[PR #247] [MERGED] feat(ghidra): add function analysis and conformance #1897

New issue

Closed

opened 2026-10-16 21:12:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/247
Author: @N0zoM1z0
Created: 7/15/2026
Status: ✅ Merged
Merged: 7/15/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/add-ghidra-function-analysis

📝 Commits (1)

26b15da feat(ghidra): add function analysis and conformance

📊 Changes

131 files changed (+4226 additions, -303 deletions)

View changed files

📝 AGENTS.md (+5 -5)
📝 README.md (+15 -13)
📝 README_ar.md (+4 -4)
📝 README_ja.md (+3 -3)
📝 README_ko.md (+3 -3)
📝 README_zh.md (+3 -3)
📝 bridge/ghidra/ReaGhidraBridge.java (+777 -8)
📝 bridge/hopper_bridge.py (+13 -3)
📝 docs/adr/0001-provider-selection-and-analysis-profiles.md (+14 -10)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_permissionPolicy.PermissionGrantError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraClient.GhidraClient.html (+12 -12)
📝 docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraProvider.GhidraProvider.html (+8 -8)
➕ docs/api/classes/ghidra_GhidraRequestQueue.GhidraRequestQueue.html (+109 -0)

...and 80 more files

📄 Description

Summary

Admit eight read-only Ghidra function-analysis operations: function metadata, pseudocode, assembly, callers, callees, typed references, xrefs, and complete function dossiers.
Keep provider-specific facts at the adapter boundary while extending shared dossiers with explicit function classification, reference-kind availability, and limitations.
Add a persistent per-Program decompiler, a bounded serial request queue, multi-format real-Ghidra conformance fixtures, and refreshed user/API documentation.

Contract and behavior

Ghidra now advertises 18 proved operations (10 inventory plus 8 function operations); the public 78-tool CLI/MCP inventory is unchanged.
One DecompInterface lives for the imported Program. Native decompilation has a 30-second deadline and a bounded 35-second adapter projection window.
A FIFO queue admits at most 32 active-plus-queued requests. Queue wait counts against the request deadline, queued cancellation is prompt, and cleanup rejects pending work.
Ghidra function identities preserve FunctionManager external/thunk facts. References preserve ReferenceManager types and flow/data metadata. Synthetic entry-point references without actionable memory sources are omitted and declared.
Targetless indirect/computed flow remains unknown. Ghidra and Hopper pseudocode/assembly are never compared as equivalent source text.
Hopper retains its existing behavior and now reports unavailable classification/reference-kind authority explicitly.
No GUI navigation or mutation capability is added.

Example request:

{"name":"analyze_function","arguments":{"procedure":"0x401000","include_assembly":true,"limit":100}}

The result remains Evidence v2 with the selected provider/profile, target digest, normalized dossier, and explicit limitations.

Verification

npm run check — 122 test files and 853 tests passed; statements 83.33%, branches 72.35%.
npm run typecheck
npm run format:check
npm run docs:check
npm run knip
npm run jscpd — within the configured threshold.
npm run scan:todos
CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package under Node 22.19.0 — isolated tarball install, CLI/setup/skill, 6 prompts, and target-free 78-tool MCP passed.
GHIDRA_INSTALL_DIR=<ghidra-12.1.2> npm run verify:ghidra — real Ghidra passed on debug and stripped x86-64 ELF, AArch64 ELF, x86-64 PE, and x86-64 Mach-O, including malformed target rejection, cancellation, timeout, concurrency, and cleanup.
HOPPER_TARGET_PATH=/bin/true HOPPER_SECOND_TARGET_PATH=/bin/ls npm run verify:hopper:linux — real Hopper 6.4.2 passed both distinct binaries, target switching, shared dossier compatibility, and clean shutdown.

Real Hopper verification was performed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/247 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/15/2026 **Status:** ✅ Merged **Merged:** 7/15/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/add-ghidra-function-analysis` --- ### 📝 Commits (1) - [`26b15da`](https://github.com/morluto/rea/commit/26b15da94d8f880058607b0b12ef28ee672fe063) feat(ghidra): add function analysis and conformance ### 📊 Changes **131 files changed** (+4226 additions, -303 deletions) <details> <summary>View changed files</summary> 📝 `AGENTS.md` (+5 -5) 📝 `README.md` (+15 -13) 📝 `README_ar.md` (+4 -4) 📝 `README_ja.md` (+3 -3) 📝 `README_ko.md` (+3 -3) 📝 `README_zh.md` (+3 -3) 📝 `bridge/ghidra/ReaGhidraBridge.java` (+777 -8) 📝 `bridge/hopper_bridge.py` (+13 -3) 📝 `docs/adr/0001-provider-selection-and-analysis-profiles.md` (+14 -10) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_permissionPolicy.PermissionGrantError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraClient.GhidraClient.html` (+12 -12) 📝 `docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraProvider.GhidraProvider.html` (+8 -8) ➕ `docs/api/classes/ghidra_GhidraRequestQueue.GhidraRequestQueue.html` (+109 -0) _...and 80 more files_ </details> ### 📄 Description ## Summary - Admit eight read-only Ghidra function-analysis operations: function metadata, pseudocode, assembly, callers, callees, typed references, xrefs, and complete function dossiers. - Keep provider-specific facts at the adapter boundary while extending shared dossiers with explicit function classification, reference-kind availability, and limitations. - Add a persistent per-Program decompiler, a bounded serial request queue, multi-format real-Ghidra conformance fixtures, and refreshed user/API documentation. ## Contract and behavior - Ghidra now advertises 18 proved operations (10 inventory plus 8 function operations); the public 78-tool CLI/MCP inventory is unchanged. - One `DecompInterface` lives for the imported Program. Native decompilation has a 30-second deadline and a bounded 35-second adapter projection window. - A FIFO queue admits at most 32 active-plus-queued requests. Queue wait counts against the request deadline, queued cancellation is prompt, and cleanup rejects pending work. - Ghidra function identities preserve FunctionManager external/thunk facts. References preserve ReferenceManager types and flow/data metadata. Synthetic entry-point references without actionable memory sources are omitted and declared. - Targetless indirect/computed flow remains unknown. Ghidra and Hopper pseudocode/assembly are never compared as equivalent source text. - Hopper retains its existing behavior and now reports unavailable classification/reference-kind authority explicitly. - No GUI navigation or mutation capability is added. Example request: ```json {"name":"analyze_function","arguments":{"procedure":"0x401000","include_assembly":true,"limit":100}} ``` The result remains Evidence v2 with the selected provider/profile, target digest, normalized dossier, and explicit limitations. ## Verification - `npm run check` — 122 test files and 853 tests passed; statements 83.33%, branches 72.35%. - `npm run typecheck` - `npm run format:check` - `npm run docs:check` - `npm run knip` - `npm run jscpd` — within the configured threshold. - `npm run scan:todos` - `CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package` under Node 22.19.0 — isolated tarball install, CLI/setup/skill, 6 prompts, and target-free 78-tool MCP passed. - `GHIDRA_INSTALL_DIR=<ghidra-12.1.2> npm run verify:ghidra` — real Ghidra passed on debug and stripped x86-64 ELF, AArch64 ELF, x86-64 PE, and x86-64 Mach-O, including malformed target rejection, cancellation, timeout, concurrency, and cleanup. - `HOPPER_TARGET_PATH=/bin/true HOPPER_SECOND_TARGET_PATH=/bin/ls npm run verify:hopper:linux` — real Hopper 6.4.2 passed both distinct binaries, target switching, shared dossier compatibility, and clean shutdown. Real Hopper verification was performed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:17 +00:00