fix(pe): reject misaligned certificate table offsets (#9276)

* fix(pe): reject misaligned certificate table offsets

* test: align ghidra limitation wording with main

* style: format ghidra limitation assertion

src/native/pe/PeCertificateParser.test.ts

@@ -105,6 +105,21 @@ it("reports unsigned attribute OIDs and incomplete nested coverage", () => {
   }
 });
 
+it.each([false, true])(
+  "rejects a misaligned certificate table (PE32+ = %s)",
+  (plus) => {
+    const aligned = peCertificateFixture(plus, undefined, undefined, true);
+    expect(parse(aligned).coverage.status).toBe("complete");
+    const shifted = Buffer.concat([
+      aligned.subarray(0, 0x200),
+      Buffer.alloc(1),
+      aligned.subarray(0x200),
+    ]);
+    shifted.writeUInt32LE(0x201, 0x98 + (plus ? 112 : 96) + 4 * 8);
+    expect(() => parse(shifted)).toThrow(/certificate table offset.*aligned/u);
+  },
+);
+
 it("accepts only zero eight-byte alignment padding included in dwLength", () => {
   for (const plus of [false, true]) {
     const bytes = peCertificateFixture(plus, undefined, undefined, true);

src/native/pe/PeCertificateParser.ts

@@ -79,6 +79,8 @@ export const parsePeCertificates = (
   const directoryAt = optionalHeaderOffset + security.offset;
   if (tableSize === 0 || tableOffset < headerSize)
     fail("PE certificate table offset overlaps headers or has zero size.");
+  if (tableOffset % 8 !== 0)
+    fail("PE certificate table offset must be aligned to eight bytes.");
   requireRange(bytes, tableOffset, tableSize);
   const table = bytes.subarray(tableOffset, tableOffset + tableSize);
   const entries: PeCertificates["entries"] = [];

tests/boundary/mcp/ghidraEvidenceMcp.test.ts

@@ -703,9 +703,7 @@ describe("Ghidra MCP evidence parity", () => {
         },
         limitations: expect.arrayContaining([
           expect.stringContaining("default auto-analysis complete"),
-          expect.stringContaining(
-            "original executable bytes are never written",
-          ),
+          expect.stringContaining("original executable bytes are unchanged"),
         ]),
       });
       const directAnalyzed = await new EnhancedTools(session).execute(