[PR #1268] [MERGED] fix(ghidra): preserve decoded return flow evidence #2750

New issue

Closed

opened 2026-10-17 21:09:49 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:09:49 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1268
Author: @N0zoM1z0
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/9/2026
Merged by: @N0zoM1z0

Base: main ← Head: fix/ghidra-return-flow

📝 Commits (1)

bcc8a77 fix(ghidra): preserve decoded return flow evidence

📊 Changes

8 files changed (+174 additions, -4 deletions)

View changed files

📝 bridge/ghidra/ReaGhidraBridge.java (+19 -2)
📝 docs/native-investigation.md (+13 -0)
📝 scripts/lib/real-ghidra-boundaries.mjs (+3 -0)
➕ scripts/lib/real-ghidra-instruction-flow.mjs (+110 -0)
📝 scripts/verify-real-ghidra-function.mjs (+1 -2)
📝 src/domain/native/nativeInstruction.ts (+11 -0)
📝 src/ghidra/GhidraAnalysisProfile.ts (+1 -0)
📝 tests/conformance/ghidra/inventory.c (+16 -0)

📄 Description

Ghidra decoded RET instructions were reported as generic terminal flow even though instruction p-code identifies a RETURN. Preserve that decoded observation as flow.kind: "return" and expose optional flow.classification_evidence with the original Listing flow type and p-code fact. Call/jump classifications and function extents retain their existing provider semantics; trap and shared-tail controls are checked separately.

Example result from the owned fixture:

{"flow":{"kind":"return","conditional":false,"computed":false,"direct_destinations":[],"classification_evidence":[{"source":"ghidra-listing-flow-type","value":"TERMINATOR"},{"source":"ghidra-instruction-pcode","value":"RETURN"}]}}

The Ghidra analysis profile commits the changed decoder semantics, preventing replay of older generic terminal results. Old retained Evidence still validates through rea evidence-import; the guide describes regenerating the analysis snapshot. Other providers and older captures may omit the new field.

Also correct the real verifier's assumption that every decoded instruction has an operand: zero-operand CET ENDBR64 is valid. RET-with-cleanup provides a separate real operand check.

Validation:

Full npm run verify:ghidra on Linux x64, Ghidra 12.1.4 / JDK 21, owned debug/stripped/type-layout fixtures. Converted CLI/MCP schemas, catalog (139 tools), 287 successful / 52 rejected boundary calls, annotation rollback, cancellation, cleanup, and unchanged input bytes passed.
Plain RET, RET with cleanup, shared-tail JMP, UD2, outside-memory and returning source-leaf controls; CLI/MCP return parity and unchanged function resolution.
Rechecked the originally audited return on the supplied target. Old-profile snapshot rejection, fresh inspection, target immutability, and importing its 19 old Evidence records passed.
Four focused files / 26 tests, npm run check, npm run docs:check.

The real lane ran with two CPUs and a 512 MiB Java heap. This is Linux verification; no new real Hopper, macOS, ARM, or Windows coverage is claimed.

Closes #1242
Closes #1238
Related: #1065, #491

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1268 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/9/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `fix/ghidra-return-flow` --- ### 📝 Commits (1) - [`bcc8a77`](https://github.com/morluto/rea/commit/bcc8a773e2a714e4899755b786a4fef1539bbace) fix(ghidra): preserve decoded return flow evidence ### 📊 Changes **8 files changed** (+174 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `bridge/ghidra/ReaGhidraBridge.java` (+19 -2) 📝 `docs/native-investigation.md` (+13 -0) 📝 `scripts/lib/real-ghidra-boundaries.mjs` (+3 -0) ➕ `scripts/lib/real-ghidra-instruction-flow.mjs` (+110 -0) 📝 `scripts/verify-real-ghidra-function.mjs` (+1 -2) 📝 `src/domain/native/nativeInstruction.ts` (+11 -0) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+1 -0) 📝 `tests/conformance/ghidra/inventory.c` (+16 -0) </details> ### 📄 Description Ghidra decoded RET instructions were reported as generic terminal flow even though instruction p-code identifies a RETURN. Preserve that decoded observation as `flow.kind: "return"` and expose optional `flow.classification_evidence` with the original Listing flow type and p-code fact. Call/jump classifications and function extents retain their existing provider semantics; trap and shared-tail controls are checked separately. Example result from the owned fixture: ```json {"flow":{"kind":"return","conditional":false,"computed":false,"direct_destinations":[],"classification_evidence":[{"source":"ghidra-listing-flow-type","value":"TERMINATOR"},{"source":"ghidra-instruction-pcode","value":"RETURN"}]}} ``` The Ghidra analysis profile commits the changed decoder semantics, preventing replay of older generic terminal results. Old retained Evidence still validates through `rea evidence-import`; the guide describes regenerating the analysis snapshot. Other providers and older captures may omit the new field. Also correct the real verifier's assumption that every decoded instruction has an operand: zero-operand CET ENDBR64 is valid. RET-with-cleanup provides a separate real operand check. Validation: - Full `npm run verify:ghidra` on Linux x64, Ghidra 12.1.4 / JDK 21, owned debug/stripped/type-layout fixtures. Converted CLI/MCP schemas, catalog (139 tools), 287 successful / 52 rejected boundary calls, annotation rollback, cancellation, cleanup, and unchanged input bytes passed. - Plain RET, RET with cleanup, shared-tail JMP, UD2, outside-memory and returning source-leaf controls; CLI/MCP return parity and unchanged function resolution. - Rechecked the originally audited return on the supplied target. Old-profile snapshot rejection, fresh inspection, target immutability, and importing its 19 old Evidence records passed. - Four focused files / 26 tests, `npm run check`, `npm run docs:check`. The real lane ran with two CPUs and a 512 MiB Java heap. This is Linux verification; no new real Hopper, macOS, ARM, or Windows coverage is claimed. Closes #1242 Closes #1238 Related: #1065, #491 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:09:49 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 00:29:47 +00:00

[GH-ISSUE #2750] [Feature] 能否支持workbuddy？ #989

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2750

No description provided.

Rows
Columns