{"ok":true,"data":{"evidence_id":"ev_550f235e7ac8d1ac6e9a35d59134c690657ada2c842429dc5a51495888e0892f","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;pd 12 @ 0x1837cbc80;pd 12 @ 0x1837dfe00;pd 12 @ 0x183812410;pd 12 @ 0x183823930;pd 12 @ 0x1837fb895;pd 12 @ 0x1836821a8","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;pd 12 @ 0x1837cbc80;pd 12 @ 0x1837dfe00;pd 12 @ 0x183812410;pd 12 @ 0x183823930;pd 12 @ 0x1837fb895;pd 12 @ 0x1836821a8","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x1837cbc80 or byte [r8-0x73], r9b\r\n 0x1837cbc84 mov word [rax+rsi*2], fs\r\n 0x1837cbc87 add eax, dword [rax]\r\n 0x1837cbc89 add byte [rax-0x77], cl\r\n 0x1837cbc8c adc dword [rax-0x77], ecx\r\n 0x1837cbc8f or byte [r8-0x73], cl\r\n 0x1837cbc93 xchg esp, eax\r\n 0x1837cbc94 and al, 0x80 ; 128\r\n 0x1837cbc96 add eax, dword [rax]\r\n 0x1837cbc98 add al, ch\r\n 0x1837cbc9a xor cl, ah\r\n 0x1837cbc9c invalid\r\n 0x1837dfe00 mov ebx, eax\r\n 0x1837dfe02 mov rcx, rax\r\n 0x1837dfe05 mov rdx, rdi\r\n 0x1837dfe08 mov r8, rsi\r\n 0x1837dfe0b call 0x1837f9d30\r\n 0x1837dfe10 mov rcx, qword [rsi+0x120]\r\n 0x1837dfe17 mov qword [rsi+0x120], rbx\r\n 0x1837dfe1e test rcx, rcx\r\n ,=< 0x1837dfe21 jz 0x1837dfe2d\r\n | 0x1837dfe23 mov edx, 0x01\r\n | 0x1837dfe28 call 0x1837fc130\r\n `-> 0x1837dfe2d mov rax, rsi\r\n 0x183812410 xor byte [rax-0x73], cl\r\n ,=< 0x183812413 jl 0x183812439\r\n | 0x183812415 mov qword [rsp+0x28], rdi\r\n | 0x18381241b mov dword [rsp+0x20], eax\r\n | 0x18381241f mov rcx, rbx\r\n | 0x183812422 call 0x183823560\r\n | 0x183812427 cmp byte [rdi+0x17], 0x00\r\n ,==< 0x18381242b jns 0x183812446\r\n || 0x18381242d mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n || 0x183812437 and rdx, qword [rsp+0x50]\r\n | 0x18381243c mov rcx, qword [rsp+0x40]\r\n | 0x183812441 call 0x1841dcbe0\r\n 0x183823930 or byte [rax-0x73], cl\r\n 0x183823933 add eax, 0xff564eb8\r\n 0x183823938 mov qword [r15+0x10], rax\r\n 0x18382393c mov qword [r15+0x18], rbx\r\n 0x183823940 lea rax, qword [0x183823ad0]\r\n 0x183823947 mov qword [r15+0x20], rax\r\n 0x18382394b mov qword [r15+0x28], r12\r\n 0x18382394f mov qword [r15+0x30], rdi\r\n 0x183823953 mov qword [r15+0x38], rsi\r\n 0x183823957 mov eax, dword [rsp+0x200]\r\n 0x18382395e mov dword [r15+0x40], eax\r\n 0x183823962 lea rdx, qword [0x190c24560] ; \"FuseRead\"\r\n ::: 0x1837fb895 shl byte [rdi+rax*1-0x76], 0x40\r\n ::: 0x1837fb89a add al, 0x84 ; 132\r\n ::: 0x1837fb89c shl byte [rbp+rdx*1+0x31], 0xd2\r\n .----> 0x1837fb8a1 mov r8b, 0x01\r\n :::: 0x1837fb8a4 call 0x1837e8aa0\r\n ::`==< 0x1837fb8a9 jmp 0x1837fb751\r\n :: : 0x1837fb8ae mov rdx, qword [rsi+0x08]\r\n :`===< 0x1837fb8b2 jmp 0x1837fb83c\r\n : : 0x1837fb8b4 mov rdx, qword [rsi+0x08]\r\n `====< 0x1837fb8b8 jmp 0x1837fb8a1\r\n : 0x1837fb8ba cmp al, cl\r\n `=< 0x1837fb8bc jz 0x1837fb751\r\n 0x1836821a8 add byte [rax], al\r\n 0x1836821aa add byte [rax-0x73], cl\r\n 0x1836821ad xchg esp, eax\r\n 0x1836821ae and al, 0xe0 ; 224\r\n 0x1836821b0 add byte [rax], al\r\n 0x1836821b2 add byte [rbp+rcx*4-0x7c], cl\r\n 0x1836821b6 and al, 