{ "evidence_id": "ev_afad7e0156a673e11c301830a248e2ddc424584d7daa9456c7ffe35963fef831", "subject": { "name": "ms_flag_checker", "digest": { "sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae" }, "local_path": "[workspace]/.qa/ctf/ms_flag_checker", "format": "elf", "architecture": "x86_64" }, "provider": { "id": "ghidra", "name": "Ghidra", "version": "12.1.4" }, "analysis_profile": { "provider": { "id": "ghidra", "name": "Ghidra", "version": "12.1.4" }, "parameters": { "target_kind": "executable", "target_format": "elf", "architecture": "x86_64", "available_architectures": [ "x86_64" ], "import_mode": "ephemeral-source-immutable", "annotation_policy": "atomic-function-entry-metadata-v1", "load_image_observations": "source-mappings-entry-context-v2", "function_body_evidence": "complete-inclusive-ranges-v1", "function_references": "complete-body-and-entry-reference-manager-v2", "call_relationship_coverage": "function-body-call-coverage-v5", "function_dossier_coverage": "observed-facets-and-call-relationships-v1", "string_inventory_evidence": "defined-data-coverage-v1", "location_resolution": "explicit-address-exact-entry-symbol-first-v3", "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2", "instruction_flow_evidence": "decoded-return-pcode-v1", "instruction_references": "exact-address-incoming-without-synthetic-entry-v2", "function_boundary_observations": "ghidra-function-boundary-limitations-v4", "no_return_repair": "returning-imports-decoded-return-v2", "process_launch": "inspected-jvm-launch-support-v1", "jump_table_evidence": "typed-case-default-blocks-v1", "decompiler_jump_loads": true, "loader": "auto-from-header", "language_id": "auto-from-header", "compiler_spec_id": "auto-default", "analyzer_preset": "ghidra-default" }, "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa" }, "predicate_type": "rea.analysis", "operation": "analyze_function", "parameters": { "procedure": "0x101217" }, "raw_result": { "value": { "procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true }, "signature": "undefined FUN_00101217()", "locals": [] }, "pseudocode": "\nint FUN_00101217(long param_1,long param_2)\n\n{\n long lVar1;\n int iVar2;\n long lVar3;\n \n lVar3 = 0x18;\n iVar2 = 0;\n do {\n lVar1 = lVar3 + -0x18;\n do {\n if (*(int *)(param_2 + lVar1) != 0) {\n iVar2 = iVar2 + *(int *)(param_1 + lVar1);\n }\n lVar1 = lVar1 + 4;\n } while (lVar1 != lVar3);\n lVar3 = lVar3 + 0x18;\n } while (lVar3 != 0xa8);\n return iVar2;\n}\n\n", "assembly": [ "0x101217: MOV EDX, 0x18", "0x10121c: MOV ECX, 0x0", "0x101221: JMP 0x00101244", "0x101223: ADD RAX, 0x4", "0x101227: CMP RAX, RDX", "0x10122a: JZ 0x00101237", "0x10122c: CMP dword ptr [RSI + RAX*0x1], 0x0", "0x101230: JZ 0x00101223", "0x101232: ADD ECX, dword ptr [RDI + RAX*0x1]", "0x101235: JMP 0x00101223", "0x101237: ADD RDX, 0x18", "0x10123b: CMP RDX, 0xa8", "0x101242: JZ 0x0010124a", "0x101244: LEA RAX, [RDX + -0x18]", "0x101248: JMP 0x0010122c", "0x10124a: MOV EAX, ECX", "0x10124c: RET" ], "comments": [], "callers": [ { "address": "0x10124d", "name": "FUN_0010124d", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x10124d", "end": "0x10134f" } ], "total_bytes": 259, "span_bytes": 259, "non_contiguous": false, "contains_entry": true } } ], "callees": [], "incoming_references": [ { "source_address": "0x1012ec", "target_address": "0x101217", "source_procedure": { "address": "0x10124d", "name": "FUN_0010124d", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x10124d", "end": "0x10134f" } ], "total_bytes": 259, "span_bytes": 259, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_CALL", "flow": true, "call": true, "jump": false, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x102054", "target_address": "0x101217", "source_procedure": null, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "INDIRECTION", "flow": true, "call": false, "jump": false, "data": false, "read": false, "write": false, "indirect": true, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x1020f0", "target_address": "0x101217", "source_procedure": null, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "DATA", "flow": false, "call": false, "jump": false, "data": true, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } } ], "outgoing_references": [ { "source_address": "0x101221", "target_address": "0x101244", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x10122a", "target_address": "0x101237", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101230", "target_address": "0x101223", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101235", "target_address": "0x101223", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101242", "target_address": "0x10124a", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101248", "target_address": "0x10122c", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } } ], "referenced_strings": [], "referenced_names": [ { "address": "0x101223", "value": "LAB_00101223", "source_address": "0x101230" }, { "address": "0x101223", "value": "LAB_00101223", "source_address": "0x101235" }, { "address": "0x10122c", "value": "LAB_0010122c", "source_address": "0x101248" }, { "address": "0x101237", "value": "LAB_00101237", "source_address": "0x10122a" }, { "address": "0x101244", "value": "LAB_00101244", "source_address": "0x101221" }, { "address": "0x10124a", "value": "LAB_0010124a", "source_address": "0x101242" } ], "basic_blocks": [ { "start": "0x101217", "end": "0x101223", "successors": [ "0x101244" ] }, { "start": "0x101223", "end": "0x10122c", "successors": [ "0x10122c", "0x101237" ] }, { "start": "0x10122c", "end": "0x101232", "successors": [ "0x101223", "0x101232" ] }, { "start": "0x101232", "end": "0x101237", "successors": [ "0x101223" ] }, { "start": "0x101237", "end": "0x101244", "successors": [ "0x101244", "0x10124a" ] }, { "start": "0x101244", "end": "0x10124a", "successors": [ "0x10122c" ] }, { "start": "0x10124a", "end": "0x10124d", "successors": [] } ], "native_api": { "available": true, "provenance": "ghidra-high-function", "signature_source": "default", "calling_convention": "__stdcall", "return_type": { "role": "return", "ordinal": null, "name": null, "data_type": "int", "size_bytes": 4, "storage": "EAX:4", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type int." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage" ] }, "parameters": [ { "role": "parameter", "ordinal": 0, "name": "param_1", "data_type": "long", "size_bytes": 8, "storage": "RDI:8", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type long." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage", "compiler-generated-variable" ] }, { "role": "parameter", "ordinal": 1, "name": "param_2", "data_type": "long", "size_bytes": 8, "storage": "RSI:8", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type long." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage", "compiler-generated-variable" ] } ], "jump_tables": [], "pseudocode": { "classification": "decompiler-generated-non-source", "compilable": false }, "decompiler_artifacts": [ "recovered-signature", "register-and-stack-variables", "compiler-generated-control-flow", "pointer-arithmetic", "pseudocode" ], "limitations": [ "Types and calling conventions are Ghidra decompiler observations, not source declarations.", "Register variables, compiler-generated blocks, and pointer arithmetic remain decompiler artifacts.", "Pseudocode is neither original source nor guaranteed to compile." ] }, "native_value_flow": { "available": true, "provenance": "ghidra-high-pcode", "operations": [ { "id": "0x101217#0", "address": "0x101217", "sequence": 0, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "18" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x10121c#158", "address": "0x10121c", "sequence": 158, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "0" } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101221#2", "address": "0x101221", "sequence": 2, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101244", "constant_hex": null } ], "output": null }, { "id": "0x101223#38", "address": "0x101223", "sequence": 38, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "4" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } }, { "id": "0x101223#154", "address": "0x101223", "sequence": 154, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101227#50", "address": "0x101227", "sequence": 50, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x10122a#55", "address": "0x10122a", "sequence": 55, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101237", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x10122c#7", "address": "0x10122c", "sequence": 7, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x30", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x10000017", "constant_hex": null } }, { "id": "0x10122c#8", "address": "0x10122c", "sequence": 