{"artifacts":[{"architecture":"arm64","digest":{"sha256":"958d2ae106a023febe244397402cdc3f1977cbc529811335fca15b93ed569a10"},"format":"mach-o"}],"captures":[],"environments":[],"providers":[{"id":"ghidra","name":"Ghidra","version":"12.1.4"},{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}],"records":[{"analysis_profile":{"digest":"20565088524a2d0359b9b96f46ac48e679d774c7b0092c56abc06de8fdbec11c","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-terminal-call-limitations-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"authority":"shipped-artifact","confidence":"observed","environment":null,"evidence_id":"ev_bf25a1cd9c181e8f034fdee81259118798ae67e640ade71238f4afb707eab142","evidence_links":[],"limitations":["The session serves operations only after Ghidra reports default auto-analysis complete; incomplete analysis does not expose partial results.","The imported Program and temporary project are ephemeral and deleted on close. Annotation operations edit session database metadata; original executable bytes are never written.","Cancelling an active Ghidra request terminates its ephemeral database and discards session annotations. The selected target remains open; the next provider query imports the original artifact again.","Default-space addresses use lowercase 0x-prefixed hexadecimal; other address spaces use <percent-encoded-space>:0x<hex>.","Regex mode uses Java Pattern semantics. Matcher or compiler stack exhaustion returns a resource constraint without closing the session; literal mode avoids regex recursion and returns complete matching values.","macOS sessions require a matching executable Ghidra native decompiler; REA checks for it but does not build native components or change Gatekeeper quarantine state."],"locations":[],"normalized_result":[{"address":"0x100000c24","value":"AppDelegate::applicationDidFinishLaunching:"},{"address":"0x100000c28","value":"AppDelegate::mss_configureLaunchArtworkWindow"},{"address":"0x100000eb4","value":"AppDelegate::mss_pixelSizeForImage:"},{"address":"0x10000100c","value":"AppDelegate::mss_backingScaleFactorForScreen:"},{"address":"0x10000104c","value":"AppDelegate::mss_fittedSizeForSize:onScreen:"},{"address":"0x1000010e4","value":"AppDelegate::window"},{"address":"0x1000010ec","value":"AppDelegate::setWindow:"}],"operation":"search_procedures","parameters":{"case_sensitive":false,"mode":"regex","pattern":"(AppDelegate|ViewController|WindowController)"},"predicate_type":"rea.analysis","provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"},"raw_result":[{"address":"0x100000c24","value":"AppDelegate::applicationDidFinishLaunching:"},{"address":"0x100000c28","value":"AppDelegate::mss_configureLaunchArtworkWindow"},{"address":"0x100000eb4","value":"AppDelegate::mss_pixelSizeForImage:"},{"address":"0x10000100c","value":"AppDelegate::mss_backingScaleFactorForScreen:"},{"address":"0x10000104c","value":"AppDelegate::mss_fittedSizeForSize:onScreen:"},{"address":"0x1000010e4","value":"AppDelegate::window"},{"address":"0x1000010ec","value":"AppDelegate::setWindow:"}],"subject":{"architecture":"arm64","digest":{"sha256":"958d2ae106a023febe244397402cdc3f1977cbc529811335fca15b93ed569a10"},"format":"mach-o","local_path":"/private/tmp/paintfcp-rea.b3j9Te/MSE18V2-host-arm64","name":"MSE18V2-host-arm64"}},{"analysis_profile":{"digest":"575a577ce88c350b8ef1d4768986d124a16377363cbf22c68a4f73cc917881d4","parameters":{"upstream_analysis_profile":{"digest":"20565088524a2d0359b9b96f46ac48e679d774c7b0092c56abc06de8fdbec11c","parameters":{"analyzer_preset":"ghidra-default","annotation_policy":"atomic-function-entry-metadata-v1","architecture":"arm64","available_architectures":["arm64"],"compiler_spec_id":"auto-default","decompiler_jump_loads":true,"function_body_evidence":"complete-inclusive-ranges-v1","function_boundary_observations":"ghidra-terminal-call-limitations-v1","function_references":"complete-body-and-entry-reference-manager-v2","import_mode":"ephemeral-source-immutable","instruction_flow_evidence":"decoded-return-pcode-v1","jump_table_evidence":"typed-case-default-blocks-v1","language_id":"auto-from-header","load_image_observations":"source-mappings-entry-context-v2","loader":"auto-from-header","location_resolution":"explicit-address-exact-entry-symbol-first-v3","no_return_repair":"returning-imports-decoded-return-v2","process_launch":"inspected-jvm-launch-support-v1","string_inventory_evidence":"defined-data-coverage-v1","target_format":"mach-o","target_kind":"executable"},"provider":{"id":"ghidra","name":"Ghidra","version":"12.1.4"}},"workflow_revision":2},"provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"}},"authority":"shipped-artifact","confidence":"derived","environment":null,"evidence_id":"ev_e57649ee7791e0ee7f491c2659e8aece223aca06c5a95f45406c5e27e5b0974b","evidence_links":[],"limitations":["Derived