shifathosn
/
rea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
rea/docs
History
Matt Van Horn 2a78763e20
feat(native): search analyzed memory for masked byte patterns (#2341) 
* feat(native): search analyzed memory for masked byte patterns

The diff adds search_bytes to the CLI, the shared MCP contract, Ghidra
inventory, and the headless bridge, and advertises the same operation on
Hopper as unavailable until that provider is verified. Patterns are
hexadecimal byte pairs with optional ?? wildcards and an optional
equal-length bit mask; the TypeScript boundary and the bridge both
require a nonempty pattern, equal lengths, and at least one constrained
bit. Ghidra walks initialized blocks in address order within inclusive
bounds, keeps overlapping matches inside a single block, and returns
each hit with its segment, unique source file offset, and containing
procedure, continuing through a cursor bound to the target, profile,
pattern, mask, and bounds. Each page reports the inclusive ranges
examined and the skipped uninitialized blocks; cancellation returns a
typed error and discards the active Ghidra database.
address_to_file_offset now uses the same unique-offset helper, which
rejects a mapping that is missing, ambiguous, or larger than a safe
integer.

* fix(native): limit unbounded byte search to loaded memory

Without start or end, search_bytes walked every Ghidra block, including
non-loaded file parts such as .symtab and overlay blocks, which the docs
call out of scope. Unbounded searches now skip those blocks and list them
in searched.skipped_not_loaded; explicit bounds in their address space
still search them. Document that a match must end at or before end.

