{"ok":true,"data":{"evidence_id":"ev_fede8f1cc07f0a9c098321072fa3d31626fb456df1b4a156ba3209a5927ffdf9","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;pd 12 @ 0x18366ff80;pd 12 @ 0x183673d38;pd 12 @ 0x1836761e5;pd 12 @ 0x1836755ba;pd 12 @ 0x183675763;pd 12 @ 0x183598840;pd 12 @ 0x1836734a1","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;pd 12 @ 0x18366ff80;pd 12 @ 0x183673d38;pd 12 @ 0x1836761e5;pd 12 @ 0x1836755ba;pd 12 @ 0x183675763;pd 12 @ 0x183598840;pd 12 @ 0x1836734a1","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" `=< 0x18366ff80 jmp 0x18366ff05\r\n 0x18366ff82 mov rcx, qword [rdi+0xb8]\r\n 0x18366ff89 test rcx, rcx\r\n ,=< 0x18366ff8c jz 0x183670017\r\n | 0x18366ff92 mov rdx, rsi\r\n | 0x18366ff95 call 0x183674860\r\n | 0x18366ff9a test al, al\r\n ,==< 0x18366ff9c jz 0x183670063\r\n || 0x18366ffa2 mov byte [rdi+0x91], 0x01\r\n || 0x18366ffa9 cmp byte [rdi+0x47], 0x00\r\n ,===< 0x18366ffad js 0x183670006\r\n ||| 0x18366ffaf xor eax, eax\r\n : 0x183673d38 and al, 0x30 ; 48\r\n : 0x183673d3b call 0x1804b0120\r\n : 0x183673d40 mov rcx, qword [rsi+0xb8]\r\n : 0x183673d47 test rcx, rcx\r\n ,==< 0x183673d4a jz 0x183673d54\r\n |: 0x183673d4c mov rdx, rdi\r\n |: 0x183673d4f call 0x183675390\r\n `--> 0x183673d54 mov byte [rsi+0x91], 0x00\r\n : 0x183673d5b cmp byte [rsi+0x47], 0x00\r\n `=< 0x183673d5f js 0x183673c97\r\n 0x183673d65 xor eax, eax\r\n 0x183673d67 mov byte [rsi+0x30], al\r\n : 0x1836761e5 cmp ecx, 0x7a120\r\n `=< 0x1836761eb jnle 0x183676105\r\n 0x1836761f1 mov qword [r13+0x18], 0x00\r\n 0x1836761f9 mov rcx, qword [r13]\r\n 0x1836761fd mov dl, 0x01\r\n 0x1836761ff call 0x18366fbc0\r\n 0x183676204 cmp dword [0x191de85c0], 0x02 ; [0x191de85c0:4]=0\r\n ,=< 0x18367620b jnle 0x1836762d1\r\n | 0x183676211 lea rdx, qword [0x190c01080] ; \"..\\..\\tab\\browser\\voice_input\\win\\browser_hotkey_monitor_win.cc\"\r\n | 0x183676218 lea rsi, qword [rsp+0x28]\r\n | 0x18367621d mov rcx, rsi\r\n | 0x183676220 mov r8d, 0x92 ; 146\r\n :: 0x1836755ba mov rax, qword [rbx]\r\n :: 0x1836755bd mov rax, qword [rax+0xa8]\r\n :: 0x1836755c4 mov rcx, rbx\r\n :: 0x1836755c7 call qword [0x191c186b0] ; [0x191c186b0:8]=0x185f59da0\r\n :: 0x1836755cd test rax, rax\r\n :`=< 0x1836755d0 jz 0x1836753b7\r\n : 0x1836755d6 mov rbx, rax\r\n : 0x1836755d9 movsx rax, byte [rdi+0x17]\r\n : 0x1836755de test rax, rax\r\n `==< 0x1836755e1 js 0x183675585\r\n 0x1836755e3 mov rcx, rax\r\n 