{
  "evidence_id": "ev_95fcf9b949769fb30646d2655cef352faf4fa32c61d506e08c5522595fb16b95",
  "subject": {
    "name": "ms_flag_checker",
    "digest": {
      "sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae"
    },
    "local_path": "[workspace]/.qa/ctf/ms_flag_checker",
    "format": "elf",
    "architecture": "x86_64"
  },
  "provider": {
    "id": "ghidra",
    "name": "Ghidra",
    "version": "12.1.4"
  },
  "analysis_profile": {
    "provider": {
      "id": "ghidra",
      "name": "Ghidra",
      "version": "12.1.4"
    },
    "parameters": {
      "target_kind": "executable",
      "target_format": "elf",
      "architecture": "x86_64",
      "available_architectures": [
        "x86_64"
      ],
      "import_mode": "ephemeral-source-immutable",
      "annotation_policy": "atomic-function-entry-metadata-v1",
      "load_image_observations": "source-mappings-entry-context-v2",
      "function_body_evidence": "complete-inclusive-ranges-v1",
      "function_references": "complete-body-and-entry-reference-manager-v2",
      "call_relationship_coverage": "function-body-call-coverage-v5",
      "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
      "string_inventory_evidence": "defined-data-coverage-v1",
      "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
      "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
      "instruction_flow_evidence": "decoded-return-pcode-v1",
      "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
      "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
      "no_return_repair": "returning-imports-decoded-return-v2",
      "process_launch": "inspected-jvm-launch-support-v1",
      "jump_table_evidence": "typed-case-default-blocks-v1",
      "decompiler_jump_loads": true,
      "loader": "auto-from-header",
      "language_id": "auto-from-header",
      "compiler_spec_id": "auto-default",
      "analyzer_preset": "ghidra-default"
    },
    "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa"
  },
  "predicate_type": "rea.analysis",
  "operation": "search_strings",
  "parameters": {
    "pattern": "flag|correct|wrong|input",
    "mode": "regex",
    "case_sensitive": false
  },
  "raw_result": [
    {
      "address": "0x102004",
      "value": "What is the flag? "
    },
    {
      "address": "0x10201c",
      "value": "Incorrect!"
    },
    {
      "address": "0x102027",
      "value": "Correct!"
    }
  ],
  "normalized_result": [
    {
      "address": "0x102004",
      "value": "What is the flag? "
    },
    {
      "address": "0x10201c",
      "value": "Incorrect!"
    },
    {
      "address": "0x102027",
      "value": "Correct!"
    }
  ],
  "confidence": "observed",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.",
    "Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}