1 line
No EOL
23 KiB
JSON
1 line
No EOL
23 KiB
JSON
{"artifacts":[{"architecture":"x86_64","digest":{"sha256":"d9e4fccdf3482e50247686d4452c0b13c75a53efc4bd7320668eece8d1ce828c"},"format":"pe"}],"captures":[],"environments":[],"providers":[{"id":"ghidra","name":"Ghidra","version":"12.1.2"},{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}],"records":[{"analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_00545a3e04cf4b015b7c951363ab2152ae2cbe175995ae0e76800c576d70cf6a","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.","External functions and functions without an analyzable body return null; other decompiler failures remain explicit.","Ghidra Listing reports a terminal call at 0x1400a7b41 to 0x140218220 FUN_140218220 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return.","The target references PDB DBCServer_Release_x64.pdb (GUID 3dbb7ebc-82fb-4496-8a47-78f2cc1f8e51, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n\nvoid FUN_1400a7aa0(undefined8 *param_1,int param_2)\n\n{\n char cVar1;\n longlong lVar2;\n int iVar3;\n undefined8 uVar4;\n undefined8 *puVar5;\n void *pvVar6;\n ulonglong uVar7;\n longlong *plVar8;\n longlong *plVar9;\n longlong lVar10;\n undefined1 auStack_2e8 [32];\n undefined8 *local_2c8;\n undefined8 local_2c0;\n undefined **local_2b8;\n char local_2b0 [136];\n char local_228;\n undefined1 local_227 [255];\n CHAR local_128 [280];\n ulonglong local_10;\n \n local_2c0 = 0xfffffffffffffffe;\n local_10 = DAT_1403463c0 ^ (ulonglong)auStack_2e8;\n if (*(int *)((longlong)param_1 + 0x10c) != 1) {\n CoInitialize((LPVOID)0x0);\n local_2c8 = operator_new(0x78);\n uVar4 = 0;\n if (local_2c8 != (void *)0x0) {\n uVar4 = FUN_140002170(local_2c8);\n }\n param_1[0x24] = uVar4;\n puVar5 = operator_new(8);\n local_2c8 = puVar5;\n if (puVar5 == (undefined8 *)0x0) {\n puVar5 = (undefined8 *)0x0;\n }\n else {\n *puVar5 = 0;\n iVar3 = FUN_140001990(puVar5);\n if ((iVar3 < 0) && (iVar3 != -0x7fffbffe)) {\n /* WARNING: Subroutine does not return */\n FUN_140218220(iVar3);\n }\n }\n param_1[0x25] = puVar5;\n pvVar6 = operator_new(0x130);\n uVar4 = 0;\n if (pvVar6 != (void *)0x0) {\n uVar4 = FUN_1400a6d00(pvVar6);\n }\n param_1[0x23] = uVar4;\n puVar5 = operator_new(0x20);\n if (puVar5 == (undefined8 *)0x0) {\n puVar5 = (undefined8 *)0x0;\n }\n else {\n *puVar5 = 0;\n puVar5[1] = &DAT_14029e010;\n puVar5[2] = &DAT_14029e010;\n *(undefined4 *)(puVar5 + 3) = 0;\n FUN_140001f70(puVar5);\n }\n *param_1 = puVar5;\n local_2b8 = CServerConfig::vftable;\n local_228 = '\\0';\n memset(local_227,0,0xff);\n GetCurrentDirectoryA(0x104,local_128);\n sprintf(&local_228,\"%s\\\\%s\");\n strcpy_s(local_2b0,0x80,&local_228);\n lVar10 = DAT_140353190;\n if (param_2 == 1) {\n plVar8 = (longlong *)(DAT_140353190 + 0xb8);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xd0)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xd0)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Web String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x134);\n printf(\"WEB : %s\\n\");\n }\n else if (param_2 == 2) {\n plVar8 = (longlong *)(DAT_140353190 + 0x90);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xa8)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xa8)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Account String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x134);\n printf(\"AUTH : %s\\n\");\n }\n else if (param_2 == 3) {\n plVar8 = (longlong *)(DAT_140353190 + 0xe0);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xf8)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xf8)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Game String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x138);\n printf(\"GAME : %s\\n\");\n }\n else if (param_2 == 4) {\n plVar8 = (longlong *)(DAT_140353190 + 0x108);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0x120)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0x120)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error GameLog String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x13c);\n printf(\"GAME LOG: %s\\n\");\n }\n else {\n printf(\"Error Type Miss !!!