[PR #5650] [MERGED] fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads #7013

New issue

Closed

opened 2026-11-01 21:44:42 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented 2026-11-01 21:44:42 +00:00

Owner

Copy link

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5650
Author: @morluto
Created: 10/20/2026
Status: ✅ Merged
Merged: 10/20/2026
Merged by: @morluto

Base: main ← Head: cursor/macho-lazy-dylib-info-eba5

---

📝 Commits (10+)

• f9482b6 fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads
• 2358fb8 fix(apple): bound lazy-load payload reads and image offsets
• 938bb69 fix(apple): bound lazy-load string scans and contained reads
• b16b091 fix(apple): reject cached lazy-load strings outside a payload
• 4cf9773 fix(apple): bound lazy-load payload range lookups
• c7c5eab fix(apple): count every lazy-info string reference
• e7cd50f fix(apple): cap retained lazy-info dependency results
• bcd0e66 fix(apple): reject a lazy-load path NUL in the final byte
• fcc2a4f fix(apple): keep may-be-missing lazy loads optional
• e8f68f1 fix(apple): cap lazy-info symbol string references

📊 Changes

12 files changed (+1492 additions, -23 deletions)

View changed files

📝 docs/apple-application-analysis.md (+21 -4)
📝 scripts/verify/apple/macos-dylib-e2e.mjs (+5 -1)
📝 src/artifacts/apple/MachoImage.fixture.ts (+124 -0)
📝 src/artifacts/apple/MachoLoadCommandReader.test.ts (+651 -1)
📝 src/artifacts/apple/MachoLoadCommandReader.ts (+475 -6)
📝 src/contracts/artifactToolContracts.ts (+1 -1)
📝 src/domain/apple/dylibResolution.test.ts (+87 -0)
📝 src/domain/apple/dylibResolution.ts (+15 -5)
📝 src/domain/apple/dylibResolutionFindings.ts (+30 -4)
📝 src/native/NativeMachoInspection.test.ts (+53 -0)
📝 src/native/NativeMachoInspection.ts (+20 -1)
📝 src/native/parsers/otool.ts (+10 -0)

📄 Description

Summary

Fixes #5551 and #5649. trace-dylib-resolution dropped LC_LAZY_LOAD_DYLIB_INFO (0x3a) and still reported complete coverage. inspect-macho kept that command as a raw load command and still marked the dependency list exhaustive.

Seed audit on main b3aadaf47: #5606 is already closed by 2b263a7fe. #5542 and #5462 are already rejected at FAT admission by 497037e6e (machoContainer.test.ts and binaryTarget.test.ts still pass). This PR does not reopen those.

Problem and expected behavior

A Mach-O linked with the current lazy-load info command stores the install name in a linkedit payload, not in a classic dylib_command. The load-command reader ignored command 0x3a, so the trace listed only the other dependencies and set coverage.status to complete. otool -l prints the command without a name field; the inspection normalizer treated the resulting dependency list as exhaustive.

The payload install name is a dependency. It is resolved like LC_LAZY_LOAD_DYLIB and not traversed, because dyld loads it on first use. An absent image is lazy-load-unresolved, not a required launch failure. When the may-be-missing flag is set (weak: true), that finding says dyld continues if the image is absent. A required lazy image still says first use would fail. Versions are null because this payload has none. The may-be-missing flag is weak. Unrecognized flag bits leave the image unsupported instead of inventing weak: false. Flag and chain-start image offsets outside the slice VM range leave the image malformed. Payload strings must start after the 24-byte header. Distinct payload bytes and payload-range lookups stay within the 16 MiB limit, and a file range already read is reused. String scanning and UTF-8 checks count every reference, including repeats and overlaps, and stop at that same aggregate. Symbol references, including repeats, stop at 65536 per slice before those strings are cached. A cached string is reused only when its start and terminating NUL both lie inside the later payload. A load-path NUL in the payload's final byte is unterminated. A slice retains at most 1024 of these commands. inspect-macho keeps the raw otool command and marks dependencies non-exhaustive, with a limitation naming the omitted command. It does not invent an install name from otool text.

