[PR #697] [MERGED] feat(ghidra): verify DOS load images and expose memory evidence #2177

New issue

Closed

opened 2026-10-16 21:15:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/697
Author: @N0zoM1z0
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/ghidra-dos-load-image-evidence

📝 Commits (4)

2d55cbb feat(ghidra): verify DOS load images and expose memory evidence
dd3a0b0 Merge remote-tracking branch 'origin/main' into feat/ghidra-dos-load-image-evidence
3a92e6f fix(cli): describe memory inspection arguments
a063d74 test(ghidra): align bridge fixtures and CLI capability accounting

📊 Changes

35 files changed (+1513 additions, -28 deletions)

View changed files

📝 README.md (+1 -1)
📝 README_ar.md (+1 -1)
📝 README_ja.md (+1 -1)
📝 README_ko.md (+1 -1)
📝 README_zh.md (+1 -1)
📝 bridge/ghidra/ReaGhidraBridge.java (+190 -0)
📝 docs/ghidra-dos.md (+27 -0)
📝 docs/product-catalog.json (+16 -9)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 scripts/verify-real-ghidra-dos.mjs (+95 -2)
📝 skills/reverse-engineer-anything/SKILL.md (+3 -3)
📝 skills/reverse-engineer-anything/references/native-and-artifacts.md (+14 -0)
📝 src/application/DirectAnalysis.ts (+3 -0)
📝 src/cli/coreAnalysisCommands.ts (+57 -0)
📝 src/cliCommandNames.ts (+3 -2)
📝 src/contracts/officialToolContracts.ts (+5 -0)
📝 src/contracts/toolEffects.ts (+1 -0)
📝 src/contracts/toolOutputSchemaGroups.ts (+2 -0)
➕ src/domain/nativeLoadImage.ts (+102 -0)
📝 src/generatedMcpToolCatalog.ts (+1 -1)

...and 15 more files

📄 Description

Changes

Add inspect_native_load_image and rea inspect-native-load-image: independently compare the immutable DOS MZ snapshot with measured Ghidra original/modified FileBytes, complete initialized header/module mappings, memory digests, relocation records and entry points.
Preserve observed values, independent expectations and mismatch coordinates. Distinguish appended overlays, uninitialized memory and unsupported formats. Accept consistent real-mode segment aliases without losing reported coordinates.
Implement existing read_bytes and address_to_file_offset contracts for Ghidra, and add CLI commands. Reads include loader fixups and explicit partial-read completeness; offsets use actual source mappings and reject missing/ambiguous mappings.
Regenerate contracts/product metadata and document the DOS workflow. No extra dependencies or installer changes.

Verification

Focused Vitest: 86 tests across load-image comparison, boundary parsing, provider projection/session handling and actual MCP contracts. Negative controls cover wrong bytes, source identities, ranges, relocation records, valid/invalid aliases, entries and malformed output.
Additional targeted checks cover CLI/catalog completeness and Ghidra client lifecycle, including snapshot availability before startup, during import and after close.
npm run check:fast and npm run docs:check.
Actual node scripts/verify-real-ghidra-dos.mjs: Linux x64, Ghidra 12.1.4; source-built MZ fixture, CLI/MCP parity for all three operations, near/far decompilation, relocated bytes, header/module offsets, partial/unmapped reads, unchanged input and owned-process cleanup. Run fb6f4150-3444-44f7-a0e0-a2f6dde488b8.
Three additional private local DOS analysis images checked with actual Ghidra. Two are diagnostic decoded derivatives, with identities kept separate from their original inputs. No proprietary binaries, projects, paths, digests or output are committed.
Real Hopper verification was not performed; its new-operation capability remains unsupported.

