[PR #2923] feat(ghidra): admit bounded m68k ELF analysis through Ghidra #5498

Open
opened 2026-10-31 01:07:06 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2923
Author: @nplanel
Created: 10/13/2026
Status: 🔄 Open

Base: main ← Head: nplanel/m68k


📝 Commits (1)

  • a596221 feat(ghidra): admit bounded m68k ELF analysis through Ghidra

📊 Changes

21 files changed (+1590 additions, -25 deletions)

View changed files

📝 docs/firmware-analysis.md (+3 -2)
➕ docs/ghidra-m68k.md (+98 -0)
📝 package.json (+1 -0)
➕ scripts/verify-real-ghidra-m68k.mjs (+281 -0)
➕ src/domain/binaryTarget.m68k.test.ts (+78 -0)
📝 src/domain/binaryTarget.ts (+36 -16)
📝 src/domain/binaryTargetTypes.ts (+17 -0)
📝 src/ghidra/GhidraAnalysisProfile.ts (+36 -3)
➕ src/ghidra/GhidraM68kProfile.test.ts (+253 -0)
➕ src/ghidra/GhidraM68kProfile.ts (+120 -0)
📝 src/ghidra/GhidraProvider.ts (+11 -1)
📝 src/ghidra/GhidraProviderClient.ts (+19 -1)
📝 src/hopper/HopperAnalysisProfile.ts (+1 -0)
📝 src/hopper/HopperProvider.ts (+5 -1)
📝 src/ida/IdaProvider.ts (+5 -1)
➕ tests/composition/analysis-sessions/m68k-identity.test.ts (+91 -0)
➕ tests/conformance/ghidra/m68k-checks.d.mts (+16 -0)
➕ tests/conformance/ghidra/m68k-checks.mjs (+172 -0)
➕ tests/conformance/ghidra/m68k-checks.test.ts (+236 -0)
➕ tests/conformance/ghidra/m68k-fixture.d.mts (+26 -0)

...and 1 more files

📄 Description

Summary

Retain ELF EM_68K as the provider-neutral m68k family with class, byte order, e_type and raw e_flags, and admit big-endian ELF32 ET_EXEC with an EF_M68K_M68000 family declaration through a bounded Ghidra lane. CPU32, ColdFire, FIDO, unspecified flags, unknown architecture bits, ELF64, little-endian images and non-ET_EXEC inputs are refused with specific reasons instead of a guessed processor profile.

Ghidra's own ELF loader opinion resolves EM_68K to the ColdFire variant (observed on the tested Ghidra 12.1.x), whose instruction set is not an M68000 superset. REA therefore pins the admitted import language to 68000:BE:32:default (MC68040) through the provider-pinned profile mechanism, commits it in the analysis profile, and enforces the observed language and compiler specification; a caller-selected language that differs from the pin is refused. The m68k header and e_flags facts bind profile identity so interpretation changes invalidate snapshots. Hopper and IDA refuse m68k targets; Windows Ghidra P0 remains PE x86/x86-64 only.

The change also widens the advertised open_binary result architecture enum (and therefore Evidence and snapshot subject schemas) with the additive m68k value. No new CLI/MCP tools or inputs are introduced.

Verification: npm run verify:ghidra:m68k passed against Ghidra 12.1.2 and JDK 21.0.12.1 with a source-owned hand-built ELF fixture, verifying the pinned effective language, loaded identity and mapping, fixed MOVE.L/short BRA bytes with immediate and branch destination, global and marker bytes, Evidence/snapshot identity, CLI/MCP agreement and process cleanup without retained descendants. The source suite passes apart from one pre-existing unrelated failure set that reproduces on current main. docs/ghidra-m68k.md records the admission boundary, the ColdFire finding and the executed run.

Problem and expected behavior

EM_68K ELF targets were rejected during target resolution ("unsupported ELF architecture"), so no provider could analyze them, and Hopper has no m68k support. Expected behavior is a provider-neutral m68k family that routes admitted big-endian ELF32 ET_EXEC EF_M68K_M68000 images to the existing Ghidra provider with an explicitly pinned language, while every unverified variant stays refused with a specific reason.

Change and scope

Adds the bounded m68k ELF lane described above to the existing Ghidra provider. Non-goals: classic m68k containers (Amiga Hunk, Atari TOS, classic Mac PEF, headerless ROMs), ISA variants (ColdFire, CPU32, FIDO), IDA/Hopper m68k lanes, and Windows P0 coverage.

