[PR #284] [MERGED] feat(ghidra): add experimental Windows x64 P0 support #1926

New issue

Closed

opened 2026-10-16 21:12:34 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:12:34 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/284
Author: @N0zoM1z0
Created: 7/16/2026
Status: ✅ Merged
Merged: 7/16/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/windows-ghidra-p0

📝 Commits (10+)

7c83357 feat(target): classify Windows PE admission metadata
55ae3bb feat(ghidra): define the Windows P0 admission boundary
86df7e9 feat(ghidra): inspect Windows headless installations
cb77b02 feat(ghidra): bind imports to admitted target bytes
39fd600 feat(ghidra): add authenticated Windows loopback transport
618a2a0 feat(ghidra): launch bounded Windows headless sessions
c03ba70 ci(ghidra): add Windows P0 acceptance and real-engine lanes
0c8686c feat(doctor): admit the Windows x64 Ghidra boundary
686981d fix(ci): validate packaged Windows CLI commands exactly
c884e71 docs(ghidra): define the experimental Windows P0

📊 Changes

198 files changed (+3801 additions, -575 deletions)

View changed files

📝 .github/workflows/ci.yml (+42 -0)
➕ .github/workflows/real-ghidra-windows.yml (+32 -0)
📝 AGENTS.md (+5 -3)
📝 README.md (+10 -5)
📝 bridge/ghidra/ReaGhidraBridge.java (+96 -11)
📝 docs/adr/0001-provider-selection-and-analysis-profiles.md (+14 -12)
📝 docs/api/assets/hierarchy.js (+1 -1)
📝 docs/api/assets/navigation.js (+1 -1)
📝 docs/api/assets/search.js (+1 -1)
📝 docs/api/classes/application_PermissionAuthority.PermissionPathError.html (+1 -1)
📝 docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html (+1 -1)
📝 docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCancelledError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisInputError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisOutputError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisProtocolError.html (+1 -1)
📝 docs/api/classes/domain_errors.AnalysisTimeoutError.html (+1 -1)
📝 docs/api/classes/domain_errors.ArtifactOperationError.html (+1 -1)

...and 80 more files

📄 Description

Summary

add an experimental Windows x64 Ghidra P0 for approved native x86-64 PE applications
preserve the existing 18-operation read-only Ghidra contract across CLI and MCP
add deterministic PE admission metadata, target snapshot/import digest binding, authenticated IPv4 loopback transport, and bounded Windows process-tree cleanup
add exact Ghidra 12.1.2/JDK 21 Windows inspection, doctor reporting, hosted Windows CI, packaged-artifact verification, and a default-branch-only controlled real-Ghidra workflow
document the security boundary and the gates that remain explicitly unsupported

Why

The public Windows fork demonstrated real user demand, but its implementation predates the current provider registry, evidence, lifecycle, and Ghidra contracts. Porting its behavior directly would bypass upstream's current trust boundaries. This PR migrates the useful P0 intent into the current architecture while keeping provider-specific mechanics in the Ghidra/process adapters.

User and developer impact

Windows x64 users can bring their own official Ghidra 12.1.2 and full 64-bit JDK 21, then analyze approved native x86-64 PE applications through the same CLI/MCP operation surface used on Linux. Windows P0 rejects DLLs, managed PE files, non-x86-64 images, malformed classifications, and other formats before launch.

This is not general Windows parity. It does not claim Hopper, setup mutation, process capture, controlled replay, private DACLs, reparse-point-safe authority, named-pipe identity isolation, or Job Object ownership. The production guide makes those limits explicit.

Validation

npm run typecheck
npm run lint (0 errors)
npm run format:check
npm run docs:check
npm test — 146 files / 997 tests; 81.71% statements, 69.81% branches, 85.28% functions, 83.84% lines
npm run knip
npm run jscpd — 1.99% duplicated lines, within the configured threshold
npm run scan:todos
npm run verify:package
npm run verify:package:windows

Real Hopper verification was not run because Hopper behavior is not changed.

