morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1037] [MERGED] feat(native): inspect offline ELF layout through pwntools #2600

New issue

Closed

opened 2026-10-17 21:08:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:05 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1037
Author: @N0zoM1z0
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: feat/binary-layout

📝 Commits (10+)

0904e60 feat(native): inspect offline ELF layout through pwntools
3ed4377 fix(build): prepare offline ELF verification on clean runners
2749789 fix(native): preserve snapshot acquisition cancellation
d17822e fix(native): handle sectionless ELF and retain decoder diagnostics
35a0f5e test(native): verify malformed symbol table entry sizes
f87ed73 fix(native): respect inherited limits and unused segment fields
b1713f0 fix(native): preserve packed relocations and decoder launch constraints
25701cd fix(native): validate symbol spans and preserve resource failures
7483290 fix(native): preserve diagnostic completeness and memory failures
b095c76 fix(native): guard bridge imports against allocation failures

📊 Changes

59 files changed (+5068 additions, -45 deletions)

View changed files

➕ .github/workflows/real-binary-layout.yml (+78 -0)
📝 README.md (+1 -0)
📝 README_ar.md (+14 -14)
📝 README_ja.md (+1 -1)
📝 README_ko.md (+1 -1)
📝 README_zh.md (+1 -1)
➕ bridge/pwntools/layout.py (+39 -0)
➕ bridge/pwntools/layout_impl.py (+356 -0)
📝 docs/architecture.mermaid (+4 -0)
➕ docs/binary-diagnostics.md (+131 -0)
📝 docs/error-contract.schema.json (+53 -0)
📝 docs/product-catalog.json (+17 -9)
📝 docs/testing.md (+17 -0)
📝 docs/verification/managed-conformance-manifest.json (+2 -2)
📝 package.json (+6 -2)
➕ scripts/fixtures/binary-layout-high.S (+10 -0)
➕ scripts/fixtures/binary-layout.c (+17 -0)
📝 scripts/lib/catalog-builders.mjs (+9 -1)
📝 scripts/lib/catalog-core.mjs (+3 -0)
➕ scripts/lib/elf-section-name-fixtures.mjs (+88 -0)

...and 39 more files

📄 Description

Summary

Refs #969. General binary diagnostics; CTF is one showcase.

Add target-free inspect_binary_layout / inspect-binary-layout through unchanged BYO pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Initial profile: Linux x64, ELF64 x86-64 little-endian EXEC/DYN/REL.
Separate portable contracts, shared Evidence workflow, provider protocol and named CLI/MCP adapters. Return full results and normalized_result inline.
Preserve original section/segment/symbol/relocation identity, raw names/ranges and lossless numbers. Distinguish linked, section, TLS, alignment, absent and unresolved values; preserve RELR encoding and inferred offsets.
Bound dynamic tags and interpreter names; retain opaque dependency/path bytes with replacement-only display. Mitigation/GOT/PLT candidates and static Unicorn emulation remain separate from runtime behavior.
Own snapshots/process cleanup and preserve diagnostic truncation. Retain actual inherited limits or explicit unknowns. Interpret reserved memory/file-size exits only with matching failure-branch markers; bare launcher exits remain unverified. Preserve output through application cancellation and malformed-result errors.
Add provenance, guides and conditional real-tool CI. No engine installation, host configuration changes or target host launch. Recorded cores, GDB/pwndbg and instruction queries remain separate increments.

CLI / MCP

rea inspect-binary-layout ./selected.elf --json

{"name":"inspect_binary_layout","arguments":{"path":"/artifacts/selected.elf"}}

Verification

Current head: 1a740ea3, integrated with main 8d5c88f1 (including LLDB call observation). Catalog has136 tools; independent ELF diagnostics add one tool.