Change and scope

The Mach-O load-command reader owns the payload parse and emits the dependency in load-command order, including FAT slices. The VM range is dyld's one-page floor extended by every segment except __LINKEDIT, measured from the __TEXT vmaddr. The trace skips traversal for both lazy commands. The otool parser records payload-only dependency commands, and inspection uses that to clear exhaustive coverage.

Follow the contribution scope.
This is an ordinary parser fix inside existing read-only Mach-O inspection. No new provider, target execution, injection, mutation, or protection recovery. Maintainer scope decision: not applicable.

Contract and boundary impact

• Semantic owner and earliest changed stage: MachoLoadCommandReader for structural dependency facts; parseOtoolLoadCommands for the otool dependency inventory. Both change before trace coverage and inspect-macho presentation.
• Contribution scope fit and linked maintainer decision: existing read-only format inspection; maintainer scope decision not applicable.
• CLI and MCP/tool-catalog contract: trace_dylib_resolution edges may include command: LC_LAZY_LOAD_DYLIB_INFO and encoding: lazy_load_dylib_info, with null versions. inspect_macho dependencies are non-exhaustive when that command is present. Catalog text mentions the payload. CI regenerates ignored catalogs.
• Provider, bridge, target-format, or platform compatibility: little-endian Mach-O only, same as the existing reader. Big-endian slices stay unsupported.
• Evidence, artifact, provenance, or reconstruction contract: trace evidence gains the lazy edge or an unsupported-image reason. inspect-macho does not claim an install name it did not read from otool.
• Target selection, authority, upstream behavior, and cleanup details (if applicable): unchanged. No process launch.
• Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): tool description text only. No package or install change.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

• Read existing files or captured data.
• Launch or attach to a process.
• Inject instrumentation or run scripts/code.
• Change process memory, registers, files, or configuration.
• Contact network services.
• Recover protected code or work around protections.
• Documentation or usability only; no target interaction.
• Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

• Tests added or updated: payload order, weak flag, FAT slice offset, truncated payload, bad path offset, unknown flags, flag and chain-start offsets, __TEXT / __LINKEDIT VM range, short segment, shared payload range, contained payload range, aggregate payload limit, payload-range lookup limit, header and symbol offsets inside the 24-byte header, cached string past a shorter payload, repeated and overlapping symbol scans, path NUL in the final payload byte, 65536 symbol references in one payload and across two payloads; filesystem trace with the library present and absent; domain non-traversal and lazy-load-unresolved; a missing may-be-missing lazy image stays lazy-load-unresolved and says dyld continues; inspect-macho non-exhaustive dependency inventory.
• Base reproduction or other evidence: #5551 records the macOS CLI omission. This environment has no Apple clang or otool, so that CLI script was not replayed. The structural fixture uses the same install name @rpath/libl.dylib, symbol _lf, and 56-byte payload size reported there. #5649 is source-derived from the otool normalizer; its opening text overstates a pre-fix inspectNativeMacho execution that was not captured. The regression was run after the fix. Offset checks follow mach_o::LazyLoadDylib::valid and dyld's linkedit maxVmOffset (Image::validLinkedit).
• User-visible CLI/MCP output (if applicable): a present lazy edge resolves and coverage stays complete without findings. An absent required one adds lazy-load-unresolved and does not traverse the library. An absent may-be-missing one uses the same kind and says dyld continues if the image is absent. inspect-macho sets dependencies.exhaustive false and mentions 1 LC_LAZY_LOAD_DYLIB_INFO. An out-of-range image offset, a header or symbol string offset, a cached string that runs past a shorter payload, or an over-budget payload, range lookup, string scan, or symbol-reference count leaves the image malformed or unsupported, so coverage does not claim a complete resolution.
• Remaining proof gaps: no real otool -l / dyld replay, no MCP transport replay, and no check that current Apple linkers still use only flag bit 0.

For evidence-bearing changes:

• Observed, derived, and inferred claims remain distinguishable.
• Artifact identity, source provenance, and failed attempts remain preserved.
• Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

• npm run check:fast — typecheck and lint passed after e8f68f18d.
• npm run test:local -- src/artifacts/apple/MachoLoadCommandReader.test.ts — 45 passed.
• Earlier on this branch, npm run test:local -- src/domain/apple/dylibResolution.test.ts src/artifacts/apple/MachoLoadCommandReader.test.ts — 133 passed, before the symbol-reference cap. The domain file was not rerun for this cap.
• oxfmt --write on the touched reader, test, and doc.

Not run: npm run check:pr, npm run docs:check, macOS trace-dylib-resolution / inspect-macho CLI, or the #5551 clang script.

Compatibility, safety, and release

• Breaking changes or migration steps: none for request shape. Callers that assumed every traced dependency was a classic dylib command, or that current_version was always a string, can now see LC_LAZY_LOAD_DYLIB_INFO and null versions. inspect_macho dependencies are no longer exhaustive when this command is present. A slice with more than 65536 lazy-info symbol references is unsupported.
• Real Hopper/Ghidra, browser, or OS coverage: not run. No engine launch.
• Package or release metadata impact: none.
• Security, privacy, process, or containment review: read-only header and payload parsing. Unknown flag bits stay unsupported. Identical and contained payload ranges are not reread, and range lookups stop at 16 MiB comparisons. String validation counts every reference, including repeats and overlaps, and stops at 16 MiB per slice. Symbol references stop at 65536 per slice before those strings are cached. A header or symbol offset inside the 24-byte header cannot become an install name. No new process authority.

Author readiness

Human owner: @morluto

• I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
• I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
• I declare this PR ready for initial maintainer review.

Before merge

• This PR addresses a concrete problem or an agreed enhancement.
• Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
• The PR has one focused outcome and the title follows type(scope): outcome.
• Related issue is linked, or the reason for not linking one is stated above.
• Tests cover changed observable behavior and meaningful failure paths.
• Owning docs, contracts, and generated metadata are updated where needed.
• User-visible CLI/MCP changes include representative output.
• I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

  

