{"ok":true,"data":{"evidence_id":"ev_3868eeddfa09ba43642f3a0d3a6490f71ddab43601f3c18b43702b75abea5445","subject":{"name":"Tabbit.dll","digest":{"sha256":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c"},"local_path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll","format":"unknown","architecture":null},"provider":{"id":"rizin","name":"Rizin","version":null},"analysis_profile":null,"predicate_type":"rea.reverse-engineering.command-observation","operation":"execute_rizin_command","parameters":{"path":"C:/Users/tjzhong/AppData/Local/Tabbit/Application/1.18.21.0/Tabbit.dll","command":"e scr.color=0;af @ 0x1837fec00;pdgo @ 0x1837fec00;afij @ 0x1837fec00","provider_executable":"C:\\Users\\tjzhong\\Documents\\Codex\\tools\\cutter-2.5.0\\Cutter-v2.5.0-Windows-x86_64\\rizin.exe","command_arguments":["-N","-q","-c","e scr.color=0;af @ 0x1837fec00;pdgo @ 0x1837fec00;afij @ 0x1837fec00","C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"]},"raw_result":{"stdout":"    0x1837fec00    |\r\n    0x1837fec00    |// WARNING: [rz-ghidra] Detected overlap for variable var_164h\r\n                   |\r\n    0x1837fec00    |void fcn.1837fec00(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t iVar3;\r\n                   |    undefined auStack_198 [32];\r\n                   |    int64_t var_178h;\r\n                   |    undefined4 var_164h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x1837fec13    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_198;\r\n    0x1837fec3c    |    if ((*(char *)arg3 == '\\x01') && (iVar1 = *(int64_t *)(arg1 + 8), (uint32_t)iVar1 < 0xfffffff4 && iVar1 != 0)) {\r\n    0x1837fec44    |        iVar3 = (*(code *)0x11c21232)(iVar1, arg2);\r\n    0x1837fec4c    |        if (iVar3 == 0) {\r\n    0x1837feca0    |            iVar3 = (*(code *)0x11c21b5a)();\r\n    0x1837fecb4    |            if ((iVar3 != 0x490) && (*(int32_t *)0x191de85c0 < 3)) {\r\n    0x1837fecb6    |                var_178h._0_4_ = (*(code *)0x11c21b5a)();\r\n    0x1837fecc7    |                func_0x000182688fd0(&var_160h, 0x190c22d30, 0x15f, 2);\r\n    0x1837fece0    |                func_0x000184dcd0d0(&var_150h, 0x190c22d70, 0x31);\r\n    0x1837fecc7    |                func_0x000182688d40(&var_160h);\r\n                   |            }\r\n                   |        }\r\n    0x1837fec53    |        var_164h = 0;\r\n    0x1837fec67    |        iVar3 = (*(code *)0x11c21d26)(*(undefined8 *)(arg1 + 8), arg2, &var_164h, 1);\r\n    0x1837fec6f    |        if (iVar3 == 0) {\r\n    0x1837fed04    |            iVar3 = (*(code *)0x11c21b5a)();\r\n    0x1837fed27    |            if (((1 < iVar3 - 0xe8U) && (iVar3 != 0x6d)) && (iVar3 != 0x3e3)) {\r\n    0x1837fed2f    |                (*(code *)0x11c22c68)(iVar3);\r\n    0x1837fed3c    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x1837fed42    |                    var_178h._0_4_ = (*(code *)0x11c21b5a)();\r\n    0x1837fed53    |                    func_0x000182688fd0(&var_160h, 0x190c22d30, 0x167, 2);\r\n    0x1837fed6c    |                    func_0x000184dcd0d0(&var_150h, 0x190c22da8, 0x30);\r\n    0x1837fed53    |                    func_0x000182688d40(&var_160h);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837fec75    |        *(undefined *)arg3 = 0;\r\n                   |    }\r\n    0x1837fec8d    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_198)) {\r\n    0x1837fec9f    |        return;\r\n                   |    }\r\n    0x1837fed98    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_198);\r\n    0x1837feda0    |    pcVar2 = (code *)swi(3);\r\n    0x1837feda0    |    (*pcVar2)();\r\n    0x1837feda0    |    return;\r\n                   |}\r\n[{\"offset\":6501166080,\"name\":\"fcn.1837fec00\",\"size\":417,\"is-pure\":false,\"realsz\":417,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":145,\"cc\":13,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":16,\"edges\":25,\"ebbs\":2,\"signature\":\"fcn.1837fec00(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6501166080,\"maxbound\":6501166497,\"callrefs\":[{\"from\":6501166148,\"to\":6740377432,\"type\":\"CALL\"},{\"from\":6501166183,\"to\":6740378544,\"type\":\"CALL\"},{\"from\":6501166240,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166262,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166299,\"to\":6482857936,\"type\":\"CALL\"},{\"from\":6501166322,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501166330,\"to\":6482857280,\"type\":\"CALL\"},{\"from\":6501166335,\"to\":6501166158,\"type\":\"CODE\"},{\"from\":6501166340,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166383,\"to\":6740380040,\"type\":\"CALL\"},{\"from\":6501166402,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166439,\"to\":6482857936,\"type\":\"CALL\"},{\"from\":6501166462,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501166470,\"to\":6482857280,\"type\":\"CALL\"},{\"from\":6501166475,\"to\":6501166197,\"type\":\"CODE\"},{\"from\":6501166491,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501166092,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501166211,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501166253,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501166272,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501166309,\"to\":6723612016,\"type\":\"DATA\"},{\"from\":6501166389,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501166412,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501166449,\"to\":6723612072,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501166335,\"to\":6501166158,\"type\":\"CODE\"},{\"from\":6501166475,\"to\":6501166197,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":14,\"nlocals\":5,\"nargs\":3,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_164h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-356}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"normalized_result":{"stdout":"    0x1837fec00    |\r\n    0x1837fec00    |// WARNING: [rz-ghidra] Detected overlap for variable var_164h\r\n                   |\r\n    0x1837fec00    |void fcn.1837fec00(int64_t arg1, int64_t arg2, int64_t arg3)\r\n                   |{\r\n                   |    int64_t iVar1;\r\n                   |    code *pcVar2;\r\n                   |    int32_t iVar3;\r\n                   |    undefined auStack_198 [32];\r\n                   |    int64_t var_178h;\r\n                   |    undefined4 var_164h;\r\n                   |    int64_t var_160h;\r\n                   |    int64_t var_150h;\r\n                   |    int64_t var_28h;\r\n                   |    \r\n    0x1837fec13    |    var_28h = *(uint64_t *)0x191c71040 ^ (uint64_t)auStack_198;\r\n    0x1837fec3c    |    if ((*(char *)arg3 == '\\x01') && (iVar1 = *(int64_t *)(arg1 + 8), (uint32_t)iVar1 < 0xfffffff4 && iVar1 != 0)) {\r\n    0x1837fec44    |        iVar3 = (*(code *)0x11c21232)(iVar1, arg2);\r\n    0x1837fec4c    |        if (iVar3 == 0) {\r\n    0x1837feca0    |            iVar3 = (*(code *)0x11c21b5a)();\r\n    0x1837fecb4    |            if ((iVar3 != 0x490) && (*(int32_t *)0x191de85c0 < 3)) {\r\n    0x1837fecb6    |                var_178h._0_4_ = (*(code *)0x11c21b5a)();\r\n    0x1837fecc7    |                func_0x000182688fd0(&var_160h, 0x190c22d30, 0x15f, 2);\r\n    0x1837fece0    |                func_0x000184dcd0d0(&var_150h, 0x190c22d70, 0x31);\r\n    0x1837fecc7    |                func_0x000182688d40(&var_160h);\r\n                   |            }\r\n                   |        }\r\n    0x1837fec53    |        var_164h = 0;\r\n    0x1837fec67    |        iVar3 = (*(code *)0x11c21d26)(*(undefined8 *)(arg1 + 8), arg2, &var_164h, 1);\r\n    0x1837fec6f    |        if (iVar3 == 0) {\r\n    0x1837fed04    |            iVar3 = (*(code *)0x11c21b5a)();\r\n    0x1837fed27    |            if (((1 < iVar3 - 0xe8U) && (iVar3 != 0x6d)) && (iVar3 != 0x3e3)) {\r\n    0x1837fed2f    |                (*(code *)0x11c22c68)(iVar3);\r\n    0x1837fed3c    |                if (*(int32_t *)0x191de85c0 < 3) {\r\n    0x1837fed42    |                    var_178h._0_4_ = (*(code *)0x11c21b5a)();\r\n    0x1837fed53    |                    func_0x000182688fd0(&var_160h, 0x190c22d30, 0x167, 2);\r\n    0x1837fed6c    |                    func_0x000184dcd0d0(&var_150h, 0x190c22da8, 0x30);\r\n    0x1837fed53    |                    func_0x000182688d40(&var_160h);\r\n                   |                }\r\n                   |            }\r\n                   |        }\r\n    0x1837fec75    |        *(undefined *)arg3 = 0;\r\n                   |    }\r\n    0x1837fec8d    |    if (*(uint64_t *)0x191c71040 == (var_28h ^ (uint64_t)auStack_198)) {\r\n    