{
  "evidence_id": "ev_6be1ee3c9c838677def32de9195e8937f9aef3e370b5f41af09f21c88720f72c",
  "subject": {
    "name": "ledger-x86_64-O1.o",
    "digest": {
      "sha256": "9a4a8082ba5e285a732552981a6935e0c5255725664f380e37c44ebfb04d803f"
    },
    "local_path": "$CAPTURE/fixtures/ledger-x86_64-O1.o",
    "format": "elf",
    "architecture": "x86_64"
  },
  "provider": {
    "id": "rea-workflow",
    "name": "REA composed investigation workflow",
    "version": "1"
  },
  "analysis_profile": {
    "provider": {
      "id": "rea-workflow",
      "name": "REA composed investigation workflow",
      "version": "1"
    },
    "parameters": {
      "upstream_analysis_profile": {
        "provider": {
          "id": "ghidra",
          "name": "Ghidra",
          "version": "12.1.4"
        },
        "parameters": {
          "target_kind": "executable",
          "target_format": "elf",
          "architecture": "x86_64",
          "available_architectures": [
            "x86_64"
          ],
          "import_mode": "ephemeral-source-immutable",
          "annotation_policy": "atomic-function-entry-metadata-v1",
          "load_image_observations": "source-mappings-entry-context-v2",
          "function_body_evidence": "complete-inclusive-ranges-v1",
          "function_references": "complete-body-and-entry-reference-manager-v2",
          "call_relationship_coverage": "function-body-call-coverage-v5",
          "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
          "string_inventory_evidence": "defined-data-coverage-v1",
          "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
          "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
          "instruction_flow_evidence": "decoded-return-pcode-v1",
          "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
          "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
          "no_return_repair": "returning-imports-decoded-return-v2",
          "process_launch": "inspected-jvm-launch-support-v1",
          "jump_table_evidence": "typed-case-default-blocks-v1",
          "decompiler_jump_loads": true,
          "loader": "auto-from-header",
          "language_id": "auto-from-header",
          "compiler_spec_id": "auto-default",
          "analyzer_preset": "ghidra-default"
        },
        "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa"
      },
      "source_limitations": "provider-operation-caveats-v1",
      "workflow_revision": 4
    },
    "digest": "8df2cbc944b295f6450179ed68f12860b8f004213764ef4d971a9b8622d65d45"
  },
  "predicate_type": "rea.analysis",
  "operation": "binary_overview",
  "parameters": {},
  "raw_result": null,
  "normalized_result": {
    "document": "target-9a4a8082ba5e.o",
    "image_base": "0x100000",
    "segments": [
      {
        "name": ".text",
        "start": "0x100000",
        "end": "0x10009f",
        "length": 159,
        "image_base": "0x100000",
        "address_space": "ram"
      },
      {
        "name": ".rodata",
        "start": "0x1000a0",
        "end": "0x1000f0",
        "length": 80,
        "image_base": "0x100000",
        "address_space": "ram"
      },
      {
        "name": ".rodata.str1.1",
        "start": "0x1000f0",
        "end": "0x1000fa",
        "length": 10,
        "image_base": "0x100000",
        "address_space": "ram"
      },
      {
        "name": ".comment",
        "start": ".comment:0x0",
        "end": ".comment:0x2f",
        "length": 47,
        "image_base": "0x100000",
        "address_space": ".comment"
      },
      {
        "name": ".rela.rodata",
        "start": ".rela.rodata:0x0",
        "end": ".rela.rodata:0x78",
        "length": 120,
        "image_base": "0x100000",
        "address_space": ".rela.rodata"
      },
      {
        "name": ".rela.text",
        "start": ".rela.text:0x0",
        "end": ".rela.text:0x48",
        "length": 72,
        "image_base": "0x100000",
        "address_space": ".rela.text"
      },
      {
        "name": ".strtab",
        "start": ".strtab:0x0",
        "end": ".strtab:0xbe",
        "length": 190,
        "image_base": "0x100000",
        "address_space": ".strtab"
      },
      {
        "name": ".symtab",
        "start": ".symtab:0x0",
        "end": ".symtab:0x138",
        "length": 312,
        "image_base": "0x100000",
        "address_space": ".symtab"
      },
      {
        "name": "_elfHeader",
        "start": "_elfHeader:0x0",
        "end": "_elfHeader:0x40",
        "length": 64,
        "image_base": "0x100000",
        "address_space": "_elfHeader"
      },
      {
        "name": "_elfSectionHeaders",
        "start": "_elfSectionHeaders:0x0",
        "end": "_elfSectionHeaders:0x2c0",
        "length": 704,
        "image_base": "0x100000",
        "address_space": "_elfSectionHeaders"
      }
    ],
    "segment_count": 10,
    "procedure_count": 4,
    "string_count": 20
  },
  "confidence": "derived",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "Derived by an REA composed workflow.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: Counts use the complete defined-string inventory and the same local/external function inventory as list_strings and list_procedures. They do not establish discovery of undefined strings or unidentified functions.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: Memory-block end addresses are exclusive; segment lengths use those observed address coordinates.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "Ghidra (ghidra 12.1.4) read_binary_inventory_summary: macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}