{"ok":true,"data":{"evidence_id":"ev_609b6701fad949170bd3f4cf7c41aa30d1da8ed946b29a4a86e5a059ceb2cf69","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","command":"e scr.color=0;af @ 0x18b83ff20;pdgo @ 0x18b83ff20;afij @ 0x18b83ff20","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x18b83ff20;pdgo @ 0x18b83ff20;afij @ 0x18b83ff20","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":" 0x18b83ff20 |\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_fch\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_70h\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_66h\r\n |\r\n 0x18b83ff20 |void fcn.18b83ff20(int64_t arg1, int64_t arg2)\r\n |{\r\n | code *pcVar1;\r\n | undefined4 *puVar2;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x18b83ff36 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x18b83ff3e | var_38h = 0x18;\r\n 0x18b83ff4f | if (*(char *)0x191de51e8 != '\\0') {\r\n 0x18b840020 | var_30h = 0x190fc1d88;\r\n 0x18b84002e | fcn.184354510(*(char *)0x191de51e8, &var_38h, &var_30h, 1);\r\n | }\r\n 0x18b83ff5e | puVar2 = (undefined4 *)fcn.185f006b8(0x50);\r\n 0x18b83ff66 | *puVar2 = 1;\r\n 0x18b83ff73 | *(undefined8 *)(puVar2 + 2) = 0x186278170;\r\n 0x18b83ff7e | *(undefined8 *)(puVar2 + 4) = 0x18b8443e0;\r\n 0x18b83ff89 | *(undefined8 *)(puVar2 + 6) = 0x1841d75d0;\r\n 0x18b83ff94 | *(undefined8 *)(puVar2 + 8) = 0x18b8497e0;\r\n 0x18b83ff98 | puVar2[10] = 0;\r\n 0x18b83ffa0 | fcn.18b842fb0(puVar2 + 0xc);\r\n 0x18b83ffba | var_40h = (int64_t)puVar2;\r\n 0x18b83ffba | fcn.1812bb5e0(arg1);\r\n 0x18b83ffbf | var_38h = 0x18;\r\n 0x18b83ffd0 | if (*(char *)0x191de51e8 != '\\0') {\r\n 0x18b83fff8 | var_30h = 0;\r\n 0x18b84000a | fcn.184354510(*(char *)0x191de51e8, &var_38h, &var_30h, 2);\r\n | }\r\n 0x18b83ffe4 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_68)) {\r\n 0x18b83ffef | return;\r\n | }\r\n 0x18b84003d | fcn.185f05b40(var_28h ^ (uint64_t)auStack_68);\r\n 0x18b840045 | pcVar1 = (code *)swi(3);\r\n 0x18b840045 | (*pcVar1)();\r\n 0x18b840045 | return;\r\n |}\r\n[{\"offset\":6635650848,\"name\":\"fcn.18b83ff20\",\"size\":294,\"is-pure\":false,\"realsz\":294,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":89,\"cc\":5,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":7,\"edges\":8,\"ebbs\":2,\"signature\":\"fcn.18b83ff20(int64_t arg1, int64_t arg2);\",\"minbound\":6635650848,\"maxbound\":6635651142,\"callrefs\":[{\"from\":6635650910,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6635650986,\"to\":6635663280,\"type\":\"CALL\"},{\"from\":6635651002,\"to\":6462092768,\"type\":\"CALL\"},{\"from\":6635651082,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635651087,\"to\":6635651026,\"type\":\"CODE\"},{\"from\":6635651118,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635651123,\"to\":6635650901,\"type\":\"CODE\"},{\"from\":6635651136,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6635650863,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635650887,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635650924,\"to\":6545703280,\"type\":\"DATA\"},{\"from\":6635650935,\"to\":6635668448,\"type\":\"DATA\"},{\"from\":6635650946,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6635650957,\"to\":6635689952,\"type\":\"DATA\"},{\"from\":6635651016,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635651034,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635651092,\"to\":6727409032,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6635651087,\"to\":6635651026,\"type\":\"CODE\"},{\"from\":6635651123,\"to\":6635650901,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":" 0x18b83ff20 |\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_fch\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_70h\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_68h\r\n 0x18b83ff20 |// WARNING: [rz-ghidra] Detected overlap for variable var_66h\r\n |\r\n 0x18b83ff20 |void fcn.18b83ff20(int64_t arg1, int64_t arg2)\r\n |{\r\n | code *pcVar1;\r\n | undefined4 *puVar2;\r\n | undefined auStack_68 [40];\r\n | int64_t var_40h;\r\n | int64_t var_38h;\r\n | int64_t var_30h;\r\n | int64_t var_28h;\r\n | \r\n 0x18b83ff36 | var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_68;\r\n 0x18b83ff3e | var_38h = 0x18;\r\n 0x18b83ff4f | if (*(char *)0x191de51e8 != '\\0') {\r\n 0x18b840020 | var_30h = 0x190fc1d88;\r\n 0x18b84002e | fcn.184354510(*(char *)0x191de51e8, &var_38h, &var_30h, 1);\r\n | }\r\n 0x18b83ff5e | puVar2 = (undefined4 *)fcn.185f006b8(0x50);\r\n 0x18b83ff66 | *puVar2 = 1;\r\n 0x18b83ff73 | *(undefined8 *)(puVar2 + 2) = 0x186278170;\r\n 0x18b83ff7e | *(undefined8 *)(puVar2 + 4) = 0x18b8443e0;\r\n 0x18b83ff89 | *(undefined8 *)(puVar2 + 6) = 0x1841d75d0;\r\n 0x18b83ff94 | *(undefined8 *)(puVar2 + 8) = 0x18b8497e0;\r\n 0x18b83ff98 | puVar2[10] = 0;\r\n 0x18b83ffa0 | fcn.18b842fb0(puVar2 + 0xc);\r\n 0x18b83ffba | var_40h = (int64_t)puVar2;\r\n 0x18b83ffba | fcn.1812bb5e0(arg1);\r\n 0x18b83ffbf | var_38h = 0x18;\r\n 0x18b83ffd0 | if (*(char *)0x191de51e8 != '\\0') {\r\n 0x18b83fff8 | var_30h = 0;\r\n 0x18b84000a | fcn.184354510(*(char *)0x191de51e8, &var_38h, &var_30h, 2);\r\n | }\r\n 0x18b83ffe4 | if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_68)) {\r\n 0x18b83ffef | return;\r\n | }\r\n 0x18b84003d | fcn.185f05b40(var_28h ^ (uint64_t)auStack_68);\r\n 0x18b840045 | pcVar1 = (code *)swi(3);\r\n 0x18b840045 | (*pcVar1)();\r\n 0x18b840045 | return;\r\n |}\r\n[{\"offset\":6635650848,\"name\":\"fcn.18b83ff20\",\"size\":294,\"is-pure\":false,\"realsz\":294,\"noreturn\":false,\"stackframe\":104,\"calltype\":\"ms\",\"cost\":89,\"cc\":5,\"loops\":2,\"bits\":64,\"type\":\"fcn\",\"nbbs\":7,\"edges\":8,\"ebbs\":2,\"signature\":\"fcn.18b83ff20(int64_t arg1, int64_t arg2);\",\"minbound\":6635650848,\"maxbound\":6635651142,\"callrefs\":[{\"from\":6635650910,\"to\":6542067384,\"type\":\"CALL\"},{\"from\":6635650986,\"to\":6635663280,\"type\":\"CALL\"},{\"from\":6635651002,\"to\":6462092768,\"type\":\"CALL\"},{\"from\":6635651082,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635651087,\"to\":6635651026,\"type\":\"CODE\"},{\"from\":6635651118,\"to\":6513050896,\"type\":\"CALL\"},{\"from\":6635651123,\"to\":6635650901,\"type\":\"CODE\"},{\"from\":6635651136,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6635650863,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635650887,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635650924,\"to\":6545703280,\"type\":\"DATA\"},{\"from\":6635650935,\"to\":6635668448,\"type\":\"DATA\"},{\"from\":6635650946,\"to\":6511490512,\"type\":\"DATA\"},{\"from\":6635650957,\"to\":6635689952,\"type\":\"DATA\"},{\"from\":6635651016,\"to\":6742233576,\"type\":\"DATA\"},{\"from\":6635651034,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6635651092,\"to\":6727409032,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6635651087,\"to\":6635651026,\"type\":\"CODE\"},{\"from\":6635651123,\"to\":6635650901,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":6,\"nlocals\":4,\"nargs\":2,\"stackvars\":[{\"name\":\"var_40h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-64}},{\"name\":\"var_38h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-56}},{\"name\":\"var_30h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-48}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"5146ms"}}