[GH-ISSUE #3506] [Design] Evidence-supported callee matches for normalized function views #1303

New issue

Open

opened 2026-10-16 21:03:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:03:58 +00:00

Owner

Originally created by @Zburgers on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3506

Before submitting

I searched open and closed issues and PRs for a related discussion.
I understand contribution scope must be reviewed before integration; open questions are welcome here.
This discussion contains no credentials, private samples, or sensitive target data.

Decision needed

What Evidence and matching rules should allow normalized function text views to share callee tokens across builds, recovering relocation coverage without hiding changed call targets?

This is a follow-up to #1947 and #2124, as Pablo recommended. It is a proposed experiment, not an implemented capability or prerequisite for landing the conservative views.

Context and evidence

Observed at PR head 8cde66673, real Ghidra 12.1.4 on Windows 10 x64, using rea-lab's llvm-mingw 20261006 x86/x64 fixtures at -O0/-O2:

Relocation only: 4/12 function comparisons are unchanged in both normalized views; 8/12 remain unknown.
Changed calls: 3/8 views are changed, 5/8 unknown, and none incorrectly unchanged.
Constant edits: all 8 views are changed.
Wallace: addPeople is unchanged; both edited functions are changed in both views.

Full setup and table. These are fixture-specific results, not a general false-equality guarantee. No matching prototype has been run.

Source-derived: caller dossiers supply callee identities and thunk targets, not callee bodies or cross-build correspondence Evidence. Independent ordinal tokens cannot establish that two referenced callees match.

Expected interaction with targets

Read existing files or captured data. The proposed comparison consumes explicit callee analyze_function Evidence; acquiring it uses existing read-only provider workflows. No target execution, injection, database mutation, or implicit provider reads are proposed.

Boundary details

Each shared token must cite a supported cross-build callee match. Preserve Evidence provenance, analysis profiles, unavailable coverage and ambiguity. Address-normalized body digests are candidate matching signals, not proof of procedure identity. Handle own-function thunk targets, thunk chains/cycles, repeated bodies and unresolved nested calls. Unmatched or ambiguous references remain visible or unknown; never assume correspondence from call position.

Options and tradeoffs

Keep the conservative guard as the baseline. Explore an additive explicit callee-Evidence/match input whose owning boundary validates correspondence before normalization. The experiment must determine which matching signals are sufficient; no particular public contract is selected yet.

Verification available so far

I can suggest a sample or manual check. Baseline results exist; matching benefits are unmeasured.

Success criteria and open questions

Run the same compare-pairs and Wallace workflows. Report recovered relocation coverage, false equality and unknowns with full denominators, side by side with the baseline. Include ambiguous identical-body candidates, changed/swapped callees, unavailable Evidence and thunk cycles. Measure additional calls, token estimates, cold/warm elapsed time, CPU and peak process-family memory; explicitly retain unmeasured costs.

Open: how much callee-body/reference coverage is sufficient, how matches are supplied and authenticated, and how recursive dependencies are bounded.

References

Originally created by @Zburgers on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3506 ### Before submitting - [x] I searched open and closed issues and PRs for a related discussion. - [x] I understand contribution scope must be reviewed before integration; open questions are welcome here. - [x] This discussion contains no credentials, private samples, or sensitive target data. ### Decision needed What Evidence and matching rules should allow normalized function text views to share callee tokens across builds, recovering relocation coverage without hiding changed call targets? This is a follow-up to #1947 and #2124, as [Pablo recommended](https://github.com/morluto/rea/issues/1947#issuecomment-6169243713). It is a proposed experiment, not an implemented capability or prerequisite for landing the conservative views. ### Context and evidence Observed at PR head `8cde66673`, real Ghidra 12.1.4 on Windows 10 x64, using rea-lab's llvm-mingw 20261006 x86/x64 fixtures at -O0/-O2: - Relocation only: 4/12 function comparisons are unchanged in both normalized views; 8/12 remain unknown. - Changed calls: 3/8 views are changed, 5/8 unknown, and none incorrectly unchanged. - Constant edits: all 8 views are changed. - Wallace: addPeople is unchanged; both edited functions are changed in both views. [Full setup and table](https://github.com/morluto/rea/pull/2124#issuecomment-6168685446). These are fixture-specific results, not a general false-equality guarantee. No matching prototype has been run. Source-derived: caller dossiers supply callee identities and thunk targets, not callee bodies or cross-build correspondence Evidence. Independent ordinal tokens cannot establish that two referenced callees match. ### Expected interaction with targets Read existing files or captured data. The proposed comparison consumes explicit callee analyze_function Evidence; acquiring it uses existing read-only provider workflows. No target execution, injection, database mutation, or implicit provider reads are proposed. ### Boundary details Each shared token must cite a supported cross-build callee match. Preserve Evidence provenance, analysis profiles, unavailable coverage and ambiguity. Address-normalized body digests are candidate matching signals, not proof of procedure identity. Handle own-function thunk targets, thunk chains/cycles, repeated bodies and unresolved nested calls. Unmatched or ambiguous references remain visible or unknown; never assume correspondence from call position. ### Options and tradeoffs Keep the conservative guard as the baseline. Explore an additive explicit callee-Evidence/match input whose owning boundary validates correspondence before normalization. The experiment must determine which matching signals are sufficient; no particular public contract is selected yet. ### Verification available so far I can suggest a sample or manual check. Baseline results exist; matching benefits are unmeasured. ### Success criteria and open questions Run the same [compare-pairs](https://github.com/pablodiazjorge/rea-lab/tree/main/fixtures/compare-pairs) and Wallace workflows. Report recovered relocation coverage, false equality and unknowns with full denominators, side by side with the baseline. Include ambiguous identical-body candidates, changed/swapped callees, unavailable Evidence and thunk cycles. Measure additional calls, token estimates, cold/warm elapsed time, CPU and peak process-family memory; explicitly retain unmeasured costs. Open: how much callee-body/reference coverage is sufficient, how matches are supplied and authenticated, and how recursive dependencies are bounded. ### References - [Batteryshark's match-based token distinction](https://github.com/morluto/rea/issues/1947#issuecomment-6150554602) - [Pablo's stripped-callee and thunk proposal](https://github.com/morluto/rea/issues/1947#issuecomment-6150792401)

bsakaguchi referenced this issue

2026-10-17 21:10:11 +00:00

[PR #1303] [MERGED] feat(ghidra): support native PE DLLs on Windows #2783

bsakaguchi referenced this issue

2026-10-17 21:10:33 +00:00

[PR #1342] [CLOSED] feat(ghidra): admit native x86 and x86-64 PE DLLs on Windows #2811