[PR #5263] test(ghidra): strengthen raw-binary, firmware, and instruction flow verification #6847

Open
opened 2026-11-01 21:43:29 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5263
Author: @liziye627-design
Created: 10/19/2026
Status: 🔄 Open

Base: main ← Head: test/raw-binary-load-image-verification


📝 Commits (1)

  • 6408e6d test(ghidra): strengthen raw-binary, firmware, and instruction flow verification

📊 Changes

6 files changed (+546 additions, -26 deletions)

View changed files

📝 src/contracts/officialToolContracts.ts (+1 -1)
📝 src/domain/rawBinary.test.ts (+54 -11)
📝 src/firmware/FirmwareReports.test.ts (+116 -0)
📝 src/ghidra/GhidraFunctionValues.test.ts (+174 -0)
📝 src/ghidra/GhidraRawBinaryLoadImage.fixture.ts (+35 -14)
📝 src/ghidra/GhidraRawBinaryLoadImage.test.ts (+166 -0)

📄 Description

Summary

Strengthen Ghidra adapter, firmware report, and native instruction boundary verification across raw-binary firmware targets, per-address instruction decoder context, and instruction flow classification evidence.

Problem and expected behavior

  • Multi-Architecture Raw-Binary Load Images: While REA admits raw-binary images across arm, arm64, x86, and x86_64, tests only covered 32-bit ARM without negative attestation checks when load image mappings drift from the immutable target snapshot.
  • 64-bit Address Boundaries: Raw-binary mapping calculations lacked unit verification for 64-bit address overflow and maximum address boundary edge cases.
  • Instruction Flow & Decoder Context: inspect_native_instruction preserves decoder_context (e.g. MIPS ISA_MODE) and flow.classification_evidence produced by ReaGhidraBridge.java, but lacked wire-boundary schema enforcement tests.
  • Firmware Report Partition Bounds: normalizeBinwalkReport lacked multi-signature partition normalization and bounds rejection tests (offset >= size or size > size - offset).

Change and scope

  • Parameterized fixtureRawBinaryLoadImage to generate test fixtures across all four admitted raw architectures (arm, arm64, x86, x86_64) with architecture-appropriate compiler specs and 64-bit base addresses.
  • Added comprehensive negative attestation tests in src/ghidra/GhidraRawBinaryLoadImage.test.ts for tampered digests, drifted start/end addresses, non-zero file offsets, mapping counts, compiler spec drift, and relocation anomalies.
  • Added 64-bit address overflow (x86_64, arm64), 32-bit overflow (x86), and boundary single-byte mapping tests in src/domain/rawBinary.test.ts.
  • Added contract and schema validation test suites in src/ghidra/GhidraFunctionValues.test.ts for decoder_context and flow.classification_evidence.
  • Added multi-partition normalization and out-of-bounds rejection tests in src/firmware/FirmwareReports.test.ts.
  • Made fake installation host platform-aware in src/ghidra/GhidraLanguageOverride.test.ts so installDir is recognized as an absolute path on Windows hosts.
  • Aligned inspect_native_load_image tool contract and provider limitation documentation with caller-supplied raw-binary support.

Contract and boundary impact

  • Semantic owner and earliest changed stage: Ghidra provider adapter and firmware domain model.
  • Contribution scope fit and linked maintainer decision: not applicable (existing boundaries and contracts preserved).
  • CLI and MCP/tool-catalog contract: Documentation and contract description aligned with caller-supplied raw binary support; no schema breaking change.
  • Provider, bridge, target-format, or platform compatibility: Fully compatible with existing Ghidra bridge, firmware domain, Linux, macOS, and Windows.
  • Evidence, artifact, provenance, or reconstruction contract: Preserved unchanged.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable (test suite additions and read-only boundary verification).
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): none.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated:
    • src/ghidra/GhidraRawBinaryLoadImage.fixture.ts
    • src/ghidra/GhidraRawBinaryLoadImage.test.ts
    • src/domain/rawBinary.test.ts
    • src/ghidra/GhidraFunctionValues.test.ts
    • src/firmware/FirmwareReports.test.ts
    • src/ghidra/GhidraLanguageOverride.test.ts
    • src/contracts/officialToolContracts.ts
    • src/ghidra/GhidraProviderCapabilities.ts
  • Base reproduction or other evidence: Existing unit coverage only exercised 32-bit ARM happy path; missing negative attestation, decoder context, and firmware bounds tests.
  • User-visible CLI/MCP output (if applicable): not applicable.
  • Remaining proof gaps: Real hardware device execution remains out of scope for unit tests; simulated fixtures verify provider boundaries.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run check:fast — passed (Turbo typecheck and Oxlint clean with 0 errors and 0 warnings)
  • npm run build:cached — passed (Turbo 3/3 tasks clean)
  • npm run test:local -- src/firmware/FirmwareReports.test.ts src/domain/rawBinary.test.ts src/ghidra/GhidraFunctionValues.test.ts src/ghidra/GhidraRawBinaryLoadImage.test.ts src/ghidra/GhidraLanguageOverride.test.ts src/ghidra/GhidraProvider.behavior.test.ts src/ghidra/GhidraMipsProfile.test.ts src/ghidra/GhidraDosComLoadImage.test.ts — passed (230/230 tests passed)

Compatibility, safety, and release

  • Breaking changes or migration steps: none.
  • Real Hopper/Ghidra, browser, or OS coverage: Validated on Windows local host; Ghidra language override tests dynamically resolve host platform.
  • Package or release metadata impact: none.
  • Security, privacy, process, or containment review: Read-only test additions; no credentials or binaries committed.

