\r\n    0x18359a02e    |    piVar3[0x11] = 0;\r\n    0x18359a02e    |    piVar3[0x12] = 0;\r\n    0x18359a02e    |    piVar3[0x13] = 0;\r\n    0x18359a032    |    piVar3[0x14] = 0;\r\n    0x18359a032    |    piVar3[0x15] = 0;\r\n    0x18359a032    |    piVar3[0x16] = 0;\r\n    0x18359a032    |    piVar3[0x17] = 0;\r\n    0x18359a036    |    piVar3[0x18] = -1;\r\n    0x18359a040    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x18359a047    |        LOCK();\r\n    0x18359a047    |        iVar1 = *piVar3;\r\n    0x18359a047    |        *piVar3 = *piVar3 + 1;\r\n    0x18359a047    |        UNLOCK();\r\n    0x18359a051    |        if (iVar1 == 0x7fffffff) {\r\n    0x18359a12f    |            pcVar2 = (code *)swi(3);\r\n    0x18359a12f    |            (*pcVar2)();\r\n    0x18359a12f    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x18359a061    |    var_30h = *(int64_t *)arg2;\r\n    0x18359a069    |    *(int32_t **)arg2 = piVar3;\r\n    0x18359a071    |    var_48h = fcn.185f006b8(0x20);\r\n    0x18359a07b    |    var_40h = 0x1f;\r\n    0x18359a088    |    var_38h = -0x7fffffffffffffe0;\r\n    0x18359a0b1    |    if (((uint64_t)var_48h <= (undefined4 *)(var_48h + 0x1f)) &&\r\n    0x18359a08d    |       ((undefined4 *)(var_48h + 0x1f) < (undefined4 *)0x1908f1f21 || (undefined4 *)0x1908f1f20 < (uint64_t)var_48h)) {\r\n    0x18359a0ba    |        *(undefined8 *)(var_48h + 0xf) = 0x7463656c65537478;\r\n    0x18359a0ba    |        *(undefined8 *)(var_48h + 0x17) = 0x746e6567416e6f69;\r\n    0x18359a0c5    |        *(undefined4 *)var_48h = 0x2e626174;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 4) = 0x6f6a6f6d;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 8) = 0x61542e6d;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 0xc) = 0x78655462;\r\n    0x18359a0c8    |        *(undefined *)(var_48h + 0x1f) = 0;\r\n    0x18359a0dc    |        fcn.1811de290(arg1, &var_48h, &var_30h);\r\n    0x18359a0e6    |        if (var_38h < 0) {\r\n    0x18359a0f5    |            fcn.1841dcbe0(var_48h, var_38h & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18359a0fd    |        fcn.184d04dd0(arg2);\r\n    0x18359a114    |        if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_68)) {\r\n    0x18359a11f    |            return;\r\n                   |        }\r\n    0x18359a125    |        fcn.185f05b40(var_28h ^ (uint64_t)auStack_68);\r\n                   |    }\r\n    0x18359a12d    |    // WARNING: Does not return\r\n    0x18359a12d    |    pcVar2 = (code *)invalidInstructionException();\r\n    0x18359a12d    |    (*pcVar2)();\r\n                   |}\r\n[{\"offset\":6498656240,\"name\":\"fcn.183599ff0\",\"size\":320,\"is-pure\":false,\"realsz\":320,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":101,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":14,\"ebbs\":3,\"signature\":\"fcn.183599ff0(int64_t arg1, int64_t arg2, int64_t arg_38h);\",\"minbound\":6498656240,\"maxbound\":6498656560,\"callrefs\":[{\"from\":6498656275,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498656369,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498656476,\"to\":6461186704,\"type\":\"CALL\"},{\"from\":6498656501,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498656509,\"to\":6523211216,\"type\":\"CALL\"},{\"from\":6498656552,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498656255,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498656410,\"to\":6720266016,\"type\":\"DATA\"},{\"from\":6498656435,\"to\":6720266031,\"type\":\"DATA\"},{\"from\":6498656446,\"to\":6720266016,\"type\":\"DATA\"},{\"from\":6498656522,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":5,\"nargs\":3,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_38h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x183599ff0    |\r\n    0x183599ff0    |// WARNING: [rz-ghidra] Detected overlap for variable var_71h\r\n    0x183599ff0    |// WARNING: [rz-ghidra] Detected overlap for variable var_78h\r\n                   |\r\n    0x183599ff0    |void fcn.183599ff0(int64_t arg1, int64_t arg2, int64_t arg_38h)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    undefined auStack_68 [32];\r\n                   |    int64_t var_48h;\r\n                   |    int64_t var_40h;\r\n                   |    int64_t var_38h;\r\n                   |    int64_t var_30h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x18359a006    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n    0x18359a013    |    piVar3 = (int32_t *)fcn.185f006b8(0x70);\r\n    0x18359a01b    |    piVar3[0x18] = 0;\r\n    0x18359a01b    |    piVar3[0x19] = 0;\r\n    0x18359a01b    |    piVar3[0x1a] = 0;\r\n    0x18359a01b    |    piVar3[0x1b] = 