[PR #699] [MERGED] feat(ghidra): enable Windows x64 read-only analysis #2179

New issue

Closed

opened 2026-10-16 21:15:17 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:17 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/699
Author: @N0zoM1z0
Created: 10/6/2026
Status: ✅ Merged
Merged: 10/6/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/527-windows-ghidra-launch

📝 Commits (5)

4d8c0e6 feat(ghidra): enable Windows x64 read-only analysis
103875f test(ghidra): exercise native Windows runtime boundaries
432177b Merge remote-tracking branch 'origin/main' into fix/527-windows-ghidra-launch
a435222 test(ghidra): verify current Windows inventory and isolate ACL observer
435e6dd fix(ghidra): align Windows admission and address P0 review

📊 Changes

65 files changed (+4104 additions, -369 deletions)

View changed files

📝 .github/workflows/ci.yml (+41 -10)
📝 .github/workflows/real-ghidra-windows.yml (+33 -1)
📝 .github/workflows/release.yml (+6 -0)
📝 README.md (+6 -6)
📝 bridge/ghidra/ReaGhidraBridge.java (+23 -7)
📝 docs/adr/README.md (+5 -5)
📝 docs/architecture.mermaid (+5 -0)
📝 docs/installation.md (+17 -13)
📝 docs/native-investigation.md (+3 -3)
📝 docs/provider-evaluation.md (+22 -19)
📝 docs/roadmap.md (+11 -12)
📝 docs/testing.md (+9 -2)
📝 docs/windows-ghidra-p0.md (+120 -120)
➕ native/windows/README.md (+102 -0)
➕ native/windows/src/addon.cc (+123 -0)
➕ native/windows/src/authority.hpp (+120 -0)
➕ native/windows/src/filesystem.cc (+531 -0)
➕ native/windows/src/process.cc (+271 -0)
📝 package.json (+10 -2)
➕ scripts/build-windows-native.mjs (+150 -0)

...and 45 more files

📄 Description

Windows detected Ghidra correctly but refused every analysis operation because native process and filesystem controls were unimplemented. This enables the experimental Windows x64 P0 automatically using a bundled Node-API addon, including the current 25 read-only inventory, memory, and function-analysis operations through CLI and MCP.

Closes #527.

Assign suspended provider processes atomically to retained kill-on-close Job Objects; verify descendant settlement without PID-based termination.
Create private runtime objects with current-user ownership and protected DACLs, admit local NTFS objects through retained handles, stream immutable snapshots with cancellation, and clean up without traversing reparse targets.
Fix Windows batch/JVM quoting and bridge endpoint publication, retain actionable native failure reasons, and preserve valid Ghidra/JDK setup configuration.
Build and validate the native artifact in package/release CI. Users need no compiler, extra native runtime, or operation approval flag; Ghidra and JDK remain bring-your-own.

Verification:

Branch verification: npm run check:ci, npm run build:cached, npm run docs:check, and npm run test:run passed: 399 test files, 2,458 tests passed, 2 skipped.
Real Windows x64, Ghidra 12.1.4, JDK 21, Node 22.19: ordinary-user native conformance passed, including independent reparse, breakaway, token, environment, owner-death, and unrelated-process checks. The fresh installed npm artifact passed ordinary-user CLI and 28 MCP calls covering all 25 operations, including loaded-byte/source-offset agreement and explicit unsupported PE attestation with measured mappings.
Installed npm artifact: Windows package maintenance verified the complete tool catalog, setup idempotence, uninstall, and update behavior. Ordinary-user packaged CLI/MCP acceptance validates canonical inputs and outputs for all 25 admitted operations, target digest preservation, and runtime cleanup.
Windows CI fixture integration: all 20 curated test files passed on an ordinary-user token (154 tests passed, 3 platform-specific skips); Linux focused runtime/transport/snapshot tests and static checks passed. These fixtures use the real native private runtime and owned-child file publication; the three affected boundary files also passed on an elevated caller (14 tests).
Final main integration: the locally assembled merge tree exactly matches GitHub merge tree 13378d791e0fb5e8c46de585dda8cd4baa8d1769 (base cf061159). The combined npm artifact also passed ordinary-user Windows CLI and all 25 operations through 28 MCP calls, with zero runtime residuals; 40 affected Ghidra tests passed.
Review regressions: installation-derived platform selection, unavailable Hopper setup idempotence, and real native single-flight cancellation isolation passed.
Native C++ warning check and machine-specific path/credential scans passed. No real Hopper verification was performed.

