[PR #1666] [CLOSED] fix(ghidra): recover returning import callers #4738

Closed
opened 2026-10-31 00:54:33 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1666
Author: @Y0UW1SH
Created: 10/11/2026
Status: ❌ Closed

Base: main ← Head: fix/ghidra-external-noreturn-1658


📝 Commits (1)

  • 09828c3 fix(ghidra): recover returning import callers

📊 Changes

8 files changed (+536 additions, -39 deletions)

View changed files

📝 bridge/ghidra/ReaGhidraNoReturnFix.java (+65 -39)
📝 docs/ghidra-provider.md (+10 -0)
📝 knip.json (+1 -0)
➕ scripts/verify-real-ghidra-noreturn.mjs (+206 -0)
📝 src/ghidra/GhidraAnalysisProfile.ts (+4 -0)
📝 tests/conformance/ghidra/README.md (+9 -0)
➕ tests/conformance/ghidra/ReaNoReturnProbe.java (+179 -0)
➕ tests/conformance/ghidra/no-return.c (+62 -0)

📄 Description

Summary

Recover Ghidra callers truncated by incorrect no-return flags on six returning imports, including flags propagated to their callers. This is a recovery follow-up to #1658: upstream commit 69a8b3a954 already supplies terminal-call qualifications and is retained unchanged.

Problem and expected behavior

The existing repair requires a decoded return in the flagged function's body. External functions have no such body, so calls to malloc, __tls_get_addr, memcpy, memset, strlen, and __errno_location remain terminal. A truncated caller can also retain its own inferred no-return flag after its body is restored, continuing the truncation further up the call chain.

For these expected returning ABI imports, recovery should restore fallthrough, preserve function signatures and independent entries, and clear propagated caller flags only when a decoded return becomes visible.

Change and scope

Clear exact matching external names, enqueue their transitive thunk entries, and repair matching terminal call sites from Ghidra's reference table. Refit each affected owner in place and enqueue newly cleared callers. This avoids rescanning the whole program at each call-chain level. Keep the Windows P0 guard and existing terminal-call qualifications. Version the repair in the analysis profile to prevent reuse of earlier snapshots.

The external-name rule assumes the standard ABI behavior; external implementations are not inspected. The reported Amethyst binary and custom implementations of these names remain unverified, so this PR is draft.

Contract and boundary impact

  • Semantic owner and earliest changed stage: packaged Ghidra post-analysis repair, before serving requests.
  • CLI and MCP/tool-catalog contract: no input or output schema changes; recovered function extents can increase.
  • Provider, bridge, target-format, or platform compatibility: non-Windows Ghidra repair; real regression coverage is Linux x86-64 ELF with Ghidra 12.1.4/JDK 21.
  • Evidence, artifact, provenance, or reconstruction contract: retain upstream boundary qualifications; add a repair profile marker so prior snapshot digests do not match.
  • Process execution, authorization, cleanup, or containment impact: no executable target execution or executable-byte mutation. The new verifier uses existing owned process supervision and retains workspaces on incomplete cleanup.
  • Generated metadata, package, or installation impact: none; generated outputs are excluded from the commit.

Evidence and regression coverage

  • Added a source-owned C fixture and real Ghidra probe: six imports, a three-function propagated flag chain, preserved signatures, transitive thunks, independent-entry guard, unknown/genuine no-return controls, local name collision, recovered pseudocode, and idempotence.

  • Base reproduction: injected terminal calls fail the returning-import assertion with the previous repair. A separate propagated-caller control fails after body recovery because the caller remains no-return. Both pass with this change.

  • Executed Ghidra regression: 47 checks pass on each ordinary PLT-call and -fno-plt GOT-call fixture; reports bind target and production-script SHA-256 values.

  • User-visible output: real Ghidra fixture pseudocode includes rea_after_call after recovery; unrepairable terminal-call boundaries retain the upstream named limitations.

