morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1679] [CLOSED] fix(native): bound NativeAOT PE reads by section virtual size #4749

New issue

Closed

opened 2026-10-31 00:54:39 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:39 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1679
Author: @kaoru0822-kitauji
Created: 10/11/2026
Status: ❌ Closed

Base: main ← Head: fix/nativeaot-pe-virtual-extent

📝 Commits (3)

707797d fix(native): bound NativeAOT PE reads by section virtual size
9f30b01 style(native): format NativeAOT diagnostics after lint fix
4ff226e Merge remote-tracking branch 'origin/main' into fix/nativeaot-pe-virtual-extent

📊 Changes

2 files changed (+56 additions, -24 deletions)

View changed files

📝 src/domain/native/nativeAotPe.test.ts (+36 -0)
📝 src/domain/native/nativeAotPe.ts (+20 -24)

📄 Description

Summary

The NativeAOT PE parser added in 76d8f68cb (src/domain/native/nativeAotPe.ts) uses the section extents that #1596 removed from managed RVA reads (975dff2e2). #1678 makes the same correction for PE resources.

read(), virtualBytesRemaining(), the hydration-base section match and the SizeOfImage check treat a section as max(VirtualSize, SizeOfRawData) bytes. Raw alignment padding past VirtualSize is therefore readable as image memory.
isExecutable() and both pointer-scan ranges use SizeOfRawData. A vtable slot that points into .text padding counts as executable code. A VirtualSize > SizeOfRawData tail of an executable section does not.

Observed effect, using tests/fixtures/nativeaotPe.ts with one header field changed:

Change	main	this PR
`.text` `VirtualSize` 0x40 (the 0x2280 MethodTable's slot targets 0x1040)	`method_tables: 3`	`2`
`.rdata` `VirtualSize` 0x300 (frozen string at 0x2300)	`status: complete`, string recovered from padding	`status: partial`, no frozen string
`.text` `VirtualSize` 0	complete, 3 tables	unchanged

Change

Two helpers:

virtualExtent is the loader's mapped size: VirtualSize, or SizeOfRawData when VirtualSize is 0, as in #1678.
fileBackedExtent is the smaller of that extent and SizeOfRawData.

Reads and executable or hydration checks use the virtual extent. Reads still return null past file-backed bytes, as before. Pointer scans cover the file-backed extent only.

Verification

src/domain/native/nativeAotPe.test.ts has three new cases from the table. The two padding cases fail against main's parser and pass here. All 14 NativeAOT parser and budget tests pass.
src/ghidra/GhidraProvider.behavior.test.ts and tests/boundary/providers/ghidra/ghidraClient.test.ts (the parser's consumers, using fake seams): 69 passed.
npm run typecheck passes. The remaining oxlint warnings in nativeAotPe.ts are on lines this PR does not touch.

Not verified: real Ghidra or Windows NativeAOT images. This Mac has no Ghidra or NativeAOT toolchain, so only the synthetic fixture claims are established.

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1679 **Author:** [@kaoru0822-kitauji](https://github.com/kaoru0822-kitauji) **Created:** 10/11/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/nativeaot-pe-virtual-extent` --- ### 📝 Commits (3) - [`707797d`](https://github.com/morluto/rea/commit/707797d80fe123d1039b343ea6ded86a47eeabf4) fix(native): bound NativeAOT PE reads by section virtual size - [`9f30b01`](https://github.com/morluto/rea/commit/9f30b01387a88294bf6a7f57a9871e0a1ec58978) style(native): format NativeAOT diagnostics after lint fix - [`4ff226e`](https://github.com/morluto/rea/commit/4ff226e98eff75feb6b2f98ffed5b73571e506b6) Merge remote-tracking branch 'origin/main' into fix/nativeaot-pe-virtual-extent ### 📊 Changes **2 files changed** (+56 additions, -24 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/native/nativeAotPe.test.ts` (+36 -0) 📝 `src/domain/native/nativeAotPe.ts` (+20 -24) </details> ### 📄 Description ## Summary The NativeAOT PE parser added in 76d8f68cb (`src/domain/native/nativeAotPe.ts`) uses the section extents that #1596 removed from managed RVA reads (975dff2e2). #1678 makes the same correction for PE resources. - `read()`, `virtualBytesRemaining()`, the hydration-base section match and the `SizeOfImage` check treat a section as `max(VirtualSize, SizeOfRawData)` bytes. Raw alignment padding past `VirtualSize` is therefore readable as image memory. - `isExecutable()` and both pointer-scan ranges use `SizeOfRawData`. A vtable slot that points into `.text` padding counts as executable code. A `VirtualSize > SizeOfRawData` tail of an executable section does not. Observed effect, using `tests/fixtures/nativeaotPe.ts` with one header field changed: | Change | main | this PR | |---|---|---| | `.text` `VirtualSize` 0x40 (the 0x2280 MethodTable's slot targets 0x1040) | `method_tables: 3` | `2` | | `.rdata` `VirtualSize` 0x300 (frozen string at 0x2300) | `status: complete`, string recovered from padding | `status: partial`, no frozen string | | `.text` `VirtualSize` 0 | complete, 3 tables | unchanged | ## Change Two helpers: - `virtualExtent` is the loader's mapped size: `VirtualSize`, or `SizeOfRawData` when `VirtualSize` is 0, as in #1678. - `fileBackedExtent` is the smaller of that extent and `SizeOfRawData`. Reads and executable or hydration checks use the virtual extent. Reads still return `null` past file-backed bytes, as before. Pointer scans cover the file-backed extent only. ## Verification - `src/domain/native/nativeAotPe.test.ts` has three new cases from the table. The two padding cases fail against main's parser and pass here. All 14 NativeAOT parser and budget tests pass. - `src/ghidra/GhidraProvider.behavior.test.ts` and `tests/boundary/providers/ghidra/ghidraClient.test.ts` (the parser's consumers, using fake seams): 69 passed. - `npm run typecheck` passes. The remaining oxlint warnings in `nativeAotPe.ts` are on lines this PR does not touch. **Not verified:** real Ghidra or Windows NativeAOT images. This Mac has no Ghidra or NativeAOT toolchain, so only the synthetic fixture claims are established. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:39 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:05 +00:00

[PR #4749] [MERGED] fix(verifiers): read packed bridge without extraction #6386

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4749

No description provided.

Rows
Columns