[PR #1715] [MERGED] feat(native): expose typed incoming references at exact addresses #4774

New issue

Closed

opened 2026-10-31 00:54:54 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:54 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1715
Author: @bugstan
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: fix/typed-incoming-native-references

📝 Commits (1)

1de1681 feat(native): expose typed incoming references at exact addresses

📊 Changes

9 files changed (+212 additions, -10 deletions)

View changed files

📝 bridge/ghidra/ReaGhidraBridge.java (+16 -3)
📝 docs/native-investigation.md (+14 -1)
📝 scripts/lib/real-ghidra-compact-references.mjs (+83 -1)
📝 src/contracts/officialToolContracts.ts (+2 -2)
📝 src/domain/native/nativeInstruction.ts (+8 -1)
📝 src/ghidra/GhidraAnalysisProfile.ts (+1 -0)
📝 src/ghidra/GhidraFunctionValues.test.ts (+39 -0)
📝 src/ghidra/GhidraSnapshotCache.test.ts (+36 -0)
📝 tests/boundary/mcp/ghidraCompactReferencesMcp.test.ts (+13 -2)

📄 Description

Closes #1245. Completes the typed incoming-reference portion left open after #1438.

inspect_native_instruction now returns incoming_references for the exact queried code or data address. Ghidra preserves each source/target, operand index, access kind, primary status and provider/source provenance, using deterministic address ordering and excluding synthetic entry-point references. Existing outgoing references and bare-address xrefs keep their meanings. Call-target resolution skips the incoming scan.

An empty array means the address was examined and no references were found; omitted/null coverage remains unavailable for historical Evidence or other providers. The Ghidra profile versions the new coverage, so older snapshots must be rebuilt instead of replaying results without it. Analyzer references remain static observations, not proof of literal addressing or runtime access.

Validation on Windows 11 x64 with Node 24.18.0 and npm 11.16.0:

Regression observed failing before the schema change, then passing; 43 focused function-value/snapshot tests pass.
10 MCP reference, schema-validity and presentation tests pass.
npm run check, npm run check:fast, npm run docs:check, and npm run verify:test-discovery pass. The full format check used an LF checkout on NTFS; the original Windows clone uses CRLF.
Real Ghidra 12.1.4 and Temurin JDK 21.0.12.1: the source-owned x86 and x86_64 PE fixtures pass verifyGhidraCompactReferences through a focused real stdio MCP/CLI harness. This covers DATA/READ/WRITE, non-primary analyzer references, incoming/outgoing/full-dossier agreement, xrefs ordering, entry-point filtering, empty and targetless cases, CLI/MCP parity, and completed runtime cleanup.

Existing verification limitations: the general Windows verifier stops at its capability-list assertion because it excludes only annotate_native_function while the read-only bridge also omits naming mutations. A broader provider test run passes 39/40; its unchanged test expecting unavailable Windows native controls fails when the built addon is present. Neither unrelated assertion was changed. The complete deterministic suite and real Linux/macOS providers were not run.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1715 **Author:** [@bugstan](https://github.com/bugstan) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/typed-incoming-native-references` --- ### 📝 Commits (1) - [`1de1681`](https://github.com/morluto/rea/commit/1de168135ebe55903b205c396f3fd965ddc6bbaa) feat(native): expose typed incoming references at exact addresses ### 📊 Changes **9 files changed** (+212 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `bridge/ghidra/ReaGhidraBridge.java` (+16 -3) 📝 `docs/native-investigation.md` (+14 -1) 📝 `scripts/lib/real-ghidra-compact-references.mjs` (+83 -1) 📝 `src/contracts/officialToolContracts.ts` (+2 -2) 📝 `src/domain/native/nativeInstruction.ts` (+8 -1) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+1 -0) 📝 `src/ghidra/GhidraFunctionValues.test.ts` (+39 -0) 📝 `src/ghidra/GhidraSnapshotCache.test.ts` (+36 -0) 📝 `tests/boundary/mcp/ghidraCompactReferencesMcp.test.ts` (+13 -2) </details> ### 📄 Description Closes #1245. Completes the typed incoming-reference portion left open after #1438. `inspect_native_instruction` now returns `incoming_references` for the exact queried code or data address. Ghidra preserves each source/target, operand index, access kind, primary status and provider/source provenance, using deterministic address ordering and excluding synthetic entry-point references. Existing outgoing `references` and bare-address `xrefs` keep their meanings. Call-target resolution skips the incoming scan. An empty array means the address was examined and no references were found; omitted/null coverage remains unavailable for historical Evidence or other providers. The Ghidra profile versions the new coverage, so older snapshots must be rebuilt instead of replaying results without it. Analyzer references remain static observations, not proof of literal addressing or runtime access. Validation on Windows 11 x64 with Node 24.18.0 and npm 11.16.0: - Regression observed failing before the schema change, then passing; 43 focused function-value/snapshot tests pass. - 10 MCP reference, schema-validity and presentation tests pass. - `npm run check`, `npm run check:fast`, `npm run docs:check`, and `npm run verify:test-discovery` pass. The full format check used an LF checkout on NTFS; the original Windows clone uses CRLF. - Real Ghidra 12.1.4 and Temurin JDK 21.0.12.1: the source-owned x86 and x86_64 PE fixtures pass `verifyGhidraCompactReferences` through a focused real stdio MCP/CLI harness. This covers DATA/READ/WRITE, non-primary analyzer references, incoming/outgoing/full-dossier agreement, xrefs ordering, entry-point filtering, empty and targetless cases, CLI/MCP parity, and completed runtime cleanup. Existing verification limitations: the general Windows verifier stops at its capability-list assertion because it excludes only `annotate_native_function` while the read-only bridge also omits naming mutations. A broader provider test run passes 39/40; its unchanged test expecting unavailable Windows native controls fails when the built addon is present. Neither unrelated assertion was changed. The complete deterministic suite and real Linux/macOS providers were not run. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:54 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:13 +00:00

[PR #4774] [CLOSED] fix(ghidra): recognize OutOfMemoryError beyond the diagnostic budget #6404

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4774

No description provided.

Rows
Columns