Author readiness

Human owner: @liziye627-design

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5263 **Author:** [@liziye627-design](https://github.com/liziye627-design) **Created:** 10/19/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `test/raw-binary-load-image-verification` --- ### 📝 Commits (1) - [`6408e6d`](https://github.com/morluto/rea/commit/6408e6d1a82da1ad63d6bcf626178662b4972b4f) test(ghidra): strengthen raw-binary, firmware, and instruction flow verification ### 📊 Changes **6 files changed** (+546 additions, -26 deletions) <details> <summary>View changed files</summary> 📝 `src/contracts/officialToolContracts.ts` (+1 -1) 📝 `src/domain/rawBinary.test.ts` (+54 -11) 📝 `src/firmware/FirmwareReports.test.ts` (+116 -0) 📝 `src/ghidra/GhidraFunctionValues.test.ts` (+174 -0) 📝 `src/ghidra/GhidraRawBinaryLoadImage.fixture.ts` (+35 -14) 📝 `src/ghidra/GhidraRawBinaryLoadImage.test.ts` (+166 -0) </details> ### 📄 Description ## Summary Strengthen Ghidra adapter, firmware report, and native instruction boundary verification across raw-binary firmware targets, per-address instruction decoder context, and instruction flow classification evidence. ## Problem and expected behavior - **Multi-Architecture Raw-Binary Load Images**: While REA admits raw-binary images across `arm`, `arm64`, `x86`, and `x86_64`, tests only covered 32-bit ARM without negative attestation checks when load image mappings drift from the immutable target snapshot. - **64-bit Address Boundaries**: Raw-binary mapping calculations lacked unit verification for 64-bit address overflow and maximum address boundary edge cases. - **Instruction Flow & Decoder Context**: `inspect_native_instruction` preserves `decoder_context` (e.g. MIPS `ISA_MODE`) and `flow.classification_evidence` produced by `ReaGhidraBridge.java`, but lacked wire-boundary schema enforcement tests. - **Firmware Report Partition Bounds**: `normalizeBinwalkReport` lacked multi-signature partition normalization and bounds rejection tests (`offset >= size` or `size > size - offset`). ## Change and scope - Parameterized `fixtureRawBinaryLoadImage` to generate test fixtures across all four admitted raw architectures (`arm`, `arm64`, `x86`, `x86_64`) with architecture-appropriate compiler specs and 64-bit base addresses. - Added comprehensive negative attestation tests in `src/ghidra/GhidraRawBinaryLoadImage.test.ts` for tampered digests, drifted start/end addresses, non-zero file offsets, mapping counts, compiler spec drift, and relocation anomalies. - Added 64-bit address overflow (`x86_64`, `arm64`), 32-bit overflow (`x86`), and boundary single-byte mapping tests in `src/domain/rawBinary.test.ts`. - Added contract and schema validation test suites in `src/ghidra/GhidraFunctionValues.test.ts` for `decoder_context` and `flow.classification_evidence`. - Added multi-partition normalization and out-of-bounds rejection tests in `src/firmware/FirmwareReports.test.ts`. - Made fake installation host platform-aware in `src/ghidra/GhidraLanguageOverride.test.ts` so `installDir` is recognized as an absolute path on Windows hosts. - Aligned `inspect_native_load_image` tool contract and provider limitation documentation with caller-supplied raw-binary support. ## Contract and boundary impact - Semantic owner and earliest changed stage: Ghidra provider adapter and firmware domain model. - Contribution scope fit and linked maintainer decision: not applicable (existing boundaries and contracts preserved). - CLI and MCP/tool-catalog contract: Documentation and contract description aligned with caller-supplied raw binary support; no schema breaking change. - Provider, bridge, target-format, or platform compatibility: Fully compatible with existing Ghidra bridge, firmware domain, Linux, macOS, and Windows. - Evidence, artifact, provenance, or reconstruction contract: Preserved unchanged. - Target selection, authority, upstream behavior, and cleanup details (if applicable): not applicable (test suite additions and read-only boundary verification). - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): none. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: - `src/ghidra/GhidraRawBinaryLoadImage.fixture.ts` - `src/ghidra/GhidraRawBinaryLoadImage.test.ts` - `src/domain/rawBinary.test.ts` - `src/ghidra/GhidraFunctionValues.test.ts` - `src/firmware/FirmwareReports.test.ts` - `src/ghidra/GhidraLanguageOverride.test.ts` - `src/contracts/officialToolContracts.ts` - `src/ghidra/GhidraProviderCapabilities.ts` - Base reproduction or other evidence: Existing unit coverage only exercised 32-bit ARM happy path; missing negative attestation, decoder context, and firmware bounds tests. - User-visible CLI/MCP output (if applicable): not applicable. - Remaining proof gaps: Real hardware device execution remains out of scope for unit tests; simulated fixtures verify provider boundaries. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:fast` — passed (Turbo typecheck and Oxlint clean with 0 errors and 0 warnings) - `npm run build:cached` — passed (Turbo 3/3 tasks clean) - `npm run test:local -- src/firmware/FirmwareReports.test.ts src/domain/rawBinary.test.ts src/ghidra/GhidraFunctionValues.test.ts src/ghidra/GhidraRawBinaryLoadImage.test.ts src/ghidra/GhidraLanguageOverride.test.ts src/ghidra/GhidraProvider.behavior.test.ts src/ghidra/GhidraMipsProfile.test.ts src/ghidra/GhidraDosComLoadImage.test.ts` — passed (230/230 tests passed) ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: Validated on Windows local host; Ghidra language override tests dynamically resolve host platform. - Package or release metadata impact: none. - Security, privacy, process, or containment review: Read-only test additions; no credentials or binaries committed. ## Author readiness Human owner: @liziye627-design - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6847
No description provided.