{
  "evidence_id": "ev_e4fb37400f9f2c10ebe6a2894922624a372a6782b8ff209104a056cb060e5cec",
  "subject": {
    "name": "ms_flag_checker",
    "digest": {
      "sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae"
    },
    "local_path": "[workspace]/.qa/ctf/ms_flag_checker",
    "format": "elf",
    "architecture": "x86_64"
  },
  "provider": {
    "id": "ghidra",
    "name": "Ghidra",
    "version": "12.1.4"
  },
  "analysis_profile": {
    "provider": {
      "id": "ghidra",
      "name": "Ghidra",
      "version": "12.1.4"
    },
    "parameters": {
      "target_kind": "executable",
      "target_format": "elf",
      "architecture": "x86_64",
      "available_architectures": [
        "x86_64"
      ],
      "import_mode": "ephemeral-source-immutable",
      "annotation_policy": "atomic-function-entry-metadata-v1",
      "load_image_observations": "source-mappings-entry-context-v2",
      "function_body_evidence": "complete-inclusive-ranges-v1",
      "function_references": "complete-body-and-entry-reference-manager-v2",
      "call_relationship_coverage": "function-body-call-coverage-v5",
      "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
      "string_inventory_evidence": "defined-data-coverage-v1",
      "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
      "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
      "instruction_flow_evidence": "decoded-return-pcode-v1",
      "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
      "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
      "no_return_repair": "returning-imports-decoded-return-v2",
      "process_launch": "inspected-jvm-launch-support-v1",
      "jump_table_evidence": "typed-case-default-blocks-v1",
      "decompiler_jump_loads": true,
      "loader": "auto-from-header",
      "language_id": "auto-from-header",
      "compiler_spec_id": "auto-default",
      "analyzer_preset": "ghidra-default"
    },
    "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa"
  },
  "predicate_type": "rea.analysis",
  "operation": "read_bytes",
  "parameters": {
    "address": "0x1040e0",
    "length": 624
  },
  "raw_result": {
    "address": "0x1040e0",
    "requested_bytes": 624,
    "returned_bytes": 624,
    "bytes_hex": "fb01fe01ff03fd02ff01ff01ff01ff02fd02fe0200000000ff01fd02fd02ff01fe03ff01ff07ff03ff02000000000000ff01ff01ff02ff01fa01ff01fe01ff01ff01fc03ff01fe0002ff05fd03ff04ff02ff05fd02fd00000000000000000000ff01fd01ff01fe01ff03ff01ff01fe05ff04ff01fd00000001fe02f801f902ff01fd01fe01fc00000000000000000000eb01f2000000000000000000000000000000000000000000fe03fc04fb01fe01ff01fe01fe01ff04ff00000000000000fc05fd01fb01fd01fe05fc02000000000000000000000000ff02fc01ff04fd01fc01ff02ff01fd01ff02fe0000000000fe01f801ff01fd01ff01f901f8000000000000000000000001fe05ff01f803fe01fe01fd01fc01000000000000000000fd01f701fe01ef01ff00000000000000000000000000000003fb04ff01fe01ff02fd03ff01ff03ff02ff000000000000fe02fd01ff01ff01ff01f901ff06ff03ff01ff000000000001fb01fe02ff02ff01ff01fb01ff01ff05fc00000000000002fd01fb04fe03fe05ff02ff02ff02000000000000000000ff01fd01ff02fe01ff07fe03ff04ff01fe01ff000000000002ff01fe02ff02fe05ff01ff02fd02ff01fe02ff0100000001fd03ff01fe01ff06ff01ff02fe01ff01ff03ff02000000f701f701fb01f6000000000000000000000000000000000001ff02fe01ff09ff01ff01f902fe01fe0100000000000000ff09ff03ff06ff01ff01fe01fd01fc000000000000000000fe01fd01ff02fb06ff02fe04ff01fc000000000000000000fe01fc01ff01fe01fd01fd01fd03fa01fe00000000000000f804fe02ff03fb01fe02ff01fc0000000000000000000000",
    "complete": true
  },
  "normalized_result": {
    "address": "0x1040e0",
    "requested_bytes": 624,
    "returned_bytes": 624,
    "bytes_hex": "fb01fe01ff03fd02ff01ff01ff01ff02fd02fe0200000000ff01fd02fd02ff01fe03ff01ff07ff03ff02000000000000ff01ff01ff02ff01fa01ff01fe01ff01ff01fc03ff01fe0002ff05fd03ff04ff02ff05fd02fd00000000000000000000ff01fd01ff01fe01ff03ff01ff01fe05ff04ff01fd00000001fe02f801f902ff01fd01fe01fc00000000000000000000eb01f2000000000000000000000000000000000000000000fe03fc04fb01fe01ff01fe01fe01ff04ff00000000000000fc05fd01fb01fd01fe05fc02000000000000000000000000ff02fc01ff04fd01fc01ff02ff01fd01ff02fe0000000000fe01f801ff01fd01ff01f901f8000000000000000000000001fe05ff01f803fe01fe01fd01fc01000000000000000000fd01f701fe01ef01ff00000000000000000000000000000003fb04ff01fe01ff02fd03ff01ff03ff02ff000000000000fe02fd01ff01ff01ff01f901ff06ff03ff01ff000000000001fb01fe02ff02ff01ff01fb01ff01ff05fc00000000000002fd01fb04fe03fe05ff02ff02ff02000000000000000000ff01fd01ff02fe01ff07fe03ff04ff01fe01ff000000000002ff01fe02ff02fe05ff01ff02fd02ff01fe02ff0100000001fd03ff01fe01ff06ff01ff02fe01ff01ff03ff02000000f701f701fb01f6000000000000000000000000000000000001ff02fe01ff09ff01ff01f902fe01fe0100000000000000ff09ff03ff06ff01ff01fe01fd01fc000000000000000000fe01fd01ff02fb06ff02fe04ff01fc000000000000000000fe01fc01ff01fe01fd01fd01fd03fa01fe00000000000000f804fe02ff03fb01fe02ff01fc0000000000000000000000",
    "complete": true
  },
  "confidence": "observed",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "Bytes reflect Ghidra's initialized memory, including loader fixups. Reads stop at an unmapped or uninitialized byte and report completeness explicitly."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}