Contribution scope: static disassembly/decompilation and evidence reporting within an existing provider. No target execution, injection, mutation, or protection recovery; the only effects are the existing Ghidra headless launch and ephemeral project writes, so no new-provider advance scope decision is required (not applicable). No m68k issue exists upstream; this PR is the initial proposal and can be linked to a feature request or design discussion if maintainers prefer that route.

Contract and boundary impact

  • Semantic owner and earliest changed stage: src/domain/binaryTarget.ts recognizes EM_68K and provides the parsed m68k metadata; consumers use those facts instead of re-reading the header.
  • Contribution scope fit and linked maintainer decision: existing Ghidra provider, static analysis only; no execution, injection, mutation, or protection recovery. Advance maintainer decision not applicable.
  • CLI and MCP/tool-catalog contract: additive m68k value in the advertised open_binary result architecture enum and the Evidence/snapshot subject schemas. No new tools or inputs.
  • Provider, bridge, target-format, or platform compatibility: Ghidra only on Linux/macOS; Ghidra 12.1.x admission, real run on 12.1.2 (other builds keep the standard unverified-build limitation). Hopper and IDA explicitly refuse m68k; Windows P0 unchanged.
  • Evidence, artifact, provenance, or reconstruction contract: the profile commits m68k_elf facts, the versioned m68k_support_lane, and language_selection: provider-pinned-v1; interpretation changes invalidate profile-bound snapshots.
  • Target selection, authority, upstream behavior, and cleanup details: existing Ghidra ephemeral import; executable bytes are never written; the real lane verifies final cleanup with no retained descendants.
  • Generated metadata: no authored generated files change; docs/public/product-catalog.json and skills/ remain CI-generated and uncommitted.

Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: src/domain/binaryTarget.m68k.test.ts, src/ghidra/GhidraM68kProfile.test.ts, tests/composition/analysis-sessions/m68k-identity.test.ts, tests/conformance/ghidra/m68k-checks.test.ts with m68k-fixture.mjs/m68k-checks.mjs, and scripts/verify-real-ghidra-m68k.mjs.
  • Base reproduction or other evidence: on the base revision EM_68K fails with "unsupported ELF architecture"; the source-owned fixture exercises header facts, admission refusals and the pinned profile. The first real run observed Ghidra selecting 68000:BE:32:Coldfire and the handshake refusing it, which motivated the pin.
  • User-visible CLI/MCP output (if applicable): open_binary returns architecture: "m68k"; rea instructions lists the fixed MOVE.L/short BRA bytes; snapshot parameters carry m68k_elf, m68k_support_lane and provider-pinned-v1.
  • Remaining proof gaps: one hand-built fixture only; no real 68000/68020/68030 corpus; MC68060-only semantics unverified; classic containers unsupported; the real run is on Ghidra 12.1.2 while the repository's verified build is 12.1.4.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run verify:ghidra:m68k — passed (Ghidra 12.1.2, JDK 21.0.12.1; language 68000:BE:32:default, mappings, probe and data bytes, snapshot and CLI/MCP parity, clean process lineage).
  • npx vitest run --project domain --project services --project adapters --project composition --project conformance --project evaluation — 6314 passed, 4 skipped; a pre-existing failure set in src/domain/reconstructionVerification.functionSources.test.ts (5 tests) reproduces unchanged on current main and is unrelated to this diff.
  • npm run check:fast — passed (typecheck, lint, module boundaries).
  • npm run docs:check — passed.
  • npx oxfmt --check . — passes; the two inherited upstream formatting failures were repaired by upstream 8fef2aa (#2938).
  • Rebased onto current main (8fef2aa); the branch is no longer conflicted.

