add agent manager release decomp
This commit is contained in:
Benjamin Palko
parent
31ff800b2a
commit
fac6117145
7019 changed files with 254032 additions and 5 deletions
180
decomp/AgentManager_Release_x64/binary_overview.json
Normal file
180
decomp/AgentManager_Release_x64/binary_overview.json
Normal file
|
|
@ -0,0 +1,180 @@
|
|||
{
|
||||
"analysis_profile": {
|
||||
"digest": "3decca45d3460a9d91b48bfb293ee703f84841379edceee6350b1ea3393d3fe1",
|
||||
"parameters": {
|
||||
"upstream_analysis_profile": {
|
||||
"digest": "de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6",
|
||||
"parameters": {
|
||||
"analyzer_preset": "ghidra-default",
|
||||
"annotation_policy": "atomic-function-entry-metadata-v1",
|
||||
"architecture": "x86_64",
|
||||
"available_architectures": [
|
||||
"x86_64"
|
||||
],
|
||||
"call_relationship_coverage": "function-body-call-coverage-v5",
|
||||
"compiler_spec_id": "auto-default",
|
||||
"decompiler_jump_loads": true,
|
||||
"executable_role": "application",
|
||||
"function_body_evidence": "complete-inclusive-ranges-v1",
|
||||
"function_boundary_observations": "ghidra-function-boundary-limitations-v3",
|
||||
"function_dossier_coverage": "observed-facets-and-call-relationships-v1",
|
||||
"function_references": "complete-body-and-entry-reference-manager-v2",
|
||||
"import_mode": "ephemeral-source-immutable",
|
||||
"instruction_flow_evidence": "decoded-return-pcode-v1",
|
||||
"instruction_references": "exact-address-incoming-v1",
|
||||
"jump_table_evidence": "typed-case-default-blocks-v1",
|
||||
"language_id": "auto-from-header",
|
||||
"load_image_observations": "source-mappings-entry-context-v2",
|
||||
"loader": "auto-from-header",
|
||||
"location_resolution": "explicit-address-exact-entry-symbol-first-v3",
|
||||
"managed": false,
|
||||
"native_aot_metadata": {
|
||||
"contract_revision": "rtr-9.1-x64-pe-read-only-v3",
|
||||
"report_bytes": 4194304,
|
||||
"source_bytes": 134217728,
|
||||
"work_units": 67108864,
|
||||
"working_memory_bytes": 67108864
|
||||
},
|
||||
"no_return_repair": "returning-imports-decoded-return-v2",
|
||||
"pdb_observations": "program-info-v1",
|
||||
"procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
|
||||
"process_launch": "inspected-jvm-launch-support-v1",
|
||||
"string_inventory_evidence": "defined-data-coverage-v1",
|
||||
"target_format": "pe",
|
||||
"target_kind": "executable"
|
||||
},
|
||||
"provider": {
|
||||
"id": "ghidra",
|
||||
"name": "Ghidra",
|
||||
"version": "12.1.2"
|
||||
}
|
||||
},
|
||||
"workflow_revision": 3
|
||||
},
|
||||
"provider": {
|
||||
"id": "rea-workflow",
|
||||
"name": "REA composed investigation workflow",
|
||||
"version": "1"
|
||||
}
|
||||
},
|
||||
"authority": "shipped-artifact",
|
||||
"confidence": "derived",
|
||||
"environment": null,
|
||||
"evidence_id": "ev_c3719a85eaa4d87a349ee02f317e2085e8db8266c450d412b0ce623bc094e871",
|
||||
"evidence_links": [],
|
||||
"limitations": [
|
||||
"Derived by an REA composed workflow.",
|
||||
"A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.",
|
||||
"Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
|
||||
"Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.",
|
||||
"Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
|
||||
"External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.",
|
||||
"Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.",
|
||||
"Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.",
|
||||
"The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
|
||||
"The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
|
||||
"The target references PDB AgentManager_Release_x64.pdb (GUID cc211b01-ac46-4192-9b64-b1d16ba71956, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.",
|
||||
"This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."
|
||||
],
|
||||
"locations": [],
|
||||
"normalized_result": {
|
||||
"document": "target-8fd8ca917258.exe",
|
||||
"image_base": "0x140000000",
|
||||
"procedure_count": 7400,
|
||||
"segment_count": 9,
|
||||
"segments": [
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x140000400",
|
||||
"image_base": "0x140000000",
|
||||
"length": 1024,
|
||||
"name": "Headers",
|
||||
"start": "0x140000000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x140104a00",
|
||||
"image_base": "0x140000000",
|
||||
"length": 1063424,
|
||||
"name": ".text",
|
||||
"start": "0x140001000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x14016ea00",
|
||||
"image_base": "0x140000000",
|
||||
"length": 432640,
|
||||
"name": ".rdata",
|
||||
"start": "0x140105000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x14017d630",
|
||||
"image_base": "0x140000000",
|
||||
"length": 58928,
|
||||
"name": ".data",
|
||||
"start": "0x14016f000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x140189800",
|
||||
"image_base": "0x140000000",
|
||||
"length": 47104,
|
||||
"name": ".pdata",
|
||||
"start": "0x14017e000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x14018a200",
|
||||
"image_base": "0x140000000",
|
||||
"length": 512,
|
||||
"name": ".tls",
|
||||
"start": "0x14018a000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x14018b200",
|
||||
"image_base": "0x140000000",
|
||||
"length": 512,
|
||||
"name": ".rsrc",
|
||||
"start": "0x14018b000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0x14018e800",
|
||||
"image_base": "0x140000000",
|
||||
"length": 10240,
|
||||
"name": ".reloc",
|
||||
"start": "0x14018c000"
|
||||
},
|
||||
{
|
||||
"address_space": "ram",
|
||||
"end": "0xff00001850",
|
||||
"image_base": "0x140000000",
|
||||
"length": 6224,
|
||||
"name": "tdb",
|
||||
"start": "0xff00000000"
|
||||
}
|
||||
],
|
||||
"string_count": 1613
|
||||
},
|
||||
"operation": "binary_overview",
|
||||
"parameters": {},
|
||||
"predicate_type": "rea.analysis",
|
||||
"provider": {
|
||||
"id": "rea-workflow",
|
||||
"name": "REA composed investigation workflow",
|
||||
"version": "1"
|
||||
},
|
||||
"raw_result": null,
|
||||
"relationship_coverage": null,
|
||||
"subject": {
|
||||
"architecture": "x86_64",
|
||||
"digest": {
|
||||
"sha256": "8fd8ca91725858651a7839d34257b10c2970ac16c97e60c523b8b0c983fcb186"
|
||||
},
|
||||
"format": "pe",
|
||||
"local_path": "/home/baobeld/Development/rusty-hearts/re-project/binaries/AgentManager_Release_x64.exe",
|
||||
"name": "AgentManager_Release_x64.exe"
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue