[PR #1913] [MERGED] feat(ghidra): apply validated analyzer overrides before analysis #4903

New issue

Closed

opened 2026-10-31 00:56:37 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:56:37 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1913
Author: @N0zoM1z0
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @N0zoM1z0

Base: main ← Head: review/ghidra-analyzer-overrides-1800-20261011

📝 Commits (8)

8bc9b47 feat(ghidra): disable named auto-analyzers via REA_GHIDRA_DISABLED_ANALYZERS
f9cc9e6 test(ghidra): cover the analyzer-options preScript in the packaged Windows verifier
37a0e4f chore(ghidra): integrate current main for analyzer override verification
f685d0f fix(ghidra): reject ineffective analyzer overrides before analysis
9785d0b test(ghidra): check real analyzer overrides before post-scripts
19db753 chore(ghidra): integrate startup progress and raw import support
9cb814e fix(ghidra): bind raw analyzer settings and supported compiler specs
e0fda68 chore: integrate existing main-side CI fixes

📊 Changes

22 files changed (+677 additions, -38 deletions)

View changed files

➕ bridge/ghidra/ReaGhidraAnalysisOptions.java (+38 -0)
📝 docs/installation.md (+21 -0)
📝 docs/raw-binary.md (+11 -7)
📝 docs/testing.md (+5 -3)
📝 package.json (+1 -0)
📝 scripts/verify-packaged-ghidra-windows.mjs (+4 -2)
📝 scripts/verify-real-ghidra-raw.mjs (+54 -2)
📝 scripts/verify/ghidra/seeds.mjs (+62 -16)
📝 src/config/environment.ts (+2 -0)
➕ src/config/ghidraDisabledAnalyzers.ts (+42 -0)
📝 src/config/parseConfig.ts (+3 -0)
📝 src/config/types.ts (+1 -0)
📝 src/ghidra/GhidraAnalysisProfile.ts (+33 -2)
➕ src/ghidra/GhidraDisabledAnalyzers.test.ts (+90 -0)
📝 src/ghidra/GhidraLauncher.ts (+17 -0)
📝 src/ghidra/GhidraProvider.behavior.test.ts (+150 -0)
📝 src/ghidra/GhidraProvider.ts (+1 -0)
📝 src/ghidra/GhidraProviderClient.ts (+22 -0)
📝 src/ghidra/GhidraRawBinaryLanguage.ts (+6 -4)
📝 src/ghidra/GhidraRawBinaryLoadImage.test.ts (+2 -2)

...and 2 more files

📄 Description

Configured Ghidra analyzer opt-outs now apply before analysis and bind to the same provider profile. This adopts @akushonkamen’s implementation from #1800 with validated corrections. Every requested registered name is checked before any option changes; disabled values are read back, and rejection aborts headless analysis before bridge readiness. Raw and header-based imports share this commitment.

A real six-byte raw repro also exposed unsupported x86 compiler specs. x86/x86_64 now use supported gcc specs consistently in profile, launch and independent load-image verification. These specs select analysis conventions; they do not identify the original compiler or ABI. Existing real seed/raw verifiers cover analyzer readback, mixed known/unknown-name rejection, byte controls and lifecycle behavior.

Validation:

All 31 exact-head CI checks passed, including CI required, static checks, the native Windows lane and both Apple lanes. Integration with main #1931 and #1776 had no conflicts. A fresh runtime/skill build of the exact tree merged as 9878bb72 and six focused files passed: 93 tests, one platform-specific skip. No new full local typecheck is claimed.
Real Linux Ghidra 12.1.4: the original ignored-name bug reproduced through public MCP; corrected unknown names reject before analysis/bridge. Real seed/analyzer readback and mixed-name controls passed. ARM CLI/MCP canonical-entry reuse/replacement and x86/x86_64 imports, mapping, byte readback and decompilation passed with unchanged targets and no owned descendants. Separate six-byte public MCP runs with overrides passed on integrated head e0fda688.
Post-merge native Windows Ghidra 12.1.4, exact 9878bb72: 16 public MCP checks on a 1,536-byte PE passed with WindowsResourceReference, return 42, call edge, mapped bytes, failed-query recovery, P0 mutation denial and unchanged target bytes. Repeated open retained the run ID and actual native observation showed no analysis JVM before the first query. The analysis JVM’s override preScript, requested name and -Xmx256M were observed. Close, closed-session status, ping, empty private TEMP and native Job settlement all passed (exit 0, zero active processes).
Native Windows unknown-name control on integrated head e0fda688: public execution_failure, ping, close, closed-session status, unchanged target and empty TEMP passed before bridge readiness.

Scope: Windows raw remains unsupported. Windows workflows used a private 280-second SDK first-query budget; default-deadline success and the reported Objective-C Mach-O performance remain unverified. These runs do not establish a timing improvement. The native run stayed within its 1.75 GiB Job commit limit. Original contributor commits are retained in the PR branch; GitHub recognizes the original contributor and maintenance coauthors in the merged commit.