---

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5650 **Author:** [@morluto](https://github.com/morluto) **Created:** 10/20/2026 **Status:** ✅ Merged **Merged:** 10/20/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `cursor/macho-lazy-dylib-info-eba5` --- ### 📝 Commits (10+) - [`f9482b6`](https://github.com/morluto/rea/commit/f9482b64e759aa4b4c6e08c76795b3099410b157) fix(apple): read LC_LAZY_LOAD_DYLIB_INFO dependency payloads - [`2358fb8`](https://github.com/morluto/rea/commit/2358fb8a55201bb8d8391a99ff77853839c8ce47) fix(apple): bound lazy-load payload reads and image offsets - [`938bb69`](https://github.com/morluto/rea/commit/938bb694ad0c037f55c2073c8ea908b8c3403a79) fix(apple): bound lazy-load string scans and contained reads - [`b16b091`](https://github.com/morluto/rea/commit/b16b091dd2956074dd6cbf23214b3bf17dcfd6cd) fix(apple): reject cached lazy-load strings outside a payload - [`4cf9773`](https://github.com/morluto/rea/commit/4cf977352f59b842e50e0eda84d05125ed68df1d) fix(apple): bound lazy-load payload range lookups - [`c7c5eab`](https://github.com/morluto/rea/commit/c7c5eab41cbef57416970ed8be4b263d693a14e6) fix(apple): count every lazy-info string reference - [`e7cd50f`](https://github.com/morluto/rea/commit/e7cd50f27d9c3e454690fbe53597d323861c9161) fix(apple): cap retained lazy-info dependency results - [`bcd0e66`](https://github.com/morluto/rea/commit/bcd0e66502997383ee697b421728a58e67760d87) fix(apple): reject a lazy-load path NUL in the final byte - [`fcc2a4f`](https://github.com/morluto/rea/commit/fcc2a4fef390edeeb63aa2a3028641fa38d4d251) fix(apple): keep may-be-missing lazy loads optional - [`e8f68f1`](https://github.com/morluto/rea/commit/e8f68f18d228662b837bb043c398a87ca093d73a) fix(apple): cap lazy-info symbol string references ### 📊 Changes **12 files changed** (+1492 additions, -23 deletions) <details> <summary>View changed files</summary> 📝 `docs/apple-application-analysis.md` (+21 -4) 📝 `scripts/verify/apple/macos-dylib-e2e.mjs` (+5 -1) 📝 `src/artifacts/apple/MachoImage.fixture.ts` (+124 -0) 📝 `src/artifacts/apple/MachoLoadCommandReader.test.ts` (+651 -1) 📝 `src/artifacts/apple/MachoLoadCommandReader.ts` (+475 -6) 📝 `src/contracts/artifactToolContracts.ts` (+1 -1) 📝 `src/domain/apple/dylibResolution.test.ts` (+87 -0) 📝 `src/domain/apple/dylibResolution.ts` (+15 -5) 📝 `src/domain/apple/dylibResolutionFindings.ts` (+30 -4) 📝 `src/native/NativeMachoInspection.test.ts` (+53 -0) 📝 `src/native/NativeMachoInspection.ts` (+20 -1) 📝 `src/native/parsers/otool.ts` (+10 -0) </details> ### 📄 Description <!-- CURSOR_AGENT_PR_BODY_BEGIN --> ## Summary Fixes #5551 and #5649. `trace-dylib-resolution` dropped `LC_LAZY_LOAD_DYLIB_INFO` (`0x3a`) and still reported complete coverage. `inspect-macho` kept that command as a raw load command and still marked the dependency list exhaustive. Seed audit on main `b3aadaf47`: #5606 is already closed by `2b263a7fe`. #5542 and #5462 are already rejected at FAT admission by `497037e6e` (`machoContainer.test.ts` and `binaryTarget.test.ts` still pass). This PR does not reopen those. ## Problem and expected behavior A Mach-O linked with the current lazy-load info command stores the install name in a linkedit payload, not in a classic `dylib_command`. The load-command reader ignored command `0x3a`, so the trace listed only the other dependencies and set `coverage.status` to `complete`. `otool -l` prints the command without a `name` field; the inspection normalizer treated the resulting dependency list as exhaustive. The payload install name is a dependency. It is resolved like `LC_LAZY_LOAD_DYLIB` and not traversed, because dyld loads it on first use. An absent image is `lazy-load-unresolved`, not a required launch failure. When the may-be-missing flag is set (`weak: true`), that finding says dyld continues if the image is absent. A required lazy image still says first use would fail. Versions are null because this payload has none. The may-be-missing flag is `weak`. Unrecognized flag bits leave the image unsupported instead of inventing `weak: false`. Flag and chain-start image offsets outside the slice VM range leave the image malformed. Payload strings must start after the 24-byte header. Distinct payload bytes and payload-range lookups stay within the 16 MiB limit, and a file range already read is reused. String scanning and UTF-8 checks count every reference, including repeats and overlaps, and stop at that same aggregate. Symbol references, including repeats, stop at 65536 per slice before those strings are cached. A cached string is reused only when its start and terminating NUL both lie inside the later payload. A load-path NUL in the payload's final byte is unterminated. A slice retains at most 1024 of these commands. `inspect-macho` keeps the raw otool command and marks dependencies non-exhaustive, with a limitation naming the omitted command. It does not invent an install name from otool text. ## Change and scope The Mach-O load-command reader owns the payload parse and emits the dependency in load-command order, including FAT slices. The VM range is dyld's one-page floor extended by every segment except `__LINKEDIT`, measured from the `__TEXT` vmaddr. The trace skips traversal for both lazy commands. The otool parser records payload-only dependency commands, and inspection uses that to clear exhaustive coverage. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). This is an ordinary parser fix inside existing read-only Mach-O inspection. No new provider, target execution, injection, mutation, or protection recovery. Maintainer scope decision: not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: `MachoLoadCommandReader` for structural dependency facts; `parseOtoolLoadCommands` for the otool dependency inventory. Both change before trace coverage and inspect-macho presentation. - Contribution scope fit and linked maintainer decision: existing read-only format inspection; maintainer scope decision not applicable. - CLI and MCP/tool-catalog contract: `trace_dylib_resolution` edges may include `command: LC_LAZY_LOAD_DYLIB_INFO` and `encoding: lazy_load_dylib_info`, with null versions. `inspect_macho` dependencies are non-exhaustive when that command is present. Catalog text mentions the payload. CI regenerates ignored catalogs. - Provider, bridge, target-format, or platform compatibility: little-endian Mach-O only, same as the existing reader. Big-endian slices stay unsupported. - Evidence, artifact, provenance, or reconstruction contract: trace evidence gains the lazy edge or an unsupported-image reason. inspect-macho does not claim an install name it did not read from otool. - Target selection, authority, upstream behavior, and cleanup details (if applicable): unchanged. No process launch. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): tool description text only. No package or install change. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: payload order, weak flag, FAT slice offset, truncated payload, bad path offset, unknown flags, flag and chain-start offsets, `__TEXT` / `__LINKEDIT` VM range, short segment, shared payload range, contained payload range, aggregate payload limit, payload-range lookup limit, header and symbol offsets inside the 24-byte header, cached string past a shorter payload, repeated and overlapping symbol scans, path NUL in the final payload byte, 65536 symbol references in one payload and across two payloads; filesystem trace with the library present and absent; domain non-traversal and `lazy-load-unresolved`; a missing may-be-missing lazy image stays `lazy-load-unresolved` and says dyld continues; inspect-macho non-exhaustive dependency inventory. - Base reproduction or other evidence: #5551 records the macOS CLI omission. This environment has no Apple clang or otool, so that CLI script was not replayed. The structural fixture uses the same install name `@rpath/libl.dylib`, symbol `_lf`, and 56-byte payload size reported there. #5649 is source-derived from the otool normalizer; its opening text overstates a pre-fix `inspectNativeMacho` execution that was not captured. The regression was run after the fix. Offset checks follow `mach_o::LazyLoadDylib::valid` and dyld's linkedit `maxVmOffset` (`Image::validLinkedit`). - User-visible CLI/MCP output (if applicable): a present lazy edge resolves and coverage stays `complete` without findings. An absent required one adds `lazy-load-unresolved` and does not traverse the library. An absent may-be-missing one uses the same kind and says dyld continues if the image is absent. inspect-macho sets `dependencies.exhaustive` false and mentions `1 LC_LAZY_LOAD_DYLIB_INFO`. An out-of-range image offset, a header or symbol string offset, a cached string that runs past a shorter payload, or an over-budget payload, range lookup, string scan, or symbol-reference count leaves the image malformed or unsupported, so coverage does not claim a complete resolution. - Remaining proof gaps: no real `otool -l` / `dyld` replay, no MCP transport replay, and no check that current Apple linkers still use only flag bit 0. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run check:fast` — typecheck and lint passed after `e8f68f18d`. - `npm run test:local -- src/artifacts/apple/MachoLoadCommandReader.test.ts` — 45 passed. - Earlier on this branch, `npm run test:local -- src/domain/apple/dylibResolution.test.ts src/artifacts/apple/MachoLoadCommandReader.test.ts` — 133 passed, before the symbol-reference cap. The domain file was not rerun for this cap. - `oxfmt --write` on the touched reader, test, and doc. Not run: `npm run check:pr`, `npm run docs:check`, macOS `trace-dylib-resolution` / `inspect-macho` CLI, or the #5551 clang script. ## Compatibility, safety, and release - Breaking changes or migration steps: none for request shape. Callers that assumed every traced dependency was a classic dylib command, or that `current_version` was always a string, can now see `LC_LAZY_LOAD_DYLIB_INFO` and null versions. `inspect_macho` dependencies are no longer exhaustive when this command is present. A slice with more than 65536 lazy-info symbol references is unsupported. - Real Hopper/Ghidra, browser, or OS coverage: not run. No engine launch. - Package or release metadata impact: none. - Security, privacy, process, or containment review: read-only header and payload parsing. Unknown flag bits stay unsupported. Identical and contained payload ranges are not reread, and range lookups stop at 16 MiB comparisons. String validation counts every reference, including repeats and overlaps, and stops at 16 MiB per slice. Symbol references stop at 65536 per slice before those strings are cached. A header or symbol offset inside the 24-byte header cannot become an install name. No new process authority. ## Author readiness Human owner: @morluto - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [ ] This PR addresses a concrete problem or an agreed enhancement. - [ ] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [ ] The PR has one focused outcome and the title follows `type(scope): outcome`. - [ ] Related issue is linked, or the reason for not linking one is stated above. - [ ] Tests cover changed observable behavior and meaningful failure paths. - [ ] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [ ] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. <!-- CURSOR_AGENT_PR_BODY_END --> <div><a href="https://cursor.com/agents/bc-ed24be5a-30fa-5038-acf0-2924b02ceba5?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-web-light.png"><img alt="Open in Web" width="114" height="28" src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a href="https://cursor.com/background-agent?bcId=bc-ed24be5a-30fa-5038-acf0-2924b02ceba5&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source media="(prefers-color-scheme: dark)" srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source media="(prefers-color-scheme: light)" srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img alt="Open in Cursor" width="131" height="28" src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div> --- _{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