MCP examples (public source fixture)

{"name":"inspect_native_load_image","arguments":{}}
{"name":"read_bytes","arguments":{"address":"0x10009","length":2}}
{"name":"address_to_file_offset","arguments":{"address":"HEADER:0x0"}}

Verification establishes the declared import coverage. It does not establish DOS runtime execution, original source equivalence, or the first differing byte within a mismatching digest range.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/697 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/ghidra-dos-load-image-evidence` --- ### 📝 Commits (4) - [`2d55cbb`](https://github.com/morluto/rea/commit/2d55cbbdaa027531b44093dbe8c58aa79f2216bd) feat(ghidra): verify DOS load images and expose memory evidence - [`dd3a0b0`](https://github.com/morluto/rea/commit/dd3a0b0c4e52b02e92da99738d5999daa61da4c7) Merge remote-tracking branch 'origin/main' into feat/ghidra-dos-load-image-evidence - [`3a92e6f`](https://github.com/morluto/rea/commit/3a92e6f1d90b379b046d67cdf43c5276d6622584) fix(cli): describe memory inspection arguments - [`a063d74`](https://github.com/morluto/rea/commit/a063d744fb7486107e16f1835ebc90522bbba64e) test(ghidra): align bridge fixtures and CLI capability accounting ### 📊 Changes **35 files changed** (+1513 additions, -28 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+1 -1) 📝 `README_ar.md` (+1 -1) 📝 `README_ja.md` (+1 -1) 📝 `README_ko.md` (+1 -1) 📝 `README_zh.md` (+1 -1) 📝 `bridge/ghidra/ReaGhidraBridge.java` (+190 -0) 📝 `docs/ghidra-dos.md` (+27 -0) 📝 `docs/product-catalog.json` (+16 -9) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `scripts/verify-real-ghidra-dos.mjs` (+95 -2) 📝 `skills/reverse-engineer-anything/SKILL.md` (+3 -3) 📝 `skills/reverse-engineer-anything/references/native-and-artifacts.md` (+14 -0) 📝 `src/application/DirectAnalysis.ts` (+3 -0) 📝 `src/cli/coreAnalysisCommands.ts` (+57 -0) 📝 `src/cliCommandNames.ts` (+3 -2) 📝 `src/contracts/officialToolContracts.ts` (+5 -0) 📝 `src/contracts/toolEffects.ts` (+1 -0) 📝 `src/contracts/toolOutputSchemaGroups.ts` (+2 -0) ➕ `src/domain/nativeLoadImage.ts` (+102 -0) 📝 `src/generatedMcpToolCatalog.ts` (+1 -1) _...and 15 more files_ </details> ### 📄 Description ## Changes - Add `inspect_native_load_image` and `rea inspect-native-load-image`: independently compare the immutable DOS MZ snapshot with measured Ghidra original/modified FileBytes, complete initialized header/module mappings, memory digests, relocation records and entry points. - Preserve observed values, independent expectations and mismatch coordinates. Distinguish appended overlays, uninitialized memory and unsupported formats. Accept consistent real-mode segment aliases without losing reported coordinates. - Implement existing `read_bytes` and `address_to_file_offset` contracts for Ghidra, and add CLI commands. Reads include loader fixups and explicit partial-read completeness; offsets use actual source mappings and reject missing/ambiguous mappings. - Regenerate contracts/product metadata and document the DOS workflow. No extra dependencies or installer changes. ## Verification - Focused Vitest: 86 tests across load-image comparison, boundary parsing, provider projection/session handling and actual MCP contracts. Negative controls cover wrong bytes, source identities, ranges, relocation records, valid/invalid aliases, entries and malformed output. - Additional targeted checks cover CLI/catalog completeness and Ghidra client lifecycle, including snapshot availability before startup, during import and after close. - `npm run check:fast` and `npm run docs:check`. - Actual `node scripts/verify-real-ghidra-dos.mjs`: Linux x64, Ghidra 12.1.4; source-built MZ fixture, CLI/MCP parity for all three operations, near/far decompilation, relocated bytes, header/module offsets, partial/unmapped reads, unchanged input and owned-process cleanup. Run `fb6f4150-3444-44f7-a0e0-a2f6dde488b8`. - Three additional private local DOS analysis images checked with actual Ghidra. Two are diagnostic decoded derivatives, with identities kept separate from their original inputs. No proprietary binaries, projects, paths, digests or output are committed. - Real Hopper verification was not performed; its new-operation capability remains unsupported. ## MCP examples (public source fixture) ```json {"name":"inspect_native_load_image","arguments":{}} {"name":"read_bytes","arguments":{"address":"0x10009","length":2}} {"name":"address_to_file_offset","arguments":{"address":"HEADER:0x0"}} ``` Verification establishes the declared import coverage. It does not establish DOS runtime execution, original source equivalence, or the first differing byte within a mismatching digest range. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:17 +00:00