Commit Graph

42 Commits

Author SHA1 Message Date
N0zoM1z0 fb679b63c2
feat(ghidra): integrate optional NativeAOT metadata recovery (#748)
* feat(ghidra): integrate optional NativeAOT metadata recovery

* fix(ghidra): bind extension snapshots to configured artifacts

* test(ghidra): verify lazy NativeAOT startup failures

* fix(ghidra): preserve NativeAOT failure reasons and coverage

* fix(ghidra): preserve NativeAOT x64 calling conventions

* test(ghidra): guard recovered NativeAOT method conventions

* fix(ghidra): reject blocking extension file inputs

* fix(ghidra): diagnose incompatible NativeAOT extension classes

* test(ghidra): verify real extension initialization failures

* fix(ghidra): keep extension descriptor fields optional
2026-10-07 00:57:08 +08:00
N0zoM1z0 9bab55337a
feat(ghidra): add atomic function annotation edits (#709)
* feat(ghidra): edit function annotations atomically

Return annotation readback and refreshed function analysis through CLI and MCP. Own each database transaction, invalidate caches and immutable snapshots, preserve executable bytes, and retain the Windows mutation boundary.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* fix(ghidra): preserve qualified function annotation identity

Preserve namespaces during local name writes and match qualified readback to the refreshed dossier. Add a producer-shaped regression and verify a real namespaced C++ function through the CLI.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* test(ghidra): align verification with annotation authority

Keep strict capability and profile checks while admitting the explicit session metadata operation. Verify packaged transport authority and atomic transaction commitments and preserve a read-only Windows expectation.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)
2026-10-06 17:24:33 +08:00
N0zoM1z0 26881da76a
feat(ghidra): enable Windows x64 read-only analysis (#699)
* feat(ghidra): enable Windows x64 read-only analysis

* test(ghidra): exercise native Windows runtime boundaries

* test(ghidra): verify current Windows inventory and isolate ACL observer

* fix(ghidra): align Windows admission and address P0 review
2026-10-06 16:53:33 +08:00
N0zoM1z0 5bcb6645b5
feat(ghidra): admit explicit DOS COM analysis (#702)
* feat(ghidra): admit explicit DOS COM analysis

Carry caller-selected COM interpretation through CLI, MCP and target
identity, seed real-mode entry/context before Ghidra analysis, and verify
complete loaded bytes, source mappings and measured register context.
Keep original binaries unchanged and PSP/runtime coverage explicit.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* fix(verification): validate COM package selection before allocating fixtures
2026-10-06 16:26:40 +08:00
N0zoM1z0 a6a8f67649
feat(ghidra): verify DOS load images and expose memory evidence (#697)
* feat(ghidra): verify DOS load images and expose memory evidence

Verify measured source bytes, mapped regions, fixups and entries against
the immutable MZ snapshot, retaining independent checks and raw evidence.
Expose loaded byte reads and authoritative original file offsets through
both CLI and MCP, with focused and actual Ghidra DOS verification.

Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering)

* fix(cli): describe memory inspection arguments

* test(ghidra): align bridge fixtures and CLI capability accounting
2026-10-06 15:48:48 +08:00
N0zoM1z0 b225b0f64b
fix(ghidra): recover evidenced switch cases and default targets (#579)
Correlate typed labels with recovered block entries and one indirect dispatch.
Preserve ambiguous and nonexact integer associations as unknown with raw diagnostics.
Expose defaults separately, collect backing load metadata, and invalidate old profiles.
Add independent compiler-byte CLI/MCP acceptance and actual Ghidra model controls.

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
2026-10-05 22:54:17 +08:00
morluto e07b81649e
refactor!: simplify runtime tools and remove replay engines (#572)
* fix(hopper): report unavailable procedure body coverage

* refactor!: simplify runtime tools and remove replay engines

Keep direct inspection, capture, and comparison tools. Bind handlers to named contracts and let agents compose experiments with commands and local fixture servers.