bsakaguchi 2026-11-01 21:44:42 +00:00

• closed this issue
• added the
  pull-request
  label

bsakaguchi referenced this issue 2026-11-03 13:38:49 +00:00

[PR #7013] [MERGED] fix(targets): keep original DOS header padding out of e_lfanew #7574

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

codex/procedure-reference-stacked

release-please--branches--main--components--rea-agents

release-please--branches--main--components--rea-agents--release-notes

codex/kuna-independent-retry

codex/byte-search-overlay-coverage

codex/open-failure-target-receipt

codex/kuna-xref-evidence

codex/ghidra-ambiguous-procedure-recovery

codex/function-source-bundle

codex/trace-function-integration-prototype

codex/snapshot-source-closure

codex/recorded-evidence-array-pages

codex/evidence-recovery-redesign

codex/trace-feature-address-scope

codex/call-discovery-scope

codex/ghidra-literal-candidate-evidence

codex/decompile-directory-independent-retry

codex/retry-provenance-base

codex/value-flow-capability-experiment

codex/ghidra-containing-instruction

cursor/readme-discord-button-ef9f

dependabot/github_actions/actions/setup-node-7.1.0

dependabot/github_actions/actions/upload-artifact-7.0.2

dependabot/npm_and_yarn/npm-minor-and-patch-d8d97ce6df

codex/kuna-1989

fix/8559-native-ui-fixture-ownership

fix/8555-go-verifier-mcp-ownership

codex/provider-capability-recovery

fix/8642-rizin-target-stdin

codex/ghidra-memory-effect-scope

codex/ghidra-annotation-entry-selector

codex/ghidra-readonly-recovery

codex/ghidra-regex-verifier-recovery

codex/evidence-discovery-view-guidance

fix/8545-bulk-append-overflow

fix/8428-navigation-refusal-alternatives

codex/address-context-recovery

codex/matching-member-limitations

codex/unknown-scope-contract

codex/evidence-view-guidance

feat/8373-native-trace-views

codex/ghidra-snapshot-verifier-binding

codex/elf-export-visibility

codex/evidence-view-recovery

codex/native-reference-cli-help

codex/provider-candidate-observation-scope

codex/kuna-session-verification

codex/ghidra-switch-lifetime-guidance

codex/pseudocode-paging-discovery

codex/clarify-evidence-view-support

codex/kuna-xrefs-selector-recovery

codex/context-capacity-recovery

codex/evidence-closure-large-links

codex/same-function-evidence-identity

codex/ghidra-verifier-inspected-jdk

codex/audit-guided-workflows

codex/crash-prompt-retained-dossiers

codex/analysis-view-error-recovery

codex/kuna-verifier-target-selection

codex/ghidra-selected-project-call-coverage

codex/docs-native-analysis-scope

codex/ghidra-java-socket-boundary

codex/ghidra-retained-snapshot-verifier

codex/ghidra-search-inventory-facts

fix/8284-zero-argument-parameter-bindings

fix/8198-ui-action-handler-offset

fix/8257-elf-entry-label-identity

fix/8304-deferred-output-schema-projection

fix/8277-call-path-computed-target-uncertainty

fix/pr-8089-conflicts

fix/ci-static-duplicate-export

dependabot/npm_and_yarn/lint-staged-17.6.0

dependabot/github_actions/actions/download-artifact-8.0.2

dependabot/npm_and_yarn/write-file-atomic-8.0.0

dependabot/npm_and_yarn/canonicalize-5.1.0

dependabot/github_actions/actions/cache/restore-6.1.0

dependabot/npm_and_yarn/toon-format/toon-4.4.0

dependabot/github_actions/actions/deploy-pages-5.0.1

codex/review-fixes-pr-2403

codex/review-fixes-pr-2400

codex/process-terminal-width

codex/test-brittleness-cleanup

verify/7167-browser-connect-macos

fix/7167-browser-connect

feat/native-matching-allowance-setting

feat/browser-scenario-dry-run

test/managed-caller-parameters-20261024

codex/parser-fortythird-boundaries

