[PR #1303] [MERGED] feat(ghidra): support native PE DLLs on Windows #2783

New issue

Closed

opened 2026-10-17 21:10:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:10:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1303
Author: @kvalls
Created: 10/9/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: codex/windows-ghidra-native-dlls

📝 Commits (4)

be6863e feat(ghidra): support native PE DLLs on Windows
941dc42 chore: merge main into Windows DLL support branch
7633dd8 fix(ghidra): publish Windows verification success after cleanup
ea1dbda test(ghidra): share result projection client setup

📊 Changes

13 files changed (+374 additions, -178 deletions)

View changed files

📝 .github/workflows/real-ghidra-windows.yml (+20 -0)
📝 docs/ghidra-provider.md (+5 -2)
📝 docs/installation.md (+1 -1)
📝 docs/managed-code-analysis.md (+4 -0)
📝 docs/native-investigation.md (+1 -1)
📝 docs/windows-ghidra-p0.md (+13 -2)
📝 scripts/create-ghidra-windows-fixture.mjs (+93 -58)
📝 scripts/verify-packaged-ghidra-windows.mjs (+102 -21)
📝 scripts/verify-real-ghidra-windows.mjs (+21 -6)
📝 src/ghidra/GhidraAnalysisProfile.ts (+6 -0)
📝 src/ghidra/GhidraProvider.behavior.test.ts (+101 -83)
📝 src/ghidra/GhidraProvider.ts (+6 -3)
📝 src/ghidra/GhidraProviderCapabilities.ts (+1 -1)

📄 Description

Summary

Windows Ghidra currently rejects native PE DLLs before import even when the matching Windows native controls are available. This extends the existing read-only provider to native x86 and x64 DLLs, preserving their shared-library identity.

Fixes #1290. Please review the implementation and Windows verification coverage.

Change and scope

Admit PE shared libraries alongside applications; retain managed-image, unsupported-architecture and non-executable refusals.
Record the observed PE role and managed flag in analysis profiles.
Generate original PE32/PE32+ DLL fixtures with two exported caller/callee functions, no imports and no entry routine. Existing EXE fixtures remain byte-identical to the base.
Extend the raw and packaged Windows verification lanes and guarded Windows workflow to both DLL architectures.
Run packaged verification in a child so the parent can remove the temporary installation after Windows releases the loaded REA addon. The initial package test exposed this cleanup failure after its analysis checks passed.
Update the owning Windows/provider documentation.

Contract and boundary impact

Semantic owner: Windows target admission in GhidraProvider.
CLI/MCP and tool catalog: existing operations and schemas; no new tool or permission switch.
Evidence/profile: PE profiles additionally commit to executable_role and managed, so PE profile IDs change. Non-PE profile parameters stay unchanged.
Authority and cleanup: static import of an immutable snapshot, read-only Windows capabilities, native handle admission, DACLs, authenticated transport and Job Object ownership retained. Target DLLs are not loaded or executed.
Package/setup: no dependency, version, installation or client-registration changes. Generated outputs remain ignored.

Validation performed

On Windows 11 x64, Node 24.18.0/npm 11.16.0, Ghidra 12.1.4 and JDK 25.0.4.1+1:

npm run build:cached, npm run check and npm run docs:check passed.
npm run test:focused -- src/ghidra/GhidraProvider.behavior.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts: 28 tests passed. The missing-native-control case ran with the ignored addon absent; it was restored for real-provider checks.
npm run verify:windows-native:artifact and npm run verify:windows-native passed, including protected DACLs, immutable snapshots, rejected junctions/streams/forged handles, cancellation and descendant cleanup.
node scripts/verify-real-ghidra-windows.mjs --dll and --x86 --dll: both passed all 25 read-only operations, the known return value and caller/callee relationship, digest linkage and cleanup.
npm run verify:ghidra:windows:package -- --dll and -- --x86 --dll: both passed against packed artifacts installed into isolated prefixes, including ordinary-user CLI/MCP, shared-library profile identity, unchanged source hashes, caller-directory collision preservation and empty runtime cleanup.

