[PR #2283] [MERGED] fix(ghidra): report unapplied PE CodeView PDB limitation #5139

New issue

Closed

opened 2026-10-31 01:04:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:16 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2283
Author: @akram1089
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/ghidra-pe-pdb-limitation-2259

📝 Commits (10+)

798497f fix(ghidra): report unapplied PE CodeView PDB limitation (#2259)
eaf8919 fix(ghidra): retain bounded PE CodeView metadata
32f6329 test(pe): group CodeView header coverage separately
26a2985 chore: sync launcher regression grouping from captured main
b83432f fix(ghidra): avoid contradictory PDB limitations
a09b843 fix(android): make DEX descriptor pattern portable
dec377e fix(ci): isolate Linux Hopper process fixture inventory
a455b76 fix(comparison): recheck historical calls-only changes (#2223)
183c095 style: format identity comparison and IDA runner
b1dfe83 fix: refresh Ghidra PE limitation PR with main

📊 Changes

9 files changed (+607 additions, -7 deletions)

View changed files

📝 src/application/BinaryTargetResolver.ts (+95 -3)
📝 src/domain/binaryTarget.fixture.ts (+72 -2)
📝 src/domain/binaryTarget.ts (+172 -1)
📝 src/domain/binaryTargetTypes.ts (+10 -0)
➕ src/ghidra/GhidraPeProfile.test.ts (+95 -0)
➕ src/ghidra/GhidraPeProfile.ts (+24 -0)
📝 src/ghidra/GhidraProvider.behavior.test.ts (+33 -0)
📝 src/ghidra/GhidraProviderClient.ts (+6 -1)
📝 tests/boundary/filesystem/binaryTarget.test.ts (+100 -0)

📄 Description

Summary

When Ghidra analyzes a PE target that references companion debug symbols in its CodeView (\IMAGE_DEBUG_TYPE_CODEVIEW\ / \RSDS\ or \NB10) debug directory, Ghidra's headless analyzer cannot automatically locate or apply the companion PDB from isolated runtime directories without companion admission. Procedure names remain analysis-generated (\FUN_

). Previously, no Evidence limitation alerted the caller or agent that symbols referenced by the PE header were unapplied.

This PR parses PE CodeView debug directory metadata during target resolution and reports an Evidence limitation informing callers that referenced debug symbols were not applied and procedure names remain analysis-generated.

Changes

Target Resolution: Added \PeCodeViewRecord\ to \BinaryTarget\ and extracted CodeView debug directory records (\RSDS\ GUID/age and \NB10\ age) from PE targets in \src/domain/binaryTarget.ts\ and \src/application/BinaryTargetResolver.ts.
Ghidra Provider: Added \ghidraPeCodeViewLimitations\ in \src/ghidra/GhidraPeProfile.ts\ and included it in \ argetLimitations\ in \src/ghidra/GhidraProviderClient.ts.
Tests:
- \src/ghidra/GhidraPeProfile.test.ts: Unit tests for CodeView limitation formatting (RSDS with GUID/age, NB10 with age).
- \ ests/boundary/filesystem/binaryTarget.test.ts: Boundary tests for PE RSDS and NB10 extraction.
- \src/ghidra/GhidraProvider.behavior.test.ts: Provider behavioral test verifying the limitation is projected in Ghidra session Evidence.