fix/6926-pinvoke-platform-decorations-20261023

fix/6889-har-body-encoding-20261023

fix/6888-sqlite-schema-budget-20261023

fix/dependency-security-gates-6708

cursor/evidence-overwrite-rebase-b4ac

feat/4057-verify-native-exports

fix/windows-acl-observer-overhead-20261022

cursor/erlang-beam-restack-4476

cursor/pe-certificate-review-bf32

fix/6116-javascript-application-fs-errors

fix/6061-unmapped-runtime-script-unknown

feat/browser-scenario-summary

fix/pe-certificates

codex/verify-3407

cursor/rebase-5699

cursor/rebase-5352

cursor/rebase-5600

cursor/fix-cli-schema-omission-10a8

codex/audit-hopper-shutdown-reasons-20261021

fix/demangle-swift-omitted-record

fix/nib-boolean-value-types

cursor/cancellation-partial-observation-a5ac

fix/ib-object-limit-reasons

fix/electron-fuse-limit-advice

fix/kuna-doctor-dangling-cache

fix/fixed-budget-refusal-advice

fix/js-ipc-listener-dedup

fix/js-return-member-provenance

fix/dmg-integrity-retry-advice

fix/ida-doctor-readiness

fix/kuna-version-probe-output-drain

fix/legacy-swift-runtime-name-matching

fix/dylib-lazy-load-commands

fix/browser-scenario-startup-cancel

fix/swift-nested-punycode-classification

fix/compare-unselected-scopes

fix/objc-method-budget-coverage

fix/dmg-mounted-root-observations

audit/ci-tests-20261019-round2

release/6.7.0

fix/wabt-cleanup-retry-resolution

fix/electron-fuse-elf-pe-architecture

fix/native-plist-descriptor-ownership

fix/kuna-caller-cleanup-ownership

experiment/atomic-codemode-20261016

review/first-contributor-3776

fix/call-resolution-full-read-cycles

fix/member-mutation-selection-repeat

experiment/atomic-re-tools-20261015

perf/member-mutation-lazy-origins

perf/static-network-mutation-index

fix/hopper-startup-lifecycle

audit/3050-windows-proof-20261015

feat/windows-window-capture-2183

audit/3049-windows-proof-20261015

audit/3735-macos-fixtures-20261015

fix/batch-decompile-null-pseudocode

fix/kuna-inventory-honors-jobs

experiment/browser-codemode-tool-design-20261015

fix/hopper-clean-runtime-argv

codex/review-2049-27f1b367

review-fixes/pr-2787-routing

fix/3360-scoped-this-emitters

fix/3367-replaced-global-effects

fix/3838-compact-any-value-items

test/hopper-download-probe-20261015

codex/windows-runtime-creation-red-green-20261015

codex/windows-readonly-root-red-green-20261015

codex/windows-root-share-red-green-20261015

codex/exp-1685-win-mcp-startup

codex/bug-sweep-20261015

investigate/2190-windows-package-phases

investigate/3543-macos-cli-deadline

perf/3281-reverse-tools-feedback-quality

fix/3406-hopper-doctor-fixture

fix/3341-wrapper-require-test-context

fix/3301-owned-uninstall-fixtures

fix/3164-compiler-input-ownership

fix/pcap-cleanup-stdout-newline-20261014

perf/interface-builder-summary

codex/review-fixes-pr-1977

fix/ghidra-effective-jvm-platform

fix/docs-turkish-rust-link-20261013

fix/main-maintenance-ci-20261010

fix/recover-binary-session-process-effects

codex/review-fixes-pr-2457

codex/ci-required-cancellation-gate

fix/main-format-baseline-20261013

fix/setup-preserve-entry-fields

cursor/restore-main-checks-1ffc

fix/ghidra-bridge-hashmap-import

codex/shared-ci-jadx-json-default-20261013

codex/shared-ci-ghidra-test-groups-20261013

codex/shared-ci-java-fixture-format-20261013

codex/fix-intrinsic-invocation-boundaries

test/release-preflight-reusable-jobs

test/js-parameter-provenance-expectation

fix/linux-hopper-verification-current

test/2419-ghidra-elf-probe-size

followup/pr-1544-native-ida

codex/fold-pr-2230-contribution

docs/readme-responsible-use

