{
  "evidence_id": "ev_76c16f11987fbc2e8d1a554b3c559120e19e4d50022de2e8166fc3034cd6e6a1",
  "subject": {
    "name": "ms_flag_checker",
    "digest": {
      "sha256": "dcd3bec4f608e11f3a12ce461100aaf5f621851ee63a1f870d7c90d4e3dd51ae"
    },
    "local_path": "[workspace]/.qa/ctf/ms_flag_checker",
    "format": "elf",
    "architecture": "x86_64"
  },
  "provider": {
    "id": "ghidra",
    "name": "Ghidra",
    "version": "12.1.4"
  },
  "analysis_profile": {
    "provider": {
      "id": "ghidra",
      "name": "Ghidra",
      "version": "12.1.4"
    },
    "parameters": {
      "target_kind": "executable",
      "target_format": "elf",
      "architecture": "x86_64",
      "available_architectures": [
        "x86_64"
      ],
      "import_mode": "ephemeral-source-immutable",
      "annotation_policy": "atomic-function-entry-metadata-v1",
      "load_image_observations": "source-mappings-entry-context-v2",
      "function_body_evidence": "complete-inclusive-ranges-v1",
      "function_references": "complete-body-and-entry-reference-manager-v2",
      "call_relationship_coverage": "function-body-call-coverage-v5",
      "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
      "string_inventory_evidence": "defined-data-coverage-v1",
      "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
      "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
      "instruction_flow_evidence": "decoded-return-pcode-v1",
      "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
      "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
      "no_return_repair": "returning-imports-decoded-return-v2",
      "process_launch": "inspected-jvm-launch-support-v1",
      "jump_table_evidence": "typed-case-default-blocks-v1",
      "decompiler_jump_loads": true,
      "loader": "auto-from-header",
      "language_id": "auto-from-header",
      "compiler_spec_id": "auto-default",
      "analyzer_preset": "ghidra-default"
    },
    "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa"
  },
  "predicate_type": "rea.analysis",
  "operation": "read_bytes",
  "parameters": {
    "address": "0x104060",
    "length": 104
  },
  "raw_result": {
    "address": "0x104060",
    "requested_bytes": 104,
    "returned_bytes": 104,
    "bytes_hex": "a1050000fb070000eb040000ef07000007070000ea02000037000000aa050000cd050000520500006302000022050000660100002a070000dc0500004b050000db070000c607000093070000c607000016010000430700003f080000e605000078030000c8040000",
    "complete": true
  },
  "normalized_result": {
    "address": "0x104060",
    "requested_bytes": 104,
    "returned_bytes": 104,
    "bytes_hex": "a1050000fb070000eb040000ef07000007070000ea02000037000000aa050000cd050000520500006302000022050000660100002a070000dc0500004b050000db070000c607000093070000c607000016010000430700003f080000e605000078030000c8040000",
    "complete": true
  },
  "confidence": "observed",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "Bytes reflect Ghidra's initialized memory, including loader fixups. Reads stop at an unmapped or uninitialized byte and report completeness explicitly."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}