Domain/service/provider/SDK: 87 passed, one host skip. Latest-main catalog/contracts/CLI/MCP integration: 23 passed; seven advertised-schema checks passed.
npm run check:fast; npm run docs:check; regenerated metadata/documents and skill routing are current.
Fresh isolated installed proofs: 26 string-reference cases, 21 canonical-encoding cases, plus a separate five-case large MCP/reserved-index proof passed. The last21-case proof reproduced two earlier false successes. Package implementation matches source; inputs unchanged and descendants empty.
The earlier fixtures that used SHN_XINDEX for small indices were incorrectly considered valid; they are now malformed regressions. A genuine65,281-section fixture establishes actual large-index behavior. Its complete MCP result requires an explicitly enlarged SDK receive buffer and request timeout. Ordinary SDK-default cases remain covered.
Earlier resource/opaque-name proofs and CI are recorded separately. CI at 4ac0f1cb passed all30 checks, including146 public + four bootstrap cases. Current ordinary lane is149 public + four bootstrap; the optional large MCP lane is150 + four. All30 latest-head checks passed, including149 public + four bootstrap cases. Latest-head automated review completed with no new findings; all review threads resolved.
Fresh latest-main package smoke: four public ordinary/sectionless CLI/MCP cases and136-tool inventory passed. The bridge/provider/application bytes match source/dist. Large-result usability follow-up: #1050.
Lower inherited memory/file/CPU limits, truncation, cancellation, launch failures and independent cleanup covered. Exec observations distinguish static Unicorn emulation from target host execution.