Resource and scope notes: the native addon is 984,434 bytes; the development npm artifact is approximately 1.45 MiB compressed and 10.92 MiB unpacked. Real Windows analysis tests ran serially with two logical CPUs and a 512 MiB Java heap. Support remains experimental and limited to native x86-64 PE applications on fixed local NTFS volumes, with no GUI or mutation authority. This is not an engine sandbox. Abrupt owner death kills the owned process job but can leave private runtime files; broader hostile-target and mutable-namespace coverage is not established.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/699 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/6/2026 **Status:** ✅ Merged **Merged:** 10/6/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/527-windows-ghidra-launch` --- ### 📝 Commits (5) - [`4d8c0e6`](https://github.com/morluto/rea/commit/4d8c0e6b07201853a3d6985c1dcc819efd108557) feat(ghidra): enable Windows x64 read-only analysis - [`103875f`](https://github.com/morluto/rea/commit/103875f39b3ae1b6cd4dfd34fde49ba57cb0cf37) test(ghidra): exercise native Windows runtime boundaries - [`432177b`](https://github.com/morluto/rea/commit/432177b3ddd831d2af3be3b2cb6ce1cca514ef35) Merge remote-tracking branch 'origin/main' into fix/527-windows-ghidra-launch - [`a435222`](https://github.com/morluto/rea/commit/a435222c9f40fc1f92eaf8a504503a539d8c7514) test(ghidra): verify current Windows inventory and isolate ACL observer - [`435e6dd`](https://github.com/morluto/rea/commit/435e6dded2e19f1d8223fbe04da8863a97e36864) fix(ghidra): align Windows admission and address P0 review ### 📊 Changes **65 files changed** (+4104 additions, -369 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+41 -10) 📝 `.github/workflows/real-ghidra-windows.yml` (+33 -1) 📝 `.github/workflows/release.yml` (+6 -0) 📝 `README.md` (+6 -6) 📝 `bridge/ghidra/ReaGhidraBridge.java` (+23 -7) 📝 `docs/adr/README.md` (+5 -5) 📝 `docs/architecture.mermaid` (+5 -0) 📝 `docs/installation.md` (+17 -13) 📝 `docs/native-investigation.md` (+3 -3) 📝 `docs/provider-evaluation.md` (+22 -19) 📝 `docs/roadmap.md` (+11 -12) 📝 `docs/testing.md` (+9 -2) 📝 `docs/windows-ghidra-p0.md` (+120 -120) ➕ `native/windows/README.md` (+102 -0) ➕ `native/windows/src/addon.cc` (+123 -0) ➕ `native/windows/src/authority.hpp` (+120 -0) ➕ `native/windows/src/filesystem.cc` (+531 -0) ➕ `native/windows/src/process.cc` (+271 -0) 📝 `package.json` (+10 -2) ➕ `scripts/build-windows-native.mjs` (+150 -0) _...and 45 more files_ </details> ### 📄 Description Windows detected Ghidra correctly but refused every analysis operation because native process and filesystem controls were unimplemented. This enables the experimental Windows x64 P0 automatically using a bundled Node-API addon, including the current 25 read-only inventory, memory, and function-analysis operations through CLI and MCP. Closes #527. - Assign suspended provider processes atomically to retained kill-on-close Job Objects; verify descendant settlement without PID-based termination. - Create private runtime objects with current-user ownership and protected DACLs, admit local NTFS objects through retained handles, stream immutable snapshots with cancellation, and clean up without traversing reparse targets. - Fix Windows batch/JVM quoting and bridge endpoint publication, retain actionable native failure reasons, and preserve valid Ghidra/JDK setup configuration. - Build and validate the native artifact in package/release CI. Users need no compiler, extra native runtime, or operation approval flag; Ghidra and JDK remain bring-your-own. Verification: - Branch verification: `npm run check:ci`, `npm run build:cached`, `npm run docs:check`, and `npm run test:run` passed: 399 test files, 2,458 tests passed, 2 skipped. - Real Windows x64, Ghidra 12.1.4, JDK 21, Node 22.19: ordinary-user native conformance passed, including independent reparse, breakaway, token, environment, owner-death, and unrelated-process checks. The fresh installed npm artifact passed ordinary-user CLI and 28 MCP calls covering all 25 operations, including loaded-byte/source-offset agreement and explicit unsupported PE attestation with measured mappings. - Installed npm artifact: Windows package maintenance verified the complete tool catalog, setup idempotence, uninstall, and update behavior. Ordinary-user packaged CLI/MCP acceptance validates canonical inputs and outputs for all 25 admitted operations, target digest preservation, and runtime cleanup. - Windows CI fixture integration: all 20 curated test files passed on an ordinary-user token (154 tests passed, 3 platform-specific skips); Linux focused runtime/transport/snapshot tests and static checks passed. These fixtures use the real native private runtime and owned-child file publication; the three affected boundary files also passed on an elevated caller (14 tests). - Final main integration: the locally assembled merge tree exactly matches GitHub merge tree `13378d791e0fb5e8c46de585dda8cd4baa8d1769` (base `cf061159`). The combined npm artifact also passed ordinary-user Windows CLI and all 25 operations through 28 MCP calls, with zero runtime residuals; 40 affected Ghidra tests passed. - Review regressions: installation-derived platform selection, unavailable Hopper setup idempotence, and real native single-flight cancellation isolation passed. - Native C++ warning check and machine-specific path/credential scans passed. No real Hopper verification was performed. Resource and scope notes: the native addon is 984,434 bytes; the development npm artifact is approximately 1.45 MiB compressed and 10.92 MiB unpacked. Real Windows analysis tests ran serially with two logical CPUs and a 512 MiB Java heap. Support remains experimental and limited to native x86-64 PE applications on fixed local NTFS volumes, with no GUI or mutation authority. This is not an engine sandbox. Abrupt owner death kills the owned process job but can leave private runtime files; broader hostile-target and mutable-namespace coverage is not established. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:17 +00:00