[PR #283] [MERGED] fix(dotnet): admit real CLI GUID and fat CIL bodies #1924

New issue

Closed

opened 2026-10-16 21:12:32 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:32 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/283
Author: @N0zoM1z0
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/16/2026
Merged by: @N0zoM1z0

Base: main ← Head: agent/managed-cli-guid

📝 Commits (1)

435ca4a fix(dotnet): admit real CLI GUID and fat CIL bodies

📊 Changes

69 files changed (+583 additions, -202 deletions)

View changed files

📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_permissionPolicy.PermissionGrantError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html (+1 -1)
📝 docs/api/classes/ghidra_GhidraSessionError.GhidraSessionError.html (+1 -1)
📝 docs/api/classes/ghidra_protocol.GhidraRemoteError.html (+1 -1)
📝 docs/api/functions/domain_managedMemberComparison.compareManagedMembers.html (+1 -1)
📝 docs/api/functions/domain_managedMemberComparison.parseManagedMemberEvidence.html (+1 -1)
📝 docs/api/functions/domain_managedNativeVerification.verifyManagedNativeBoundaries.html (+1 -1)
📝 docs/api/functions/domain_managedReconstruction.importManagedReconstruction.html (+1 -1)
📝 docs/api/functions/domain_managedRuntimeCorrelation.planManagedRuntimeCorrelation.html (+1 -1)
📝 docs/api/hierarchy.html (+28 -28)
📝 docs/api/interfaces/application_AnalysisProvider.AnalysisClient.html (+1 -1)
📝 docs/api/interfaces/application_AnalysisProvider.AnalysisOperationPort.html (+1 -1)
📝 docs/api/interfaces/application_AnalysisProvider.AnalysisProvider.html (+1 -1)
📝 docs/api/interfaces/application_AnalysisProvider.AnalysisProviderCandidate.html (+1 -1)

...and 49 more files

📄 Description

Summary

admit every exact 16-byte ECMA-335 CLI metadata GUID instead of requiring RFC 4122 UUID version/variant bits
read fat method-header size from the complete flags-and-size word and validate the full header boundary
decode the complete standard CIL opcode inventory with correct scalar, branch, token, signature, and switch operand widths
fail reserved/unsupported opcodes as malformed instead of normalizing their bytes as operand-free instructions
let operator-local managed application manifests optionally lock the raw CIL SHA-256 in addition to the normalized instruction digest
regenerate caller-visible schemas, TypeDoc, product catalog, and skill metadata

Root cause

The managed output schemas used Zod's RFC UUID validator for MVID, EncId, and EncBaseId. ECMA-335 stores arbitrary 16-byte GUID heap values and does not require RFC version or variant bit patterns, so a valid real-world MVID could reach the parser and then fail at the provider output boundary.

The fat CIL reader also derived the header DWORD count from the high nibble of the first byte. The size field actually occupies the high four bits of the full little-endian flags-and-size word. This shifted real method bodies eight bytes early. A sparse opcode table then compounded the problem by treating unknown bytes as operand-free instructions, producing plausible-looking but incorrect hashes and anchors.

Behavior and compatibility

This is an additive schema admission and a correctness fix. Existing RFC-shaped GUIDs and tiny method bodies retain their behavior. Previously rejected legal CLI GUIDs now succeed. Fat method bodies now produce hashes and anchors from the actual CIL byte range; callers that persisted hashes generated by the buggy fat-header path must recapture the static observation.

ILSpy remains bring-your-own and non-canonical. Decompiled C# stays reconstruction/inference and does not replace REA's static metadata/CIL observations. No target assembly is loaded, reflected, resolved, or executed.

Real application audit

An official local osu!stable 1.3.3.8 executable was kept outside git and matched the existing operator research lock:

target SHA-256: 6e182c10d1813209d12753dbc70b3a5bba00fef4ecf64bc42051870e6dfe4b7d
module MVID: 0ec6eb3a-4adc-4b54-1f45-8b4ed40b33b1
classification: .NET Framework, x86, CIL
21,398 MethodDef rows admitted
9/9 selected Taiko research tokens matched their independently recorded raw CIL lengths and SHA-256 values
all 9 method bodies decoded with no unknown opcode, truncation, or malformed status
ilspycmd 9.1.0.7988 listed the real assembly and reconstructed the selected obfuscated type without stderr; only output byte counts and SHA-256 digests were retained
no proprietary binary, C#, IL dump, or operator manifest is included in this PR

Verification

npx vitest run tests/managedArtifactProvider.test.ts --coverage=false
npm run typecheck
npm run check
npm run docs:generate
npm run docs:check
npm run knip
npm run jscpd
npm run scan:todos
CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package
REA_MANAGED_APP_MANIFEST_PATH=/tmp/rea-osu-real-managed-app-manifest.json REA_ILSPY_CMD_PATH=/home/pentester/.dotnet/tools/ilspycmd npm run verify:managed
git diff --check

