[PR #1030] [MERGED] feat(ghidra): support native x86 PE applications on Windows #2594

New issue

Closed

opened 2026-10-17 21:07:58 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:07:58 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1030
Author: @N0zoM1z0
Created: 10/7/2026
Status: ✅ Merged
Merged: 10/7/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/ghidra-windows-x86

📝 Commits (1)

8511f7d feat(ghidra): support native x86 PE applications on Windows

📊 Changes

15 files changed (+203 additions, -85 deletions)

View changed files

📝 .github/workflows/real-ghidra-windows.yml (+18 -1)
📝 AGENTS.md (+1 -1)
📝 README.md (+5 -5)
📝 docs/installation.md (+1 -1)
📝 docs/managed-code-analysis.md (+1 -1)
📝 docs/provider-evaluation.md (+11 -11)
📝 docs/roadmap.md (+1 -1)
📝 docs/testing.md (+1 -1)
📝 docs/windows-ghidra-p0.md (+6 -2)
📝 scripts/create-ghidra-windows-fixture.mjs (+60 -42)
📝 scripts/verify-packaged-ghidra-windows.mjs (+10 -4)
📝 scripts/verify-real-ghidra-windows.mjs (+28 -3)
📝 src/ghidra/GhidraProvider.behavior.test.ts (+57 -9)
📝 src/ghidra/GhidraProvider.ts (+2 -2)
📝 src/ghidra/GhidraProviderCapabilities.ts (+1 -1)

📄 Description

Windows Ghidra rejected native 32-bit PE applications before import. REA now admits native x86 and x86-64 PE applications on the existing Windows x64 host boundary, using the same immutable snapshots, private runtime, Job Object ownership, and read-only operations.

The source-owned fixture generator produces PE32 and PE32+ applications. Real verification checks Ghidra’s actual language width, known decompiled return value, loaded bytes against source offsets, every admitted operation, and cleanup. The npm-artifact lane now also exercises automatic MCP target selection and binary_overview. The protected default-branch Windows workflow runs both architectures sequentially and uses the HTTPS compiler mirror preparation already verified in #1016.

Closes #806. The independent Java snapshot-reader blocker discovered during reproduction was fixed and merged in #1027 / #1026 first.

With Ghidra configured once, the MCP workflow uses the existing contracts:

{"name":"open_binary","arguments":{"path":"C:\\fixtures\\sample-x86.exe"}}
{"name":"binary_overview","arguments":{}}
{"name":"list_procedures","arguments":{}}

Validation:

Real Windows x64, Node 22.19.0, Ghidra 12.1.4, JDK 21: all 25 raw x86 operations passed; observed language x86:LE:32:default, known return value 42, source-byte mapping, and complete cleanup verified. Peak combined working set approximately 690 MiB with two CPUs and a 512 MiB JVM heap.
npm run test:focused -- src/ghidra/GhidraProvider.behavior.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts src/ghidra/GhidraInstallation.test.ts: 52 tests passed, including generated PE32 admission and managed/DLL rejection.
npm run typecheck, npm run lint, npm run build:cached, npm run docs:check, Oxfmt, and git diff --check. Direct static checks were used after the cached task runner exceeded the configured local memory budget.
Real Windows npm-packed artifact installed with npm ci from an integrity-verified isolated offline cache: x86 CLI providers / inspect, 29 MCP operations including automatic open_binary and binary_overview, ordinary-user token, unchanged target bytes, caller working-directory isolation, and complete cleanup passed. Optional dependencies were omitted for this Ghidra lane. Peak combined working set was approximately 951 MiB. The preceding x86-64 artifact verification passed in #1027.