fix/issue-2064

fix/issue-2050

fix/issue-2053

fix/issue-1968

fix/issue-1945

experiment/codemode-bridge-20261011

fix/tool-effects-negative-wording-1904-20261012

fix/1842-electron-interop-provenance

feat/recover-javascript-multi-input

refactor/website-i18n-prep

fix/nativeaot-pe-virtual-extent

fix/browser-verifier-ci-hang

fix/pe-resources-input-selection

docs/beginner-friendly-guides

docs/beginner-setup-guide

fix/javascript-analysis-worker-1563

fix/1649-ghidra-duplicate-names

fix/javascript-export-keys-integration-1369

test/maintenance-boundary-contracts-20261011

review/javascript-export-keys-1369

review/process-live-progress-1483

test/javascript-1495-growth-ratio

fix/ci-escape-timing

docs/normalized-terminal-geometry-1450

release/6.3.0

archive/release-6.3.0-pr1381

release/6.2.0

fix/electron-preload-dynamic-override

fix/javascript-self-referential-bundler-edges

release/6.1.0

cursor/grok-client-cherry-pick-0b56

feat/signature-posture

feat/dyld-shared-cache

feat/artifact-integrity-policy

feat/pkg-inventory

release/6.0.0

chore/sync-release-5.0.0

release/5.0.0

cursor/cloud-agent-node-787e

fix/javascript-xhr-open-endpoints

review/pr-711-realpath-fallback-wording

cleanup/replay-confinement

codex/test-suite-performance

codex/issue-foundations

codex/address-open-issues-2026-07-20

agent/javascript-vite-rollup-esbuild-adapters

agent/process-cleanup

agent/triage-integration

agent/unknown-commands-registry

feat/mcp-identity-metadata

morlvps/issue_cleanup

codex/installer-redesign

morl/roadmap-investigation-core

morl/roadmap-investigation-docs

release-please--branches--main--components--rea

rea-agents-6.8.0

rea-agents-6.7.0

rea-agents-6.6.0

experiment/atomic-codemode-wait-runtime-20261016

rea-agents-6.5.0

rea-agents-6.4.0

rea-agents-6.3.0

rea-agents-6.2.0

rea-agents-6.1.0

rea-agents-6.0.0

rea-agents-5.0.0

rea-agents-4.1.0

rea-agents-4.0.1

rea-agents-4.0.0

rea-agents-3.2.1

rea-agents-3.2.0

rea-agents-3.1.0

rea-agents-3.0.0

rea-agents-2.7.0

rea-agents-2.6.0

rea-agents-2.5.1

rea-agents-2.5.0

rea-agents-2.4.0

rea-agents-2.3.0

rea-agents-2.2.0

rea-agents-2.1.0

rea-agents-2.0.0

rea-agents-1.7.0

rea-agents-1.6.0

rea-agents-1.5.0

rea-agents-1.4.0

rea-agents-1.3.0

rea-agents-1.2.0

rea-agents-1.1.0

rea-agents-1.0.0

rea-agents-0.5.0

rea-agents-0.4.0

rea-agents-0.3.0

rea-0.2.1

rea-0.2.0

Labels

Clear labels   

area: bridge

  

area: bridge

  

area: build

  

area: build

  

area: build

  

area: cli

  

area: domain

  

area: evidence

  

area: mcp

  

area: native

  

area: providers

  

area: runtime

  

area: server

  

area: setup

  

area: tests

  

bug

  

design

  

documentation

  

enhancement

  

enhancement

  

enhancement

  

experiment

  

help wanted

  

i18n

  

invalid

  

P0: critical

  

P1: high

  

P2: medium

  

P2: medium

  

P2: medium

  

P3: low

  

performance

  

provider-request

  

pull-request

Mirrored from GitHub Pull Request

  

question

  

roadmap

  

triage

No labels

area: bridge

area: bridge

area: build

area: build

area: build

area: cli

area: domain

area: evidence

area: mcp

area: native

area: providers

area: runtime

area: server

area: setup

area: tests

bug

design

documentation

enhancement

enhancement

enhancement

experiment

help wanted

i18n

invalid

P0: critical

P1: high

P2: medium

P2: medium

P2: medium

P3: low

performance

provider-request

pull-request

question

roadmap

triage

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7013

No description provided.