Kaoru0822andClaude Opus 5.5
44b6384009
* fix(native): find procedures by the secondary names exact lookup accepts search_procedures matched only each procedure's primary name, while exact lookup also accepts Kuna inventory aliases (versioned-symbol and generated sub_ names) and Ghidra symbols at an exact function entry. A search for a name procedure_address resolves returned nothing, and trace_feature silently missed the procedure. Both providers now match the same names their exact lookup accepts. A procedure still appears once under its primary name; the optional matched_aliases field lists the secondary names that matched, so aliases never become procedures of their own and list_procedures is unchanged. The shared domain helper owns that row rule for Kuna and for the Ghidra host-side Unicode folding pass. The Ghidra analysis profile records the new search semantics so older snapshots cannot replay alias-blind results. Fixes #8330 Co-Authored-By: Claude Opus 5.5 <[email protected]> * fix(ghidra): match leaf spellings of procedure names in search procedure_address accepts each entry symbol's leaf or namespace-qualified spelling, but procedure search tested only qualified names, so a regex such as ^audit_alias$ missed a secondary symbol ns::audit_alias (and ^same$ missed a primary alpha::same) that exact lookup selects. Lookup and search now share one bridge definition of the names that select a procedure, so they cannot drift. Matching secondary symbols are still reported by their qualified names; because a leaf ends its qualified spelling, the host's Unicode literal pass stays exact over those names. Co-Authored-By: Claude Opus 5.5 <[email protected]> --------- Co-authored-by: Claude Opus 5.5 <[email protected]>
Ghidra conformance corpus
These source-owned fixtures are compiled at verification time; generated binaries and Ghidra projects are never committed.
-
../c/riscv.candriscv-probe.Sproduce source-owned RV32/RV64 ELF images with double-float ABI declarations and an independently known instruction.../c/riscv-float-abi.c,riscv-probe.Sandriscv-isa-probe.Sproduce typed and stripped RV32 ilp32 images whose calls cover every rule of the ilp32 policy;riscv-checks.mjsholds that policy's expected storage and the call-site oracle.npm run verify:ghidra:riscvexercises real CLI/MCP discovery, decompilation, argument storage, output schemas, profile and snapshot identity, admission and refusal diagnostics, immutable source bytes, and owned cleanup. It requires BYO Ghidra 12.1.4/JDK 21+ and RISC-V Clang/LLD/LLVM readelf/LLVM objdump;REA_RISCV_CLANG,REA_RISCV_LLD,REA_RISCV_READELFandREA_RISCV_OBJDUMPselect existing tool commands. -
ReaDecodeProbe.javadecodes source-owned instruction bytes from a language's default context and checks each mnemonic, length and optional complete operand. Theghidra-bridge-sourcesCI job runs it forARM:LE:32:Cortex,ARM:LE:32:v8-mandXtensa:LE:32:default; the bytes are never executed. -
inventory.cproduces separate x86-64 debug and stripped ELF executables. It covers imports, an externalputsfunction, linker thunks, source symbols, direct calls, a targetless callback call, two referenced strings, and a multi-block branch. -
entry-aliases.cpreserves secondary imported entry labels, a bare-hex alias, and an interior label. The native CLI/MCP lane verifies entry selection, procedure search and feature tracing by the secondary name, annotation, interior-label rejection, and unchanged source bytes. -
cross-format.cis freestanding so the verifier can produce AArch64 ELF, x86-64 PE, and x86-64 Mach-O targets from the same semantics. It preserves an exported entry, direct and indirect calls, a volatile string reference, and a multi-block branch across loaders. -
relocation-symbol.cbuilds an x86-64 ELF with named and unnamed dynamic relocations. The cross-format verifier checks their Ghidra observations through the public CLI without executing the artifact. -
no-return.candReaNoReturnProbe.javainject incorrect import flags into a real ELF or Mach-O analysis database, verify caller recovery, propagated flag repair and signature preservation, and retain genuine/unknown no-return calls and independently identified entries. Runnpm run build:cached, thennode scripts/verify-real-ghidra-noreturn.mjswith the Ghidra/JDK environment below on Linux or macOS x64/arm64. On Linux, use a procps-compatible process table that exposes REA's current process for owned cleanup. It also checks named limitations through the real read-only TCP bridge and provider Evidence projection; default Unix-socket transport, Windows, and the reported Amethyst artifact need separate verification. Fixture target code is never executed. -
ReaDecompilerFailureProbe.javareplaces the bridge decompiler after a real import ofcross-format.c, so one function's decompilation fails. It checks thatanalyze_functionstill returns that function's assembly, callers, callees, references and basic blocks unchanged, marks pseudocode, native API and p-code value flow unavailable with the decompiler's reason, and that cancellation still ends the request. Runnpm run build:cached, thennode scripts/verify-real-ghidra-decompiler-failure.mjson Linux or macOS x64/arm64. The lane also parses the degraded dossier with REA's Ghidra output contract and checks the healthy provider path through the real read-only TCP bridge. Decompiler failure marks only that observation as live: retain its Evidence, retry after backend recovery, and keep healthy dossier snapshot reuse. The injection does not establish which natural inputs make the decompiler fail. -
node scripts/verify-real-ghidra-decompile-timeout.mjs(afternpm run build:cached, Linux or macOS x64/arm64) compiles a generated shared library whoserea_slowfunction has thousands of branches and analyzes it withREA_GHIDRA_DECOMPILE_TIMEOUT_SECONDS=1through the real read-only TCP provider. Ghidra's own decompiler stops at the limit with no injection:analyze_functionreturns the listing facets with pseudocode unavailable and a live cache policy,procedure_pseudo_codefails with a message naming the setting, and the same session then decompilesrea_small. SetREA_DECOMPILE_TIMEOUT_BRANCHESto change the fixture size. The verifier budgets 1 MiB for generated C source and derives the maximum branch count from the worst-case line size before allocating the source. Larger or invalid counts are rejected before installation inspection or compilation.
scripts/verify-real-ghidra.mjs uses cc, clang, and lld-link by default;
REA_CC, REA_CLANG, and REA_LLD_LINK can select alternate commands. The
verifier requires the verified bring-your-own Ghidra 12.1.4 installation through
GHIDRA_INSTALL_DIR and validates header classification before starting the
provider. Provider admission accepts newer 12.x (>=12.1) builds with an unverified-build limitation; this lane does
not.
Conformance compares semantic facts: provider/profile identity, function classification, resolved call edges, typed references, strings/xrefs, and CFG topology. It only requires provider pseudocode and assembly to be non-empty, bounded, and address-bearing; it never compares their text with Hopper. The callback fixture also proves that an unresolved targetless flow is not silently promoted to a direct callee. Every target runs in a separate owned project and must leave no process, socket, project, or runtime root after close.
relative-switch-signed.S covers signed halfword offsets, the CBZ zero-entry
route, and selector biases of 0, 2 and 10 in the AArch64 jump-table lane. The
nonzero biases exercise overlapping and disjoint typed label/index ranges. REA
retains Ghidra's typed labels when the compared selector has an earlier register
definition; additional labels remain unknown until their relationship to the
typed switch selector can be proved. The oracle rejects extra numeric labels
and verifies each retained target against the source instruction immediate.