Native x86 support requires this source change; published npm versions through 5.0.0 still have the previous x86-64 admission boundary. The reporter’s original target was unavailable; the regression uses a controlled 1 KiB PE32 fixture and does not execute it. No real Hopper verification was performed.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1030 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/7/2026 **Status:** ✅ Merged **Merged:** 10/7/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/ghidra-windows-x86` --- ### 📝 Commits (1) - [`8511f7d`](https://github.com/morluto/rea/commit/8511f7dfbacfb7f8df4213909399a1b946470ece) feat(ghidra): support native x86 PE applications on Windows ### 📊 Changes **15 files changed** (+203 additions, -85 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-ghidra-windows.yml` (+18 -1) 📝 `AGENTS.md` (+1 -1) 📝 `README.md` (+5 -5) 📝 `docs/installation.md` (+1 -1) 📝 `docs/managed-code-analysis.md` (+1 -1) 📝 `docs/provider-evaluation.md` (+11 -11) 📝 `docs/roadmap.md` (+1 -1) 📝 `docs/testing.md` (+1 -1) 📝 `docs/windows-ghidra-p0.md` (+6 -2) 📝 `scripts/create-ghidra-windows-fixture.mjs` (+60 -42) 📝 `scripts/verify-packaged-ghidra-windows.mjs` (+10 -4) 📝 `scripts/verify-real-ghidra-windows.mjs` (+28 -3) 📝 `src/ghidra/GhidraProvider.behavior.test.ts` (+57 -9) 📝 `src/ghidra/GhidraProvider.ts` (+2 -2) 📝 `src/ghidra/GhidraProviderCapabilities.ts` (+1 -1) </details> ### 📄 Description Windows Ghidra rejected native 32-bit PE applications before import. REA now admits native x86 and x86-64 PE applications on the existing Windows x64 host boundary, using the same immutable snapshots, private runtime, Job Object ownership, and read-only operations. The source-owned fixture generator produces PE32 and PE32+ applications. Real verification checks Ghidra’s actual language width, known decompiled return value, loaded bytes against source offsets, every admitted operation, and cleanup. The npm-artifact lane now also exercises automatic MCP target selection and `binary_overview`. The protected default-branch Windows workflow runs both architectures sequentially and uses the HTTPS compiler mirror preparation already verified in #1016. Closes #806. The independent Java snapshot-reader blocker discovered during reproduction was fixed and merged in #1027 / #1026 first. With Ghidra configured once, the MCP workflow uses the existing contracts: ```json {"name":"open_binary","arguments":{"path":"C:\\fixtures\\sample-x86.exe"}} {"name":"binary_overview","arguments":{}} {"name":"list_procedures","arguments":{}} ``` Validation: - Real Windows x64, Node 22.19.0, Ghidra 12.1.4, JDK 21: all 25 raw x86 operations passed; observed language `x86:LE:32:default`, known return value 42, source-byte mapping, and complete cleanup verified. Peak combined working set approximately 690 MiB with two CPUs and a 512 MiB JVM heap. - `npm run test:focused -- src/ghidra/GhidraProvider.behavior.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts src/ghidra/GhidraInstallation.test.ts`: 52 tests passed, including generated PE32 admission and managed/DLL rejection. - `npm run typecheck`, `npm run lint`, `npm run build:cached`, `npm run docs:check`, Oxfmt, and `git diff --check`. Direct static checks were used after the cached task runner exceeded the configured local memory budget. - Real Windows npm-packed artifact installed with `npm ci` from an integrity-verified isolated offline cache: x86 CLI `providers` / `inspect`, 29 MCP operations including automatic `open_binary` and `binary_overview`, ordinary-user token, unchanged target bytes, caller working-directory isolation, and complete cleanup passed. Optional dependencies were omitted for this Ghidra lane. Peak combined working set was approximately 951 MiB. The preceding x86-64 artifact verification passed in #1027. Native x86 support requires this source change; published npm versions through 5.0.0 still have the previous x86-64 admission boundary. The reporter’s original target was unavailable; the regression uses a controlled 1 KiB PE32 fixture and does not execute it. No real Hopper verification was performed. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:07:58 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2594

No description provided.

Rows
Columns