8, "opcode": "LOAD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "1b1" }, { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } }, { "id": "0x10122c#14", "address": "0x10122c", "sequence": 14, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null }, { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "0" } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x10122c#120", "address": "0x10122c", "sequence": 120, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x8e00", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } }, { "id": "0x10122c#153", "address": "0x10122c", "sequence": 153, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x10122c#165", "address": "0x10122c", "sequence": 165, "opcode": "CAST", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x10000017", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } }, { "id": "0x101230#19", "address": "0x101230", "sequence": 19, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101223", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x101232#21", "address": "0x101232", "sequence": 21, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x38", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x1000001f", "constant_hex": null } }, { "id": "0x101232#26", "address": "0x101232", "sequence": 26, "opcode": "LOAD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "1b1" }, { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } }, { "id": "0x101232#27", "address": "0x101232", "sequence": 27, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101232#166", "address": "0x101232", "sequence": 166, "opcode": "CAST", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x1000001f", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } }, { "id": "0x101235#35", "address": "0x101235", "sequence": 35, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101223", "constant_hex": null } ], "output": null }, { "id": "0x101237#58", "address": "0x101237", "sequence": 58, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "18" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x10123b#70", "address": "0x10123b", "sequence": 70, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "a8" } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x101242#75", "address": "0x101242", "sequence": 75, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x10124a", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x101244#3", "address": "0x101244", "sequence": 3, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "ffffffffffffffe8" } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x8e00", "constant_hex": null } }, { "id": "0x101244#135", "address": "0x101244", "sequence": 135, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x101244#157", "address": "0x101244", "sequence": 157, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101248#5", "address": "0x101248", "sequence": 5, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x10122c", "constant_hex": null } ], "output": null }, { "id": "0x10124a#164", "address": "0x10124a", "sequence": 164, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x0", "constant_hex": null } }, { "id": "0x10124c#80", "address": "0x10124c", "sequence": 80, "opcode": "RETURN", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "0" }, { "kind": "register", "size_bytes": 4, "location": "register:0x0", "constant_hex": null } ], "output": null } ], "def_use": [ { "definition": "0x10122c#120", "use": "0x101223#38", "input_index": 0 }, { "definition": "0x10122c#153", "use": "0x101223#154", "input_index": 0 }, { "definition": "0x101232#27", "use": "0x101223#154", "input_index": 1 }, { "definition": "0x101223#38", "use": "0x101227#50", "input_index": 0 }, { "definition": "0x101244#135", "use": "0x101227#50", "input_index": 1 }, { "definition": "0x101227#50", "use": "0x10122a#55", "input_index": 1 }, { "definition": "0x10122c#120", "use": "0x10122c#7", "input_index": 1 }, { "definition": "0x10122c#165", "use": "0x10122c#8", "input_index": 1 }, { "definition": "0x10122c#8", "use": "0x10122c#14", "input_index": 0 }, { "definition": "0x101244#3", "use": "0x10122c#120", "input_index": 0 }, { "definition": "0x101223#38", "use": "0x10122c#120", "input_index": 1 }, { "definition": "0x101244#157", "use": "0x10122c#153", "input_index": 0 }, { "definition": "0x101223#154", "use": "0x10122c#153", "input_index": 1 }, { "definition": "0x10122c#7", "use": "0x10122c#165", "input_index": 0 }, { "definition": "0x10122c#14", "use": "0x101230#19", "input_index": 1 }, { "definition": "0x10122c#120", "use": "0x101232#21", "input_index": 