The matching addon was built locally from unchanged upstream C++ sources using MSVC 14.44 and Node-API 8. The canonical Linux/MinGW artifact build and protected upstream runner were not run locally. Static lint completed with existing warnings and zero errors. Full deterministic coverage is left to CI. Managed DLLs, other target architectures and Windows NativeAOT metadata recovery were not added or tested.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1303 **Author:** [@kvalls](https://github.com/kvalls) **Created:** 10/9/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/windows-ghidra-native-dlls` --- ### 📝 Commits (4) - [`be6863e`](https://github.com/morluto/rea/commit/be6863e9a16bcc3a09d87c50981e69292795a512) feat(ghidra): support native PE DLLs on Windows - [`941dc42`](https://github.com/morluto/rea/commit/941dc425ca12736504227edc084613c0d3612659) chore: merge main into Windows DLL support branch - [`7633dd8`](https://github.com/morluto/rea/commit/7633dd8d5dcb94eb5c2fca8b69858949c51b0eaf) fix(ghidra): publish Windows verification success after cleanup - [`ea1dbda`](https://github.com/morluto/rea/commit/ea1dbda1c747400fe2228c1802a3721995216277) test(ghidra): share result projection client setup ### 📊 Changes **13 files changed** (+374 additions, -178 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/real-ghidra-windows.yml` (+20 -0) 📝 `docs/ghidra-provider.md` (+5 -2) 📝 `docs/installation.md` (+1 -1) 📝 `docs/managed-code-analysis.md` (+4 -0) 📝 `docs/native-investigation.md` (+1 -1) 📝 `docs/windows-ghidra-p0.md` (+13 -2) 📝 `scripts/create-ghidra-windows-fixture.mjs` (+93 -58) 📝 `scripts/verify-packaged-ghidra-windows.mjs` (+102 -21) 📝 `scripts/verify-real-ghidra-windows.mjs` (+21 -6) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+6 -0) 📝 `src/ghidra/GhidraProvider.behavior.test.ts` (+101 -83) 📝 `src/ghidra/GhidraProvider.ts` (+6 -3) 📝 `src/ghidra/GhidraProviderCapabilities.ts` (+1 -1) </details> ### 📄 Description ## Summary Windows Ghidra currently rejects native PE DLLs before import even when the matching Windows native controls are available. This extends the existing read-only provider to native x86 and x64 DLLs, preserving their shared-library identity. Fixes #1290. Please review the implementation and Windows verification coverage. ## Change and scope - Admit PE shared libraries alongside applications; retain managed-image, unsupported-architecture and non-executable refusals. - Record the observed PE role and managed flag in analysis profiles. - Generate original PE32/PE32+ DLL fixtures with two exported caller/callee functions, no imports and no entry routine. Existing EXE fixtures remain byte-identical to the base. - Extend the raw and packaged Windows verification lanes and guarded Windows workflow to both DLL architectures. - Run packaged verification in a child so the parent can remove the temporary installation after Windows releases the loaded REA addon. The initial package test exposed this cleanup failure after its analysis checks passed. - Update the owning Windows/provider documentation. ## Contract and boundary impact - Semantic owner: Windows target admission in `GhidraProvider`. - CLI/MCP and tool catalog: existing operations and schemas; no new tool or permission switch. - Evidence/profile: PE profiles additionally commit to `executable_role` and `managed`, so PE profile IDs change. Non-PE profile parameters stay unchanged. - Authority and cleanup: static import of an immutable snapshot, read-only Windows capabilities, native handle admission, DACLs, authenticated transport and Job Object ownership retained. Target DLLs are not loaded or executed. - Package/setup: no dependency, version, installation or client-registration changes. Generated outputs remain ignored. ## Validation performed On Windows 11 x64, Node 24.18.0/npm 11.16.0, Ghidra 12.1.4 and JDK 25.0.4.1+1: - `npm run build:cached`, `npm run check` and `npm run docs:check` passed. - `npm run test:focused -- src/ghidra/GhidraProvider.behavior.test.ts tests/conformance/providers/ghidra/realGhidraWindowsWorkflow.test.ts`: 28 tests passed. The missing-native-control case ran with the ignored addon absent; it was restored for real-provider checks. - `npm run verify:windows-native:artifact` and `npm run verify:windows-native` passed, including protected DACLs, immutable snapshots, rejected junctions/streams/forged handles, cancellation and descendant cleanup. - `node scripts/verify-real-ghidra-windows.mjs --dll` and `--x86 --dll`: both passed all 25 read-only operations, the known return value and caller/callee relationship, digest linkage and cleanup. - `npm run verify:ghidra:windows:package -- --dll` and `-- --x86 --dll`: both passed against packed artifacts installed into isolated prefixes, including ordinary-user CLI/MCP, shared-library profile identity, unchanged source hashes, caller-directory collision preservation and empty runtime cleanup. The matching addon was built locally from unchanged upstream C++ sources using MSVC 14.44 and Node-API 8. The canonical Linux/MinGW artifact build and protected upstream runner were not run locally. Static lint completed with existing warnings and zero errors. Full deterministic coverage is left to CI. Managed DLLs, other target architectures and Windows NativeAOT metadata recovery were not added or tested. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:10:11 +00:00