{"ok":true,"data":{"evidence_id":"ev_ab6dfec52dad0a0c69870f605a2ffdcc08bb2684faba55b4f8a9c5797648069f","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1837dfd50;pdgo @ 0x1837dfd50;afij @ 0x1837dfd50","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837dfd50;pdgo @ 0x1837dfd50;afij @ 0x1837dfd50","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1837dfd50    |int64_t fcn.1837dfd50(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    int64_t iVar5;\r\n                   |    \r\n    0x1837dfd64    |    *(undefined8 *)arg1 = 0x18fd2a1f8;\r\n    0x1837dfd7b    |    if ((arg2 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837dfd80    |        func_0x0001841c7180(arg2);\r\n                   |    }\r\n    0x1837dfd85    |    *(int64_t *)(arg1 + 8) = arg2;\r\n    0x1837dfd8f    |    *(undefined *)(arg1 + 0x100) = 0;\r\n    0x1837dfd89    |    func_0x000185f5a0c0(arg1 + 0x10, 0, 0xd9);\r\n    0x1837dfda5    |    *(undefined8 *)(arg1 + 0x108) = 0;\r\n    0x1837dfda5    |    *(undefined8 *)(arg1 + 0x110) = 0;\r\n    0x1837dfdac    |    *(undefined8 *)(arg1 + 0x118) = 0;\r\n    0x1837dfdac    |    *(undefined8 *)(arg1 + 0x120) = 0;\r\n    0x1837dfdb3    |    *(undefined *)(arg1 + 0x128) = 0;\r\n    0x1837dfdbe    |    piVar3 = (int32_t *)func_0x000185f006b8(8);\r\n    0x1837dfdc3    |    *piVar3 = 0;\r\n    0x1837dfdc9    |    *(undefined *)(piVar3 + 1) = 0;\r\n    0x1837dfdcc    |    *(int32_t **)(arg1 + 0x130) = piVar3;\r\n    0x1837dfdd6    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837dfddd    |        LOCK();\r\n    0x1837dfddd    |        iVar1 = *piVar3;\r\n    0x1837dfddd    |        *piVar3 = *piVar3 + 1;\r\n    0x1837dfddd    |        UNLOCK();\r\n    0x1837dfde7    |        if (iVar1 == 0x7fffffff) {\r\n    0x1837dfe38    |            pcVar2 = (code *)swi(3);\r\n    0x1837dfe38    |            iVar5 = (*pcVar2)();\r\n    0x1837dfe38    |            return iVar5;\r\n                   |        }\r\n                   |    }\r\n    0x1837dfde9    |    *(int64_t *)(arg1 + 0x138) = arg1;\r\n    0x1837dfdf3    |    if (arg2 != 0) {\r\n    0x1837dfdfa    |        uVar4 = func_0x000185f006b8(0x90);\r\n    0x1837dfe0b    |        func_0x0001837f9d30(uVar4, arg2, arg1);\r\n    0x1837dfe10    |        iVar5 = *(int64_t *)(arg1 + 0x120);\r\n    0x1837dfe17    |        *(undefined8 *)(arg1 + 0x120) = uVar4;\r\n    0x1837dfe21    |        if (iVar5 != 0) {\r\n    0x1837dfe28    |            func_0x0001837fc130(iVar5, 1);\r\n                   |        }\r\n    0x1837dfe37    |        return arg1;\r\n                   |    }\r\n    0x1837dfe3b    |    pcVar2 = (code *)swi(3);\r\n    0x1837dfe3b    |    iVar5 = (*pcVar2)();\r\n    0x1837dfe3b    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6501039440,\"name\":\"fcn.1837dfd50\",\"size\":236,\"is-pure\":false,\"realsz\":234,\"noreturn\":false,\"stackframe\":56,\"calltype\":\"ms\",\"cost\":79,\"cc\":8,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":10,\"edges\":12,\"ebbs\":3,\"signature\":\"fcn.1837dfd50(int64_t arg1, int64_t arg2);\",\"minbound\":6501039440,\"maxbound\":6501039676,\"callrefs\":[{\"from\":6501039488,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501039517,\"to\":6542434496,\"type\":\"CALL\"},{\"from\":6501039550,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501039610,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501039627,\"to\":6501145904,\"type\":\"CALL\"},{\"from\":6501039656,\"to\":6501155120,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501039453,\"to\":6707913208,\"type\":\"DATA\"},{\"from\":6501039476,\"to\":6741126408,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":0,\"nargs\":2,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1837dfd50    |int64_t fcn.1837dfd50(int64_t arg1, int64_t arg2)\r\n                   |{\r\n                   |    int32_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t *piVar3;\r\n                   |    undefined8 uVar4;\r\n                   |    int64_t iVar5;\r\n                   |    \r\n    0x1837dfd64    |    *(undefined8 *)arg1 = 0x18fd2a1f8;\r\n    0x1837dfd7b    |    if ((arg2 & 0xfffffffc00000000U) == *(uint64_t *)0x191cd6d08) {\r\n    0x1837dfd80    |        func_0x0001841c7180(arg2);\r\n                   |    }\r\n    0x1837dfd85    |    *(int64_t *)(arg1 + 8) = arg2;\r\n    0x1837dfd8f    |    *(undefined *)(arg1 + 0x100) = 0;\r\n    0x1837dfd89    |    func_0x000185f5a0c0(arg1 + 0x10, 0, 0xd9);\r\n    0x1837dfda5    |    *(undefined8 *)(arg1 + 0x108) = 0;\r\n    0x1837dfda5    |    *(undefined8 *)(arg1 + 0x110) = 0;\r\n    0x1837dfdac    |    *(undefined8 *)(arg1 + 0x118) = 0;\r\n    0x1837dfdac    |    *(undefined8 *)(arg1 + 0x120) = 0;\r\n    0x1837dfdb3    |    *(undefined *)(arg1 + 0x128) = 0;\r\n    0x1837dfdbe    |    piVar3 = (int32_t *)func_0x000185f006b8(8);\r\n    0x1837dfdc3    |    *piVar3 = 0;\r\n    0x1837dfdc9    |    *(undefined *)(piVar3 + 1) = 0;\r\n    0x1837dfdcc    |    *(int32_t **)(arg1 + 0x130) = piVar3;\r\n    0x1837dfdd6    |    if (piVar3 != (int32_t *)0x0) {\r\n    0x1837dfddd    |        LOCK();\r\n    0x1837dfddd    |        iVar1 = *piVar3;\r\n    0x1837dfddd    |        *piVar3 = *piVar3 + 1;\r\n    0x1837dfddd    |        UNLOCK();\r\n    0x1837dfde7    |        if (iVar1 == 0x7fffffff) {\r\n    0x1837dfe38    |            pcVar2 = (code *)swi(3);\r\n    0x1837dfe38    |            iVar5 = (*pcVar2)();\r\n    0x1837dfe38    |            return iVar5;\r\n                   |        }\r\n                   |    }\r\n    0x1837dfde9    |    *(int64_t *)(arg1 + 0x138) = arg1;\r\n    0x1837dfdf3    |    if (arg2 != 0) {\r\n    0x1837dfdfa    |        uVar4 = func_0x000185f006b8(0x90);\r\n    0x1837dfe0b    |        func_0x0001837f9d30(uVar4, arg2, arg1);\r\n    0x1837dfe10    |        iVar5 = *(int64_t *)(arg1 + 0x120);\r\n    0x1837dfe17    |        *(undefined8 *)(arg1 + 0x120) = uVar4;\r\n    0x1837dfe21    |        if (iVar5 != 0) {\r\n    0x1837dfe28    |            func_0x0001837fc130(iVar5, 1);\r\n                   |        }\r\n    0x1837dfe37    |        return arg1;\r\n                   |    }\r\n    0x1837dfe3b    |    pcVar2 = (code *)swi(3);\r\n    0x1837dfe3b    |    iVar5 = (*pcVar2)();\r\n    0x1837dfe3b    |    return iVar5;\r\n                   |}\r\n[{\"offset\":6501039440,\"name\":\"fcn.1837dfd50\",\"size\":236,\"is-pure\":false,\"realsz\":234,\"noreturn\":false,\"stackframe\":56,\"calltype\":\"ms\",\"cost\":79,\"cc\":8,\"loops\":0,\"bits\":64,\"type\":\"fcn\",\"nbbs\":10,\"edges\":12,\"ebbs\":3,\"signature\":\"fcn.1837dfd50(int64_t arg1, int64_t arg2);\",\"minbound\":6501039440,\"maxbound\":6501039676,\"callrefs\":[{\"from\":6501039488,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6501039517,\"to\":6542434496,\"type\":\"CALL\"},{\"from\":6501039550,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501039610,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6501039627,\"to\":6501145904,\"type\":\"CALL\"},{\"from\":6501039656,\"to\":6501155120,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501039453,\"to\":6707913208,\"type\":\"DATA\"},{\"from\":6501039476,\"to\":6741126408,\"type\":\"DATA\"}],\"indegree\":0,\"outdegree\":6,\"nlocals\":0,\"nargs\":2,\"stackvars\":[],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5125ms"}}