  • Remaining proof gaps: exact stripped Amethyst ELF, Windows, and full provider/CLI/MCP execution of the new verifier. This workspace's PID namespace and mounted process table prevent owned provider startup; Unix-socket tests also fail with EPERM on the unchanged base.

  • Observed, derived, and inferred claims remain distinguishable.

  • Artifact identity, source provenance, and failed attempts remain preserved.

  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run build:cached: passed.
  • npm run test:local -- src/ghidra/*.test.ts src/ghidra/extensions/GhidraExtensions.test.ts: 250 tests passed across 14 files on the updated base.
  • npm run check:ci: passed, including typecheck, lint, formatting, Knip, duplication and architecture gates.
  • npm run docs:check: passed.
  • Ghidra 12.1.4 analyzeHeadless with ReaNoReturnProbe.java: passed all 47 checks for ordinary and -fno-plt fixtures, using read-only/deleted projects and never executing target code.
  • node scripts/verify-real-ghidra-noreturn.mjs: attempted; blocked before child launch by process ownership inspection (ps: fatal library error, lookup self). No full end-to-end success is claimed.
  • npm test: attempted, then interrupted (exit 130) after sandbox process-inspection failures in unrelated JavaScript CLI workflows. An isolated applicationWorkflowCli.test.ts case reproduced fatal library error, lookup self at ProcessOwnershipObservation.prepare. The full project gate is not green or complete in this environment.
  • git diff --check: passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: none. Earlier cached analyses are invalidated by the repair profile marker.
  • Real Hopper/Ghidra, browser, or OS coverage: real Ghidra Linux ELF recovery controls described above; other hosts/formats and exact reported artifact are unverified.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: changes only the ephemeral analysis database; Windows mutation remains disabled, unknown imports and independent function entries are preserved, and verifier cleanup uses existing ownership primitives.