Fixes #2259

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2283 **Author:** [@akram1089](https://github.com/akram1089) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/ghidra-pe-pdb-limitation-2259` --- ### 📝 Commits (10+) - [`798497f`](https://github.com/morluto/rea/commit/798497f73b660494fee05b65d531599a80d5d06e) fix(ghidra): report unapplied PE CodeView PDB limitation (#2259) - [`eaf8919`](https://github.com/morluto/rea/commit/eaf8919811fd9b4c6dfd3cc0d58c17782fcd9570) fix(ghidra): retain bounded PE CodeView metadata - [`32f6329`](https://github.com/morluto/rea/commit/32f63297651829e29b097d5faee9b2e795e04814) test(pe): group CodeView header coverage separately - [`26a2985`](https://github.com/morluto/rea/commit/26a2985a6cef11db5871247a05a0164e5674d7b3) chore: sync launcher regression grouping from captured main - [`b83432f`](https://github.com/morluto/rea/commit/b83432f4c91af0a88f1f79e87b28d1fb774d8910) fix(ghidra): avoid contradictory PDB limitations - [`a09b843`](https://github.com/morluto/rea/commit/a09b843c809034ab4662cd18e259fc0dbbbb373a) fix(android): make DEX descriptor pattern portable - [`dec377e`](https://github.com/morluto/rea/commit/dec377e8c86076d537c858b2face73339b91a5ea) fix(ci): isolate Linux Hopper process fixture inventory - [`a455b76`](https://github.com/morluto/rea/commit/a455b76124fe76cbfb75ddd2ef8239ecb2c492c2) fix(comparison): recheck historical calls-only changes (#2223) - [`183c095`](https://github.com/morluto/rea/commit/183c095ad777067f27f15404afe6bf0fa93e8f05) style: format identity comparison and IDA runner - [`b1dfe83`](https://github.com/morluto/rea/commit/b1dfe837b1e31948516dd443a7cc05734de2a2f6) fix: refresh Ghidra PE limitation PR with main ### 📊 Changes **9 files changed** (+607 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/application/BinaryTargetResolver.ts` (+95 -3) 📝 `src/domain/binaryTarget.fixture.ts` (+72 -2) 📝 `src/domain/binaryTarget.ts` (+172 -1) 📝 `src/domain/binaryTargetTypes.ts` (+10 -0) ➕ `src/ghidra/GhidraPeProfile.test.ts` (+95 -0) ➕ `src/ghidra/GhidraPeProfile.ts` (+24 -0) 📝 `src/ghidra/GhidraProvider.behavior.test.ts` (+33 -0) 📝 `src/ghidra/GhidraProviderClient.ts` (+6 -1) 📝 `tests/boundary/filesystem/binaryTarget.test.ts` (+100 -0) </details> ### 📄 Description ### Summary When Ghidra analyzes a PE target that references companion debug symbols in its CodeView (\IMAGE_DEBUG_TYPE_CODEVIEW\ / \RSDS\ or \NB10\) debug directory, Ghidra's headless analyzer cannot automatically locate or apply the companion PDB from isolated runtime directories without companion admission. Procedure names remain analysis-generated (\FUN_<address>\). Previously, no Evidence limitation alerted the caller or agent that symbols referenced by the PE header were unapplied. This PR parses PE CodeView debug directory metadata during target resolution and reports an Evidence limitation informing callers that referenced debug symbols were not applied and procedure names remain analysis-generated. ### Changes - **Target Resolution**: Added \PeCodeViewRecord\ to \BinaryTarget\ and extracted CodeView debug directory records (\RSDS\ GUID/age and \NB10\ age) from PE targets in \src/domain/binaryTarget.ts\ and \src/application/BinaryTargetResolver.ts\. - **Ghidra Provider**: Added \ghidraPeCodeViewLimitations\ in \src/ghidra/GhidraPeProfile.ts\ and included it in \ argetLimitations\ in \src/ghidra/GhidraProviderClient.ts\. - **Tests**: - \src/ghidra/GhidraPeProfile.test.ts\: Unit tests for CodeView limitation formatting (RSDS with GUID/age, NB10 with age). - \ ests/boundary/filesystem/binaryTarget.test.ts\: Boundary tests for PE RSDS and NB10 extraction. - \src/ghidra/GhidraProvider.behavior.test.ts\: Provider behavioral test verifying the limitation is projected in Ghidra session Evidence. Fixes #2259 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:16 +00:00