* fix(native): preserve implicit address spaces in range consumers

* fix(native): reject present malformed byte search state

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
 		2026-10-13 23:41:45 +08:00
..
.vitepress docs: move translated READMEs under docs/readme (#2165) 2026-10-13 22:25:32 +08:00
assets docs: keep license sections text-only 2026-10-10 00:09:46 +08:00
readme docs: move translated READMEs under docs/readme (#2165) 2026-10-13 22:25:32 +08:00
releases chore(main): release rea-agents 6.4.0 (#1399) 2026-10-11 11:57:29 +08:00
specs/solidity/cbor-metadata feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790) 2026-10-13 21:55:30 +08:00
adb-device-analysis.md fix: align MCP archive contracts and documentation (#2478) 2026-10-13 12:06:41 +08:00
android-analysis.md fix(android): clean Windows workspaces after owner termination (#2440) 2026-10-13 22:03:16 +08:00
apktool-resource-analysis.md fix(apktool): run Windows batch launchers through cmd.exe (#1777) 2026-10-11 17:16:48 +08:00
apple-application-analysis.md fix(apple): limit already-loaded reuse to rpath dependencies (#2292) 2026-10-13 14:40:43 +08:00
architecture.mermaid refactor(evm): bind offline analysis through a static descriptor 2026-10-13 01:26:43 +08:00
binary-diagnostics.md fix(pwntools): let callers widen the artifact input bound (#2486) 2026-10-13 21:18:12 +08:00
browser-observation.md docs(browser): clarify attach coverage and Chromium setup (#2287) 2026-10-13 20:44:41 +08:00
browser-scenario-contract.md fix(browser): report mismatched event family selection as unknown in capture comparison (#2239) 2026-10-13 02:36:45 +08:00
cli.md feat(ghidra): support raw NMOS 6502 analysis (#2079) 2026-10-13 21:13:01 +08:00
client-configuration.md feat(setup): add Kimi Code client support (#2744) 2026-10-13 23:36:54 +08:00
client-verification.md test(evaluation): grade managed agent fixture facts (#1924) 2026-10-13 23:34:17 +08:00
electron-observation.md fix(electron): support packaged app.asar pages and rewritten unpacked companions (#1400) 2026-10-10 23:01:54 +08:00
error-contract.schema.json feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
evm-bytecode.md feat(evm): inspect lossless Solidity terminal CBOR metadata (#2790) 2026-10-13 21:55:30 +08:00
firmware-analysis.md feat(ghidra): admit RISC-V ELF analysis through a pinned generic lane (#2151) 2026-10-13 00:11:35 +08:00
flutter-analysis.md fix(flutter): reject ambiguous ELF mappings and bound note reads (#2334) 2026-10-13 22:13:22 +08:00
frida-instrumentation.md feat: add Frida instrumentation support (#1359) 2026-10-12 22:01:58 +08:00
ghidra-dos.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
ghidra-mips.md feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language (#1898) 2026-10-13 21:42:38 +08:00
ghidra-nativeaot.md feat(ghidra): inspect NativeAOT PE metadata read-only 2026-10-11 10:31:49 +08:00
ghidra-provider.md feat(native): search analyzed memory for masked byte patterns (#2341) 2026-10-13 23:41:45 +08:00
ghidra-psp.md feat(ghidra): admit bounded PSP ELF through installed Allegrex (#1599) 2026-10-11 19:47:33 +08:00
ghidra-riscv.md feat(ghidra): support raw NMOS 6502 analysis (#2079) 2026-10-13 21:13:01 +08:00
go-binaries.md feat(go): inspect embedded binary build metadata (#1363) 2026-10-12 11:34:02 +08:00
harmony-analysis.md feat(harmony): project HarmonyOS package inventory evidence (#1447) 2026-10-11 20:09:21 +08:00
ida-provider.md fix(ida): report missing tools when a compatibility profile mismatches (#2307) 2026-10-13 21:58:36 +08:00
index.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
installation.md feat(setup): add Kimi Code client support (#2744) 2026-10-13 23:36:54 +08:00
javascript-application-graph.md fix(javascript): retain compiler-dependent module resolution facts 2026-10-13 15:58:25 +08:00
javascript-application-workflows.md fix(javascript): retain getter receivers through local aliases (#2778) 2026-10-13 21:26:13 +08:00
javascript-artifact-reconstruction.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
javascript-recovery.md feat(javascript): recover code-split bundles from multiple inputs (#1686) 2026-10-11 18:39:49 +08:00
javascript-runtime-observation.md fix(runtime)!: preserve unknown debugger attachment state 2026-10-12 12:37:00 +08:00
javascript-runtime-reconciliation.md fix: align MCP archive contracts and documentation (#2478) 2026-10-13 12:06:41 +08:00
jeb-analysis.md feat(jeb): add JEB engine provider over its MCP interface (#1536) 2026-10-10 23:03:27 +08:00
managed-code-analysis.md feat(managed): name the declaring type of call and field targets (#2163) 2026-10-13 21:12:15 +08:00
mcp-contracts.md fix(mcp): count the error flag in error result budgets (#2848) 2026-10-13 23:06:55 +08:00
mcp-prompts.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
migration-6.2.md docs: correct MCP error and capture import guidance 2026-10-10 05:41:52 +08:00
native-investigation.md feat(native): search analyzed memory for masked byte patterns (#2341) 2026-10-13 23:41:45 +08:00
packet-captures.md feat(captures): discover installed protocol and field definitions (#2496) 2026-10-13 15:55:25 +09:00
pcap-analysis.md feat(pcap): add bounded capture summaries through CLI and MCP 2026-10-13 04:53:03 +00:00
process-capture.md fix(process): add an opt-in Swift module cache (#2252) 2026-10-13 02:26:16 +08:00
raw-binary.md feat(ghidra): support raw NMOS 6502 analysis (#2079) 2026-10-13 21:13:01 +08:00
reconstruction-obligation-ledgers.md refactor: return complete analysis results inline 2026-09-29 08:07:24 +08:00
reconstruction-readiness.md docs(readiness): align required stage identifier and checks with evaluator (#2200) 2026-10-13 00:15:54 +08:00
recorded-crashes.md fix(pwntools): let callers widen the artifact input bound (#2486) 2026-10-13 21:18:12 +08:00
releasing.md ci: separate fast feedback from full qualification 2026-10-13 17:09:53 +08:00
roadmap.md docs: remove retired architecture and migration artifacts 2026-10-10 05:41:45 +08:00
signal-recordings.md feat(signals): discover installed decoders and option help (#2487) 2026-10-13 15:58:19 +09:00
sqlite-databases.md feat(sqlite): inspect offline snapshots with selective evidence (#2271) 2026-10-12 18:33:23 +00:00
testing.md feat(ghidra): support raw NMOS 6502 analysis (#2079) 2026-10-13 21:13:01 +08:00
tool-design.md docs: define performance priorities for analysis workflows (#2245) 2026-10-13 00:42:06 +08:00
user-visible-errors.csv feat(native): search analyzed memory for masked byte patterns (#2341) 2026-10-13 23:41:45 +08:00
wasm-artifacts.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
web-network-captures.md feat(browser): inspect retained aioquic qlog JSON captures 2026-10-13 03:24:05 +00:00
web-runtime.md fix(browser): treat module-import initiator positions as script positions 2026-10-08 16:44:25 +00:00
web-source-location.md fix(bun): report the real runtime and enforce worker memory budgets on Windows (#1730) 2026-10-11 19:20:00 +08:00
website-module-trace.md feat(browser): trace captured website module imports (#879) 2026-10-07 14:59:52 +08:00
website-script-export.md fix(browser): preserve body API provenance through script export 2026-10-12 14:12:19 +08:00
windows-ghidra-p0.md feat(ghidra): support raw NMOS 6502 analysis (#2079) 2026-10-13 21:13:01 +08:00