{"ok":true,"data":{"evidence_id":"ev_f435ede65b39c6a1e99a9e77d57d0a6aba605f82318d778da113021c0321ee09","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x183598a30;pdgo @ 0x183598a30;afij @ 0x183598a30","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x183598a30;pdgo @ 0x183598a30;afij @ 0x183598a30","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x183598a30 |\r\n 0x183598a30 |// WARNING: [rz-ghidra] Detected overlap for variable var_1ch\r\n |\r\n 0x183598a30 |void fcn.183598a30(int64_t arg1, int64_t arg2)\r\n |{\r\n | int64_t iVar1;\r\n | int64_t iVar2;\r\n | code *pcVar3;\r\n | char cVar4;\r\n | undefined auStack_68 [32];\r\n | int64_t var_48h;\r\n | int64_t var_38h;\r\n | undefined8 uStack_30;\r\n | undefined8 uStack_28;\r\n | undefined4 var_1ch;\r\n | int64_t var_18h;\r\n | \r\n 0x183598a3d | var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x183598a4c | if (arg2 == *(int64_t *)(arg1 + 0x178)) {\r\n 0x183598a55 | func_0x000184cb7790(arg1 + 0x100);\r\n 0x183598a61 | *(int64_t *)(arg1 + 0x178) = *(int64_t *)(arg1 + 0x178) + 1;\r\n 0x183598a68 | iVar1 = *(int64_t *)(arg1 + 0x160);\r\n 0x183598a6f | iVar2 = *(int64_t *)(arg1 + 0x170);\r\n 0x183598a78 | *(undefined8 *)(arg1 + 0x160) = 0;\r\n 0x183598a7f | *(undefined4 *)(arg1 + 0x168) = 0;\r\n 0x183598a89 | *(undefined8 *)(arg1 + 0x170) = 0;\r\n 0x183598a93 | if (iVar2 != 0) {\r\n 0x183598a9a | func_0x0001811b5ec0(iVar2, 1);\r\n | }\r\n 0x183598aa2 | if (iVar1 != 0) {\r\n 0x183598adf | func_0x000184777f70(iVar1, 1);\r\n | }\r\n 0x183598aa8 | if (*(char *)(arg1 + 0x60) == '\\x01') {\r\n 0x183598aaa | *(undefined *)(arg1 + 0x60) = 0;\r\n | }\r\n 0x183598ab3 | var_1ch = 0;\r\n 0x183598abc | cVar4 = func_0x0001835985d0(arg1);\r\n 0x183598ac3 | if (cVar4 == '\\0') {\r\n 0x183598acc | if (*(char *)(arg1 + 0x80) == '\\x01') {\r\n 0x183598ace | *(undefined *)(arg1 + 0x80) = 0;\r\n | }\r\n | } else {\r\n 0x183598af2 | var_38h = 0;\r\n 0x183598af2 | uStack_30 = 0;\r\n 0x183598af5 | uStack_28 = 0;\r\n 0x183598afd | var_48h._0_4_ = var_1ch;\r\n 0x183598b0a | func_0x000183599d10(arg1, &var_38h, 0, 0);\r\n | }\r\n | }\r\n 0x183598b21 | if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_68)) {\r\n 0x183598b29 | return;\r\n | }\r\n 0x183598b2f | func_0x000185f05b40(var_18h ^ (uint64_t)auStack_68);\r\n 0x183598b37 | pcVar3 = (code *)swi(3);\r\n 0x183598b37 | (*pcVar3)();\r\n 0x183598b37 | return;\r\n |}\r\n[{\"offset\":6498650672,\"name\":\"fcn.183598a30\",\"size\":264,\"is-pure\":false,\"realsz\":264,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":87,\"cc\":9,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":14,\"edges\":19,\"ebbs\":2,\"signature\":\"fcn.183598a30(int64_t arg1, int64_t arg2);\",\"minbound\":6498650672,\"maxbound\":6498650936,\"callrefs\":[{\"from\":6498650716,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6498650778,\"to\":6461021888,\"type\":\"CALL\"},{\"from\":6498650812,\"to\":6498649552,\"type\":\"CALL\"},{\"from\":6498650837,\"to\":6498650895,\"type\":\"CODE\"},{\"from\":6498650847,\"to\":6517391216,\"type\":\"CALL\"},{\"from\":6498650852,\"to\":6498650788,\"type\":\"CODE\"},{\"from\":6498650890,\"to\":6498655504,\"type\":\"CALL\"},{\"from\":6498650930,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498650678,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498650903,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498650837,\"to\":6498650895,\"type\":\"CODE\"},{\"from\":6498650852,\"to\":6498650788,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_1ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-28}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x183598a30 |\r\n 0x183598a30 |// WARNING: [rz-ghidra] Detected overlap for variable var_1ch\r\n |\r\n 0x183598a30 |void fcn.183598a30(int64_t arg1, int64_t arg2)\r\n |{\r\n | int64_t iVar1;\r\n | int64_t iVar2;\r\n | code *pcVar3;\r\n | char cVar4;\r\n | undefined auStack_68 [32];\r\n | int64_t var_48h;\r\n | int64_t var_38h;\r\n | undefined8 uStack_30;\r\n | undefined8 uStack_28;\r\n | undefined4 var_1ch;\r\n | int64_t var_18h;\r\n | \r\n 0x183598a3d | var_18h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x183598a4c | if (arg2 == *(int64_t *)(arg1 + 0x178)) {\r\n 0x183598a55 | func_0x000184cb7790(arg1 + 0x100);\r\n 0x183598a61 | *(int64_t *)(arg1 + 0x178) = *(int64_t *)(arg1 + 0x178) + 1;\r\n 0x183598a68 | iVar1 = *(int64_t *)(arg1 + 0x160);\r\n 0x183598a6f | iVar2 = *(int64_t *)(arg1 + 0x170);\r\n 0x183598a78 | *(undefined8 *)(arg1 + 0x160) = 0;\r\n 0x183598a7f | *(undefined4 *)(arg1 + 0x168) = 0;\r\n 0x183598a89 | *(undefined8 *)(arg1 + 0x170) = 0;\r\n 0x183598a93 | if (iVar2 != 0) {\r\n 0x183598a9a | func_0x0001811b5ec0(iVar2, 1);\r\n | }\r\n 0x183598aa2 | if (iVar1 != 0) {\r\n 0x183598adf | func_0x000184777f70(iVar1, 1);\r\n | }\r\n 0x183598aa8 | if (*(char *)(arg1 + 0x60) == '\\x01') {\r\n 0x183598aaa | *(undefined *)(arg1 + 0x60) = 0;\r\n | }\r\n 0x183598ab3 | var_1ch = 0;\r\n 0x183598abc | cVar4 = func_0x0001835985d0(arg1);\r\n 0x183598ac3 | if (cVar4 == '\\0') {\r\n 0x183598acc | if (*(char *)(arg1 + 0x80) == '\\x01') {\r\n 0x183598ace | *(undefined *)(arg1 + 0x80) = 0;\r\n | }\r\n | } else {\r\n 0x183598af2 | var_38h = 0;\r\n 0x183598af2 | uStack_30 = 0;\r\n 0x183598af5 | uStack_28 = 0;\r\n 0x183598afd | var_48h._0_4_ = var_1ch;\r\n 0x183598b0a | func_0x000183599d10(arg1, &var_38h, 0, 0);\r\n | }\r\n | }\r\n 0x183598b21 | if (*(uint64_t *)0x191c71040 == (var_18h ^ (uint64_t)auStack_68)) {\r\n 0x183598b29 | return;\r\n | }\r\n 0x183598b2f | func_0x000185f05b40(var_18h ^ (uint64_t)auStack_68);\r\n 0x183598b37 | pcVar3 = (code *)swi(3);\r\n 0x183598b37 | (*pcVar3)();\r\n 0x183598b37 | return;\r\n |}\r\n[{\"offset\":6498650672,\"name\":\"fcn.183598a30\",\"size\":264,\"is-pure\":false,\"realsz\":264,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":87,\"cc\":9,\"loops\":1,\"bits\":64,\"type\":\"fcn\",\"nbbs\":14,\"edges\":19,\"ebbs\":2,\"signature\":\"fcn.183598a30(int64_t arg1, int64_t arg2);\",\"minbound\":6498650672,\"maxbound\":6498650936,\"callrefs\":[{\"from\":6498650716,\"to\":6522894224,\"type\":\"CALL\"},{\"from\":6498650778,\"to\":6461021888,\"type\":\"CALL\"},{\"from\":6498650812,\"to\":6498649552,\"type\":\"CALL\"},{\"from\":6498650837,\"to\":6498650895,\"type\":\"CODE\"},{\"from\":6498650847,\"to\":6517391216,\"type\":\"CALL\"},{\"from\":6498650852,\"to\":6498650788,\"type\":\"CODE\"},{\"from\":6498650890,\"to\":6498655504,\"type\":\"CALL\"},{\"from\":6498650930,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6498650678,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6498650903,\"to\":6740709440,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6498650837,\"to\":6498650895,\"type\":\"CODE\"},{\"from\":6498650852,\"to\":6498650788,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_48h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-72}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_1ch\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-28}},{\"name\":\"var_18h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-24}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5229ms"}}