morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #1851] [Feature] Verify and admit MIPS16 shared ELF images in the native analysis lane #627

New issue

Closed

opened 2026-10-15 18:26:44 +00:00 by bsakaguchi · 3 comments

bsakaguchi commented

2026-10-15 18:26:44 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1851

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, private paths, and sensitive target data.

Area

Native analysis or decompilation; provider or capability discovery.

Current limitation

REA's native admission rejects unchanged ET_DYN MIPS images and separately excludes MIPS16 encodings. This blocks analysis of ordinary shared ELF members extracted from firmware even when the configured native engine can load the original bytes.

Use cases

Inspect a caller-selected shared library from a retained firmware image and recover its parser/validator behavior through REA.

Desired outcome and success criteria

Establish a real-provider verified ET_DYN/MIPS16 lane with exact language/mode, relocation and procedure identity.
Admit the original bytes without header edits or replacement artifacts.
Preserve truthful unsupported outcomes for encodings/load semantics not verified.
Cover cancellation, target digests and ephemeral-project cleanup.

Authority boundaries and non-goals

No executable-byte modification, GUI control or relaxation of native mutation authority. Engine availability alone does not prove correct loading or decompilation.

Alternatives considered

The existing standard-instruction MIPS lane deliberately excludes these formats. Header changes do not establish support and must not be recommended as recovery.

Possible direction

Add only the load/mode semantics established by real-provider verification at the provider admission boundary. Related but distinct: #1620.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1851 ### Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, private paths, and sensitive target data. ### Area Native analysis or decompilation; provider or capability discovery. ### Current limitation REA's native admission rejects unchanged ET_DYN MIPS images and separately excludes MIPS16 encodings. This blocks analysis of ordinary shared ELF members extracted from firmware even when the configured native engine can load the original bytes. ### Use cases Inspect a caller-selected shared library from a retained firmware image and recover its parser/validator behavior through REA. ### Desired outcome and success criteria - Establish a real-provider verified ET_DYN/MIPS16 lane with exact language/mode, relocation and procedure identity. - Admit the original bytes without header edits or replacement artifacts. - Preserve truthful unsupported outcomes for encodings/load semantics not verified. - Cover cancellation, target digests and ephemeral-project cleanup. ### Authority boundaries and non-goals No executable-byte modification, GUI control or relaxation of native mutation authority. Engine availability alone does not prove correct loading or decompilation. ### Alternatives considered The existing standard-instruction MIPS lane deliberately excludes these formats. Header changes do not establish support and must not be recommended as recovery. ### Possible direction Add only the load/mode semantics established by real-provider verification at the provider admission boundary. Related but distinct: #1620.

bsakaguchi

2026-10-15 18:26:44 +00:00

closed this issue
added the
area: providers

area: native

triage

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

The admission failure has multiple independent gates in GhidraMipsProfile: ELF32 ET_DYN is rejected before ISA inspection; MIPS16 ASE flags are then refused; and a missing ABI record is separately outside the declared-ABI lane. Removing only the first gate would not establish support.

Observed target declarations are ELF32, big endian, e_type=3, e_flags=0x74001005, eight program headers and no section table. Source bytes remain unchanged. Related #1898 covers recordless standard MIPS32 ET_EXEC, not this combination.

Isolated read-only backend investigation provides a useful starting point: a controlled MIPS16 shared ELF under Ghidra 12.1.4's ordinary MIPS:BE:32:default profile has the expected aligned entry, ISA_MODE=1, four exact 2-byte instructions and the source expression (input ^ 0x5a) + 7. An independent controlled executable returned the expected value 84. A mixed-mode caller retains 4-byte instructions and a JALX transition into the 2-byte callee. The original shared target also imports unchanged; three selected routines expose mode 1 and decompile successfully.

These are backend load, instruction-mode and liveness observations, not yet verified REA native support or whole-image semantic correctness. The next acceptance work must cover public CLI/MCP admission, exact caller-selected procedures, declared versus unknown ABI facts, load coordinates, mixed-mode decoding, canonical target identity and unsupported-format negative cases. Floating-point ABI absence must stay explicit; do not relabel it as a declaration or suggest executable header edits.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): The admission failure has multiple independent gates in `GhidraMipsProfile`: ELF32 `ET_DYN` is rejected before ISA inspection; MIPS16 ASE flags are then refused; and a missing ABI record is separately outside the declared-ABI lane. Removing only the first gate would not establish support. Observed target declarations are ELF32, big endian, `e_type=3`, `e_flags=0x74001005`, eight program headers and no section table. Source bytes remain unchanged. Related #1898 covers recordless standard MIPS32 **ET_EXEC**, not this combination. Isolated read-only backend investigation provides a useful starting point: a controlled MIPS16 shared ELF under Ghidra 12.1.4's ordinary `MIPS:BE:32:default` profile has the expected aligned entry, `ISA_MODE=1`, four exact 2-byte instructions and the source expression `(input ^ 0x5a) + 7`. An independent controlled executable returned the expected value 84. A mixed-mode caller retains 4-byte instructions and a JALX transition into the 2-byte callee. The original shared target also imports unchanged; three selected routines expose mode 1 and decompile successfully. These are backend load, instruction-mode and liveness observations, **not yet verified REA native support or whole-image semantic correctness**. The next acceptance work must cover public CLI/MCP admission, exact caller-selected procedures, declared versus unknown ABI facts, load coordinates, mixed-mode decoding, canonical target identity and unsupported-format negative cases. Floating-point ABI absence must stay explicit; do not relabel it as a declaration or suggest executable header edits.

