{"ok":true,"data":{"evidence_id":"ev_26dea991232c4a795d4cb4dea5994bde0b19191d0df33efcf59d23e1670107b1","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x1832888a0;pdgo @ 0x1832888a0;afij @ 0x1832888a0","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1832888a0;pdgo @ 0x1832888a0;afij @ 0x1832888a0","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"                   |\r\n    0x1832888a0    |undefined8 * fcn.1832888a0(void)\r\n                   |{\r\n                   |    undefined8 *puVar1;\r\n                   |    uint64_t unaff_RDI;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_58 [40];\r\n                   |    int64_t var_30h;\r\n                   |    undefined8 uStack_28;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x1832888ae    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_58;\r\n    0x1832888c0    |    if (*(undefined8 **)0x191d847f8 != (undefined8 *)0x0) goto code_r0x00018328899a;\r\n    0x1832888cb    |    puVar1 = (undefined8 *)func_0x000185f006b8(0x68);\r\n    0x1832888df    |    var_30h = 0x190124fb0;\r\n    0x1832888e2    |    uStack_28 = 0x45;\r\n    0x1832888f3    |    func_0x000185327950(puVar1, &var_30h, 0x1e);\r\n    0x1832888ff    |    *puVar1 = 0x18fbab4d8;\r\n    0x183288909    |    puVar1[1] = 0x190124d00;\r\n    0x18328890d    |    puVar1[2] = 0x17;\r\n    0x18328891f    |    if (*(uint64_t *)0x191de50b0 == 0) {\r\n    0x183288a08    |        *(uint64_t *)0x191de50b0 = func_0x00018ad3e790();\r\n                   |    }\r\n    0x183288925    |    unaff_RDI = *(uint64_t *)0x191de50b0;\r\n    0x18328893c    |    if ((*(uint64_t *)0x191de50b0 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183288941    |        func_0x0001841c7180(*(uint64_t *)0x191de50b0);\r\n                   |    }\r\n    0x183288954    |    if ((puVar1[9] & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) goto code_r0x0001832889fe;\r\n    0x1832889ac    |    while( true ) {\r\n    0x18328895a    |        puVar1[9] = unaff_RDI;\r\n    0x18328897d    |        if (*(int32_t *)\r\n    0x183288973    |             (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18328897d    |            *(int32_t *)0x191dee7c0) {\r\n    0x1832889c0    |            func_0x000185f00fe8(0x191dee7c0);\r\n    0x1832889cc    |            if (*(int32_t *)0x191dee7c0 == -1) {\r\n    0x1832889d1    |                *(undefined8 *)0x191dee7a8 = 0;\r\n    0x1832889d1    |                *(undefined8 *)0x191dee7b0 = 0;\r\n    0x1832889d8    |                *(undefined8 *)0x191dee7b8 = 0;\r\n    0x1832889ea    |                func_0x000185f00f7c(0x191dee7c0);\r\n                   |            }\r\n                   |        }\r\n    0x18328898e    |        var_30h = (int64_t)puVar1;\r\n    0x18328898e    |        func_0x000180ee1290(0x191dee7a8);\r\n    0x183288993    |        *(undefined8 **)0x191d847f8 = puVar1;\r\n                   |code_r0x00018328899a:\r\n    0x18328899a    |        puVar1 = *(undefined8 **)0x191d847f8;\r\n    0x1832889ac    |        if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_58)) break;\r\n    0x1832889f6    |        func_0x000185f05b40(var_20h ^ (uint64_t)auStack_58);\r\n                   |code_r0x0001832889fe:\r\n    0x1832889fe    |        func_0x00018005f390();\r\n                   |    }\r\n    0x1832889b8    |    return *(undefined8 **)0x191d847f8;\r\n                   |}\r\n[{\"offset\":6495439008,\"name\":\"fcn.1832888a0\",\"size\":380,\"is-pure\":false,\"realsz\":380,\"noreturn\":false,\"stackframe\":88,\"calltype\":\"ms\",\"cost\":111,\"cc\":8,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":14,\"edges\":20,\"ebbs\":1,\"signature\":\"fcn.1832888a0();\",\"minbound\":6495439008,\"maxbound\":6495439388,\"callrefs\":[{\"from\":6495439051,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495439091,\"to\":6529644880,\"type\":\"CALL\"},{\"from\":6495439169,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6495439246,\"to\":6458053264,\"type\":\"CALL\"},{\"from\":6495439296,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6495439338,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6495439343,\"to\":6495439231,\"type\":\"CODE\"},{\"from\":6495439353,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6495439358,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6495439363,\"to\":6495439194,\"type\":\"CODE\"},{\"from\":6495439368,\"to\":6624110480,\"type\":\"CALL\"},{\"from\":6495439383,\"to\":6495439141,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6495439015,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495439030,\"to\":6741837816,\"type\":\"DATA\"},{\"from\":6495439059,\"to\":6712086448,\"type\":\"DATA\"},{\"from\":6495439096,\"to\":6706345176,\"type\":\"DATA\"},{\"from\":6495439106,\"to\":6712085760,\"type\":\"DATA\"},{\"from\":6495439125,\"to\":6742233264,\"type\":\"DATA\"},{\"from\":6495439157,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6495439181,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6495439198,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439204,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495439239,\"to\":6742271912,\"type\":\"DATA\"},{\"from\":6495439251,\"to\":6741837816,\"type\":\"DATA\"},{\"from\":6495439266,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495439289,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439301,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439313,\"to\":6742271912,\"type\":\"DATA\"},{\"from\":6495439320,\"to\":6742271928,\"type\":\"DATA\"},{\"from\":6495439331,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439376,\"to\":6742233264,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6495439343,\"to\":6495439231,\"type\":\"CODE\"},{\"from\":6495439363,\"to\":6495439194,\"type\":\"CODE\"},{\"from\":6495439383,\"to\":6495439141,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":9,\"nlocals\":2,\"nargs\":0,\"stackvars\":[{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"                   |\r\n    0x1832888a0    |undefined8 * fcn.1832888a0(void)\r\n                   |{\r\n                   |    undefined8 *puVar1;\r\n                   |    uint64_t unaff_RDI;\r\n                   |    int64_t unaff_GS_OFFSET;\r\n                   |    undefined auStack_58 [40];\r\n                   |    int64_t var_30h;\r\n                   |    undefined8 uStack_28;\r\n                   |    int64_t var_20h;\r\n                   |    \r\n    0x1832888ae    |    var_20h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_58;\r\n    0x1832888c0    |    if (*(undefined8 **)0x191d847f8 != (undefined8 *)0x0) goto code_r0x00018328899a;\r\n    0x1832888cb    |    puVar1 = (undefined8 *)func_0x000185f006b8(0x68);\r\n    0x1832888df    |    var_30h = 0x190124fb0;\r\n    0x1832888e2    |    uStack_28 = 0x45;\r\n    0x1832888f3    |    func_0x000185327950(puVar1, &var_30h, 0x1e);\r\n    0x1832888ff    |    *puVar1 = 0x18fbab4d8;\r\n    0x183288909    |    puVar1[1] = 0x190124d00;\r\n    0x18328890d    |    puVar1[2] = 0x17;\r\n    0x18328891f    |    if (*(uint64_t *)0x191de50b0 == 0) {\r\n    0x183288a08    |        *(uint64_t *)0x191de50b0 = func_0x00018ad3e790();\r\n                   |    }\r\n    0x183288925    |    unaff_RDI = *(uint64_t *)0x191de50b0;\r\n    0x18328893c    |    if ((*(uint64_t *)0x191de50b0 & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) {\r\n    0x183288941    |        func_0x0001841c7180(*(uint64_t *)0x191de50b0);\r\n                   |    }\r\n    0x183288954    |    if ((puVar1[9] & 0xfffffffc00000000) == *(uint64_t *)0x191cd6d08) goto code_r0x0001832889fe;\r\n    0x1832889ac    |    while( true ) {\r\n    0x18328895a    |        puVar1[9] = unaff_RDI;\r\n    0x18328897d    |        if (*(int32_t *)\r\n    0x183288973    |             (*(int64_t *)(*(int64_t *)(unaff_GS_OFFSET + 0x58) + (uint64_t)*(uint32_t *)0x191d832e0 * 8) + 