\\n\");\n }\n iVar3 = *(int *)(param_1 + 0x21);\n if (iVar3 == 0) {\n iVar3 = 500;\n }\n *(int *)(param_1 + 0x21) = iVar3;\n *(undefined4 *)((longlong)param_1 + 0x10c) = 1;\n }\n return;\n}\n\n","operation":"procedure_pseudo_code","parameters":{"procedure":"0x1400a7aa0"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"},"raw_result":{"limitations":["Ghidra Listing reports a terminal call at 0x1400a7b41 to 0x140218220 FUN_140218220 (external=false, thunk=false, hasNoReturn=true); fallthrough is excluded by Ghidra's flow model. This records Ghidra's FunctionManager flag, not an independent verification that the callee cannot return."],"value":"\n/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */\n\nvoid FUN_1400a7aa0(undefined8 *param_1,int param_2)\n\n{\n char cVar1;\n longlong lVar2;\n int iVar3;\n undefined8 uVar4;\n undefined8 *puVar5;\n void *pvVar6;\n ulonglong uVar7;\n longlong *plVar8;\n longlong *plVar9;\n longlong lVar10;\n undefined1 auStack_2e8 [32];\n undefined8 *local_2c8;\n undefined8 local_2c0;\n undefined **local_2b8;\n char local_2b0 [136];\n char local_228;\n undefined1 local_227 [255];\n CHAR local_128 [280];\n ulonglong local_10;\n \n local_2c0 = 0xfffffffffffffffe;\n local_10 = DAT_1403463c0 ^ (ulonglong)auStack_2e8;\n if (*(int *)((longlong)param_1 + 0x10c) != 1) {\n CoInitialize((LPVOID)0x0);\n local_2c8 = operator_new(0x78);\n uVar4 = 0;\n if (local_2c8 != (void *)0x0) {\n uVar4 = FUN_140002170(local_2c8);\n }\n param_1[0x24] = uVar4;\n puVar5 = operator_new(8);\n local_2c8 = puVar5;\n if (puVar5 == (undefined8 *)0x0) {\n puVar5 = (undefined8 *)0x0;\n }\n else {\n *puVar5 = 0;\n iVar3 = FUN_140001990(puVar5);\n if ((iVar3 < 0) && (iVar3 != -0x7fffbffe)) {\n /* WARNING: Subroutine does not return */\n FUN_140218220(iVar3);\n }\n }\n param_1[0x25] = puVar5;\n pvVar6 = operator_new(0x130);\n uVar4 = 0;\n if (pvVar6 != (void *)0x0) {\n uVar4 = FUN_1400a6d00(pvVar6);\n }\n param_1[0x23] = uVar4;\n puVar5 = operator_new(0x20);\n if (puVar5 == (undefined8 *)0x0) {\n puVar5 = (undefined8 *)0x0;\n }\n else {\n *puVar5 = 0;\n puVar5[1] = &DAT_14029e010;\n puVar5[2] = &DAT_14029e010;\n *(undefined4 *)(puVar5 + 3) = 0;\n FUN_140001f70(puVar5);\n }\n *param_1 = puVar5;\n local_2b8 = CServerConfig::vftable;\n local_228 = '\\0';\n memset(local_227,0,0xff);\n GetCurrentDirectoryA(0x104,local_128);\n sprintf(&local_228,\"%s\\\\%s\");\n strcpy_s(local_2b0,0x80,&local_228);\n lVar10 = DAT_140353190;\n if (param_2 == 1) {\n plVar8 = (longlong *)(DAT_140353190 + 0xb8);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xd0)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xd0)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Web String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x134);\n printf(\"WEB : %s\\n\");\n }\n else if (param_2 == 2) {\n plVar8 = (longlong *)(DAT_140353190 + 0x90);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xa8)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xa8)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Account String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x134);\n printf(\"AUTH : %s\\n\");\n }\n else if (param_2 == 3) {\n plVar8 = (longlong *)(DAT_140353190 + 0xe0);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xf8)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0xf8)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error Game String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x138);\n printf(\"GAME : %s\\n\");\n }\n else if (param_2 == 4) {\n plVar8 = (longlong *)(DAT_140353190 + 0x108);\n plVar9 = plVar8;\n if (0xf < *(ulonglong *)(DAT_140353190 + 0x120)) {\n plVar9 = (longlong *)*plVar8;\n }\n uVar7 = 0xffffffffffffffff;\n do {\n if (uVar7 == 0) break;\n uVar7 = uVar7 - 1;\n cVar1 = *(char *)plVar9;\n plVar9 = (longlong *)((longlong)plVar9 + 1);\n } while (cVar1 != '\\0');\n if (~uVar7 - 1 < 0x100) {\n if (0xf < *(ulonglong *)(DAT_140353190 + 0x120)) {\n plVar8 = (longlong *)*plVar8;\n }\n lVar2 = 8 - (longlong)plVar8;\n do {\n cVar1 = *(char *)plVar8;\n *(char *)((longlong)plVar8 + (longlong)param_1 + lVar2) = cVar1;\n plVar8 = (longlong *)((longlong)plVar8 + 1);\n } while (cVar1 != '\\0');\n }\n else {\n printf(\"Error GameLog String Max.!