{
  "built_at": "2026-08-24T03:22:55.401Z",
  "path_tokens": {
    "{NXDIR}": "C:\\WinDash-Nonexistent",
    "{NXFILE}": "C:\\WinDash-Nonexistent-in.bin",
    "{NXFILE2}": "C:\\WinDash-Nonexistent-out.bin",
    "{NXGLOB}": "C:\\WinDash-Nonexistent\\*.txt",
    "{NXKEY}": "HKLM\\SOFTWARE\\WinDash-Nonexistent",
    "{NXTASK}": "\\WinDash-Nonexistent-task"
  },
  "prefixes": [
    {
      "token_key": "dash-space-flag",
      "literal": "- ",
      "codepoints": [
        45,
        32
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "division-slash",
      "literal": "∕",
      "codepoints": [
        8725
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "double-hyphen",
      "literal": "--",
      "codepoints": [
        45,
        45
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "em-dash",
      "literal": "—",
      "codepoints": [
        8212
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "en-dash",
      "literal": "–",
      "codepoints": [
        8211
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "figure-dash",
      "literal": "‒",
      "codepoints": [
        8210
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "fraction-slash",
      "literal": "⁄",
      "codepoints": [
        8260
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "fullwidth-hyphen-minus",
      "literal": "－",
      "codepoints": [
        65293
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "fullwidth-solidus",
      "literal": "／",
      "codepoints": [
        65295
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "horizontal-bar",
      "literal": "―",
      "codepoints": [
        8213
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "hyphen-minus",
      "literal": "-",
      "codepoints": [
        45
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "minus-sign",
      "literal": "−",
      "codepoints": [
        8722
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "non-breaking-hyphen",
      "literal": "‑",
      "codepoints": [
        8209
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "small-hyphen-minus",
      "literal": "﹣",
      "codepoints": [
        65123
      ],
      "verdict": "reject",
      "parser_acceptance": "not-accepted"
    },
    {
      "token_key": "solidus",
      "literal": "/",
      "codepoints": [
        47
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    }
  ],
  "terminators": [
    {
      "token_key": "colon-separator",
      "literal": ":",
      "codepoints": [
        58
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "double-quote-terminator",
      "literal": "\"",
      "codepoints": [
        34
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "end-of-string-terminator",
      "literal": "",
      "codepoints": [],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "equals-separator",
      "literal": "=",
      "codepoints": [
        61
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "no-break-space-terminator",
      "literal": " ",
      "codepoints": [
        160
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "space-terminator",
      "literal": " ",
      "codepoints": [
        32
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    },
    {
      "token_key": "tab-terminator",
      "literal": "\t",
      "codepoints": [
        9
      ],
      "verdict": "adopt",
      "parser_acceptance": "accepted"
    }
  ],
  "control_reject_prefix": {
    "token_key": "control-at-sign",
    "literal": "@",
    "codepoints": [
      64
    ]
  },
  "probe": [
    {
      "binary": "certutil.exe",
      "argument": "decode",
      "exe": "C:\\WINDOWS\\system32\\certutil.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "",
      "fixed_post": " {NXFILE} {NXFILE2}",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "certutil -decode of an INPUT file that does not exist cannot write its output file.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "certutil.exe",
      "argument": "decodehex",
      "exe": "C:\\WINDOWS\\system32\\certutil.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "",
      "fixed_post": " {NXFILE} {NXFILE2}",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "certutil -decodehex of an INPUT file that does not exist cannot write its output file.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "certutil.exe",
      "argument": "encode",
      "exe": "C:\\WINDOWS\\system32\\certutil.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "",
      "fixed_post": " {NXFILE} {NXFILE2}",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "certutil -encode of an INPUT file that does not exist cannot write its output file. This pair is also the DASH-canonical control against the slash-canonical built-ins. urlcache/verifyctl/syncwithWU (network) and every certificate-store verb are denied.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "expand.exe",
      "argument": "f",
      "exe": "C:\\WINDOWS\\system32\\expand.exe",
      "takes_value": true,
      "invalid_value": "{NXGLOB}",
      "fixed_pre": "",
      "fixed_post": " {NXFILE} {NXDIR}",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "colon-separator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "expand -F:<files> <cab> <dest> where the CAB does not exist, so nothing is ever extracted or written. THE HIGH-VALUE PAIR: expand -F: is a known colon-separator hole (separators_attested = {:} on this row), and its canonical terminator is the COLON rather than a space, which is why canonical_terminator is set here.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "findstr.exe",
      "argument": "i",
      "exe": "C:\\WINDOWS\\system32\\findstr.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "",
      "fixed_post": " needle {NXFILE}",
      "canonical_prefix": "solidus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "findstr only ever READS, and the target file does not exist, so the parse fails at file-open. No write path, no network, no child process.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "reg.exe",