0x1836755e6 test rcx, rcx\r\n 0x183675763 call 0x1854229f0\r\n 0x183675768 mov rax, qword [rbx]\r\n 0x18367576b mov rax, qword [rax+0x40]\r\n 0x18367576f mov rcx, rbx\r\n 0x183675772 mov rdx, rdi\r\n 0x183675775 call qword [0x191c186b0] ; [0x191c186b0:8]=0x185f59da0\r\n 0x18367577b cmp byte [rdi+0x17], 0x00\r\n ,=< 0x18367577f jns 0x183675793\r\n | 0x183675781 mov rcx, qword [rsp+0x30]\r\n | 0x183675786 mov rdx, qword [rsp+0x40]\r\n | 0x18367578b add rdx, rdx\r\n | 0x18367578e call 0x1841dcbe0\r\n 0x183598840 mov rcx, rbx\r\n 0x183598843 call 0x1835988d0\r\n 0x183598848 mov rcx, qword [rdi+0x170]\r\n 0x18359884f mov rax, qword [rsi]\r\n 0x183598852 lea rdx, qword [rsp+0x20]\r\n 0x183598857 mov qword [rdx], rax\r\n 0x18359885a mov qword [rsi], 0x00\r\n 0x183598861 call 0x18340d080\r\n 0x183598866 mov rcx, qword [rsi]\r\n 0x183598869 test rcx, rcx\r\n ,=< 0x18359886c jnz 0x1835988a0\r\n | 0x18359886e mov rax, qword [rsp+0x38]\r\n 0x1836734a1 lea rcx, qword [rsp+0x40]\r\n 0x1836734a6 call 0x1804b0120\r\n 0x1836734ab lea rdx, qword [rsp+0x170]\r\n 0x1836734b3 mov rcx, rdi\r\n 0x1836734b6 call 0x183673ae0\r\n 0x1836734bb cmp byte [rsp+0x187], 0x00\r\n ,=< 0x1836734c3 jns 0x1836734e4\r\n | 0x1836734c5 mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n | 0x1836734cf and rdx, qword [rsp+0x180]\r\n | 0x1836734d7 mov rcx, qword [rsp+0x170]\r\n | 0x1836734df call 0x1841dcbe0\r\n `-> 0x1836734e4 mov rcx, rsi\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" `=< 0x18366ff80 jmp 0x18366ff05\r\n 0x18366ff82 mov rcx, qword [rdi+0xb8]\r\n 0x18366ff89 test rcx, rcx\r\n ,=< 0x18366ff8c jz 0x183670017\r\n | 0x18366ff92 mov rdx, rsi\r\n | 0x18366ff95 call 0x183674860\r\n | 0x18366ff9a test al, al\r\n ,==< 0x18366ff9c jz 0x183670063\r\n || 0x18366ffa2 mov byte [rdi+0x91], 0x01\r\n || 0x18366ffa9 cmp byte [rdi+0x47], 0x00\r\n ,===< 0x18366ffad js 0x183670006\r\n ||| 0x18366ffaf xor eax, eax\r\n : 0x183673d38 and al, 0x30 ; 48\r\n : 0x183673d3b call 0x1804b0120\r\n : 0x183673d40 mov rcx, qword [rsi+0xb8]\r\n : 0x183673d47 test rcx, rcx\r\n ,==< 0x183673d4a jz 0x183673d54\r\n |: 0x183673d4c mov rdx, rdi\r\n |: 0x183673d4f call 0x183675390\r\n `--> 0x183673d54 mov byte [rsi+0x91], 0x00\r\n : 0x183673d5b cmp byte [rsi+0x47], 0x00\r\n `=< 0x183673d5f js 0x183673c97\r\n 0x183673d65 xor eax, eax\r\n 0x183673d67 mov byte [rsi+0x30], al\r\n : 0x1836761e5 cmp ecx, 0x7a120\r\n `=< 0x1836761eb jnle 0x183676105\r\n 0x1836761f1 mov qword [r13+0x18], 0x00\r\n 0x1836761f9 mov rcx, qword [r13]\r\n 0x1836761fd mov dl, 0x01\r\n 0x1836761ff call 0x18366fbc0\r\n 0x183676204 cmp dword [0x191de85c0], 0x02 ; [0x191de85c0:4]=0\r\n ,=< 0x18367620b jnle 0x1836762d1\r\n | 0x183676211 lea rdx, qword [0x190c01080] ; \"..