1 }, { "definition": "0x101232#166", "use": "0x101232#26", "input_index": 1 }, { "definition": "0x10122c#153", "use": "0x101232#27", "input_index": 0 }, { "definition": "0x101232#26", "use": "0x101232#27", "input_index": 1 }, { "definition": "0x101232#21", "use": "0x101232#166", "input_index": 0 }, { "definition": "0x101244#135", "use": "0x101237#58", "input_index": 0 }, { "definition": "0x101237#58", "use": "0x10123b#70", "input_index": 0 }, { "definition": "0x10123b#70", "use": "0x101242#75", "input_index": 1 }, { "definition": "0x101244#135", "use": "0x101244#3", "input_index": 0 }, { "definition": "0x101217#0", "use": "0x101244#135", "input_index": 0 }, { "definition": "0x101237#58", "use": "0x101244#135", "input_index": 1 }, { "definition": "0x10121c#158", "use": "0x101244#157", "input_index": 0 }, { "definition": "0x101223#154", "use": "0x101244#157", "input_index": 1 }, { "definition": "0x101223#154", "use": "0x10124a#164", "input_index": 0 }, { "definition": "0x10124a#164", "use": "0x10124c#80", "input_index": 1 } ], "parameters": [ { "ordinal": 0, "name": "param_1", "data_type": "/long" }, { "ordinal": 1, "name": "param_2", "data_type": "/long" } ], "parameter_uses": [ { "ordinal": 1, "use": "0x10122c#7", "input_index": 0 }, { "ordinal": 0, "use": "0x101232#21", "input_index": 0 } ], "effects": [ { "operation": "0x10122a#55", "kind": "conditional_branch", "operand_input": null, "value_input": 1 }, { "operation": "0x10122c#8", "kind": "memory_read", "operand_input": 1, "value_input": null }, { "operation": "0x101230#19", "kind": "conditional_branch", "operand_input": null, "value_input": 1 }, { "operation": "0x101232#26", "kind": "memory_read", "operand_input": 1, "value_input": null }, { "operation": "0x101242#75", "kind": "conditional_branch", "operand_input": null, "value_input": 1 } ], "truncated": false, "omitted_operations_lower_bound": 0, "known_omitted_inputs": 0, "known_omitted_edges": 0, "limitations": [ "High p-code is decompiler-derived, not original source or runtime behavior. is_dead preserves the Java AST flag; decoded block members can retain that flag, so block_membership separately reports actual syntax-tree membership.", "Def-use links do not cross function boundaries and may omit memory aliasing, call side effects, or unresolved indirect flow.", "Memory read/write effects include stack and temporary memory operations; they do not identify persistent state or business meaning.", "Operation, input, and def-use limits can truncate large functions; inspect truncation, omitted lower bounds, and known omitted counts before drawing conclusions.", "Known omitted-edge counts cover links omitted from retained operations; omitted operations may contain additional uncounted links." ] }, "facet_availability": { "pseudocode": { "available": true }, "comments": { "available": true }, "callers": { "available": true }, "callees": { "available": true }, "references": { "available": true }, "strings_names": { "available": true }, "cfg": { "available": true }, "assembly": { "available": true } }, "unresolved_calls": [], "limitations": [ "Unresolved computed or indirect flows without target addresses are not represented as reference edges.", "Thunk and external classifications are Ghidra FunctionManager observations; they do not resolve targetless calls.", "Pseudocode and assembly are Ghidra-specific representations, not original source or Hopper-equivalent text.", "Synthetic Ghidra entry-point references without actionable memory sources are omitted." ] }, "limitations": [], "relationship_coverage": { "status": "complete", "diagnostics": [ "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals." ] } }, "normalized_result": { "procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true }, "signature": "undefined FUN_00101217()", "locals": [] }, "pseudocode": "\nint FUN_00101217(long param_1,long param_2)\n\n{\n long lVar1;\n int iVar2;\n long lVar3;\n \n lVar3 = 0x18;\n iVar2 = 0;\n do {\n lVar1 = lVar3 + -0x18;\n do {\n if (*(int *)(param_2 + lVar1) != 0) {\n iVar2 = iVar2 + *(int *)(param_1 + lVar1);\n }\n lVar1 = lVar1 + 4;\n } while (lVar1 != lVar3);\n lVar3 = lVar3 + 0x18;\n } while (lVar3 != 0xa8);\n return iVar2;\n}\n\n", "assembly": [ "0x101217: MOV EDX, 0x18", "0x10121c: MOV ECX, 0x0", "0x101221: JMP 0x00101244", "0x101223: ADD RAX, 0x4", "0x101227: CMP RAX, RDX", "0x10122a: JZ 0x00101237", "0x10122c: CMP dword ptr [RSI + RAX*0x1], 0x0", "0x101230: JZ 