{"evidence_id":"ev_9ec17cfca1a869df4352fd6e5db03285c014f0efc2024a30ec924c337c7a22f0","subject":{"name":"chrome_crashpad_handler","digest":{"sha256":"3e9742b8edaef6779c48e0966b9f433db39e59ee148854312b5a5c8612100a04"},"local_path":"/home/runner/work/_temp/extraido/opt/drawio/chrome_crashpad_handler","format":"elf","architecture":"x86_64"},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"analysis_profile":{"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"parameters":{"upstream_analysis_profile":{"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"},"parameters":{"target_kind":"executable","target_format":"elf","architecture":"x86_64","available_architectures":["x86_64"],"import_mode":"ephemeral-source-immutable","annotation_policy":"atomic-function-entry-metadata-v1","load_image_observations":"source-mappings-entry-context-v2","function_body_evidence":"complete-inclusive-ranges-v1","function_references":"complete-body-and-entry-reference-manager-v2","call_relationship_coverage":"function-body-call-coverage-v5","function_dossier_coverage":"observed-facets-and-call-relationships-v1","string_inventory_evidence":"defined-data-coverage-v1","location_resolution":"explicit-address-exact-entry-symbol-first-v3","procedure_file_offset_resolution":"address-first-unique-target-source-mapping-v2","instruction_flow_evidence":"decoded-return-pcode-v1","instruction_references":"exact-address-incoming-v1","function_boundary_observations":"ghidra-function-boundary-limitations-v3","no_return_repair":"returning-imports-decoded-return-v2","process_launch":"inspected-jvm-launch-support-v1","jump_table_evidence":"typed-case-default-blocks-v1","decompiler_jump_loads":true,"loader":"auto-from-header","language_id":"auto-from-header","compiler_spec_id":"auto-default","analyzer_preset":"ghidra-default"},"digest":"9c7f6b24be69294e61da046e4583e3856cb9e40433b149c1bf8bb534d2fe03ef"},"workflow_revision":3},"digest":"254cb0a085f83e1f68619dbf09f01b4f8f067d7ec40c710025202227a4238472"},"predicate_type":"rea.analysis","operation":"binary_overview","parameters":{},"raw_result":null,"normalized_result":{"document":"target-3e9742b8edae.bin","image_base":"0x100000","segments":[{"name":"segment_2.1","start":"0x100000","end":"0x1002e0","length":736,"image_base":"0x100000","address_space":"ram"},{"name":".interp","start":"0x1002e0","end":"0x1002fc","length":28,"image_base":"0x100000","address_space":"ram"},{"name":".note.ABI-tag","start":"0x1002fc","end":"0x10031c","length":32,"image_base":"0x100000","address_space":"ram"},{"name":".note.crashpad.info","start":"0x10031c","end":"0x10033c","length":32,"image_base":"0x100000","address_space":"ram"},{"name":".note.gnu.build-id","start":"0x10033c","end":"0x100360","length":36,"image_base":"0x100000","address_space":"ram"},{"name":".dynsym","start":"0x100360","end":"0x102d30","length":10704,"image_base":"0x100000","address_space":"ram"},{"name":".gnu.version","start":"0x102d30","end":"0x1030ac","length":892,"image_base":"0x100000","address_space":"ram"},{"name":".gnu.version_r","start":"0x1030ac","end":"0x10325c","length":432,"image_base":"0x100000","address_space":"ram"},{"name":".gnu.hash","start":"0x103260","end":"0x103898","length":1592,"image_base":"0x100000","address_space":"ram"},{"name":".dynstr","start":"0x103898","end":"0x105b26","length":8846,"image_base":"0x100000","address_space":"ram"},{"name":".rela.dyn","start":"0x105b28","end":"0x11bd88","length":90720,"image_base":"0x100000","address_space":"ram"},{"name":".rela.plt","start":"0x11bd88","end":"0x11d1e0","length":5208,"image_base":"0x100000","address_space":"ram"},{"name":".rodata","start":"0x11d200","end":"0x13317a","length":89978,"image_base":"0x100000","address_space":"ram"},{"name":".gcc_except_table","start":"0x13317c","end":"0x134458","length":4828,"image_base":"0x100000","address_space":"ram"},{"name":".eh_frame_hdr","start":"0x134458","end":"0x13541c","length":4036,"image_base":"0x100000","address_space":"ram"},{"name":".eh_frame","start":"0x135420","end":"0x13a764","length":21316,"image_base":"0x100000","address_space":"ram"},{"name":".text","start":"0x13b780","end":"0x2b4ec2","length":1546050,"image_base":"0x100000","address_space":"ram"},{"name":".init","start":"0x2b4ec4","end":"0x2b4edb","length":23,"image_base":"0x100000","address_space":"ram"},{"name":".fini","start":"0x2b4edc","end":"0x2b4ee5","length":9,"image_base":"0x100000","address_space":"ram"},{"name":"malloc_hook","start":"0x2b4ef0","end":"0x2b5052","length":354,"image_base":"0x100000","address_space":"ram"},{"name":".plt","start":"0x2b5060","end":"0x2b5e00","length":3488,"image_base":"0x100000","address_space":"ram"},{"name":".tdata","start":"0x2b6e00","end":"0x2b6ea0","length":160,"image_base":"0x100000","address_space":"ram"},{"name":".fini_array","start":"0x2b6ea0","end":"0x2b6ea8","length":8,"image_base":"0x100000","address_space":"ram"},{"name":".init_array","start":"0x2b6ea8","end":"0x2b6eb8","length":16,"image_base":"0x100000","address_space":"ram"},{"name":".data.rel.ro","start":"0x2b6ec0","end":"0x2c4478","length":54712,"image_base":"0x100000","address_space":"ram"},{"name":".dynamic","start":"0x2c4478","end":"0x2c4688","length":528,"image_base":"0x100000","address_space":"ram"},{"name":".got","start":"0x2c4688","end":"0x2c4798","length":272,"image_base":"0x100000","address_space":"ram"},{"name":".got.plt","start":"0x2c4798","end":"0x2c4e78","length":1760,"image_base":"0x100000","address_space":"ram"},{"name":".relro_padding","start":"0x2c4e78","end":"0x2c5000","length":392,"image_base":"0x100000","address_space":"ram"},{"name":".data","start":"0x2c6000","end":"0x2d6a80","length":68224,"image_base":"0x100000","address_space":"ram"},{"name":".bss","start":"0x2d7000","end":"0x2e76c0","length":67264,"image_base":"0x100000","address_space":"ram"},{"name":"EXTERNAL","start":"0x2e8000","end":"0x2e8740","length":1856,"image_base":"0x100000","address_space":"ram"},{"name":".comment","start":".comment:0x0","end":".comment:0x139","length":313,"image_base":"0x100000","address_space":".comment"},{"name":".gnu_debuglink","start":".gnu_debuglink:0x0","end":".gnu_debuglink:0x24","length":36,"image_base":"0x100000","address_space":".gnu_debuglink"},{"name":".shstrtab","start":".shstrtab:0x0","end":".shstrtab:0x16d","length":365,"image_base":"0x100000","address_space":".shstrtab"},{"name":"_elfSectionHeaders","start":"_elfSectionHeaders:0x0","end":"_elfSectionHeaders:0x900","length":2304,"image_base":"0x100000","address_space":"_elfSectionHeaders"}],"segment_count":36,"procedure_count":5802,"string_count":2184},"confidence":"derived","authority":"shipped-artifact","environment":null,"limitations":["Derived by an REA composed workflow.","A headless Ghidra session contains exactly one imported Program, unlike Hopper's multi-document GUI session.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Charset is reported, while a non-missing terminator cannot distinguish a present terminator from a fixed or Pascal layout.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","External functions and local thunks are distinct; procedure metadata identifies both and preserves a thunk target when Ghidra resolves one.","Memory-block end addresses are exclusive; permissions come from Ghidra MemoryBlock flags rather than inference from section names.","Only Ghidra-defined string Data is observed; packed or undefined string bytes may be absent. Completeness applies to that inventory, and an empty search does not establish that text is absent from the artifact. If an address is known, use read_bytes and xrefs to inspect bytes and references.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results."],"relationship_coverage":null,"locations":[],"evidence_links":[]}