Compatibility, safety, and release

  • Breaking changes or migration steps: none; the architecture enum addition is additive.
  • Real Hopper/Ghidra, browser, or OS coverage: real Ghidra 12.1.2 + JDK 21.0.12.1 on Linux x64; no Hopper or browser coverage claimed.
  • Package or release metadata impact: new verify:ghidra:m68k npm script only; no runtime dependency change.
  • Security, privacy, process, or containment review: no network, no target execution, no mutation; existing ephemeral-provider lifecycle and cleanup rules apply.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2923 **Author:** [@nplanel](https://github.com/nplanel) **Created:** 10/13/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `nplanel/m68k` --- ### 📝 Commits (1) - [`a596221`](https://github.com/morluto/rea/commit/a59622152ef7ce1cef11989f868d4282be44c979) feat(ghidra): admit bounded m68k ELF analysis through Ghidra ### 📊 Changes **21 files changed** (+1590 additions, -25 deletions) <details> <summary>View changed files</summary> 📝 `docs/firmware-analysis.md` (+3 -2) ➕ `docs/ghidra-m68k.md` (+98 -0) 📝 `package.json` (+1 -0) ➕ `scripts/verify-real-ghidra-m68k.mjs` (+281 -0) ➕ `src/domain/binaryTarget.m68k.test.ts` (+78 -0) 📝 `src/domain/binaryTarget.ts` (+36 -16) 📝 `src/domain/binaryTargetTypes.ts` (+17 -0) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+36 -3) ➕ `src/ghidra/GhidraM68kProfile.test.ts` (+253 -0) ➕ `src/ghidra/GhidraM68kProfile.ts` (+120 -0) 📝 `src/ghidra/GhidraProvider.ts` (+11 -1) 📝 `src/ghidra/GhidraProviderClient.ts` (+19 -1) 📝 `src/hopper/HopperAnalysisProfile.ts` (+1 -0) 📝 `src/hopper/HopperProvider.ts` (+5 -1) 📝 `src/ida/IdaProvider.ts` (+5 -1) ➕ `tests/composition/analysis-sessions/m68k-identity.test.ts` (+91 -0) ➕ `tests/conformance/ghidra/m68k-checks.d.mts` (+16 -0) ➕ `tests/conformance/ghidra/m68k-checks.mjs` (+172 -0) ➕ `tests/conformance/ghidra/m68k-checks.test.ts` (+236 -0) ➕ `tests/conformance/ghidra/m68k-fixture.d.mts` (+26 -0) _...and 1 more files_ </details> ### 📄 Description ## Summary Retain ELF `EM_68K` as the provider-neutral `m68k` family with class, byte order, `e_type` and raw `e_flags`, and admit big-endian ELF32 `ET_EXEC` with an `EF_M68K_M68000` family declaration through a bounded Ghidra lane. CPU32, ColdFire, FIDO, unspecified flags, unknown architecture bits, ELF64, little-endian images and non-`ET_EXEC` inputs are refused with specific reasons instead of a guessed processor profile. Ghidra's own ELF loader opinion resolves `EM_68K` to the ColdFire variant (observed on the tested Ghidra 12.1.x), whose instruction set is not an M68000 superset. REA therefore pins the admitted import language to `68000:BE:32:default` (MC68040) through the provider-pinned profile mechanism, commits it in the analysis profile, and enforces the observed language and compiler specification; a caller-selected language that differs from the pin is refused. The m68k header and `e_flags` facts bind profile identity so interpretation changes invalidate snapshots. Hopper and IDA refuse m68k targets; Windows Ghidra P0 remains PE x86/x86-64 only. The change also widens the advertised `open_binary` result `architecture` enum (and therefore Evidence and snapshot subject schemas) with the additive `m68k` value. No new CLI/MCP tools or inputs are introduced. Verification: `npm run verify:ghidra:m68k` passed against Ghidra 12.1.2 and JDK 21.0.12.1 with a source-owned hand-built ELF fixture, verifying the pinned effective language, loaded identity and mapping, fixed MOVE.L/short BRA bytes with immediate and branch destination, global and marker bytes, Evidence/snapshot identity, CLI/MCP agreement and process cleanup without retained descendants. The source suite passes apart from one pre-existing unrelated failure set that reproduces on current `main`. `docs/ghidra-m68k.md` records the admission boundary, the ColdFire finding and the executed run. ## Problem and expected behavior `EM_68K` ELF targets were rejected during target resolution ("unsupported ELF architecture"), so no provider could analyze them, and Hopper has no m68k support. Expected behavior is a provider-neutral `m68k` family that routes admitted big-endian ELF32 `ET_EXEC` `EF_M68K_M68000` images to the existing Ghidra provider with an explicitly pinned language, while every unverified variant stays refused with a specific reason. ## Change and scope Adds the bounded m68k ELF lane described above to the existing Ghidra provider. Non-goals: classic m68k containers (Amiga Hunk, Atari TOS, classic Mac PEF, headerless ROMs), ISA variants (ColdFire, CPU32, FIDO), IDA/Hopper