[GH-ISSUE #3741] [Feature] zkVM reverse engineering: RISC Zero, SP1 and zkWasm guest images, receipts, journals and proof metadata #1452

New issue

Open

opened 2026-10-16 21:05:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:33 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3741

Problem Statement & Context

Zero-Knowledge Virtual Machines (zkVMs) represent the next evolution in verifiable computation, enabling developers to write standard high-level code (Rust, C++, Go) compiled to standard ISAs (RISC-V or WebAssembly), executing inside a cryptographic prover that outputs a succinct zero-knowledge receipt:

RISC Zero: Executes standard 32-bit RISC-V (RV32IM) binaries inside a zk-STARK circuit, producing a Receipt consisting of a cryptographic seal and a public Journal. Programs are uniquely identified by a 32-byte cryptographic ImageID (Merkle root of the initial memory state).
Succinct SP1: High-performance, open-source zkVM targeting 32-bit RISC-V (RV32IM), utilizing Plonky3 and customized precompiles for hashes (Keccak, SHA-256) and elliptic curves (secp256k1, ed25519).
zkWasm: Proves execution of WebAssembly bytecode modules within an algebraic constraint framework.

When investigating a zkVM-based system (e.g. verifiable coprocessors, ZK light clients, off-chain rollups), analysts encounter cryptographic receipts, image IDs, and public journals without visibility into what the guest program actually computed. REA needs a dedicated zkVM reverse engineering engine capable of disassembling guest ELF/Wasm binaries, validating ImageIDs, decoding public journals, and verifying receipt metadata.

Proposed Architecture

flowchart TD
    A["zkVM Artifact (Guest ELF / ImageID / Receipt / Journal)"] --> B["zkVM Semantic Engine"]
    B --> C["Guest Binary Disassembler (RV32IM / Wasm)"]
    B --> D["ImageID & Initial Memory State Verifier"]
    B --> E["Public Journal & State Deserializer"]
    B --> F["Cryptographic Receipt & Precompile Auditor"]
    
    C --> C1["RISC-V ELF Disassembly (Instruction Stream & Syscalls)"]
    C --> C2["Guest-Host Communication (env::read, env::commit)"]
    
    D --> D1["Memory Page Table Merkle Tree Simulation"]
    D --> D2["ImageID / Program Digest Calculation"]
    
    E --> E1["Journal Byte Payload Decoding (Serde / BCS / Borsh)"]
    E --> E2["Public Input / Output Commitments"]
    
    F --> F1["Receipt Seal Validation (STARK / SNARK Wrapper)"]
    F --> F2["Custom Precompile Usage (Keccak, Secp256k1, BigInt)"]
    
    C & D & E & F --> G["Synthesized zkVM Guest Blueprint & Verified Execution Report"]

Technical Capabilities & Modules

Guest Binary Disassembly (RISC-V RV32IM & Wasm):
- Ingest guest executables: 32-bit RISC-V ELF binaries (for RISC Zero and SP1) or WebAssembly modules (for zkWasm).
- Disassemble standard instructions, identifying zkVM-specific host communication syscalls:
  - sys_read / sys_write: Reading private witness inputs from host.
  - sys_commit: Committing public outputs to the journal.
  - sys_halt: Terminating execution.
ImageID & Initial State Verification:
- Simulate zkVM memory page initialization: partition the ELF image into standard 1 KB memory pages.
- Compute the Merkle tree over the initial memory state using the zkVM's canonical hash function (BabyBear Poseidon2 or Keccak).
- Verify whether a candidate guest binary produces the exact ImageID asserted in an on-chain verifier.
Public Journal Deserialization:
- Extract raw byte slices from public receipt journals.
- Deserialize payload schemas using standard Rust serialization codecs: bincode, serde_json, borsh, postcard.
- Reconstruct structured public claims (e.g., aggregated state roots, verified light client headers).
Hardware Precompile & Acceleration Mapping:
- Identify guest invocations of accelerated precompiles: SHA-256 compression, Keccak-256 f1600 permutations, Secp256k1 point additions/doublings, BigInt modular arithmetic.
- Quantify compute cycles saved by specialized cryptographic hardware gates.
Receipt Verification & On-Chain Wrapper Correlation:
- Verify receipt metadata structure (composite receipts, Groth16 / PLONK SNARK wrappers).
- Correlate zkVM verification keys with deployed Ethereum verifier contracts (RiscZeroGroth16Verifier, SP1Verifier).

Acceptance Criteria

Disassembly of RV32IM guest ELF binaries and identification of zkVM runtime syscalls.
Simulation of memory page layout and calculation of deterministic ImageID digests.
Structured deserialization of public journal byte buffers into typed records.
Identification and mapping of accelerated cryptographic precompiles.
Correlation of guest program hashes with on-chain verifier contracts.