BREAKING CHANGE: Remove controlled replay, Node characterization, finite replay-machine, managed runtime planning, and redundant string-tracing tools. Retire process replay, shims, reactive scenarios, custom checkpoints, and active browser replay and origin-scope inputs.
2026-10-05 21:15:04 +08:00
morluto b5e98915c6
fix(tools)!: simplify direct invocation and harden boundary contracts (#555)
Remove REA permission grants, scope ceilings, approval confirmations, and inert settings. Preserve selected local evidence, accept caller-chosen commands and paths, and report actual runtime failures.

Harden provider results, schema serialization, snapshot evidence binding, archive paths, source maps, native screenshots, managed EH parsing, and cancellation cleanup. Regenerate tool metadata and document direct invocation.

BREAKING CHANGE: Removed permission configuration and policy commands, approval fields, filesystem scope inputs, and fixed confirmation options. Process capture inherits the host environment and accepts command names; callers must refresh tool schemas and migrate removed fields.
2026-10-05 20:16:44 +08:00
N0zoM1z0 4f099a10f8
feat(ghidra): add DOS MZ analysis and complete function extents (#556)
Validate DOS MZ load modules and import them with Ghidra's 16-bit
real-mode profile. Preserve complete observed inclusive function body
ranges through inventory, function analysis, Evidence and snapshots.

Add a public source-generated DOS CLI/MCP verification lane and
regressions for malformed headers, body membership and cache profiles.

Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
2026-10-05 20:09:45 +08:00
morluto 405732a7f5
fix: correct native inventories and bridge error classification (#503)
* fix(hopper): preserve normalized inventory addresses

* test(hopper): isolate real inventory verification

* fix(native): preserve otool addresses and section alignment

* fix: preserve address spaces in call path evidence

* fix(hopper): distinguish request validation from provider faults

* fix(native): retain tool inventory facts and reject failed signatures
2026-10-04 17:25:09 +08:00
morluto 4fbc501121
feat(native): add inspection primitives, dispatch traces and approved UI observation (#500)
* fix(hopper): normalize string-backed addresses and update verification

* feat(native): add inspection primitives, dispatch traces and approved UI observation

* test: prioritize real artifact E2E and captured golden regressions

* fix(process): queue observed output before reactive rendering actions

* test: prune redundant cases and strengthen boundary assertions

* fix(cli): route native value tracing through shared workflows

* test: replace synthetic success with real workflows and captured data

* fix(catalog): separate portable metadata from native host availability
2026-10-04 16:02:36 +08:00
morluto ed933d1893
feat(native): add investigation features (#486)
* feat(native): add UI and dispatch investigation workflows

* feat(ghidra): support macOS host validation

* docs: update native investigation capabilities

* feat(artifacts): decode compiled Interface Builder archives

* feat(ghidra): expose bounded p-code value flow

* test(ghidra): split host and cross-format verification

* fix(verify): follow complete result contracts

* refactor: remove unused authorization and schema helpers

* refactor: remove unused evidence result alias

* fix(ghidra): report jump-table evidence precisely

* fix(verify): align browser scenario fixture schema

* fix(setup): compare parsed client config structurally

* test(ghidra): verify AArch64 jump-table mappings

* fix(ghidra): recover AArch64 byte jump tables

* test(artifacts): verify compiled interface builder archives

* feat(native): trace UI actions through handlers

* fix(tests): update native trace and shutdown fixtures

* fix(verification): diagnose browser scenario failures

* fix(browser): wrap scenario snapshots in capture state

* fix(native): bind and bound investigation workflows

* fix(artifacts): preserve bounded interface builder evidence

* fix(ghidra): enforce admitted hosts and preflight tools

* fix(native): preserve trace cancellation and bounds

* test(application): expect bound analysis target evidence

* fix(native): preserve investigation bounds and cancellation

* fix(application): preserve bundle and unresolved trace evidence

* style(test): format artifact subject fixture
2026-09-30 00:41:05 +08:00
morluto 5f73cb061b refactor(tools): remove arbitrary workflow ceilings 2026-09-29 17:36:26 +08:00
morluto ecf3ed8bdb refactor(tools): remove remaining arbitrary workflow caps 2026-09-29 17:00:06 +08:00
morluto 2f08c7c932 refactor(tools): remove artificial analysis ceilings 2026-09-29 16:29:23 +08:00
morluto c2a6f4bc43 refactor(ghidra): remove redundant schema markers 2026-09-29 11:38:16 +08:00
morluto a8c58c6605 refactor(analysis): remove caller-selected result caps 2026-09-29 11:22:31 +08:00
morluto bd0e341572 refactor(tools): remove redundant limits and acknowledgements 2026-09-29 10:53:45 +08:00
morluto a66e43a99d fix(ghidra): return complete native analysis results 2026-09-29 08:45:49 +08:00
morluto 0d96275b68 refactor: return complete tool results inline 2026-09-29 07:08:46 +08:00
morluto 521139d4a5 feat(native): inspect API boundaries with evidence 2026-07-25 14:29:28 +00:00
morluto 7a43420029 feat(hopper): report bridge progress diagnostics 2026-07-25 14:29:02 +00:00
morluto 8e7709d35a feat(analysis): add bounded memory and call tracing 2026-07-24 13:14:01 +00:00
N0zoM1z0 e0bc7fd973 fix(hopper): add bounded analysis recovery 2026-07-24 00:33:29 +09:00
N0zoM1z0 629ffc3872 feat(ghidra): add authenticated Windows loopback transport
Keep private Unix sockets on supported POSIX hosts and add a Windows P0 transport that binds the Java bridge to IPv4 loopback on an ephemeral port. Publish only a strict, token-free endpoint record through an atomic rename, validate it before connecting, and retain the same authenticated request protocol, bounded queue, handshake, cancellation, and shutdown semantics across both transports.
2026-07-17 03:05:19 +09:00
N0zoM1z0 be19c3fd12 feat(ghidra): bind imports to admitted target bytes
Copy each selected target into the ephemeral Ghidra runtime and reject the snapshot unless its SHA-256 matches the provider-neutral target identity. Advance the Java bridge protocol to v4, require Ghidra's imported executable digest to match again, and include that digest in the authenticated session handshake and diagnostics. Preserve bounded streaming hashes and remove mismatched snapshots before launch.
2026-07-17 03:05:19 +09:00
N0zoM1z0 d8321defd7 feat(ghidra): add function analysis and conformance 2026-07-16 04:17:08 +09:00
N0zoM1z0 b1c07dd9c6 feat(ghidra): implement read-only inventory operations 2026-07-16 02:59:37 +09:00
N0zoM1z0 f0e625d7ee feat(ghidra): add private headless provider session 2026-07-16 01:27:54 +09:00
morluto fb51874bb9
fix(hopper): complete owned Linux shutdown (#116)
* fix(hopper): avoid blocking owned Linux shutdown

* fix(hopper): complete owned shutdown cleanup
2026-07-14 06:05:25 +08:00
morluto 2c707abb66 fix(hopper): return addresses for procedure relationships 2026-07-14 04:21:28 +08:00
morluto 179870e825 fix(hopper): cancel analysis and close documents reliably 2026-07-14 04:18:26 +08:00
N0zoM1z0 65682ee65c fix(bridge): bound regex search work 2026-07-13 22:21:58 +08:00
morluto f8e8ea35ff fix(bridge): harden bounded Hopper boundaries 2026-07-13 03:14:15 +00:00
morluto 4ff4c11a00 Add evidence-backed investigation workflows 2026-07-12 21:12:18 +00:00
morluto cc8681a856 feat: add evidence-backed process investigations 2026-07-12 20:36:00 +08:00
morluto 4f18e26ee5 feat: evolve REA analysis platform 2026-07-12 19:32:13 +08:00
morluto 893d2e2d05 feat(mcp): add typed bounded analysis tools 2026-07-12 18:59:53 +08:00
morluto 62ede515b7 docs: record runtime and release constraints 2026-07-12 08:45:35 +08:00
morluto 3d70812c37 feat(identity): rename package and CLI to REA 2026-07-12 07:44:30 +08:00
morluto d9c9025ffb Improve Hopper session reliability 2026-07-12 06:53:31 +08:00
morluto d8a2b70565 Add in-process Python bridge for Hopper API 2026-07-12 03:25:18 +08:00