by an REA composed workflow."],"locations":[{"address":"0x100000c24","kind":"address"},{"address":"0x100000c28","kind":"address"}],"normalized_result":{"failed":0,"items":[{"address":"0x100000c24","procedure":{"address":"0x100000c24","name":"AppDelegate::applicationDidFinishLaunching:","status":"resolved"},"pseudocode":"\n/* Function Stack Size: 0x18 bytes */\n\nID __objc_msgSend_stub AppDelegate::applicationDidFinishLaunching_(ID self,...)\n\n{\n  ID IVar1;\n  \n  IVar1 = (*(code *)PTR__objc_msgSend_100004008)(self,\"mss_configureLaunchArtworkWindow\");\n  return IVar1;\n}\n\n","status":"ok"},{"address":"0x100000c28","procedure":{"address":"0x100000c28","name":"AppDelegate::mss_configureLaunchArtworkWindow","status":"resolved"},"pseudocode":"\n/* Function Stack Size: 0x10 bytes */\n\nvoid AppDelegate::mss_configureLaunchArtworkWindow(ID param_1,SEL param_2)\n\n{\n  ID IVar1;\n  ID IVar2;\n  double extraout_d0;\n  double dVar3;\n  undefined8 extraout_d0_00;\n  undefined8 uVar5;\n  CGSize CVar6;\n  CGSize CVar7;\n  double dVar4;\n  \n  IVar1 = window(param_1);\n  if (IVar1 == 0) {\n    return;\n  }\n  IVar1 = NSImage::imageNamed_((ID)&_OBJC_CLASS___NSImage,&cf_cNz_ofV);\n  if (IVar1 == 0) {\n    IVar1 = NSBundle::mainBundle((ID)&_OBJC_CLASS___NSBundle);\n    IVar1 = NSBundle::pathForResource_ofType_(IVar1,&cf_cNz_ofV,&cf_png);\n    IVar2 = NSBundle::length(IVar1);\n    if (IVar2 == 0) {\n      return;\n    }\n    IVar2 = _objc_alloc(&_OBJC_CLASS___NSImage);\n    IVar1 = NSImage::initWithContentsOfFile_(IVar2,IVar1);\n    if (IVar1 == 0) {\n      return;\n    }\n  }\n  CVar6 = mss_pixelSizeForImage_(param_1,IVar1);\n  dVar3 = CVar6.field1_0x8;\n  if ((CVar6.field0_0x0 <= 0.0) || (dVar3 <= 0.0)) {\n    NSImage::size(IVar1);\n    CVar6.field1_0x8 = dVar3;\n    CVar6.field0_0x0 = extraout_d0;\n  }\n  if ((0.0 < CVar6.field0_0x0) && (0.0 < CVar6.field1_0x8)) {\n    IVar2 = window(param_1);\n    IVar2 = objc_stub::screen(IVar2);\n    if ((IVar2 == 0) && (IVar2 = NSScreen::mainScreen((ID)&_OBJC_CLASS___NSScreen), IVar2 == 0)) {\n      IVar2 = NSScreen::screens((ID)&_OBJC_CLASS___NSScreen);\n      IVar2 = NSScreen::firstObject(IVar2);\n    }\n    dVar3 = mss_backingScaleFactorForScreen_(param_1,IVar2);\n    CVar7.field1_0x8 = CVar6.field1_0x8 / dVar3;\n    CVar7.field0_0x0 = CVar6.field0_0x0 / dVar3;\n    CVar6 = mss_fittedSizeForSize_onScreen_(param_1,CVar7,IVar2);\n    dVar4 = CVar6.field1_0x8;\n    dVar3 = CVar6.field0_0x0;\n    IVar2 = _objc_alloc(&_OBJC_CLASS___NSImageView);\n    IVar2 = NSImageView::initWithFrame_(IVar2,0,0,dVar3,dVar4);\n    NSImageView::setImage_(IVar2,IVar1);\n    NSImageView::setImageScaling_(IVar2,3);\n    NSImageView::setImageAlignment_(IVar2,0);\n    IVar1 = window(param_1);\n    objc_stub::setContentView_(IVar1,IVar2);\n    IVar1 = window(param_1);\n    objc_stub::setTitle_(IVar1,&cf_MSE18V2);\n    IVar1 = window(param_1);\n    objc_stub::setContentAspectRatio_(IVar1,dVar3,dVar4);\n    IVar1 = window(param_1);\n    objc_stub::setContentMinSize_(IVar1,dVar3,dVar4);\n    IVar1 = window(param_1);\n    objc_stub::setContentMaxSize_(IVar1,dVar3,dVar4);\n    IVar1 = window(param_1);\n    IVar2 = objc_stub::styleMask(IVar1);\n    objc_stub::setStyleMask_(IVar1,IVar2 & 0xfffffffffffffff7);\n    IVar1 = window(param_1);\n    uVar5 = 0;\n    objc_stub::frameRectForContentRect_(IVar1,0,0,dVar3,dVar4);\n    IVar1 = window(param_1);\n    objc_stub::setFrame_display_(IVar1,extraout_d0_00,uVar5,CVar6.field0_0x0,CVar6.field1_0x8,1);\n    IVar1 = window(param_1);\n    objc_stub::center(IVar1);\n    IVar1 = window(param_1);\n    objc_stub::makeKeyAndOrderFront_(IVar1,0);\n    objc_stub::activateIgnoringOtherApps_(*(ID *)PTR__NSApp_100004020,1);\n    return;\n  }\n  return;\n}\n\n","status":"ok"}],"succeeded":2,"total":2},"operation":"batch_decompile","parameters":{"addresses":["0x100000c24","0x100000c28"]},"predicate_type":"rea.analysis","provider":{"id":"rea-workflow","name":"REA composed investigation workflow","version":"1"},"raw_result":null,"subject":{"architecture":"arm64","digest":{"sha256":"958d2ae106a023febe244397402cdc3f1977cbc529811335fca15b93ed569a10"},"format":"mach-o","local_path":"/private/tmp/paintfcp-rea.b3j9Te/MSE18V2-host-arm64","name":"MSE18V2-host-arm64"}}],"scenarios":[],"unknowns":[]}