{ "evidence_id": "ev_555ce57c7e3313e7750409a627e7ac50b2fe4a73133937721bbda4b0a0106902", "subject": { "name": "ledger-x86_64-O1.o", "digest": { "sha256": "9a4a8082ba5e285a732552981a6935e0c5255725664f380e37c44ebfb04d803f" }, "local_path": "$CAPTURE/fixtures/ledger-x86_64-O1.o", "format": "elf", "architecture": "x86_64" }, "provider": { "id": "ghidra", "name": "Ghidra", "version": "12.1.4" }, "analysis_profile": { "provider": { "id": "ghidra", "name": "Ghidra", "version": "12.1.4" }, "parameters": { "target_kind": "executable", "target_format": "elf", "architecture": "x86_64", "available_architectures": [ "x86_64" ], "import_mode": "ephemeral-source-immutable", "annotation_policy": "atomic-function-entry-metadata-v1", "load_image_observations": "source-mappings-entry-context-v2", "function_body_evidence": "complete-inclusive-ranges-v1", "function_references": "complete-body-and-entry-reference-manager-v2", "call_relationship_coverage": "function-body-call-coverage-v5", "function_dossier_coverage": "observed-facets-and-call-relationships-v1", "string_inventory_evidence": "defined-data-coverage-v1", "location_resolution": "explicit-address-exact-entry-symbol-first-v3", "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2", "instruction_flow_evidence": "decoded-return-pcode-v1", "instruction_references": "exact-address-incoming-without-synthetic-entry-v2", "function_boundary_observations": "ghidra-function-boundary-limitations-v4", "no_return_repair": "returning-imports-decoded-return-v2", "process_launch": "inspected-jvm-launch-support-v1", "jump_table_evidence": "typed-case-default-blocks-v1", "decompiler_jump_loads": true, "loader": "auto-from-header", "language_id": "auto-from-header", "compiler_spec_id": "auto-default", "analyzer_preset": "ghidra-default" }, "digest": "769518a8e9b57f953dd241adbb63672f0f486bb3d66359b9deef7c5e088ca7aa" }, "predicate_type": "rea.analysis", "operation": "procedure_pseudo_code", "parameters": { "procedure": "grade" }, "raw_result": { "value": "\nuint grade(int param_1)\n\n{\n uint uVar1;\n uint uVar2;\n \n uVar2 = param_1 / 10 - 6;\n uVar1 = -(param_1 >> 0x1f) ^ (uint)((ulong)((long)param_1 * 0x66666667) >> 0x3f);\n if (uVar2 < 5) {\n uVar1 = *(uint *)(&DAT_001000b4 + (ulong)uVar2 * 4);\n }\n return uVar1;\n}\n\n", "limitations": [] }, "normalized_result": "\nuint grade(int param_1)\n\n{\n uint uVar1;\n uint uVar2;\n \n uVar2 = param_1 / 10 - 6;\n uVar1 = -(param_1 >> 0x1f) ^ (uint)((ulong)((long)param_1 * 0x66666667) >> 0x3f);\n if (uVar2 < 5) {\n uVar1 = *(uint *)(&DAT_001000b4 + (ulong)uVar2 * 4);\n }\n return uVar1;\n}\n\n", "confidence": "observed", "authority": "shipped-artifact", "environment": null, "limitations": [ "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.", "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.", "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.", "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use :0x.", "Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.", "External functions and functions without an analyzable body return null; other decompiler failures remain explicit.", "macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state." ], "relationship_coverage": null, "locations": [], "evidence_links": [] }