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

Root-cause follow-up: the current provider policy excludes all MIPS16 ET_DYN images before opening a session. Direct read-only Ghidra 12.1.4 controls establish that the generic endian-matched MIPS32 language correctly decodes per-function MIPS16 context; selecting a global MIPS16 language is unsuitable for mixed instruction modes.

An unchanged, sectionless ELF32/o32/MIPS32r2 shared image yielded 412 functions. Independent source mapping checked all 13 symbol-index-zero R_MIPS_REL32 records and 166 initialized GOT slots. All 169 nonzero values matched the source word plus analysis image-base adjustment; 10 zero GOT entries retain unresolved external-binding uncertainty. The three selected functions decoded under observed ISA_MODE=1 and decompiled successfully. This is backend investigation evidence, not yet a supported public REA workflow.

A negative control in both byte orders exposed a separate limit: symbol-bearing R_MIPS_REL32 relocation uses a normalized even function address and loses the source MIPS16 pointer tag. Those controls remain unsupported. The planned REA admission will inspect complete dynamic relocation declarations, retain this refusal, pin the verified endian-matched MIPS32 language and validate the bridge-reported language. Inspected absence of an ABI record will preserve unknown floating-point semantics rather than infer a floating-point ABI. Original artifact bytes remain unchanged throughout.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): Root-cause follow-up: the current provider policy excludes all MIPS16 `ET_DYN` images before opening a session. Direct read-only Ghidra 12.1.4 controls establish that the generic endian-matched MIPS32 language correctly decodes per-function MIPS16 context; selecting a global MIPS16 language is unsuitable for mixed instruction modes. An unchanged, sectionless ELF32/o32/MIPS32r2 shared image yielded 412 functions. Independent source mapping checked all 13 symbol-index-zero `R_MIPS_REL32` records and 166 initialized GOT slots. All 169 nonzero values matched the source word plus analysis image-base adjustment; 10 zero GOT entries retain unresolved external-binding uncertainty. The three selected functions decoded under observed `ISA_MODE=1` and decompiled successfully. This is backend investigation evidence, not yet a supported public REA workflow. A negative control in both byte orders exposed a separate limit: symbol-bearing `R_MIPS_REL32` relocation uses a normalized even function address and loses the source MIPS16 pointer tag. Those controls remain unsupported. The planned REA admission will inspect complete dynamic relocation declarations, retain this refusal, pin the verified endian-matched MIPS32 language and validate the bridge-reported language. Inspected absence of an ABI record will preserve unknown floating-point semantics rather than infer a floating-point ABI. Original artifact bytes remain unchanged throughout.

bsakaguchi commented

2026-10-15 18:26:46 +00:00

Author

Owner

@N0zoM1z0 commented on GitHub (Oct 11, 2026):

Correction to the early header inventory: the sectionless shared ELF has a PT_MIPS_ABIFLAGS record. The complete source parser retains MIPS32r2, o32, MIPS16 ASE and soft-float (fp_abi=3, no CPR1). Missing section headers do not imply missing program-header ABI declarations.

The public MCP prototype now opens the unchanged image, returns 412 functions and a decoded instruction with preserved language variant default and observed per-address ISA_MODE=1. Evidence retains the source ABI record and the existing soft-float storage policy. Validation remains in progress; recordless behavior is tested with a separate source-built control, not by editing the original.

@N0zoM1z0 commented on GitHub (Oct 11, 2026): Correction to the early header inventory: the sectionless shared ELF has a `PT_MIPS_ABIFLAGS` record. The complete source parser retains MIPS32r2, o32, MIPS16 ASE and soft-float (`fp_abi=3`, no CPR1). Missing section headers do not imply missing program-header ABI declarations. The public MCP prototype now opens the unchanged image, returns 412 functions and a decoded instruction with preserved language variant `default` and observed per-address `ISA_MODE=1`. Evidence retains the source ABI record and the existing soft-float storage policy. Validation remains in progress; recordless behavior is tested with a separate source-built control, not by editing the original.

bsakaguchi referenced this issue

2026-10-16 21:14:39 +00:00

[PR #627] [MERGED] test: extract shared fixtures, drop knip carve-outs #2125

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:22 +00:00