0x00101223", "0x101232: ADD ECX, dword ptr [RDI + RAX*0x1]", "0x101235: JMP 0x00101223", "0x101237: ADD RDX, 0x18", "0x10123b: CMP RDX, 0xa8", "0x101242: JZ 0x0010124a", "0x101244: LEA RAX, [RDX + -0x18]", "0x101248: JMP 0x0010122c", "0x10124a: MOV EAX, ECX", "0x10124c: RET" ], "comments": [], "callers": [ { "address": "0x10124d", "name": "FUN_0010124d", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x10124d", "end": "0x10134f" } ], "total_bytes": 259, "span_bytes": 259, "non_contiguous": false, "contains_entry": true } } ], "callees": [], "incoming_references": [ { "source_address": "0x1012ec", "target_address": "0x101217", "source_procedure": { "address": "0x10124d", "name": "FUN_0010124d", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x10124d", "end": "0x10134f" } ], "total_bytes": 259, "span_bytes": 259, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_CALL", "flow": true, "call": true, "jump": false, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x102054", "target_address": "0x101217", "source_procedure": null, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "INDIRECTION", "flow": true, "call": false, "jump": false, "data": false, "read": false, "write": false, "indirect": true, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x1020f0", "target_address": "0x101217", "source_procedure": null, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "DATA", "flow": false, "call": false, "jump": false, "data": true, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } } ], "outgoing_references": [ { "source_address": "0x101221", "target_address": "0x101244", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x10122a", "target_address": "0x101237", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101230", "target_address": "0x101223", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101235", "target_address": "0x101223", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101242", "target_address": "0x10124a", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "CONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": true, "terminal": false, "primary": true, "operand_index": 0, "external": false } }, { "source_address": "0x101248", "target_address": "0x10122c", "source_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "target_procedure": { "address": "0x101217", "name": "FUN_00101217", "classification": { "external": false, "thunk": false, "thunk_target": null, "provenance": "ghidra-function-manager" }, "body": { "available": true, "provenance": "ghidra-function-body-address-set", "ranges": [ { "start": "0x101217", "end": "0x10124c" } ], "total_bytes": 54, "span_bytes": 54, "non_contiguous": false, "contains_entry": true } }, "kind": { "available": true, "provenance": "ghidra-reference-manager", "type": "UNCONDITIONAL_JUMP", "flow": true, "call": false, "jump": true, "data": false, "read": false, "write": false, "indirect": false, "computed": false, "conditional": false, "terminal": false, "primary": true, "operand_index": 0, "external": false } } ], "unresolved_calls": [], "referenced_strings": [], "referenced_names": [ { "address": "0x101223", "value": "LAB_00101223", "source_address": "0x101230" }, { "address": "0x101223", "value": "LAB_00101223", "source_address": "0x101235" }, { "address": "0x10122c", "value": "LAB_0010122c", "source_address": "0x101248" }, { "address": "0x101237", "value": "LAB_00101237", "source_address": "0x10122a" }, { "address": "0x101244", "value": "LAB_00101244", "source_address": "0x101221" }, { "address": "0x10124a", "value": "LAB_0010124a", "source_address": "0x101242" } ], "basic_blocks": [ { "start": "0x101217", "end": "0x101223", "successors": [ "0x101244" ] }, { "start": "0x101223", "end": "0x10122c", "successors": [ "0x10122c", "0x101237" ] }, { "start": "0x10122c", "end": "0x101232", "successors": [ "0x101223", "0x101232" ] }, { "start": "0x101232", "end": "0x101237", "successors": [ "0x101223" ] }, { "start": "0x101237", "end": "0x101244", "successors": [ "0x101244", "0x10124a" ] }, { "start": "0x101244", "end": "0x10124a", "successors": [ "0x10122c" ] }, { "start": "0x10124a", "end": "0x10124d", "successors": [] } ], "native_api": { "available": true, "provenance": "ghidra-high-function", "signature_source": "default", "calling_convention": "__stdcall", "return_type": { "ordinal": null, "name": null, "data_type": "int", "size_bytes": 4, "storage": "EAX:4", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type int." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage" ], "role": "return" }, "parameters": [ { "ordinal": 0, "name": "param_1", "data_type": "long", "size_bytes": 8, "storage": "RDI:8", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type long." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage", "compiler-generated-variable" ], "role": "parameter" }, { "ordinal": 1, "name": "param_2", "data_type": "long", "size_bytes": 8, "storage": "RSI:8", "confidence": "low", "evidence": [ { "kind": "signature-source", "source": "ghidra-function-manager", "detail": "Function signature source is default." }, { "kind": "decompiler-type", "source": "ghidra-high-function", "detail": "HighFunction recovered data type long." } ], "decompiler_artifacts": [ "recovered-signature", "register-or-stack-storage", "compiler-generated-variable" ], "role": "parameter" } ], "jump_tables": [], "pseudocode": { "classification": "decompiler-generated-non-source", "compilable": false }, "decompiler_artifacts": [ "recovered-signature", "register-and-stack-variables", "compiler-generated-control-flow", "pointer-arithmetic", "pseudocode" ], "limitations": [ "Types and calling conventions are Ghidra decompiler observations, not source declarations.", "Register variables, compiler-generated blocks, and pointer arithmetic remain decompiler artifacts.", "Pseudocode is neither original source nor guaranteed to compile." ] }, "native_value_flow": { "available": true, "provenance": "ghidra-high-pcode", "operations": [ { "id": "0x101217#0", "address": "0x101217", "sequence": 0, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "18" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x10121c#158", "address": "0x10121c", "sequence": 158, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "0" } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101221#2", "address": "0x101221", "sequence": 2, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101244", "constant_hex": null } ], "output": null }, { "id": "0x101223#38", "address": "0x101223", "sequence": 38, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "4" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } }, { "id": "0x101223#154", "address": "0x101223", "sequence": 154, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101227#50", "address": "0x101227", "sequence": 50, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x10122a#55", "address": "0x10122a", "sequence": 55, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101237", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x10122c#7", "address": "0x10122c", "sequence": 7, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x30", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x10000017", "constant_hex": null } }, { "id": "0x10122c#8", "address": "0x10122c", "sequence": 8, "opcode": "LOAD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "1b1" }, { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } }, { "id": "0x10122c#14", "address": "0x10122c", "sequence": 14, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null }, { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "0" } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x10122c#120", "address": "0x10122c", "sequence": 120, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x8e00", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } }, { "id": "0x10122c#153", "address": "0x10122c", "sequence": 153, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x10122c#165", "address": "0x10122c", "sequence": 165, "opcode": "CAST", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x10000017", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } }, { "id": "0x101230#19", "address": "0x101230", "sequence": 19, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101223", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x101232#21", "address": "0x101232", "sequence": 21, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x38", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x0", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x1000001f", "constant_hex": null } }, { "id": "0x101232#26", "address": "0x101232", "sequence": 26, "opcode": "LOAD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 4, "location": null, "constant_hex": "1b1" }, { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } }, { "id": "0x101232#27", "address": "0x101232", "sequence": 27, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "unique", "size_bytes": 