\\..\\tab\\browser\\voice_input\\win\\browser_hotkey_monitor_win.cc\"\r\n | 0x183676218 lea rsi, qword [rsp+0x28]\r\n | 0x18367621d mov rcx, rsi\r\n | 0x183676220 mov r8d, 0x92 ; 146\r\n :: 0x1836755ba mov rax, qword [rbx]\r\n :: 0x1836755bd mov rax, qword [rax+0xa8]\r\n :: 0x1836755c4 mov rcx, rbx\r\n :: 0x1836755c7 call qword [0x191c186b0] ; [0x191c186b0:8]=0x185f59da0\r\n :: 0x1836755cd test rax, rax\r\n :`=< 0x1836755d0 jz 0x1836753b7\r\n : 0x1836755d6 mov rbx, rax\r\n : 0x1836755d9 movsx rax, byte [rdi+0x17]\r\n : 0x1836755de test rax, rax\r\n `==< 0x1836755e1 js 0x183675585\r\n 0x1836755e3 mov rcx, rax\r\n 0x1836755e6 test rcx, rcx\r\n 0x183675763 call 0x1854229f0\r\n 0x183675768 mov rax, qword [rbx]\r\n 0x18367576b mov rax, qword [rax+0x40]\r\n 0x18367576f mov rcx, rbx\r\n 0x183675772 mov rdx, rdi\r\n 0x183675775 call qword [0x191c186b0] ; [0x191c186b0:8]=0x185f59da0\r\n 0x18367577b cmp byte [rdi+0x17], 0x00\r\n ,=< 0x18367577f jns 0x183675793\r\n | 0x183675781 mov rcx, qword [rsp+0x30]\r\n | 0x183675786 mov rdx, qword [rsp+0x40]\r\n | 0x18367578b add rdx, rdx\r\n | 0x18367578e call 0x1841dcbe0\r\n 0x183598840 mov rcx, rbx\r\n 0x183598843 call 0x1835988d0\r\n 0x183598848 mov rcx, qword [rdi+0x170]\r\n 0x18359884f mov rax, qword [rsi]\r\n 0x183598852 lea rdx, qword [rsp+0x20]\r\n 0x183598857 mov qword [rdx], rax\r\n 0x18359885a mov qword [rsi], 0x00\r\n 0x183598861 call 0x18340d080\r\n 0x183598866 mov rcx, qword [rsi]\r\n 0x183598869 test rcx, rcx\r\n ,=< 0x18359886c jnz 0x1835988a0\r\n | 0x18359886e mov rax, qword [rsp+0x38]\r\n 0x1836734a1 lea rcx, qword [rsp+0x40]\r\n 0x1836734a6 call 0x1804b0120\r\n 0x1836734ab lea rdx, qword [rsp+0x170]\r\n 0x1836734b3 mov rcx, rdi\r\n 0x1836734b6 call 0x183673ae0\r\n 0x1836734bb cmp byte [rsp+0x187], 0x00\r\n ,=< 0x1836734c3 jns 0x1836734e4\r\n | 0x1836734c5 mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n | 0x1836734cf and rdx, qword [rsp+0x180]\r\n | 0x1836734d7 mov rcx, qword [rsp+0x170]\r\n | 0x1836734df call 0x1841dcbe0\r\n `-> 0x1836734e4 mov rcx, rsi\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4994ms"}}