OFRAK PRO LICENSE AGREEMENT Version 1.0 Effective: July 22, 2024 RED BALLOON SECURITY, INC., A DELAWARE CORPORATION, WITH AN ADDRESS AT 639 11TH AVENUE, 4TH FLOOR, NEW YORK, NY 10036, USA ("RED BALLOON") LICENSES OFRAK AND RELATED DOCUMENTATION PURSUANT TO THE OFRAK PRO LICENSE AGREEMENT (COLLECTIVELY WITH THE REGISTRATION FORM, THIS "AGREEMENT"). READ THIS AGREEMENT CAREFULLY BEFORE ACCESSING, INSTALLING, COPYING AND USING OFRAK UNDER THE OFRAK PRO AGREEMENT. BY TYPING "I AGREE" ON THE REGISTRATION FORM, OR OTHERWISE ACCESSING, INSTALLING, COPYING OR OTHERWISE USING OFRAK, YOU ("LICENSEE") AGREE THAT THE REGISTRATION FORM SHALL BE DEEMED TO BE MUTUALLY EXECUTED AND THE REGISTRATION FORM SHALL BE INCORPORATED INTO AND BECOME A MATERIAL PART OF THE OFRAK PRO LICENSE AGREEMENT BETWEEN LICENSEE AND RED BALLOON LOCATED AT https://ofrak.com/docs/license.html. YOU REPRESENT THAT YOU ARE AUTHORIZED TO ACCEPT THIS AGREEMENT ON BEHALF OF LICENSEE. IF LICENSEE DOES NOT AGREE TO THE FOREGOING TERMS AND CONDITIONS, DO NOT TYPE "I AGREE", OR OTHERWISE ACCESS, INSTALL, COPY OR USE OFRAK. 1. Definitions. 1.1 "OFRAK" consists of (a) the source code repository for OFRAK, which can be found at https://github.com/red-balloon-security/ofrak; (b) the following Python packages, which are also available via PyPI, the Python Package Index: ofrak, ofrak_components, ofrak_io, ofrak_type, ofrak_patch_maker, ofrak_angr, ofrak_binary_ninja, ofrak_ghidra; (c) the OFRAK graphical user interface (GUI); and (d) OFRAK documentation. OFRAK includes all updates, improvements, APIs and add-ons provided by Red Balloon with respect thereto that Red Balloon makes available to Licensee under this OFRAK Pro Agreement. OFRAK is presently made available in three formats: (i) source code repository, (ii) PyPI Packages and (iii) Docker images with dependencies preinstalled. 1.2 "Academic Purposes" means use within a non-profit academic institution by its then-current faculty and students for the purposes of non-profit scholarly research, classroom and education, and not any other use (including without limitation, directly or indirectly in connection with any commercial activity such as, for example, sponsored research or consulting services). 1.3 "Authorized User(s)" means any user(s) named in the license file. 1.4 "Commercial Use" means any use other than Academic Purposes or Limited Commercial Use, and any use other than by an Authorized User, including without limitation redistributing the OFRAK code (including Derivatives), OFRAK analysis, OFRAK-modified binaries, or other OFRAK outputs for use outside of a consulting engagement of Licensee or volume redistribution of any OFRAK-modified binaries. 1.5 "Derivatives" means any modifications, additions, enhancements, or derivative works of OFRAK or any component thereof. For purposes of this OFRAK Pro Agreement, Derivatives shall not include works that remain separable from, or merely link to, the interfaces of OFRAK or any Derivatives. 1.6 "Limited Commercial Use" means internal business use by any Authorized User of OFRAK during the term specified in the license file (the "Term"), which includes use of OFRAK in exchange for monetary and other consideration (such as security research purposes) and redistribution of (i) OFRAK analysis, (ii) other OFRAK outputs, and (iii) OFRAK-modified binaries to an end-user for such end user’s internal use, in each case in connection with consulting engagements entered into between Licensee and such end user. For clarity, neither Licensee nor the end user shall have the right to further redistribute OFRAK-modified binaries outside of such end-user. 2. License. Subject to the terms and conditions of this OFRAK Pro Agreement, Red Balloon grants to Licensee a nonexclusive, nonsublicensable, nontransferable, royalty-free, limited license during the term specified in the license file ("Term") to install, use, copy, modify and create Derivatives of OFRAK only by Authorized Users (a) for Academic Purposes, (b) for Limited Commercial Use and (c) to share Derivatives (i) publicly within the community (via publicly available forks on GitHub.com), (ii) for an Academic Purpose, and (iii) with Red Balloon, for the purposes stated in this OFRAK Pro Agreement. For clarity, the foregoing license does not grant to Licensee any other right or license to commercialize, distribute or use OFRAK for any other purpose whatsoever, including Commercial Use. In the event that Licensee wishes to use OFRAK for any other purpose, including Commercial Use, Licensee needs to contact Red Balloon and enter into a separate OFRAK Enterprise License or other custom agreement. Except for the limited rights and licenses expressly granted hereunder, no other license is granted, no other use is permitted. 