{
  "evidence_id": "ev_8209118c07f8b7ba11be718cde9292b703322c3bbba88d47dfa1c2c6147579b0",
  "subject": {
    "name": "ms_flag_checker",
    "digest": {
      "sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae"
    },
    "local_path": "[workspace]/.qa/ctf/ms_flag_checker",
    "format": "elf",
    "architecture": "x86_64"
  },
  "provider": {
    "id": "ghidra",
    "name": "Ghidra",
    "version": "12.1.4"
  },
  "analysis_profile": {
    "provider": {
      "id": "ghidra",
      "name": "Ghidra",
      "version": "12.1.4"
    },
    "parameters": {
      "target_kind": "executable",
      "target_format": "elf",
      "architecture": "x86_64",
      "available_architectures": [
        "x86_64"
      ],
      "import_mode": "ephemeral-source-immutable",
      "annotation_policy": "atomic-function-entry-metadata-v1",
      "load_image_observations": "source-mappings-entry-context-v2",
      "function_body_evidence": "complete-inclusive-ranges-v1",
      "function_references": "complete-body-and-entry-reference-manager-v2",
      "call_relationship_coverage": "function-body-call-coverage-v5",
      "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
      "string_inventory_evidence": "defined-data-coverage-v1",
      "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
      "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
      "instruction_flow_evidence": "decoded-return-pcode-v1",
      "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
      "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
      "no_return_repair": "returning-imports-decoded-return-v2",
      "process_launch": "inspected-jvm-launch-support-v1",
      "jump_table_evidence": "typed-case-default-blocks-v1",
      "decompiler_jump_loads": true,
      "loader": "auto-from-header",
      "language_id": "auto-from-header",
      "compiler_spec_id": "auto-default",
      "analyzer_preset": "ghidra-default"
    },
    "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa"
  },
  "predicate_type": "rea.analysis",
  "operation": "xrefs",
  "parameters": {
    "address": "0x102004"
  },
  "raw_result": [
    "0x10126d"
  ],
  "normalized_result": [
    "0x10126d"
  ],
  "confidence": "observed",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "The direct address list projects exact Ghidra references to one address but does not expose their kinds; procedure_references and analyze_function preserve available kind metadata.",
    "Synthetic Ghidra entry-point references without actionable memory sources are omitted."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}