Complements #3621 (Unknown binary file-format inference)
Complements #3716 (Common Bytecode and VM Framework)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3741 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse__engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Zero-Knowledge Virtual Machines (zkVMs) represent the next evolution in verifiable computation, enabling developers to write standard high-level code (Rust, C++, Go) compiled to standard ISAs (RISC-V or WebAssembly), executing inside a cryptographic prover that outputs a succinct zero-knowledge receipt: - **RISC Zero**: Executes standard 32-bit RISC-V (RV32IM) binaries inside a zk-STARK circuit, producing a `Receipt` consisting of a cryptographic seal and a public `Journal`. Programs are uniquely identified by a 32-byte cryptographic `ImageID` (Merkle root of the initial memory state). - **Succinct SP1**: High-performance, open-source zkVM targeting 32-bit RISC-V (RV32IM), utilizing Plonky3 and customized precompiles for hashes (Keccak, SHA-256) and elliptic curves (secp256k1, ed25519). - **zkWasm**: Proves execution of WebAssembly bytecode modules within an algebraic constraint framework. When investigating a zkVM-based system (e.g. verifiable coprocessors, ZK light clients, off-chain rollups), analysts encounter cryptographic receipts, image IDs, and public journals without visibility into what the guest program actually computed. REA needs a dedicated zkVM reverse engineering engine capable of disassembling guest ELF/Wasm binaries, validating ImageIDs, decoding public journals, and verifying receipt metadata. ### Proposed Architecture ```mermaid flowchart TD A["zkVM Artifact (Guest ELF / ImageID / Receipt / Journal)"] --> B["zkVM Semantic Engine"] B --> C["Guest Binary Disassembler (RV32IM / Wasm)"] B --> D["ImageID & Initial Memory State Verifier"] B --> E["Public Journal & State Deserializer"] B --> F["Cryptographic Receipt & Precompile Auditor"] C --> C1["RISC-V ELF Disassembly (Instruction Stream & Syscalls)"] C --> C2["Guest-Host Communication (env::read, env::commit)"] D --> D1["Memory Page Table Merkle Tree Simulation"] D --> D2["ImageID / Program Digest Calculation"] E --> E1["Journal Byte Payload Decoding (Serde / BCS / Borsh)"] E --> E2["Public Input / Output Commitments"] F --> F1["Receipt Seal Validation (STARK / SNARK Wrapper)"] F --> F2["Custom Precompile Usage (Keccak, Secp256k1, BigInt)"] C & D & E & F --> G["Synthesized zkVM Guest Blueprint & Verified Execution Report"] ``` ### Technical Capabilities & Modules 1. **Guest Binary Disassembly (RISC-V RV32IM & Wasm):** - Ingest guest executables: 32-bit RISC-V ELF binaries (for RISC Zero and SP1) or WebAssembly modules (for zkWasm). - Disassemble standard instructions, identifying zkVM-specific host communication syscalls: - `sys_read` / `sys_write`: Reading private witness inputs from host. - `sys_commit`: Committing public outputs to the journal. - `sys_halt`: Terminating execution. 2. **ImageID & Initial State Verification:** - Simulate zkVM memory page initialization: partition the ELF image into standard 1 KB memory pages. - Compute the Merkle tree over the initial memory state using the zkVM's canonical hash function (BabyBear Poseidon2 or Keccak). - Verify whether a candidate guest binary produces the exact `ImageID` asserted in an on-chain verifier. 3. **Public Journal Deserialization:** - Extract raw byte slices from public receipt journals. - Deserialize payload schemas using standard Rust serialization codecs: `bincode`, `serde_json`, `borsh`, `postcard`. - Reconstruct structured public claims (e.g., aggregated state roots, verified light client headers). 4. **Hardware Precompile & Acceleration Mapping:** - Identify guest invocations of accelerated precompiles: SHA-256 compression, Keccak-256 f1600 permutations, Secp256k1 point additions/doublings, BigInt modular arithmetic. - Quantify compute cycles saved by specialized cryptographic hardware gates. 5. **Receipt Verification & On-Chain Wrapper Correlation:** - Verify receipt metadata structure (composite receipts, Groth16 / PLONK SNARK wrappers). - Correlate zkVM verification keys with deployed Ethereum verifier contracts (`RiscZeroGroth16Verifier`, `SP1Verifier`). ### Acceptance Criteria - [ ] Disassembly of RV32IM guest ELF binaries and identification of zkVM runtime syscalls. - [ ] Simulation of memory page layout and calculation of deterministic ImageID digests. - [ ] Structured deserialization of public journal byte buffers into typed records. - [ ] Identification and mapping of accelerated cryptographic precompiles. - [ ] Correlation of guest program hashes with on-chain verifier contracts. ### Related Issues & Dependencies - Complements #3621 (Unknown binary file-format inference) - Complements #3716 (Common Bytecode and VM Framework)

bsakaguchi referenced this issue

2026-10-17 21:11:32 +00:00

[PR #1452] [MERGED] docs(mcp): record real Windows first-query recovery #2896

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1452

No description provided.

Rows
Columns