Hopper/Ghidra/LLDB were not run locally for this capability. No private game data, binary fixtures or reference clones committed/packaged.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1037 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `feat/binary-layout` --- ### 📝 Commits (10+) - [`0904e60`](https://github.com/morluto/rea/commit/0904e60ba8fc1935b7539bc8a528a6dc25a95ae1) feat(native): inspect offline ELF layout through pwntools - [`3ed4377`](https://github.com/morluto/rea/commit/3ed43778b384550bba607f4ae325c180eea0b0a2) fix(build): prepare offline ELF verification on clean runners - [`2749789`](https://github.com/morluto/rea/commit/27497895ae03ad19da36cf5a5079607ea2acb6d4) fix(native): preserve snapshot acquisition cancellation - [`d17822e`](https://github.com/morluto/rea/commit/d17822e7792fc72136c45eea5dd10141dfd07b3c) fix(native): handle sectionless ELF and retain decoder diagnostics - [`35a0f5e`](https://github.com/morluto/rea/commit/35a0f5e3436b4c303ea332912b495ffca210486d) test(native): verify malformed symbol table entry sizes - [`f87ed73`](https://github.com/morluto/rea/commit/f87ed7321f04182e10bfeb83c82cf756d30eb5f9) fix(native): respect inherited limits and unused segment fields - [`b1713f0`](https://github.com/morluto/rea/commit/b1713f0048e9ee2b048df9b88211fcd56cd62158) fix(native): preserve packed relocations and decoder launch constraints - [`25701cd`](https://github.com/morluto/rea/commit/25701cdccceb373f228f4c3d84358e01af98bca7) fix(native): validate symbol spans and preserve resource failures - [`7483290`](https://github.com/morluto/rea/commit/7483290b4151bc0d1e3c324e54a1ae54eb34ee6b) fix(native): preserve diagnostic completeness and memory failures - [`b095c76`](https://github.com/morluto/rea/commit/b095c76f934e70878620830893dea149379663ac) fix(native): guard bridge imports against allocation failures ### 📊 Changes **59 files changed** (+5068 additions, -45 deletions) <details> <summary>View changed files</summary> ➕ `.github/workflows/real-binary-layout.yml` (+78 -0) 📝 `README.md` (+1 -0) 📝 `README_ar.md` (+14 -14) 📝 `README_ja.md` (+1 -1) 📝 `README_ko.md` (+1 -1) 📝 `README_zh.md` (+1 -1) ➕ `bridge/pwntools/layout.py` (+39 -0) ➕ `bridge/pwntools/layout_impl.py` (+356 -0) 📝 `docs/architecture.mermaid` (+4 -0) ➕ `docs/binary-diagnostics.md` (+131 -0) 📝 `docs/error-contract.schema.json` (+53 -0) 📝 `docs/product-catalog.json` (+17 -9) 📝 `docs/testing.md` (+17 -0) 📝 `docs/verification/managed-conformance-manifest.json` (+2 -2) 📝 `package.json` (+6 -2) ➕ `scripts/fixtures/binary-layout-high.S` (+10 -0) ➕ `scripts/fixtures/binary-layout.c` (+17 -0) 📝 `scripts/lib/catalog-builders.mjs` (+9 -1) 📝 `scripts/lib/catalog-core.mjs` (+3 -0) ➕ `scripts/lib/elf-section-name-fixtures.mjs` (+88 -0) _...and 39 more files_ </details> ### 📄 Description ## Summary Refs #969. General binary diagnostics; CTF is one showcase. - Add target-free `inspect_binary_layout` / `inspect-binary-layout` through unchanged BYO pwntools 4.15.0, pyelftools 0.33 and Unicorn 2.1.2. Initial profile: Linux x64, ELF64 x86-64 little-endian EXEC/DYN/REL. - Separate portable contracts, shared Evidence workflow, provider protocol and named CLI/MCP adapters. Return full results and `normalized_result` inline. - Preserve original section/segment/symbol/relocation identity, raw names/ranges and lossless numbers. Distinguish linked, section, TLS, alignment, absent and unresolved values; preserve RELR encoding and inferred offsets. - Bound dynamic tags and interpreter names; retain opaque dependency/path bytes with replacement-only display. Mitigation/GOT/PLT candidates and static Unicorn emulation remain separate from runtime behavior. - Own snapshots/process cleanup and preserve diagnostic truncation. Retain actual inherited limits or explicit unknowns. Interpret reserved memory/file-size exits only with matching failure-branch markers; bare launcher exits remain unverified. Preserve output through application cancellation and malformed-result errors. - Add provenance, guides and conditional real-tool CI. No engine installation, host configuration changes or target host launch. Recorded cores, GDB/pwndbg and instruction queries remain separate increments. ## CLI / MCP ```sh rea inspect-binary-layout ./selected.elf --json ``` ```json {"name":"inspect_binary_layout","arguments":{"path":"/artifacts/selected.elf"}} ``` ## Verification Current head: `1a740ea3`, integrated with main `8d5c88f1` (including LLDB call observation). Catalog has136 tools; independent ELF diagnostics add one tool. - Domain/service/provider/SDK: **87 passed, one host skip**. Latest-main catalog/contracts/CLI/MCP integration: **23 passed**; **seven advertised-schema checks passed**. - `npm run check:fast`; `npm run docs:check`; regenerated metadata/documents and skill routing are current. - Fresh isolated installed proofs: **26 string-reference cases**, **21 canonical-encoding cases**, plus a separate **five-case large MCP/reserved-index proof** passed. The last21-case proof reproduced two earlier false successes. Package implementation matches source; inputs unchanged and descendants empty. - The earlier fixtures that used SHN_XINDEX for small indices were incorrectly considered valid; they are now malformed regressions. A genuine65,281-section fixture establishes actual large-index behavior. Its complete MCP result requires an explicitly enlarged SDK receive buffer and request timeout. Ordinary SDK-default cases remain covered. - Earlier resource/opaque-name proofs and CI are recorded separately. CI at `4ac0f1cb` passed all30 checks, including146 public + four bootstrap cases. **Current ordinary lane is149 public + four bootstrap; the optional large MCP lane is150 + four. All30 latest-head checks passed, including149 public + four bootstrap cases. Latest-head automated review completed with no new findings; all review threads resolved.** - Fresh latest-main package smoke: **four public ordinary/sectionless CLI/MCP cases and136-tool inventory** passed. The bridge/provider/application bytes match source/dist. Large-result usability follow-up: #1050. - Lower inherited memory/file/CPU limits, truncation, cancellation, launch failures and independent cleanup covered. Exec observations distinguish static Unicorn emulation from target host execution. Hopper/Ghidra/LLDB were not run locally for this capability. No private game data, binary fixtures or reference clones committed/packaged. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:05 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:42:35 +00:00

[GH-ISSUE #5965] [Bug] Historical capture reply-budget refusals use unreadable-result and doctor advice #3634

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2600

No description provided.

Rows
Columns