{"ok":true,"data":{"evidence_id":"ev_6ef3f1335dfa1788a0e8f7b6ff400e5b61e8632264691b505745d2215c028efd","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;pd 7 @ 0x1837cbc99;pd 7 @ 0x1837dfe0b;pd 7 @ 0x183812422;pd 7 @ 0x183823940;pd 7 @ 0x1837fb8a4;pd 7 @ 0x1836821bb","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;pd 7 @ 0x1837cbc99;pd 7 @ 0x1837dfe0b;pd 7 @ 0x183812422;pd 7 @ 0x183823940;pd 7 @ 0x1837fb8a4;pd 7 @ 0x1836821bb","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x1837cbc99 call 0x1837c88d0\r\n 0x1837cbc9e cmp eax, 0x01 ; 1\r\n ,=< 0x1837cbca1 jz 0x1837ccf76\r\n | 0x1837cbca7 cmp eax, 0x02 ; 2\r\n ,==< 0x1837cbcaa jz 0x1837cce32\r\n || 0x1837cbcb0 cmp eax, 0x03 ; 3\r\n ,===< 0x1837cbcb3 jnz 0x1837ce3fb\r\n 0x1837dfe0b call 0x1837f9d30\r\n 0x1837dfe10 mov rcx, qword [rsi+0x120]\r\n 0x1837dfe17 mov qword [rsi+0x120], rbx\r\n 0x1837dfe1e test rcx, rcx\r\n ,=< 0x1837dfe21 jz 0x1837dfe2d\r\n | 0x1837dfe23 mov edx, 0x01\r\n | 0x1837dfe28 call 0x1837fc130\r\n 0x183812422 call 0x183823560\r\n 0x183812427 cmp byte [rdi+0x17], 0x00\r\n ,=< 0x18381242b jns 0x183812446\r\n | 0x18381242d mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n | 0x183812437 and rdx, qword [rsp+0x50]\r\n | 0x18381243c mov rcx, qword [rsp+0x40]\r\n | 0x183812441 call 0x1841dcbe0\r\n 0x183823940 lea rax, qword [0x183823ad0]\r\n 0x183823947 mov qword [r15+0x20], rax\r\n 0x18382394b mov qword [r15+0x28], r12\r\n 0x18382394f mov qword [r15+0x30], rdi\r\n 0x183823953 mov qword [r15+0x38], rsi\r\n 0x183823957 mov eax, dword [rsp+0x200]\r\n 0x18382395e mov dword [r15+0x40], eax\r\n ::: 0x1837fb8a4 call 0x1837e8aa0\r\n ::`=< 0x1837fb8a9 jmp 0x1837fb751\r\n :: 0x1837fb8ae mov rdx, qword [rsi+0x08]\r\n :`==< 0x1837fb8b2 jmp 0x1837fb83c\r\n : 0x1837fb8b4 mov rdx, qword [rsi+0x08]\r\n `===< 0x1837fb8b8 jmp 0x1837fb8a1\r\n 0x1837fb8ba cmp al, cl\r\n 0x1836821bb call 0x18a89a160\r\n 0x1836821c0 lea r13, qword [rsp+0x2a8]\r\n 0x1836821c8 lea r12, qword [rsp+0x320]\r\n 0x1836821d0 lea rbp, qword [rsp+0x328]\r\n 0x1836821d8 lea rcx, qword [rsp+0x2a0]\r\n 0x1836821e0 mov r8d, 0xa8 ; 168\r\n 0x1836821e6 xor edx, edx\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x1837cbc99 call 0x1837c88d0\r\n 0x1837cbc9e cmp eax, 0x01 ; 1\r\n ,=< 0x1837cbca1 jz 0x1837ccf76\r\n | 0x1837cbca7 cmp eax, 0x02 ; 2\r\n ,==< 0x1837cbcaa jz 0x1837cce32\r\n || 0x1837cbcb0 cmp eax, 0x03 ; 3\r\n ,===< 0x1837cbcb3 jnz 0x1837ce3fb\r\n 0x1837dfe0b call 0x1837f9d30\r\n 0x1837dfe10 mov rcx, qword [rsi+0x120]\r\n 0x1837dfe17 mov qword [rsi+0x120], rbx\r\n 0x1837dfe1e test rcx, rcx\r\n ,=< 0x1837dfe21 jz 0x1837dfe2d\r\n | 0x1837dfe23 mov edx, 0x01\r\n | 0x1837dfe28 call 0x1837fc130\r\n 0x183812422 call 0x183823560\r\n 0x183812427 cmp byte [rdi+0x17], 0x00\r\n ,=< 0x18381242b jns 0x183812446\r\n | 0x18381242d mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n | 0x183812437 and rdx, qword [rsp+0x50]\r\n | 0x18381243c mov rcx, qword [rsp+0x40]\r\n | 0x183812441 call 0x1841dcbe0\r\n 0x183823940 lea rax, qword [0x183823ad0]\r\n 0x183823947 mov qword [r15+0x20], rax\r\n 0x18382394b mov qword [r15+0x28], r12\r\n 0x18382394f mov qword [r15+0x30], rdi\r\n 0x183823953 mov qword [r15+0x38], rsi\r\n 0x183823957 mov eax, dword [rsp+0x200]\r\n 0x18382395e mov dword [r15+0x40], eax\r\n ::: 0x1837fb8a4 call 0x1837e8aa0\r\n ::`=< 0x1837fb8a9 jmp 0x1837fb751\r\n :: 0x1837fb8ae mov rdx, qword [rsi+0x08]\r\n :`==< 0x1837fb8b2 jmp 0x1837fb83c\r\n : 0x1837fb8b4 mov rdx, qword [rsi+0x08]\r\n `===< 0x1837fb8b8 jmp 0x1837fb8a1\r\n 0x1837fb8ba cmp al, cl\r\n 0x1836821bb call 0x18a89a160\r\n 0x1836821c0 lea r13, qword [rsp+0x2a8]\r\n 0x1836821c8 lea r12, qword [rsp+0x320]\r\n 0x1836821d0 lea rbp, qword [rsp+0x328]\r\n 0x1836821d8 lea rcx, qword [rsp+0x2a0]\r\n 0x1836821e0 mov r8d, 0xa8 ; 168\r\n 0x1836821e6 xor edx, edx\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4838ms"}}