163ee09a74
feat(native): inspect recorded crashes through pwntools and pwndbg ( #1054 )
...
* feat(native): inspect recorded crashes through pwntools and pwndbg
* fix(native): bind core note semantics to raw owner bytes
* fix(native): validate recorded core ABI and evidence scalars
* fix(native): require complete recorded note interpretations
* fix(native): bind physical core notes to original headers
2026-10-08 16:50:31 +08:00
7af7bc88ce
feat(evm): inspect offline bytecode interfaces through EVMole ( #1051 )
...
* feat(evm): inspect offline bytecode interfaces through evmole
* fix(evm): distinguish unsupported bytecode targets
* style(evm): format verifier string-prefix checks
2026-10-08 15:32:05 +08:00
4fc6565b0f
feat(native): inspect offline ELF layout through pwntools ( #1037 )
...
* feat(native): inspect offline ELF layout through pwntools
* fix(build): prepare offline ELF verification on clean runners
* fix(native): preserve snapshot acquisition cancellation
* fix(native): handle sectionless ELF and retain decoder diagnostics
* test(native): verify malformed symbol table entry sizes
* fix(native): respect inherited limits and unused segment fields
* fix(native): preserve packed relocations and decoder launch constraints
* fix(native): validate symbol spans and preserve resource failures
* fix(native): preserve diagnostic completeness and memory failures
* fix(native): guard bridge imports against allocation failures
* fix(native): validate relocation symbol and section references
* fix(native): retain diagnostics through compounded cleanup failures
* fix(native): preserve unresolved relocation section references
* fix(native): bound linkage evidence and preserve CPU signal diagnostics
* fix(native): preserve file-size resource failure evidence
* fix(native): retain opaque linkage names and late cancellation output
* test(native): make CPU-limit fixture robust across runners
* fix(native): verify resource failure branches before interpreting exits
* fix(native): validate declared ELF string references
* fix(native): validate section-name table before decoding
* fix(native): enforce canonical ELF name-table escapes
2026-10-08 14:22:08 +08:00
2bf3663f65
feat(browser): inspect historical web network captures ( #992 )
...
* feat(browser): inspect retained HAR and mitmproxy capture evidence
Add independent offline format adapters, inline CLI/MCP evidence, bounded
owned decoder processes, and real producer verification.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): preserve capture boundaries during cancellation and decoding
Honor cancellation during owned-command cleanup, retain opaque HAR
extension content, and clean verifier resources on every failure path.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture fields across representations
Normalize known native transport URLs for both bytes and strings, including backups. Exclude explicitly sensitive text fields with null so redaction markers cannot reintroduce declared literals. Cover both provider identities in catalog conformance.
Refs #882
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(browser): exclude sensitive capture identities and bound diagnostics
* fix(browser): validate excluded HAR subtrees before projection
* fix(browser): distinguish capture input limits from decoder failures
* fix(browser): preserve decoder failure categories
* fix(browser): validate excluded native credential values
* test(browser): report capture verifier assertions directly
* fix(browser): classify native representation failures precisely
* fix(browser): exclude URL userinfo after header whitespace
* fix(browser): preserve capture evidence and failure boundaries
* fix(browser): exclude sensitive literals from capture limitations
* test(browser): check limitation values without JSON syntax
* fix(browser): preserve acquisition integrity and exclude selection diagnostics
* fix(browser): preserve capture acquisition and declaration boundaries
* fix(mcp): project sensitive capture argument validation
* fix: preserve capture bytes and prelaunch cancellation
* fix(browser): exclude sensitive HAR record ancestry
* fix(browser): preserve transport URL and parameter exclusions
* fix(browser): preserve numeric redaction and canonical capture provenance
* fix(browser): cover derived capture values and ownership preparation deadlines
* fix(browser): exclude explicitly sensitive artifact digests
* chore: regenerate generated metadata
* fix(browser): reject lossy HAR member normalization
* test(browser): assert the advertised unsupported-profile outcome
* fix(browser): preserve JSON visitor nesting failure locations
* fix(browser): exclude explicitly sensitive native source ranges
---------
Co-authored-by: Kaoru0822 <208281322+kaoru0822-kitauji@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-10-08 07:53:41 +08:00
166dcd21d0
feat(javascript): recover readable modules with Wakaru ( #848 )
...
* feat(javascript): recover readable modules with Wakaru
Integrate pinned upstream source behind a typed optional recovery port,
preserve source identity and producer provenance, and publish verified
artifacts for existing JavaScript analysis through CLI and MCP.
Add focused real-tool CI with genuine bundler fixtures and bounded
resource, cancellation, cleanup, schema and packaged-artifact checks.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* fix(javascript): align recovery catalog and browser verification
Share canonical Wakaru provider identity, describe CLI mode options, and
format the new workflow test. Disconnect the real page transport after
its observation readiness progress instead of a fixed delay.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
* refactor(javascript): consume the investigation evidence writer
Verify that the SDK recovery handler records complete Evidence through the newly shared investigation owner.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
* chore(test): account for isolated recovery fixture compilers
* fix(javascript): validate recovery paths before acquiring the engine
Return field-specific invalid_format diagnostics for relative paths and verify compiled CLI/MCP parity even when the optional engine is unavailable.
Assisted-by: Yukari (gensokyo-skills:yukari-boundary-analysis)
Assisted-by: Kogasa (gensokyo-skills:kogasa-surprise-testing)
2026-10-07 12:46:13 +08:00
fb679b63c2
feat(ghidra): integrate optional NativeAOT metadata recovery ( #748 )
...
* feat(ghidra): integrate optional NativeAOT metadata recovery
* fix(ghidra): bind extension snapshots to configured artifacts
* test(ghidra): verify lazy NativeAOT startup failures
* fix(ghidra): preserve NativeAOT failure reasons and coverage
* fix(ghidra): preserve NativeAOT x64 calling conventions
* test(ghidra): guard recovered NativeAOT method conventions
* fix(ghidra): reject blocking extension file inputs
* fix(ghidra): diagnose incompatible NativeAOT extension classes
* test(ghidra): verify real extension initialization failures
* fix(ghidra): keep extension descriptor fields optional
2026-10-07 00:57:08 +08:00
5a7c769692
feat(firmware): integrate Binwalk and Unblob analysis
...
* feat(firmware): integrate Binwalk and Unblob analysis
* fix(firmware): verify published files and namespace source references
* test(firmware): isolate extractor dependency failure from process cleanup
* fix(firmware): retain actionable report and cleanup diagnostics
* test: assert retained batch output failure diagnostics
2026-10-06 14:16:04 +00:00
904d03e987
feat(android): integrate static APK analysis with headless JADX ( #738 )
...
* feat(android): integrate static APK analysis with headless JADX
* test(android): include APK tools in explicit effects audit
2026-10-06 12:46:48 +00:00
Ysopwnable