Real Ghidra verification was not run locally because this checkout is Linux without the operator-provided Windows Ghidra installation. The PR adds verify:ghidra:windows and a protected, repository-dispatch, default-branch-only self-hosted workflow; hosted Windows CI validates build, package, admission, transport, lifecycle, and contract seams on the PR without executing untrusted PR code on the real-engine runner.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/284 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 7/16/2026 **Status:** ✅ Merged **Merged:** 7/16/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/windows-ghidra-p0` --- ### 📝 Commits (10+) - [`7c83357`](https://github.com/morluto/rea/commit/7c833571d6b7958ad327b6fb9b66d4685be692c8) feat(target): classify Windows PE admission metadata - [`55ae3bb`](https://github.com/morluto/rea/commit/55ae3bb2ff1753a3ba9857983aede211008e4b50) feat(ghidra): define the Windows P0 admission boundary - [`86df7e9`](https://github.com/morluto/rea/commit/86df7e9add619016104312e932dfe502abfc74b5) feat(ghidra): inspect Windows headless installations - [`cb77b02`](https://github.com/morluto/rea/commit/cb77b02b90bbc0e332bf262b14b098482cd1ce89) feat(ghidra): bind imports to admitted target bytes - [`39fd600`](https://github.com/morluto/rea/commit/39fd6002d7502bc18cb7e0bcb16b36097391bff0) feat(ghidra): add authenticated Windows loopback transport - [`618a2a0`](https://github.com/morluto/rea/commit/618a2a04b437c24423bc5ec3e004c2d33a4187cb) feat(ghidra): launch bounded Windows headless sessions - [`c03ba70`](https://github.com/morluto/rea/commit/c03ba70da9fec9194a505bc71c6a2446e7e513ed) ci(ghidra): add Windows P0 acceptance and real-engine lanes - [`0c8686c`](https://github.com/morluto/rea/commit/0c8686c76220bd365acf55ce39d820a25975b56a) feat(doctor): admit the Windows x64 Ghidra boundary - [`686981d`](https://github.com/morluto/rea/commit/686981d0ef4ed9b762662c6dd3e0652e32eb9bc6) fix(ci): validate packaged Windows CLI commands exactly - [`c884e71`](https://github.com/morluto/rea/commit/c884e718c7f850daf981790e03dcf90808c86171) docs(ghidra): define the experimental Windows P0 ### 📊 Changes **198 files changed** (+3801 additions, -575 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+42 -0) ➕ `.github/workflows/real-ghidra-windows.yml` (+32 -0) 📝 `AGENTS.md` (+5 -3) 📝 `README.md` (+10 -5) 📝 `bridge/ghidra/ReaGhidraBridge.java` (+96 -11) 📝 `docs/adr/0001-provider-selection-and-analysis-profiles.md` (+14 -12) 📝 `docs/api/assets/hierarchy.js` (+1 -1) 📝 `docs/api/assets/navigation.js` (+1 -1) 📝 `docs/api/assets/search.js` (+1 -1) 📝 `docs/api/classes/application_PermissionAuthority.PermissionPathError.html` (+1 -1) 📝 `docs/api/classes/application_ProcessCaptureError.ProcessCaptureError.html` (+1 -1) 📝 `docs/api/classes/application_ProjectPermissionStore.ProjectPermissionStoreError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCancelledError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisCapabilityUnavailableError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisInputError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisOutputError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisProtocolError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.AnalysisTimeoutError.html` (+1 -1) 📝 `docs/api/classes/domain_errors.ArtifactOperationError.html` (+1 -1) _...and 80 more files_ </details> ### 📄 Description ## Summary - add an experimental Windows x64 Ghidra P0 for approved native x86-64 PE applications - preserve the existing 18-operation read-only Ghidra contract across CLI and MCP - add deterministic PE admission metadata, target snapshot/import digest binding, authenticated IPv4 loopback transport, and bounded Windows process-tree cleanup - add exact Ghidra 12.1.2/JDK 21 Windows inspection, doctor reporting, hosted Windows CI, packaged-artifact verification, and a default-branch-only controlled real-Ghidra workflow - document the security boundary and the gates that remain explicitly unsupported ## Why The public Windows fork demonstrated real user demand, but its implementation predates the current provider registry, evidence, lifecycle, and Ghidra contracts. Porting its behavior directly would bypass upstream's current trust boundaries. This PR migrates the useful P0 intent into the current architecture while keeping provider-specific mechanics in the Ghidra/process adapters. ## User and developer impact Windows x64 users can bring their own official Ghidra 12.1.2 and full 64-bit JDK 21, then analyze approved native x86-64 PE applications through the same CLI/MCP operation surface used on Linux. Windows P0 rejects DLLs, managed PE files, non-x86-64 images, malformed classifications, and other formats before launch. This is not general Windows parity. It does not claim Hopper, setup mutation, process capture, controlled replay, private DACLs, reparse-point-safe authority, named-pipe identity isolation, or Job Object ownership. The production guide makes those limits explicit. ## Validation - `npm run typecheck` - `npm run lint` (0 errors) - `npm run format:check` - `npm run docs:check` - `npm test` — 146 files / 997 tests; 81.71% statements, 69.81% branches, 85.28% functions, 83.84% lines - `npm run knip` - `npm run jscpd` — 1.99% duplicated lines, within the configured threshold - `npm run scan:todos` - `npm run verify:package` - `npm run verify:package:windows` Real Hopper verification was not run because Hopper behavior is not changed. Real Ghidra verification was not run locally because this checkout is Linux without the operator-provided Windows Ghidra installation. The PR adds `verify:ghidra:windows` and a protected, repository-dispatch, default-branch-only self-hosted workflow; hosted Windows CI validates build, package, admission, transport, lifecycle, and contract seams on the PR without executing untrusted PR code on the real-engine runner. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:12:34 +00:00