      "argument": "d",
      "exe": "C:\\WINDOWS\\system32\\reg.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "query {NXKEY} ",
      "fixed_post": " /f WinDash-NoSuchData",
      "canonical_prefix": "solidus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "/d restricts a reg QUERY search to data only. Under QUERY it is read-only -- it is only the reg ADD verb where /d supplies data to write, and every write verb is denied.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "reg.exe",
      "argument": "f",
      "exe": "C:\\WINDOWS\\system32\\reg.exe",
      "takes_value": true,
      "invalid_value": "WinDash-NoSuchData",
      "fixed_pre": "query {NXKEY} ",
      "fixed_post": "",
      "canonical_prefix": "solidus",
      "canonical_terminator": "space-terminator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "/f is the search-data option of reg QUERY. The key does not exist, so nothing is searched and nothing is written.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "reg.exe",
      "argument": "s",
      "exe": "C:\\WINDOWS\\system32\\reg.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "query {NXKEY} ",
      "fixed_post": "",
      "canonical_prefix": "solidus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "recursive QUERY of a key that does not exist; /s is a valid QUERY option and is read-only.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "reg.exe",
      "argument": "t",
      "exe": "C:\\WINDOWS\\system32\\reg.exe",
      "takes_value": true,
      "invalid_value": "REG_WINDASH_NOSUCHTYPE",
      "fixed_pre": "query {NXKEY} ",
      "fixed_post": "",
      "canonical_prefix": "solidus",
      "canonical_terminator": "space-terminator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "/t is the data-type filter of reg QUERY and the value is not a registry type, so the parse fails on the value. Read-only.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "reg.exe",
      "argument": "v",
      "exe": "C:\\WINDOWS\\system32\\reg.exe",
      "takes_value": true,
      "invalid_value": "WinDash-NoSuchValue",
      "fixed_pre": "query {NXKEY} ",
      "fixed_post": "",
      "canonical_prefix": "solidus",
      "canonical_terminator": "space-terminator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "reg QUERY of a key that does not exist. /v is a valid QUERY option. Every reg write verb (add, delete, save, restore, import, load, unload, copy) is denied, so no hive can be touched.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "schtasks.exe",
      "argument": "tn",
      "exe": "C:\\WINDOWS\\system32\\schtasks.exe",
      "takes_value": true,
      "invalid_value": "{NXTASK}",
      "fixed_pre": "/query ",
      "fixed_post": "",
      "canonical_prefix": "solidus",
      "canonical_terminator": "space-terminator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "schtasks /QUERY for a task name that does not exist. /tn is a valid QUERY option. create, run, change, delete and disable are all denied, so no task is registered, started or removed.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "schtasks.exe",
      "argument": "xml",
      "exe": "C:\\WINDOWS\\system32\\schtasks.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "/query ",
      "fixed_post": " /tn {NXTASK}",
      "canonical_prefix": "solidus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "/xml is a valid output form of schtasks /QUERY, and the task queried does not exist. Read-only.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "tar.exe",
      "argument": "x",
      "exe": "C:\\WINDOWS\\system32\\tar.exe",
      "takes_value": false,
      "invalid_value": "",
      "fixed_pre": "",
      "fixed_post": " -f {NXFILE}",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "end-of-string-terminator",
      "terminator_keys": [
        "end-of-string-terminator",
        "colon-separator",
        "equals-separator"
      ],
      "safe_because": "tar -x against an archive that does not exist fails at open, so nothing is extracted. The archive-CREATING flags (-c, -r, -u) are denied. bsdtar also accepts the GNU double-hyphen long form, which makes this pair the natural double-hyphen witness.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    },
    {
      "binary": "tasklist.exe",
      "argument": "m",
      "exe": "C:\\WINDOWS\\system32\\tasklist.exe",
      "takes_value": true,
      "invalid_value": "windash-nosuch.dll",
      "fixed_pre": "",
      "fixed_post": "",
      "canonical_prefix": "hyphen-minus",
      "canonical_terminator": "space-terminator",
      "terminator_keys": [
        "colon-separator",
        "double-quote-terminator",
        "end-of-string-terminator",
        "equals-separator",
        "no-break-space-terminator",
        "space-terminator",
        "tab-terminator"
      ],
      "safe_because": "tasklist /m enumerates loaded modules and is read-only. The module name does not exist, so the result is an empty match. The remote /s form is not allowed here.",
      "grid_tokens": [
        "em-dash",
        "en-dash",
        "horizontal-bar",
        "hyphen-minus",
        "solidus"
      ]
    }
  ],
  "obfuscations": {
    "targets": [
      "findstr.exe|i",
      "reg.exe|v",
      "certutil.exe|encode",
      "expand.exe|f"
    ],
    "forms": [
      {
        "id": "caret_mid",
        "note": "caret between prefix and flag: -^f. cmd.exe consumes the caret, so the binary never sees it; a direct CreateProcess passes it through literally."
      },
      {
        "id": "caret_pre",
        "note": "caret before the prefix: ^-f. Same shell-dependence, different position."
      },
      {
        "id": "quote_flag",
        "note": "quote insertion around the flag: -\"f\". Removed by the CRT argv parser, not by the shell."
      },
      {
        "id": "quote_pre",
        "note": "quote insertion around the prefix: \"-\"f."
      }
    ]
  },
  "shells": [
    "direct",
    "cmd"
  ]
}