Review checklist

  • This PR addresses a concrete problem or an agreed enhancement.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output. Full workflow verification remains pending; producer output was checked directly.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1666 **Author:** [@Y0UW1SH](https://github.com/Y0UW1SH) **Created:** 10/11/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/ghidra-external-noreturn-1658` --- ### 📝 Commits (1) - [`09828c3`](https://github.com/morluto/rea/commit/09828c326208da4f412ee01ea27862a4b6f9faf2) fix(ghidra): recover returning import callers ### 📊 Changes **8 files changed** (+536 additions, -39 deletions) <details> <summary>View changed files</summary> 📝 `bridge/ghidra/ReaGhidraNoReturnFix.java` (+65 -39) 📝 `docs/ghidra-provider.md` (+10 -0) 📝 `knip.json` (+1 -0) ➕ `scripts/verify-real-ghidra-noreturn.mjs` (+206 -0) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+4 -0) 📝 `tests/conformance/ghidra/README.md` (+9 -0) ➕ `tests/conformance/ghidra/ReaNoReturnProbe.java` (+179 -0) ➕ `tests/conformance/ghidra/no-return.c` (+62 -0) </details> ### 📄 Description ## Summary Recover Ghidra callers truncated by incorrect no-return flags on six returning imports, including flags propagated to their callers. This is a recovery follow-up to #1658: upstream commit 69a8b3a954a89b9e083f89213c2835c9701e0af2 already supplies terminal-call qualifications and is retained unchanged. ## Problem and expected behavior The existing repair requires a decoded return in the flagged function's body. External functions have no such body, so calls to `malloc`, `__tls_get_addr`, `memcpy`, `memset`, `strlen`, and `__errno_location` remain terminal. A truncated caller can also retain its own inferred no-return flag after its body is restored, continuing the truncation further up the call chain. For these expected returning ABI imports, recovery should restore fallthrough, preserve function signatures and independent entries, and clear propagated caller flags only when a decoded return becomes visible. ## Change and scope Clear exact matching external names, enqueue their transitive thunk entries, and repair matching terminal call sites from Ghidra's reference table. Refit each affected owner in place and enqueue newly cleared callers. This avoids rescanning the whole program at each call-chain level. Keep the Windows P0 guard and existing terminal-call qualifications. Version the repair in the analysis profile to prevent reuse of earlier snapshots. The external-name rule assumes the standard ABI behavior; external implementations are not inspected. The reported Amethyst binary and custom implementations of these names remain unverified, so this PR is draft. ## Contract and boundary impact - Semantic owner and earliest changed stage: packaged Ghidra post-analysis repair, before serving requests. - CLI and MCP/tool-catalog contract: no input or output schema changes; recovered function extents can increase. - Provider, bridge, target-format, or platform compatibility: non-Windows Ghidra repair; real regression coverage is Linux x86-64 ELF with Ghidra 12.1.4/JDK 21. - Evidence, artifact, provenance, or reconstruction contract: retain upstream boundary qualifications; add a repair profile marker so prior snapshot digests do not match. - Process execution, authorization, cleanup, or containment impact: no executable target execution or executable-byte mutation. The new verifier uses existing owned process supervision and retains workspaces on incomplete cleanup. - Generated metadata, package, or installation impact: none; generated outputs are excluded from the commit. ## Evidence and regression coverage - Added a source-owned C fixture and real Ghidra probe: six imports, a three-function propagated flag chain, preserved signatures, transitive thunks, independent-entry guard, unknown/genuine no-return controls, local name collision, recovered pseudocode, and idempotence. - Base reproduction: injected terminal calls fail the returning-import assertion with the previous repair. A separate propagated-caller control fails after body recovery because the caller remains no-return. Both pass with this change. - Executed Ghidra regression: 47 checks pass on each ordinary PLT-call and `-fno-plt` GOT-call fixture; reports bind target and production-script SHA-256 values. - User-visible output: real Ghidra fixture pseudocode includes `rea_after_call` after recovery; unrepairable terminal-call boundaries retain the upstream named limitations. - Remaining proof gaps: exact stripped Amethyst ELF, Windows, and full provider/CLI/MCP execution of the new verifier. This workspace's PID namespace and mounted process table prevent owned provider startup; Unix-socket tests also fail with `EPERM` on the unchanged base. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run build:cached`: passed. - `npm run test:local -- src/ghidra/*.test.ts src/ghidra/extensions/GhidraExtensions.test.ts`: 250 tests passed across 14 files on the updated base. - `npm run check:ci`: passed, including typecheck, lint, formatting, Knip, duplication and architecture gates. - `npm run docs:check`: passed. - Ghidra 12.1.4 `analyzeHeadless` with `ReaNoReturnProbe.java`: passed all 47 checks for ordinary and `-fno-plt` fixtures, using read-only/deleted projects and never executing target code. - `node scripts/verify-real-ghidra-noreturn.mjs`: attempted; blocked before child launch by process ownership inspection (`ps`: `fatal library error, lookup self`). No full end-to-end success is claimed. - `npm test`: attempted, then interrupted (exit 130) after sandbox process-inspection failures in unrelated JavaScript CLI workflows. An isolated `applicationWorkflowCli.test.ts` case reproduced `fatal library error, lookup self` at `ProcessOwnershipObservation.prepare`. The full project gate is not green or complete in this environment. - `git diff --check`: passed. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Earlier cached analyses are invalidated by the repair profile marker. - Real Hopper/Ghidra, browser, or OS coverage: real Ghidra Linux ELF recovery controls described above; other hosts/formats and exact reported artifact are unverified. - Package or release metadata impact: none. - Security, privacy, process, or containment review: changes only the ephemeral analysis database; Windows mutation remains disabled, unknown imports and independent function entries are preserved, and verifier cleanup uses existing ownership primitives. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. Full workflow verification remains pending; producer output was checked directly. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-10-31 00:54:33 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#4738
No description provided.