Refs #1783, #1836. Follow-up to #1800 and #1868.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1913 **Author:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `review/ghidra-analyzer-overrides-1800-20261011` --- ### 📝 Commits (8) - [`8bc9b47`](https://github.com/morluto/rea/commit/8bc9b47c205897b3d89fe8b120cd2ec6e27caebf) feat(ghidra): disable named auto-analyzers via REA_GHIDRA_DISABLED_ANALYZERS - [`f9cc9e6`](https://github.com/morluto/rea/commit/f9cc9e6f166bcebc47f234689bf752cbd6150c72) test(ghidra): cover the analyzer-options preScript in the packaged Windows verifier - [`37a0e4f`](https://github.com/morluto/rea/commit/37a0e4fdcf810f0d2aa3fcca201917bf88e96ac8) chore(ghidra): integrate current main for analyzer override verification - [`f685d0f`](https://github.com/morluto/rea/commit/f685d0f5c8ca59bdea3fc427115a4c5318a6a3f3) fix(ghidra): reject ineffective analyzer overrides before analysis - [`9785d0b`](https://github.com/morluto/rea/commit/9785d0b0ec26e02b84ad3b359e7c07f8dbf1a7ac) test(ghidra): check real analyzer overrides before post-scripts - [`19db753`](https://github.com/morluto/rea/commit/19db753c3f45ef40572b6fd6dd935cd53f781329) chore(ghidra): integrate startup progress and raw import support - [`9cb814e`](https://github.com/morluto/rea/commit/9cb814e537338dd333819b0185dea70a698087e6) fix(ghidra): bind raw analyzer settings and supported compiler specs - [`e0fda68`](https://github.com/morluto/rea/commit/e0fda6887289dc5090bb767a88fc136458732982) chore: integrate existing main-side CI fixes ### 📊 Changes **22 files changed** (+677 additions, -38 deletions) <details> <summary>View changed files</summary> ➕ `bridge/ghidra/ReaGhidraAnalysisOptions.java` (+38 -0) 📝 `docs/installation.md` (+21 -0) 📝 `docs/raw-binary.md` (+11 -7) 📝 `docs/testing.md` (+5 -3) 📝 `package.json` (+1 -0) 📝 `scripts/verify-packaged-ghidra-windows.mjs` (+4 -2) 📝 `scripts/verify-real-ghidra-raw.mjs` (+54 -2) 📝 `scripts/verify/ghidra/seeds.mjs` (+62 -16) 📝 `src/config/environment.ts` (+2 -0) ➕ `src/config/ghidraDisabledAnalyzers.ts` (+42 -0) 📝 `src/config/parseConfig.ts` (+3 -0) 📝 `src/config/types.ts` (+1 -0) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+33 -2) ➕ `src/ghidra/GhidraDisabledAnalyzers.test.ts` (+90 -0) 📝 `src/ghidra/GhidraLauncher.ts` (+17 -0) 📝 `src/ghidra/GhidraProvider.behavior.test.ts` (+150 -0) 📝 `src/ghidra/GhidraProvider.ts` (+1 -0) 📝 `src/ghidra/GhidraProviderClient.ts` (+22 -0) 📝 `src/ghidra/GhidraRawBinaryLanguage.ts` (+6 -4) 📝 `src/ghidra/GhidraRawBinaryLoadImage.test.ts` (+2 -2) _...and 2 more files_ </details> ### 📄 Description Configured Ghidra analyzer opt-outs now apply before analysis and bind to the same provider profile. This adopts @akushonkamen’s implementation from #1800 with validated corrections. Every requested registered name is checked before any option changes; disabled values are read back, and rejection aborts headless analysis before bridge readiness. Raw and header-based imports share this commitment. A real six-byte raw repro also exposed unsupported x86 compiler specs. x86/x86_64 now use supported `gcc` specs consistently in profile, launch and independent load-image verification. These specs select analysis conventions; they do not identify the original compiler or ABI. Existing real seed/raw verifiers cover analyzer readback, mixed known/unknown-name rejection, byte controls and lifecycle behavior. Validation: - All 31 exact-head CI checks passed, including CI required, static checks, the native Windows lane and both Apple lanes. Integration with main #1931 and #1776 had no conflicts. A fresh runtime/skill build of the exact tree merged as `9878bb72` and six focused files passed: 93 tests, one platform-specific skip. No new full local typecheck is claimed. - Real Linux Ghidra 12.1.4: the original ignored-name bug reproduced through public MCP; corrected unknown names reject before analysis/bridge. Real seed/analyzer readback and mixed-name controls passed. ARM CLI/MCP canonical-entry reuse/replacement and x86/x86_64 imports, mapping, byte readback and decompilation passed with unchanged targets and no owned descendants. Separate six-byte public MCP runs with overrides passed on integrated head `e0fda688`. - Post-merge native Windows Ghidra 12.1.4, exact `9878bb72`: 16 public MCP checks on a 1,536-byte PE passed with `WindowsResourceReference`, return 42, call edge, mapped bytes, failed-query recovery, P0 mutation denial and unchanged target bytes. Repeated open retained the run ID and actual native observation showed no analysis JVM before the first query. The analysis JVM’s override preScript, requested name and `-Xmx256M` were observed. Close, closed-session status, ping, empty private TEMP and native Job settlement all passed (exit 0, zero active processes). - Native Windows unknown-name control on integrated head `e0fda688`: public `execution_failure`, ping, close, closed-session status, unchanged target and empty TEMP passed before bridge readiness. Scope: Windows raw remains unsupported. Windows workflows used a private 280-second SDK first-query budget; default-deadline success and the reported Objective-C Mach-O performance remain unverified. These runs do not establish a timing improvement. The native run stayed within its 1.75 GiB Job commit limit. Original contributor commits are retained in the PR branch; GitHub recognizes the original contributor and maintenance coauthors in the merged commit. Refs #1783, #1836. Follow-up to #1800 and #1868. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:56:37 +00:00