\\n\");\n lVar10 = DAT_140353190;\n }\n *(undefined4 *)(param_1 + 0x21) = *(undefined4 *)(lVar10 + 0x13c);\n printf(\"GAME LOG: %s\\n\");\n }\n else {\n printf(\"Error Type Miss !!!\\n\");\n }\n iVar3 = *(int *)(param_1 + 0x21);\n if (iVar3 == 0) {\n iVar3 = 500;\n }\n *(int *)(param_1 + 0x21) = iVar3;\n *(undefined4 *)((longlong)param_1 + 0x10c) = 1;\n }\n return;\n}\n\n"},"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"d9e4fccdf3482e50247686d4452c0b13c75a53efc4bd7320668eece8d1ce828c"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/DBCServer_Release_x64.exe","name":"DBCServer_Release_x64.exe"}},{"analysis_profile":{"digest":"3decca45d3460a9d91b48bfb293ee703f84841379edceee6350b1ea3393d3fe1","parameters":{"upstream_analysis_profile":{"digest":"de1d200f7c777e7d47b9def837d80cf1e4326106753fd45afae1b8f0c68936f6","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"x86_64","available_architectures":["x86_64"],"call_relationship_coverage":"function-body-call-coverage-v5","compiler_spec_id":"auto-default","decompiler_jump_loads":true,"executable_role":"application","function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","function_dossier_coverage":"observed-facets-and-call-relationships-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","managed":false,"native_aot_metadata":{"contract_revision":"rtr-9.1-x64-pe-read-only-v3","report_bytes":4194304,"source_bytes":134217728,"work_units":67108864,"working_memory_bytes":67108864},"no_return_repair":"returning-imports-decoded-return-v2","pdb_observations":"program-info-v1","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"pe","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.2"}},"workflow_revision":3},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_389cbf95a4bc2b3f34f5851957a58cdcf3374e5a3dc653d96d3a7a6eb8023f5a","evidence_links":[],"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The target references PDB DBCServer_Release_x64.pdb (GUID 3dbb7ebc-82fb-4496-8a47-78f2cc1f8e51, age (hex) 1, signature unknown, version RSDS); Ghidra reports load state unknown. Original names and types may be missing; an empty name search does not prove a procedure is absent. Use list_procedures and address-based analysis to inspect recovered functions. REA does not admit a caller-selected PDB companion.","This session uses Ghidra 12.1.2. The bridge is verified against 12.1.4; other 12.1.x builds are accepted and the observed version is reported."],"locations":[],"normalized_result":{"document":"target-d9e4fccdf348.exe","image_base":"0x140000000","procedure_count":20732,"segment_count":9,"segments":[{"address_space":"ram","end":"0x140000400","image_base":"0x140000000","length":1024,"name":"Headers","start":"0x140000000"},{"address_space":"ram","end":"0x140274800","image_base":"0x140000000","length":2570240,"name":".text","start":"0x140001000"},{"address_space":"ram","end":"0x140343e00","image_base":"0x140000000","length":847360,"name":".rdata","start":"0x140275000"},{"address_space":"ram","end":"0x14039d410","image_base":"0x140000000","length":365584,"name":".data","start":"0x140344000"},{"address_space":"ram","end":"0x1403af400","image_base":"0x140000000","length":70656,"name":".pdata","start":"0x14039e000"},{"address_space":"ram","end":"0x1403b0200","image_base":"0x140000000","length":512,"name":".tls","start":"0x1403b0000"},{"address_space":"ram","end":"0x1403b1200","image_base":"0x140000000","length":512,"name":".rsrc","start":"0x1403b1000"},{"address_space":"ram","end":"0x1403b6600","image_base":"0x140000000","length":17920,"name":".reloc","start":"0x1403b2000"},{"address_space":"ram","end":"0xff00001850","image_base":"0x140000000","length":6224,"name":"tdb","start":"0xff00000000"}],"string_count":3363},"operation":"binary_overview","parameters":{},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"relationship_coverage":null,"subject":{"architecture":"x86_64","digest":{"sha256":"d9e4fccdf3482e50247686d4452c0b13c75a53efc4bd7320668eece8d1ce828c"},"format":"pe","local_path":"/home/baobeld/Development/rusty-hearts/re-project/binaries/DBCServer_Release_x64.exe","name":"DBCServer_Release_x64.exe"}}],"scenarios":[],"unknowns":[]} |