morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #5173] [CLOSED] Fix/psx zero gp unknown 4138 #6800

New issue

Closed

opened 2026-11-01 21:43:07 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:43:07 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5173
Author: @ljluestc
Created: 10/19/2026
Status: ❌ Closed

Base: main ← Head: fix/psx-zero-gp-unknown-4138

📝 Commits (10+)

bbf8ffc feat(ghidra): add bounded PS-X EXE static analysis
ebde17a fix(ghidra): merge main and harden PS-X artifact admission
c99850a fix(ghidra): retain verifier errors during lineage completion
4e39a1a fix(ghidra): seed PS-X frame state and reject short entries
36cb5fb chore: merge captured main into PR #1948
396428d chore: reconcile captured main with PR #1948
f022f06 fix(ghidra): preserve PS-X profile and format-specific readback
2211098 Merge branch 'main' into codex/psx-r3000a
9f628e8 Merge branch 'main' into codex/psx-r3000a
6582a6e fix(ghidra): treat a zero PS-X header GP as unknown

📊 Changes

28 files changed (+814 additions, -58 deletions)

View changed files

📝 bridge/ghidra/ReaGhidraBridge.java (+9 -3)
➕ bridge/ghidra/ReaGhidraPreparePsx.java (+68 -0)
📝 docs/ghidra-mips.md (+2 -0)
➕ docs/ghidra-psx.md (+54 -0)
📝 package.json (+2 -0)
➕ scripts/verify-real-ghidra-psx.mjs (+249 -0)
📝 src/application/BinaryTargetResolver.ts (+3 -0)
📝 src/artifacts/inventory/ArtifactGraphConstruction.ts (+2 -0)
📝 src/artifacts/inventory/ArtifactOccurrenceIdentity.test.ts (+9 -0)
📝 src/contracts/toolOutputSchemaPrimitives.ts (+1 -0)
📝 src/domain/analysisSnapshot.ts (+1 -0)
📝 src/domain/artifactGraph.ts (+2 -0)
📝 src/domain/artifactInspection.ts (+1 -1)
📝 src/domain/binaryTarget.ts (+22 -0)
📝 src/domain/binaryTargetTypes.ts (+10 -0)
📝 src/domain/evidence.ts (+1 -0)
➕ src/domain/psxExe.test.ts (+92 -0)
➕ src/domain/psxExe.ts (+97 -0)
📝 src/ghidra/GhidraAnalysisProfile.ts (+21 -0)
📝 src/ghidra/GhidraLauncher.ts (+89 -49)

...and 8 more files

📄 Description

fix(ghidra): treat a zero PS-X header GP as unknown

Summary

Stacked on #1948 (codex/psx-r3000a). Addresses finding 1 from #4138.

A PS-X EXE header gp0 of 0 declares no small-data base, but
ReaGhidraPreparePsx.java seeded it as a real gp register value at the
entry. Ghidra then resolved GP-relative globals against address 0, so they
appeared as uRam000000d4 instead of DAT_8002xxxx.

Changes

bridge/ghidra/ReaGhidraPreparePsx.java: seed gp only when the header
declares a nonzero value, matching the existing zero-stack-base rule. A zero
GP leaves the register unknown.
src/ghidra/GhidraAnalysisProfile.ts: bump entry_seed to
psx-header-entry-gp-sp-bss-v2 so analysis profiles and snapshots record the
changed seeding semantics.
docs/ghidra-psx.md: document that a zero GP, like a zero stack base, is
unknown rather than zero.

Validation

npm run test:local -- src/domain/psxExe.test.ts: 17 passed.
npm run test:focused -- tests/boundary/providers/ghidra/ghidraLauncher.test.ts:
23 passed, 4 skipped.
npm run typecheck: passed.
npm run check:fast: lint reports 2 max-lines-per-function errors in
unrelated files (artifactComparison.test.ts, ManagedCilDecoding.test.ts).
They come from the base branch and are not introduced here.

Real-provider verification scope

Not verified against real Ghidra. verify:ghidra:psx was not run, and its
fixture declares a nonzero GP, so it does not cover the zero-GP path. A zero-GP
fixture round is still needed.

Out of scope (remaining in #4138)

Allowing a PSX:LE:32:default override through a fingerprinted ghidra_psx_ldr
Overlay admission, .reginfo/PT_MIPS_REGINFO GP under the PSX language
Database reuse across --snapshot calls, analyze_function paging,
Ghidra set_comment, function creation at arbitrary addresses