4, "location": "unique:0x23c00", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101232#166", "address": "0x101232", "sequence": 166, "opcode": "CAST", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "unique", "size_bytes": 8, "location": "unique:0x1000001f", "constant_hex": null } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x9400", "constant_hex": null } }, { "id": "0x101235#35", "address": "0x101235", "sequence": 35, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x101223", "constant_hex": null } ], "output": null }, { "id": "0x101237#58", "address": "0x101237", "sequence": 58, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "18" } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x10123b#70", "address": "0x10123b", "sequence": 70, "opcode": "INT_NOTEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "a8" } ], "output": { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } }, { "id": "0x101242#75", "address": "0x101242", "sequence": 75, "opcode": "CBRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x10124a", "constant_hex": null }, { "kind": "register", "size_bytes": 1, "location": "register:0x206", "constant_hex": null } ], "output": null }, { "id": "0x101244#3", "address": "0x101244", "sequence": 3, "opcode": "INT_ADD", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "ffffffffffffffe8" } ], "output": { "kind": "unique", "size_bytes": 8, "location": "unique:0x8e00", "constant_hex": null } }, { "id": "0x101244#135", "address": "0x101244", "sequence": 135, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null }, { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 8, "location": "register:0x10", "constant_hex": null } }, { "id": "0x101244#157", "address": "0x101244", "sequence": 157, "opcode": "MULTIEQUAL", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null }, { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } }, { "id": "0x101248#5", "address": "0x101248", "sequence": 5, "opcode": "BRANCH", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "address", "size_bytes": 1, "location": "0x10122c", "constant_hex": null } ], "output": null }, { "id": "0x10124a#164", "address": "0x10124a", "sequence": 164, "opcode": "COPY", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "register", "size_bytes": 4, "location": "register:0x8", "constant_hex": null } ], "output": { "kind": "register", "size_bytes": 4, "location": "register:0x0", "constant_hex": null } }, { "id": "0x10124c#80", "address": "0x10124c", "sequence": 80, "opcode": "RETURN", "is_dead": true, "block_membership": "member", "inputs": [ { "kind": "constant", "size_bytes": 8, "location": null, "constant_hex": "0" }, { "kind": "register", "size_bytes": 4, "location": "register:0x0", "constant_hex": null } ], "output": null } ], "def_use": [ { "definition": "0x10122c#120", "use": "0x101223#38", "input_index": 0 }, { "definition": "0x10122c#153", "use": "0x101223#154", "input_index": 0 }, { "definition": "0x101232#27", "use": "0x101223#154", "input_index": 1 }, { "definition": "0x101223#38", "use": "0x101227#50", "input_index": 0 }, { "definition": "0x101244#135", "use": "0x101227#50", "input_index": 1 }, { "definition": "0x101227#50", "use": "0x10122a#55", "input_index": 1 }, { "definition": "0x10122c#120", "use": "0x10122c#7", "input_index": 1 }, { "definition": "0x10122c#165", "use": "0x10122c#8", "input_index": 1 }, { "definition": "0x10122c#8", "use": "0x10122c#14", "input_index": 0 }, { "definition": "0x101244#3", "use": "0x10122c#120", "input_index": 0 }, { "definition": "0x101223#38", "use": "0x10122c#120", "input_index": 1 }, { "definition": "0x101244#157", "use": "0x10122c#153", "input_index": 0 }, { "definition": "0x101223#154", "use": "0x10122c#153", "input_index": 1 }, { "definition": "0x10122c#7", "use": "0x10122c#165", "input_index": 0 }, { "definition": "0x10122c#14", "use": "0x101230#19", "input_index": 1 }, { "definition": "0x10122c#120", "use": "0x101232#21", "input_index": 1 }, { "definition": "0x101232#166", "use": "0x101232#26", "input_index": 1 }, { "definition": "0x10122c#153", "use": "0x101232#27", "input_index": 0 }, { "definition": "0x101232#26", "use": "0x101232#27", "input_index": 1 }, { "definition": "0x101232#21", "use": "0x101232#166", "input_index": 0 }, { "definition": "0x101244#135", "use": "0x101237#58", "input_index": 0 }, { "definition": "0x101237#58", "use": "0x10123b#70", "input_index": 0 }, { "definition": "0x10123b#70", "use": "0x101242#75", "input_index": 