3. Derivatives. To the extent that Licensee prepares or creates any Derivatives, Licensee shall and hereby grant to (a) all users of OFRAK a right and license to such Derivatives upon the terms and conditions set forth in the OFRAK Community License, located at https://ofrak.com/docs/license.html and (b) Red Balloon a perpetual, fully paid-up, royalty-free, worldwide and irrevocable, right and license to use, copy, modify, enhance, prepare derivative works of, distribute, with unlimited right to sublicense, make, have made, sell, have sold, import, export and otherwise commercialize such Derivatives. Licensee acknowledges that Red Balloon may, but is not obligated to, include Licensee’s Derivatives in, and otherwise incorporate Licensee’s Derivatives into, the core OFRAK codebase. In the event that Licensee creates Derivatives, Licensee must (i) retain all copyright and other proprietary rights licenses included in the original OFRAK code, and any other Derivatives, and (ii) make it clear that Licensee modified the original version of OFRAK. Red Balloon encourages Licensee to make Licensee’s Derivatives available to the community by forking the OFRAK source code repository on GitHub and publishing Licensee’s Derivatives on Licensee’s forked repository, but Licensee is not required to do so. Licensee represents and warrants that Licensee has sufficient rights to any Derivatives and is legally entitled to grant the above rights and licenses. 4. Ownership; Restrictions. Except as expressly and unambiguously set forth herein, Red Balloon and its licensors and contributors retain all right, title and interest in and to OFRAK, Derivatives prepared or created by Red Balloon, all copies, modifications and derivative works thereof, including without limitation, all rights to patent, copyright, trade secret and other proprietary or intellectual property rights related to any of the foregoing. To the extent that Licensee creates any Derivatives, subject to the rights and licenses granted herein, Licensee retains ownership of all right, title and interest in and to such Derivatives prepared or created by Licensee, including without limitation, all intellectual property rights related to any of the foregoing. Licensee will maintain the copyright notice and any other notices or identifications that appear on or in OFRAK and any Derivatives or any other media or documentation that is subject to this OFRAK Pro Agreement. Licensee will not (and will not allow any third party to): (a) use OFRAK or any Derivatives, except as expressly permitted in this OFRAK Pro Agreement, (b) provide, lease, lend, disclose, use for timesharing or service bureau purposes, or otherwise use or allow others to use for the benefit of any third party, OFRAK, (c) possess or use OFRAK, or allow the transfer, transmission, export, or re-export of OFRAK or portion thereof in violation of any export control laws or regulations administered by the U.S. Commerce Department, U.S. Treasury Department’s Office of Foreign Assets Control, or any other government agency, (d) use OFRAK in any way that violates any applicable law, rule or regulation or for any illegal use or activity, or (e) seek any patent or other intellectual property rights or protections over or in connection with OFRAK or any Derivatives that Licensee prepares or creates. 5. Feedback. In addition to Derivatives prepared or created by Licensee, Licensee may, from time to time and in Licensee’s sole discretion, make suggestions for changes, modifications or improvements to OFRAK ("Feedback"). Red Balloon shall have an irrevocable, perpetual, worldwide, sublicenseable, transferable, full paid-up, royalty free right and license to use, distribute and otherwise exploit all Feedback for any purpose. 6. Fees. Licensee agrees to pay Red Balloon all fees and other charges in the amounts and at the times specified by Red Balloon in writing (without deduction, set-off, or counterclaim). 7. Services. No training or support services are provided under this OFRAK Pro Agreement. Red Balloon may in its discretion respond to support inquiries through Red Balloon’s support channels, such as Slack. 