Continuation real-provider audits also passed against the same base: Ghidra 12.1.2 verified x86-64 debug/stripped ELF, AArch64 ELF, PE, and Mach-O with complete cleanup; real Notion 7.6.1 app.asar reconstruction completed with six missing unpacked native entries truthfully unavailable. Real Hopper was not run because this dotnet-only change does not affect Hopper and no local Hopper environment was in scope.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/283 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/16/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `agent/managed-cli-guid` --- ### 📝 Commits (1) - [`435ca4a`](https://github.com/morluto/rea/commit/435ca4ad487ae31adf0dbeb4e2ac4cde20eaf36b) fix(dotnet): admit real CLI GUID and fat CIL bodies ### 📊 Changes **69 files changed** (+583 additions, -202 deletions) <details> <summary>View changed files</summary> 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_permissionPolicy.PermissionGrantError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraLauncher.GhidraLaunchError.html` (+1 -1) 📝 `docs/api/classes/ghidra_GhidraSessionError.GhidraSessionError.html` (+1 -1) 📝 `docs/api/classes/ghidra_protocol.GhidraRemoteError.html` (+1 -1) 📝 `docs/api/functions/domain_managedMemberComparison.compareManagedMembers.html` (+1 -1) 📝 `docs/api/functions/domain_managedMemberComparison.parseManagedMemberEvidence.html` (+1 -1) 📝 `docs/api/functions/domain_managedNativeVerification.verifyManagedNativeBoundaries.html` (+1 -1) 📝 `docs/api/functions/domain_managedReconstruction.importManagedReconstruction.html` (+1 -1) 📝 `docs/api/functions/domain_managedRuntimeCorrelation.planManagedRuntimeCorrelation.html` (+1 -1) 📝 `docs/api/hierarchy.html` (+28 -28) 📝 `docs/api/interfaces/application_AnalysisProvider.AnalysisClient.html` (+1 -1) 📝 `docs/api/interfaces/application_AnalysisProvider.AnalysisOperationPort.html` (+1 -1) 📝 `docs/api/interfaces/application_AnalysisProvider.AnalysisProvider.html` (+1 -1) 📝 `docs/api/interfaces/application_AnalysisProvider.AnalysisProviderCandidate.html` (+1 -1) _...and 49 more files_ </details> ### 📄 Description ## Summary - admit every exact 16-byte ECMA-335 CLI metadata GUID instead of requiring RFC 4122 UUID version/variant bits - read fat method-header size from the complete flags-and-size word and validate the full header boundary - decode the complete standard CIL opcode inventory with correct scalar, branch, token, signature, and switch operand widths - fail reserved/unsupported opcodes as malformed instead of normalizing their bytes as operand-free instructions - let operator-local managed application manifests optionally lock the raw CIL SHA-256 in addition to the normalized instruction digest - regenerate caller-visible schemas, TypeDoc, product catalog, and skill metadata ## Root cause The managed output schemas used Zod's RFC UUID validator for MVID, EncId, and EncBaseId. ECMA-335 stores arbitrary 16-byte GUID heap values and does not require RFC version or variant bit patterns, so a valid real-world MVID could reach the parser and then fail at the provider output boundary. The fat CIL reader also derived the header DWORD count from the high nibble of the first byte. The size field actually occupies the high four bits of the full little-endian flags-and-size word. This shifted real method bodies eight bytes early. A sparse opcode table then compounded the problem by treating unknown bytes as operand-free instructions, producing plausible-looking but incorrect hashes and anchors. ## Behavior and compatibility This is an additive schema admission and a correctness fix. Existing RFC-shaped GUIDs and tiny method bodies retain their behavior. Previously rejected legal CLI GUIDs now succeed. Fat method bodies now produce hashes and anchors from the actual CIL byte range; callers that persisted hashes generated by the buggy fat-header path must recapture the static observation. ILSpy remains bring-your-own and non-canonical. Decompiled C# stays reconstruction/inference and does not replace REA's static metadata/CIL observations. No target assembly is loaded, reflected, resolved, or executed. ## Real application audit An official local osu!stable 1.3.3.8 executable was kept outside git and matched the existing operator research lock: - target SHA-256: `6e182c10d1813209d12753dbc70b3a5bba00fef4ecf64bc42051870e6dfe4b7d` - module MVID: `0ec6eb3a-4adc-4b54-1f45-8b4ed40b33b1` - classification: .NET Framework, x86, CIL - 21,398 MethodDef rows admitted - 9/9 selected Taiko research tokens matched their independently recorded raw CIL lengths and SHA-256 values - all 9 method bodies decoded with no unknown opcode, truncation, or malformed status - `ilspycmd 9.1.0.7988` listed the real assembly and reconstructed the selected obfuscated type without stderr; only output byte counts and SHA-256 digests were retained - no proprietary binary, C#, IL dump, or operator manifest is included in this PR ## Verification - `npx vitest run tests/managedArtifactProvider.test.ts --coverage=false` - `npm run typecheck` - `npm run check` - `npm run docs:generate` - `npm run docs:check` - `npm run knip` - `npm run jscpd` - `npm run scan:todos` - `CC=/usr/bin/gcc-13 CXX=/usr/bin/g++-13 npm run verify:package` - `REA_MANAGED_APP_MANIFEST_PATH=/tmp/rea-osu-real-managed-app-manifest.json REA_ILSPY_CMD_PATH=/home/pentester/.dotnet/tools/ilspycmd npm run verify:managed` - `git diff --check` Continuation real-provider audits also passed against the same base: Ghidra 12.1.2 verified x86-64 debug/stripped ELF, AArch64 ELF, PE, and Mach-O with complete cleanup; real Notion 7.6.1 `app.asar` reconstruction completed with six missing unpacked native entries truthfully unavailable. Real Hopper was not run because this dotnet-only change does not affect Hopper and no local Hopper environment was in scope. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:32 +00:00