0x00\r\n 0x1836821b8 add dword [rax], eax\r\n 0x1836821ba add al, ch\r\n 0x1836821bc mov al, byte [0xa824ac8d4c07217f]\r\n 0x1836821c5 add al, byte [rax]\r\n 0x1836821c7 add byte [rbp+rcx*4-0x5c], cl\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x1837cbc80 or byte [r8-0x73], r9b\r\n 0x1837cbc84 mov word [rax+rsi*2], fs\r\n 0x1837cbc87 add eax, dword [rax]\r\n 0x1837cbc89 add byte [rax-0x77], cl\r\n 0x1837cbc8c adc dword [rax-0x77], ecx\r\n 0x1837cbc8f or byte [r8-0x73], cl\r\n 0x1837cbc93 xchg esp, eax\r\n 0x1837cbc94 and al, 0x80 ; 128\r\n 0x1837cbc96 add eax, dword [rax]\r\n 0x1837cbc98 add al, ch\r\n 0x1837cbc9a xor cl, ah\r\n 0x1837cbc9c invalid\r\n 0x1837dfe00 mov ebx, eax\r\n 0x1837dfe02 mov rcx, rax\r\n 0x1837dfe05 mov rdx, rdi\r\n 0x1837dfe08 mov r8, rsi\r\n 0x1837dfe0b call 0x1837f9d30\r\n 0x1837dfe10 mov rcx, qword [rsi+0x120]\r\n 0x1837dfe17 mov qword [rsi+0x120], rbx\r\n 0x1837dfe1e test rcx, rcx\r\n ,=< 0x1837dfe21 jz 0x1837dfe2d\r\n | 0x1837dfe23 mov edx, 0x01\r\n | 0x1837dfe28 call 0x1837fc130\r\n `-> 0x1837dfe2d mov rax, rsi\r\n 0x183812410 xor byte [rax-0x73], cl\r\n ,=< 0x183812413 jl 0x183812439\r\n | 0x183812415 mov qword [rsp+0x28], rdi\r\n | 0x18381241b mov dword [rsp+0x20], eax\r\n | 0x18381241f mov rcx, rbx\r\n | 0x183812422 call 0x183823560\r\n | 0x183812427 cmp byte [rdi+0x17], 0x00\r\n ,==< 0x18381242b jns 0x183812446\r\n || 0x18381242d mov rdx, 0x7fffffffffffffff ; 9223372036854775807\r\n || 0x183812437 and rdx, qword [rsp+0x50]\r\n | 0x18381243c mov rcx, qword [rsp+0x40]\r\n | 0x183812441 call 0x1841dcbe0\r\n 0x183823930 or byte [rax-0x73], cl\r\n 0x183823933 add eax, 0xff564eb8\r\n 0x183823938 mov qword [r15+0x10], rax\r\n 0x18382393c mov qword [r15+0x18], rbx\r\n 0x183823940 lea rax, qword [0x183823ad0]\r\n 0x183823947 mov qword [r15+0x20], rax\r\n 0x18382394b mov qword [r15+0x28], r12\r\n 0x18382394f mov qword [r15+0x30], rdi\r\n 0x183823953 mov qword [r15+0x38], rsi\r\n 0x183823957 mov eax, dword [rsp+0x200]\r\n 0x18382395e mov dword [r15+0x40], eax\r\n 0x183823962 lea rdx, qword [0x190c24560] ; \"FuseRead\"\r\n ::: 0x1837fb895 shl byte [rdi+rax*1-0x76], 0x40\r\n ::: 0x1837fb89a add al, 0x84 ; 132\r\n ::: 0x1837fb89c shl byte [rbp+rdx*1+0x31], 0xd2\r\n .----> 0x1837fb8a1 mov r8b, 0x01\r\n :::: 0x1837fb8a4 call 0x1837e8aa0\r\n ::`==< 0x1837fb8a9 jmp 0x1837fb751\r\n :: : 0x1837fb8ae mov rdx, qword [rsi+0x08]\r\n :`===< 0x1837fb8b2 jmp 0x1837fb83c\r\n : : 0x1837fb8b4 mov rdx, qword [rsi+0x08]\r\n `====< 0x1837fb8b8 jmp 0x1837fb8a1\r\n : 0x1837fb8ba cmp al, cl\r\n `=< 0x1837fb8bc jz 0x1837fb751\r\n 0x1836821a8 add byte [rax], al\r\n 0x1836821aa add byte [rax-0x73], cl\r\n 0x1836821ad xchg esp, eax\r\n 0x1836821ae and al, 0xe0 ; 224\r\n 0x1836821b0 add byte [rax], al\r\n 0x1836821b2 add byte [rbp+rcx*4-0x7c], cl\r\n 0x1836821b6 and al, 0x00\r\n 0x1836821b8 add dword [rax], eax\r\n 0x1836821ba add al, ch\r\n 0x1836821bc mov al, byte [0xa824ac8d4c07217f]\r\n 0x1836821c5 add al, byte [rax]\r\n 0x1836821c7 add byte [rbp+rcx*4-0x5c], cl\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4993ms"}}