0x1837fec9f    |        return;\r\n                   |    }\r\n    0x1837fed98    |    func_0x000185f05b40(var_28h ^ (uint64_t)auStack_198);\r\n    0x1837feda0    |    pcVar2 = (code *)swi(3);\r\n    0x1837feda0    |    (*pcVar2)();\r\n    0x1837feda0    |    return;\r\n                   |}\r\n[{\"offset\":6501166080,\"name\":\"fcn.1837fec00\",\"size\":417,\"is-pure\":false,\"realsz\":417,\"noreturn\":false,\"stackframe\":408,\"calltype\":\"ms\",\"cost\":145,\"cc\":13,\"loops\":8,\"bits\":64,\"type\":\"fcn\",\"nbbs\":16,\"edges\":25,\"ebbs\":2,\"signature\":\"fcn.1837fec00(int64_t arg1, int64_t arg2, int64_t arg3);\",\"minbound\":6501166080,\"maxbound\":6501166497,\"callrefs\":[{\"from\":6501166148,\"to\":6740377432,\"type\":\"CALL\"},{\"from\":6501166183,\"to\":6740378544,\"type\":\"CALL\"},{\"from\":6501166240,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166262,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166299,\"to\":6482857936,\"type\":\"CALL\"},{\"from\":6501166322,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501166330,\"to\":6482857280,\"type\":\"CALL\"},{\"from\":6501166335,\"to\":6501166158,\"type\":\"CODE\"},{\"from\":6501166340,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166383,\"to\":6740380040,\"type\":\"CALL\"},{\"from\":6501166402,\"to\":6740378384,\"type\":\"CALL\"},{\"from\":6501166439,\"to\":6482857936,\"type\":\"CALL\"},{\"from\":6501166462,\"to\":6524031184,\"type\":\"CALL\"},{\"from\":6501166470,\"to\":6482857280,\"type\":\"CALL\"},{\"from\":6501166475,\"to\":6501166197,\"type\":\"CODE\"},{\"from\":6501166491,\"to\":6542089024,\"type\":\"CALL\"}],\"datarefs\":[{\"from\":6501166092,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501166211,\"to\":6740709440,\"type\":\"DATA\"},{\"from\":6501166253,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501166272,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501166309,\"to\":6723612016,\"type\":\"DATA\"},{\"from\":6501166389,\"to\":6742246848,\"type\":\"DATA\"},{\"from\":6501166412,\"to\":6723611952,\"type\":\"DATA\"},{\"from\":6501166449,\"to\":6723612072,\"type\":\"DATA\"}],\"codexrefs\":[{\"from\":6501166335,\"to\":6501166158,\"type\":\"CODE\"},{\"from\":6501166475,\"to\":6501166197,\"type\":\"CODE\"}],\"dataxrefs\":[],\"indegree\":2,\"outdegree\":14,\"nlocals\":5,\"nargs\":3,\"stackvars\":[{\"name\":\"var_178h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-376}},{\"name\":\"var_164h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-356}},{\"name\":\"var_160h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-352}},{\"name\":\"var_150h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-336}},{\"name\":\"var_28h\",\"arg\":false,\"type\":\"int64_t\",\"storage\":{\"type\":\"stack\",\"stack\":-40}}],\"regvars\":[{\"name\":\"arg3\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"r8\"}},{\"name\":\"arg1\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rcx\"}},{\"name\":\"arg2\",\"arg\":true,\"type\":\"int64_t\",\"storage\":{\"type\":\"reg\",\"reg\":\"rdx\"}}]}]\r\n","stderr":"WARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0xfb71e00) exceeds max region size (0xa00000), skipping it.\r\nWARNING: bin_file_strings: search interval size (0x20fd400) exceeds max region size (0xa00000), skipping it.\r\n","exit_code":0,"signal":null,"output_truncated":false,"completion_status":"complete","artifact_sha256_after":"a10ee34ead4a08c906e09f3dd4449042fb084a69ce59210b1c8cee815723bf3c","artifact_changed":false},"confidence":"observed","authority":"shipped-artifact","environment":null,"limitations":["The executable version and supported formats are reported as unknown because no reliable version probe was performed.","A non-zero process exit is preserved as an observed command result.","Rizin commands and retained plugins may read files or access network resources outside the selected artifact; those external inputs are not bound to Evidence.","When both are available, pre-run and post-run digests detect artifact changes across the provider call but cannot prove the exact bytes consumed during the call."],"relationship_coverage":null,"locations":[{"kind":"artifact-path","path":"C:\\Users\\tjzhong\\AppData\\Local\\Tabbit\\Application\\1.18.21.0\\Tabbit.dll"}],"evidence_links":[]},"meta":{"command":"execute-rizin-command","duration":"4947ms"}}