{
  "evidence_id": "ev_9e80f1b6ce426ccc5010abc77a53cbdf57a2e8c5adc93bb4d6011115e5b6ee9f",
  "subject": {
    "name": "ledger-arm64-O1",
    "digest": {
      "sha256": "01b5d08b08fb94678be5919d0e753d44b505a53107c95b94634f0e5d41c9e375"
    },
    "local_path": "$CAPTURE/fixtures/ledger-arm64-O1",
    "format": "mach-o",
    "architecture": "arm64"
  },
  "provider": {
    "id": "ghidra",
    "name": "Ghidra",
    "version": "12.1.4"
  },
  "analysis_profile": {
    "provider": {
      "id": "ghidra",
      "name": "Ghidra",
      "version": "12.1.4"
    },
    "parameters": {
      "target_kind": "executable",
      "target_format": "mach-o",
      "architecture": "arm64",
      "available_architectures": [
        "arm64"
      ],
      "import_mode": "ephemeral-source-immutable",
      "annotation_policy": "atomic-function-entry-metadata-v1",
      "load_image_observations": "source-mappings-entry-context-v2",
      "function_body_evidence": "complete-inclusive-ranges-v1",
      "function_references": "complete-body-and-entry-reference-manager-v2",
      "call_relationship_coverage": "function-body-call-coverage-v5",
      "function_dossier_coverage": "observed-facets-and-call-relationships-v1",
      "string_inventory_evidence": "defined-data-coverage-v1",
      "location_resolution": "explicit-address-exact-entry-symbol-first-v3",
      "procedure_file_offset_resolution": "address-first-unique-target-source-mapping-v2",
      "instruction_flow_evidence": "decoded-return-pcode-v1",
      "instruction_references": "exact-address-incoming-without-synthetic-entry-v2",
      "function_boundary_observations": "ghidra-function-boundary-limitations-v4",
      "no_return_repair": "returning-imports-decoded-return-v2",
      "process_launch": "inspected-jvm-launch-support-v1",
      "jump_table_evidence": "typed-case-default-blocks-v1",
      "decompiler_jump_loads": true,
      "loader": "auto-from-header",
      "language_id": "auto-from-header",
      "compiler_spec_id": "auto-default",
      "analyzer_preset": "ghidra-default"
    },
    "digest": "3fc72c9b4b78498fb992b938f8f3389dc670244a293c1d40abf5e1d10162ed3b"
  },
  "predicate_type": "rea.analysis",
  "operation": "procedure_pseudo_code",
  "parameters": {
    "procedure": "_total"
  },
  "raw_result": {
    "value": "\nint _total(int *param_1,uint param_2)\n\n{\n  int iVar1;\n  ulong uVar2;\n  \n  if (0 < (int)param_2) {\n    iVar1 = 0;\n    uVar2 = (ulong)param_2;\n    do {\n      iVar1 = *param_1 + iVar1;\n      uVar2 = uVar2 - 1;\n      param_1 = param_1 + 1;\n    } while (uVar2 != 0);\n    return iVar1;\n  }\n  return 0;\n}\n\n",
    "limitations": []
  },
  "normalized_result": "\nint _total(int *param_1,uint param_2)\n\n{\n  int iVar1;\n  ulong uVar2;\n  \n  if (0 < (int)param_2) {\n    iVar1 = 0;\n    uVar2 = (ulong)param_2;\n    do {\n      iVar1 = *param_1 + iVar1;\n      uVar2 = uVar2 - 1;\n      param_1 = param_1 + 1;\n    } while (uVar2 != 0);\n    return iVar1;\n  }\n  return 0;\n}\n\n",
  "confidence": "observed",
  "authority": "shipped-artifact",
  "environment": null,
  "limitations": [
    "The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.",
    "The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.",
    "Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.",
    "Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.",
    "Pseudocode is Ghidra decompiler output, not original source and not text-equivalent to Hopper output.",
    "External functions and functions without an analyzable body return null; other decompiler failures remain explicit.",
    "macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."
  ],
  "relationship_coverage": null,
  "locations": [],
  "evidence_links": []
}