m68k lanes, and Windows P0 coverage. Contribution scope: static disassembly/decompilation and evidence reporting within an existing provider. No target execution, injection, mutation, or protection recovery; the only effects are the existing Ghidra headless launch and ephemeral project writes, so no new-provider advance scope decision is required (not applicable). No m68k issue exists upstream; this PR is the initial proposal and can be linked to a feature request or design discussion if maintainers prefer that route. ## Contract and boundary impact - Semantic owner and earliest changed stage: `src/domain/binaryTarget.ts` recognizes `EM_68K` and provides the parsed `m68k` metadata; consumers use those facts instead of re-reading the header. - Contribution scope fit and linked maintainer decision: existing Ghidra provider, static analysis only; no execution, injection, mutation, or protection recovery. Advance maintainer decision not applicable. - CLI and MCP/tool-catalog contract: additive `m68k` value in the advertised `open_binary` result `architecture` enum and the Evidence/snapshot subject schemas. No new tools or inputs. - Provider, bridge, target-format, or platform compatibility: Ghidra only on Linux/macOS; Ghidra 12.1.x admission, real run on 12.1.2 (other builds keep the standard unverified-build limitation). Hopper and IDA explicitly refuse m68k; Windows P0 unchanged. - Evidence, artifact, provenance, or reconstruction contract: the profile commits `m68k_elf` facts, the versioned `m68k_support_lane`, and `language_selection: provider-pinned-v1`; interpretation changes invalidate profile-bound snapshots. - Target selection, authority, upstream behavior, and cleanup details: existing Ghidra ephemeral import; executable bytes are never written; the real lane verifies final cleanup with no retained descendants. - Generated metadata: no authored generated files change; `docs/public/product-catalog.json` and `skills/` remain CI-generated and uncommitted. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `src/domain/binaryTarget.m68k.test.ts`, `src/ghidra/GhidraM68kProfile.test.ts`, `tests/composition/analysis-sessions/m68k-identity.test.ts`, `tests/conformance/ghidra/m68k-checks.test.ts` with `m68k-fixture.mjs`/`m68k-checks.mjs`, and `scripts/verify-real-ghidra-m68k.mjs`. - Base reproduction or other evidence: on the base revision `EM_68K` fails with "unsupported ELF architecture"; the source-owned fixture exercises header facts, admission refusals and the pinned profile. The first real run observed Ghidra selecting `68000:BE:32:Coldfire` and the handshake refusing it, which motivated the pin. - User-visible CLI/MCP output (if applicable): `open_binary` returns `architecture: "m68k"`; `rea instructions` lists the fixed MOVE.L/short BRA bytes; snapshot parameters carry `m68k_elf`, `m68k_support_lane` and `provider-pinned-v1`. - Remaining proof gaps: one hand-built fixture only; no real 68000/68020/68030 corpus; MC68060-only semantics unverified; classic containers unsupported; the real run is on Ghidra 12.1.2 while the repository's verified build is 12.1.4. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run verify:ghidra:m68k` — passed (Ghidra 12.1.2, JDK 21.0.12.1; language `68000:BE:32:default`, mappings, probe and data bytes, snapshot and CLI/MCP parity, clean process lineage). - `npx vitest run --project domain --project services --project adapters --project composition --project conformance --project evaluation` — 6314 passed, 4 skipped; a pre-existing failure set in `src/domain/reconstructionVerification.functionSources.test.ts` (5 tests) reproduces unchanged on current `main` and is unrelated to this diff. - `npm run check:fast` — passed (typecheck, lint, module boundaries). - `npm run docs:check` — passed. - `npx oxfmt --check .` — passes; the two inherited upstream formatting failures were repaired by upstream `8fef2aa` (#2938). - Rebased onto current `main` (`8fef2aa`); the branch is no longer conflicted. ## Compatibility, safety, and release - Breaking changes or migration steps: none; the architecture enum addition is additive. - Real Hopper/Ghidra, browser, or OS coverage: real Ghidra 12.1.2 + JDK 21.0.12.1 on Linux x64; no Hopper or browser coverage claimed. - Package or release metadata impact: new `verify:ghidra:m68k` npm script only; no runtime dependency change. - Security, privacy, process, or containment review: no network, no target execution, no mutation; existing ephemeral-provider lifecycle and cleanup rules apply. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#5498
No description provided.