4) <\r\n    0x18328897d    |            *(int32_t *)0x191dee7c0) {\r\n    0x1832889c0    |            func_0x000185f00fe8(0x191dee7c0);\r\n    0x1832889cc    |            if (*(int32_t *)0x191dee7c0 == -1) {\r\n    0x1832889d1    |                *(undefined8 *)0x191dee7a8 = 0;\r\n    0x1832889d1    |                *(undefined8 *)0x191dee7b0 = 0;\r\n    0x1832889d8    |                *(undefined8 *)0x191dee7b8 = 0;\r\n    0x1832889ea    |                func_0x000185f00f7c(0x191dee7c0);\r\n                   |            }\r\n                   |        }\r\n    0x18328898e    |        var_30h = (int64_t)puVar1;\r\n    0x18328898e    |        func_0x000180ee1290(0x191dee7a8);\r\n    0x183288993    |        *(undefined8 **)0x191d847f8 = puVar1;\r\n                   |code_r0x00018328899a:\r\n    0x18328899a    |        puVar1 = *(undefined8 **)0x191d847f8;\r\n    0x1832889ac    |        if (*(uint64_t *)0x191c71040 == (var_20h ^ (uint64_t)auStack_58)) break;\r\n    0x1832889f6    |        func_0x000185f05b40(var_20h ^ (uint64_t)auStack_58);\r\n                   |code_r0x0001832889fe:\r\n    0x1832889fe    |        func_0x00018005f390();\r\n                   |    }\r\n    0x1832889b8    |    return *(undefined8 **)0x191d847f8;\r\n                   |}\r\n[{\"offset\":6495439008,\"name\":\"fcn.1832888a0\",\"size\":380,\"is-pure\":false,\"realsz\":380,\"noreturn\":false,\"stackframe\":88,\"calltype\":\"ms\",\"cost\":111,\"cc\":8,\"loops\":4,\"bits\":64,\"type\":\"fcn\",\"nbbs\":14,\"edges\":20,\"ebbs\":1,\"signature\":\"fcn.1832888a0();\",\"minbound\":6495439008,\"maxbound\":6495439388,\"callrefs\":[{\"from\":6495439051,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6495439091,\"to\":6529644880,\"type\":\"CALL\"},{\"from\":6495439169,\"to\":6511423872,\"type\":\"CALL\"},{\"from\":6495439246,\"to\":6458053264,\"type\":\"CALL\"},{\"from\":6495439296,\"to\":6542069736,\"type\":\"CALL\"},{\"from\":6495439338,\"to\":6542069628,\"type\":\"CALL\"},{\"from\":6495439343,\"to\":6495439231,\"type\":\"CODE\"},{\"from\":6495439353,\"to\":6542089024,\"type\":\"CALL\"},{\"from\":6495439358,\"to\":6442840976,\"type\":\"CALL\"},{\"from\":6495439363,\"to\":6495439194,\"type\":\"CODE\"},{\"from\":6495439368,\"to\":6624110480,\"type\":\"CALL\"},{\"from\":6495439383,\"to\":6495439141,\"type\":\"CODE\"}],\"datarefs\":[{\"from\":6495439015,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495439030,\"to\":6741837816,\"type\":\"DATA\"},{\"from\":6495439059,\"to\":6712086448,\"type\":\"DATA\"},{\"from\":6495439096,\"to\":6706345176,\"type\":\"DATA\"},{\"from\":6495439106,\"to\":6712085760,\"type\":\"DATA\"},{\"from\":6495439125,\"to\":6742233264,\"type\":\"DATA\"},{\"from\":6495439157,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6495439181,\"to\":6741126408,\"type\":\"DATA\"},{\"from\":6495439198,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439204,\"to\":6741832416,\"type\":\"DATA\"},{\"from\":6495439239,\"to\":6742271912,\"type\":\"DATA\"},{\"from\":6495439251,\"to\":6741837816,\"type\":\"DATA\"},{\"from\":6495439266,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6495439289,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439301,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439313,\"to\":6742271912,\"type\":\"DATA\"},{\"from\":6495439320,\"to\":6742271928,\"type\":\"DATA\"},{\"from\":6495439331,\"to\":6742271936,\"type\":\"DATA\"},{\"from\":6495439376,\"to\":6742233264,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6495439343,\"to\":6495439231,\"type\":\"CODE\"},{\"from\":6495439363,\"to\":6495439194,\"type\":\"CODE\"},{\"from\":6495439383,\"to\":6495439141,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":3,\"outdegree\":9,\"nlocals\":2,\"nargs\":0,\"stackvars\":[{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_20h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-32}}],\"regvars\":[]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5778ms"}}