1 }, { "definition": "0x101244#135", "use": "0x101244#3", "input_index": 0 }, { "definition": "0x101217#0", "use": "0x101244#135", "input_index": 0 }, { "definition": "0x101237#58", "use": "0x101244#135", "input_index": 1 }, { "definition": "0x10121c#158", "use": "0x101244#157", "input_index": 0 }, { "definition": "0x101223#154", "use": "0x101244#157", "input_index": 1 }, { "definition": "0x101223#154", "use": "0x10124a#164", "input_index": 0 }, { "definition": "0x10124a#164", "use": "0x10124c#80", "input_index": 1 } ], "effects": [ { "operation": "0x10122a#55", "kind": "conditional_branch", "operand_input": null, "value_input": 1 }, { "operation": "0x10122c#8", "kind": "memory_read", "operand_input": 1, "value_input": null }, { "operation": "0x101230#19", "kind": "conditional_branch", "operand_input": null, "value_input": 1 }, { "operation": "0x101232#26", "kind": "memory_read", "operand_input": 1, "value_input": null }, { "operation": "0x101242#75", "kind": "conditional_branch", "operand_input": null, "value_input": 1 } ], "parameters": [ { "ordinal": 0, "name": "param_1", "data_type": "/long" }, { "ordinal": 1, "name": "param_2", "data_type": "/long" } ], "parameter_uses": [ { "ordinal": 1, "use": "0x10122c#7", "input_index": 0 }, { "ordinal": 0, "use": "0x101232#21", "input_index": 0 } ], "truncated": false, "omitted_operations_lower_bound": 0, "known_omitted_inputs": 0, "known_omitted_edges": 0, "limitations": [ "High p-code is decompiler-derived, not original source or runtime behavior. is_dead preserves the Java AST flag; decoded block members can retain that flag, so block_membership separately reports actual syntax-tree membership.", "Def-use links do not cross function boundaries and may omit memory aliasing, call side effects, or unresolved indirect flow.", "Memory read/write effects include stack and temporary memory operations; they do not identify persistent state or business meaning.", "Operation, input, and def-use limits can truncate large functions; inspect truncation, omitted lower bounds, and known omitted counts before drawing conclusions.", "Known omitted-edge counts cover links omitted from retained operations; omitted operations may contain additional uncounted links." ] }, "facet_availability": { "pseudocode": { "available": true }, "assembly": { "available": true }, "comments": { "available": true }, "callers": { "available": true }, "callees": { "available": true }, "references": { "available": true }, "strings_names": { "available": true }, "cfg": { "available": true } }, "limitations": [ "Unresolved computed or indirect flows without target addresses are not represented as reference edges.", "Thunk and external classifications are Ghidra FunctionManager observations; they do not resolve targetless calls.", "Pseudocode and assembly are Ghidra-specific representations, not original source or Hopper-equivalent text.", "Synthetic Ghidra entry-point references without actionable memory sources are omitted." ] }, "confidence": "observed", "authority": "shipped-artifact", "environment": null, "limitations": [ "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.", "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.", "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.", "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.", "References cover the complete Ghidra function-body AddressSet and exact entry. Dossier incoming edges omit sources owned by that function; procedure_references also retains those internal edges.", "The dossier combines Ghidra FunctionManager, Listing, ReferenceManager, BasicBlockModel, and decompiler observations; provider-specific pseudocode and assembly are not cross-provider text invariants.", "Resolved reference metadata identifies computed, indirect, external, call, jump, and data edges; unresolved targetless flows remain unknown, and function classifications distinguish thunks and externals.", "Synthetic Ghidra entry-point references without actionable memory sources are omitted.", "The Java bridge serializes one function request per Program and lets each decompilation run until it completes or the caller cancels." ], "relationship_coverage": { "status": "complete", "diagnostics": [ "Only resolved Ghidra call references are returned; unresolved computed or indirect calls remain unknown, while function classifications distinguish thunks and externals." ] }, "locations": [], "evidence_links": [] }