0;\r\n    0x18359a01f    |    piVar3[0] = 0;\r\n    0x18359a01f    |    piVar3[1] = 0;\r\n    0x18359a01f    |    piVar3[2] = 0;\r\n    0x18359a01f    |    piVar3[3] = 0;\r\n    0x18359a022    |    piVar3[4] = 0;\r\n    0x18359a022    |    piVar3[5] = 0;\r\n    0x18359a022    |    piVar3[6] = 0;\r\n    0x18359a022    |    piVar3[7] = 0;\r\n    0x18359a026    |    piVar3[8] = 0;\r\n    0x18359a026    |    piVar3[9] = 0;\r\n    0x18359a026    |    piVar3[10] = 0;\r\n    0x18359a026    |    piVar3[0xb] = 0;\r\n    0x18359a02a    |    piVar3[0xc] = 0;\r\n    0x18359a02a    |    piVar3[0xd] = 0;\r\n    0x18359a02a    |    piVar3[0xe] = 0;\r\n    0x18359a02a    |    piVar3[0xf] = 0;\r\n    0x18359a02e    |    piVar3[0x10] = 0;\r\n    0x18359a02e    |    piVar3[0x11] = 0;\r\n    0x18359a02e    |    piVar3[0x12] = 0;\r\n    0x18359a02e    |    piVar3[0x13] = 0;\r\n    0x18359a032    |    piVar3[0x14] = 0;\r\n    0x18359a032    |    piVar3[0x15] = 0;\r\n    0x18359a032    |    piVar3[0x16] = 0;\r\n    0x18359a032    |    piVar3[0x17] = 0;\r\n    0x18359a036    |    piVar3[0x18] = -1;\r\n    0x18359a040    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x18359a047    |        LOCK();\r\n    0x18359a047    |        iVar1 = *piVar3;\r\n    0x18359a047    |        *piVar3 = *piVar3 + 1;\r\n    0x18359a047    |        UNLOCK();\r\n    0x18359a051    |        if (iVar1 == 0x7fffffff) {\r\n    0x18359a12f    |            pcVar2 = (code *)swi(3);\r\n    0x18359a12f    |            (*pcVar2)();\r\n    0x18359a12f    |            return;\r\n                   |        }\r\n                   |    }\r\n    0x18359a061    |    var_30h = *(int64_t *)arg2;\r\n    0x18359a069    |    *(int32_t **)arg2 = piVar3;\r\n    0x18359a071    |    var_48h = fcn.185f006b8(0x20);\r\n    0x18359a07b    |    var_40h = 0x1f;\r\n    0x18359a088    |    var_38h = -0x7fffffffffffffe0;\r\n    0x18359a0b1    |    if (((uint64_t)var_48h <= (undefined4 *)(var_48h + 0x1f)) &&\r\n    0x18359a08d    |       ((undefined4 *)(var_48h + 0x1f) < (undefined4 *)0x1908f1f21 || (undefined4 *)0x1908f1f20 < (uint64_t)var_48h)) {\r\n    0x18359a0ba    |        *(undefined8 *)(var_48h + 0xf) = 0x7463656c65537478;\r\n    0x18359a0ba    |        *(undefined8 *)(var_48h + 0x17) = 0x746e6567416e6f69;\r\n    0x18359a0c5    |        *(undefined4 *)var_48h = 0x2e626174;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 4) = 0x6f6a6f6d;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 8) = 0x61542e6d;\r\n    0x18359a0c5    |        *(undefined4 *)(var_48h + 0xc) = 0x78655462;\r\n    0x18359a0c8    |        *(undefined *)(var_48h + 0x1f) = 0;\r\n    0x18359a0dc    |        fcn.1811de290(arg1, &var_48h, &var_30h);\r\n    0x18359a0e6    |        if (var_38h < 0) {\r\n    0x18359a0f5    |            fcn.1841dcbe0(var_48h, var_38h & 0x7fffffffffffffff);\r\n                   |        }\r\n    0x18359a0fd    |        fcn.184d04dd0(arg2);\r\n    0x18359a114    |        if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_68)) {\r\n    0x18359a11f    |            return;\r\n                   |        }\r\n    0x18359a125    |        fcn.185f05b40(var_28h ^ (uint64_t)auStack_68);\r\n                   |    }\r\n    0x18359a12d    |    // WARNING: Does not return\r\n    0x18359a12d    |    pcVar2 = (code *)invalidInstructionException();\r\n    0x18359a12d    |    (*pcVar2)();\r\n                   |}\r\n[{\"offset\":6498656240,\"name\":\"fcn.183599ff0\",\"size\":320,\"is-pure\":false,\"realsz\":320,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":101,\"cc\":9,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":11,\"edges\":14,\"ebbs\":3,\"signature\":\"fcn.183599ff0(int64_t arg1, int64_t arg2, int64_t arg_38h);\",\"minbound\":6498656240,\"maxbound\":6498656560,\"callrefs\":[{\"from\":6498656275,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498656369,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6498656476,\"to\":6461186704,\"type\":\"CALL\"},{\"from\":6498656501,\"to\":6511512544,\"type\":\"CALL\"},{\"from\":6498656509,\"to\":6523211216,\"type\":\"CALL\"},{\"from\":6498656552,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498656255,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498656410,\"to\":6720266016,\"type\":\"DATA\"},{\"from\":6498656435,\"to\":6720266031,\"type\":\"DATA\"},{\"from\":6498656446,\"to\":6720266016,\"type\":\"DATA\"},{\"from\":6498656522,\"to\":6740709440,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":5,\"nargs\":3,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}},{\"name\":\"arg_38h\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":56}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5098ms"}}