Refs #4138

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5173 **Author:** [@ljluestc](https://github.com/ljluestc) **Created:** 10/19/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/psx-zero-gp-unknown-4138` --- ### 📝 Commits (10+) - [`bbf8ffc`](https://github.com/morluto/rea/commit/bbf8ffcab63fdf847ce68f383fc63eb81119625e) feat(ghidra): add bounded PS-X EXE static analysis - [`ebde17a`](https://github.com/morluto/rea/commit/ebde17aa1cb31da61abfb89c98fc86d3079cfc49) fix(ghidra): merge main and harden PS-X artifact admission - [`c99850a`](https://github.com/morluto/rea/commit/c99850a65c6371d2958de73c19fb5e500f4093c7) fix(ghidra): retain verifier errors during lineage completion - [`4e39a1a`](https://github.com/morluto/rea/commit/4e39a1a2230b09d68757e14ae88a45d54def5f6f) fix(ghidra): seed PS-X frame state and reject short entries - [`36cb5fb`](https://github.com/morluto/rea/commit/36cb5fb2484beb6dae176947ae0a5cfb286c2765) chore: merge captured main into PR #1948 - [`396428d`](https://github.com/morluto/rea/commit/396428d1eb50d3c8cd79495291fb4abe9841230a) chore: reconcile captured main with PR #1948 - [`f022f06`](https://github.com/morluto/rea/commit/f022f0684314d2b55b2e98854cc2c31f6237063f) fix(ghidra): preserve PS-X profile and format-specific readback - [`2211098`](https://github.com/morluto/rea/commit/22110986d8d5246c7c8a35b1118f9138222918b8) Merge branch 'main' into codex/psx-r3000a - [`9f628e8`](https://github.com/morluto/rea/commit/9f628e875ded3359c76dbf28ed67b0ce90c14d71) Merge branch 'main' into codex/psx-r3000a - [`6582a6e`](https://github.com/morluto/rea/commit/6582a6eadeb9666dd4dea6beb3829d4491df17fa) fix(ghidra): treat a zero PS-X header GP as unknown ### 📊 Changes **28 files changed** (+814 additions, -58 deletions) <details> <summary>View changed files</summary> 📝 `bridge/ghidra/ReaGhidraBridge.java` (+9 -3) ➕ `bridge/ghidra/ReaGhidraPreparePsx.java` (+68 -0) 📝 `docs/ghidra-mips.md` (+2 -0) ➕ `docs/ghidra-psx.md` (+54 -0) 📝 `package.json` (+2 -0) ➕ `scripts/verify-real-ghidra-psx.mjs` (+249 -0) 📝 `src/application/BinaryTargetResolver.ts` (+3 -0) 📝 `src/artifacts/inventory/ArtifactGraphConstruction.ts` (+2 -0) 📝 `src/artifacts/inventory/ArtifactOccurrenceIdentity.test.ts` (+9 -0) 📝 `src/contracts/toolOutputSchemaPrimitives.ts` (+1 -0) 📝 `src/domain/analysisSnapshot.ts` (+1 -0) 📝 `src/domain/artifactGraph.ts` (+2 -0) 📝 `src/domain/artifactInspection.ts` (+1 -1) 📝 `src/domain/binaryTarget.ts` (+22 -0) 📝 `src/domain/binaryTargetTypes.ts` (+10 -0) 📝 `src/domain/evidence.ts` (+1 -0) ➕ `src/domain/psxExe.test.ts` (+92 -0) ➕ `src/domain/psxExe.ts` (+97 -0) 📝 `src/ghidra/GhidraAnalysisProfile.ts` (+21 -0) 📝 `src/ghidra/GhidraLauncher.ts` (+89 -49) _...and 8 more files_ </details> ### 📄 Description # fix(ghidra): treat a zero PS-X header GP as unknown ## Summary Stacked on #1948 (`codex/psx-r3000a`). Addresses finding 1 from #4138. A PS-X EXE header `gp0` of 0 declares no small-data base, but `ReaGhidraPreparePsx.java` seeded it as a real `gp` register value at the entry. Ghidra then resolved GP-relative globals against address 0, so they appeared as `uRam000000d4` instead of `DAT_8002xxxx`. ## Changes - `bridge/ghidra/ReaGhidraPreparePsx.java`: seed `gp` only when the header declares a nonzero value, matching the existing zero-stack-base rule. A zero GP leaves the register unknown. - `src/ghidra/GhidraAnalysisProfile.ts`: bump `entry_seed` to `psx-header-entry-gp-sp-bss-v2` so analysis profiles and snapshots record the changed seeding semantics. - `docs/ghidra-psx.md`: document that a zero GP, like a zero stack base, is unknown rather than zero. ## Validation - `npm run test:local -- src/domain/psxExe.test.ts`: 17 passed. - `npm run test:focused -- tests/boundary/providers/ghidra/ghidraLauncher.test.ts`: 23 passed, 4 skipped. - `npm run typecheck`: passed. - `npm run check:fast`: lint reports 2 `max-lines-per-function` errors in unrelated files (`artifactComparison.test.ts`, `ManagedCilDecoding.test.ts`). They come from the base branch and are not introduced here. ## Real-provider verification scope Not verified against real Ghidra. `verify:ghidra:psx` was not run, and its fixture declares a nonzero GP, so it does not cover the zero-GP path. A zero-GP fixture round is still needed. ## Out of scope (remaining in #4138) - Allowing a `PSX:LE:32:default` override through a fingerprinted ghidra_psx_ldr - Overlay admission, `.reginfo`/`PT_MIPS_REGINFO` GP under the PSX language - Database reuse across `--snapshot` calls, `analyze_function` paging, Ghidra `set_comment`, function creation at arbitrary addresses Refs #4138 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:43:07 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6800

No description provided.

Rows
Columns