8. Term and Termination. This OFRAK Pro Agreement shall commence upon the date of license issue set forth in the license file and shall continue for the Term unless terminated as set forth herein. This OFRAK Pro Agreement may be terminated by Red Balloon immediately upon notice to Licensee in the event that Licensee breaches any term or condition of this OFRAK Pro Agreement. Upon expiration or any termination, Licensee shall immediately cease all use of OFRAK. This sentence and the following provisions will survive termination: 1, 3 - 5 and 9 - 12. Termination is not an exclusive remedy and all other remedies will remain available. 9. Warranty Disclaimer. The parties acknowledge that OFRAK is provided "AS IS" and may not be functional on any machine or in any environment. NEITHER RED BALLOON NOR ANY CONTRIBUTOR OF ANY DERIVATIVES MAKE ANY WARRANTIES, EXPRESS OR IMPLIED, EITHER IN FACT OR BY OPERATION OF LAW, STATUTORY OR OTHERWISE, AND RED BALLOON AND ANY CONTRIBUTOR OF ANY DERIVATIVES EXPRESSLY EXCLUDES AND DISCLAIMS ANY WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, ACCURACY, FREEDOM FROM ERRORS, FREEDOM FROM PROGRAMMING DEFECTS, NONINTERFERENCE AND NONINFRINGEMENT, AND ALL IMPLIED WARRANTIES ARISING OUT OF COURSE OF DEALING, COURSE OF PERFORMANCE AND USAGE OF TRADE. THIS OFRAK PRO AGREEMENT IS NOT INTENDED FOR USE OF OFRAK IN HAZARDOUS ENVIRONMENTS REQUIRING FAIL-SAFE PERFORMANCE WHERE THE FAILURE OF OFRAK COULD LEAD DIRECTLY TO DEATH, PERSONAL INJURY, OR SIGNIFICANT PHYSICAL OR ENVIRONMENTAL DAMAGE ("HIGH RISK ACTIVITIES"). USE OF OFRAK IN HIGH RISK ACTIVITIES IS NOT AUTHORIZED PURSUANT TO THIS OFRAK PRO AGREEMENT. THE PARTIES AGREE THAT THIS SECTION 9 REPRESENTS A REASONABLE ALLOCATION OF RISK AND THAT RED BALLOON WOULD NOT PROCEED IN THE ABSENCE OF SUCH ALLOCATION. 10. Limitations. NEITHER RED BALLOON NOR ANY CONTRIBUTOR OF DERIVATIVES SHALL BE RESPONSIBLE OR LIABLE WITH RESPECT TO ANY SUBJECT MATTER OF THIS OFRAK PRO AGREEMENT OR TERMS AND CONDITIONS RELATED THERETO UNDER ANY CONTRACT, NEGLIGENCE, STRICT LIABILITY OR OTHER THEORY (A) FOR LOSS OR INACCURACY OF DATA, OR COST OF PROCUREMENT OF SUBSTITUTE GOODS, SERVICES OR TECHNOLOGY; (B) FOR ANY DIRECT, INDIRECT, PUNITIVE, INCIDENTAL, RELIANCE, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES INCLUDING, BUT NOT LIMITED TO, LOSS OF REVENUES AND LOSS OF PROFITS TO LICENSEE OR ANY THIRD PARTIES; (C) FOR ANY MATTER BEYOND ITS REASONABLE CONTROL OR (D) FOR USE THAT LICENSEE OR OTHERS MAY MAKE OF OFRAK, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 11. Indemnification. Licensee agrees that (a) Red Balloon and any contributors shall have no liability whatsoever for Licensee’s use of OFRAK or any Derivatives and (b) Licensee shall indemnify, and hold harmless, and (upon request) defend Red Balloon and any other user or contributor from and against any and all claims, damages, liabilities, losses, and costs (including reasonable attorneys’ fees) suffered or incurred by such party which arise from or relate to Licensee’s (i) use of OFRAK or Derivatives, or (ii) breach of this OFRAK Pro Agreement. 12. Miscellaneous. Neither this OFRAK Pro Agreement nor the licenses granted hereunder are assignable or transferable by Licensee; any attempt to do so shall be void. Red Balloon may assign this OFRAK Pro Agreement in whole or in part. Any notice, report, approval or consent required or permitted hereunder shall be in writing. The provisions hereof are for the benefit of the parties only and not for any other person or entity. If any provision of this OFRAK Pro Agreement shall be adjudged by any court of competent jurisdiction to be unenforceable or invalid, that provision shall be limited or eliminated to the minimum extent necessary so that this OFRAK Pro Agreement shall otherwise remain in full force and effect and enforceable. This OFRAK Pro Agreement shall be deemed to have been made in, and shall be construed pursuant to the laws of the State of New York, without regard to conflicts of laws provisions thereof, and without regard to the United Nations Convention on the International Sale of Goods or the Uniform Computer Information Transactions Act. Any waivers or amendments shall be effective only if made in writing. This OFRAK Pro Agreement is the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements and communications relating to the subject matter of this OFRAK Pro Agreement. In the event of any conflict between this OFRAK Pro License Agreement and the OFRAK Community License Agreement, located at https://ofrak.com/docs/license.html, this OFRAK Pro Agreement shall control.