[GH-ISSUE #2158] [Feature] Decode ldstr user strings in inspect_managed_members #707

New issue

Closed

opened 2026-10-15 18:27:34 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:27:34 +00:00

Owner

Originally created by @Nelglor on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2158

Note

🤖 Claude Opus 5.5 responding on behalf of Nick

Before submitting

I searched the open and closed issues and pull requests for a related proposal.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction (managed static analysis, inspect_managed_members)

Current limitation

inspect_managed_members reports every ldstr operand as a bare 0x70 token, and no REA operation reads the #US stream. The layout admits only #Strings, #GUID and #Blob. An analyst can see that a method loads a literal, but not which one.

This blocks the first move in most managed teardowns: finding where a file name, key, URL or format marker is used. Today that needs a second tool such as ILSpy or dnSpy.

Use cases

Save-file and config work on Unity Mono games. In PEAK's Assembly-CSharp.dll (Unity Mono, 1.6 MB), Peak.Quicksave has 12 ldstr literals. The useful one is quicksave.peak, the save file name, and REA currently shows it only as 0x7000e875.
Tracing hard-coded keys, endpoints, registry paths and log messages back to the method that uses them, without loading the assembly.

Desired outcome and success criteria

Each distinct ldstr token loaded by an inspected method body is decoded once, with its token, #US file offset and value.
Values keep their stored UTF-16 code units, including unpaired surrogates.
Instruction anchors and normalized_il_sha256 stay unchanged, so build-local tokens and cross-build comparison semantics are preserved.
Type selection (--type / type_names) restricts the strings like it restricts methods.
A missing #US stream or a malformed item is reported against its token as partial coverage. Readable literals remain.
Older member Evidence without the field still parses, with the field reading as not examined.

Authority boundaries and non-goals

Static only. No assembly loading or execution.
No decompilation.
No change to the representation budget.
No string search across assemblies.
No change to the normalized CIL digest contract.

Alternatives considered

Resolving inline on each ldstr anchor repeats a literal at every use and changes the anchor shape.
A token-keyed inventory, like member_refs, keeps anchors and digests stable and charges each literal once.

Possible direction

Add a top-level user_strings: [{ token, offset, value }] | null to the member inspection result, defaulting to null the way exported_types does.

I have an implementation with focused tests ready and will open a PR referencing this issue.

References

ECMA-335 II.24.2.4 (#US and #Blob heaps).
docs/managed-code-analysis.md, normalized CIL digest tuple format.

Originally created by @Nelglor on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2158 > [!NOTE] > 🤖 **Claude Opus 5.5 responding on behalf of Nick** ### Before submitting - [x] I searched the open and closed issues and pull requests for a related proposal. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction (managed static analysis, `inspect_managed_members`) ### Current limitation `inspect_managed_members` reports every `ldstr` operand as a bare `0x70` token, and no REA operation reads the `#US` stream. The layout admits only `#Strings`, `#GUID` and `#Blob`. An analyst can see that a method loads a literal, but not which one. This blocks the first move in most managed teardowns: finding where a file name, key, URL or format marker is used. Today that needs a second tool such as ILSpy or dnSpy. ### Use cases - **Save-file and config work on Unity Mono games.** In PEAK's `Assembly-CSharp.dll` (Unity Mono, 1.6 MB), `Peak.Quicksave` has 12 `ldstr` literals. The useful one is `quicksave.peak`, the save file name, and REA currently shows it only as `0x7000e875`. - **Tracing hard-coded keys, endpoints, registry paths and log messages** back to the method that uses them, without loading the assembly. ### Desired outcome and success criteria - Each distinct `ldstr` token loaded by an inspected method body is decoded once, with its token, `#US` file offset and value. - Values keep their stored UTF-16 code units, including unpaired surrogates. - Instruction anchors and `normalized_il_sha256` stay unchanged, so build-local tokens and cross-build comparison semantics are preserved. - Type selection (`--type` / `type_names`) restricts the strings like it restricts methods. - A missing `#US` stream or a malformed item is reported against its token as partial coverage. Readable literals remain. - Older member Evidence without the field still parses, with the field reading as not examined. ### Authority boundaries and non-goals - Static only. No assembly loading or execution. - No decompilation. - No change to the representation budget. - No string search across assemblies. - No change to the normalized CIL digest contract. ### Alternatives considered - Resolving inline on each `ldstr` anchor repeats a literal at every use and changes the anchor shape. - A token-keyed inventory, like `member_refs`, keeps anchors and digests stable and charges each literal once. ### Possible direction Add a top-level `user_strings: [{ token, offset, value }] | null` to the member inspection result, defaulting to `null` the way `exported_types` does. I have an implementation with focused tests ready and will open a PR referencing this issue. ### References - ECMA-335 II.24.2.4 (`#US` and `#Blob` heaps). - docs/managed-code-analysis.md, normalized CIL digest tuple format.

bsakaguchi

2026-10-15 18:27:34 +00:00

closed this issue
added the
area: domain

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:27:35 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Design & Implementation Review

Decoding ldstr operands via the #US (User String) stream in ECMA-335 CLI metadata is a high-value addition for managed reverse engineering:

Stream Format: In the #US stream, each user string begins with a compressed integer byte length, followed by UTF-16LE characters and a trailing byte indicating whether any character has its high byte set.
Operand Token: The ldstr CIL opcode takes a 4-byte 0x70xxxxxx token where the lower 24 bits represent the direct byte offset into the #US stream.
Safety / Memory Limits: String literals should be bounded (e.g., truncate strings longer than 1024 characters with an explicit truncated: true limitation indicator) to prevent oversized payloads from blowing up MCP JSON responses.

@matbrgz commented on GitHub (Oct 12, 2026): ### Design & Implementation Review Decoding `ldstr` operands via the `#US` (User String) stream in ECMA-335 CLI metadata is a high-value addition for managed reverse engineering: - **Stream Format:** In the `#US` stream, each user string begins with a compressed integer byte length, followed by UTF-16LE characters and a trailing byte indicating whether any character has its high byte set. - **Operand Token:** The `ldstr` CIL opcode takes a 4-byte `0x70xxxxxx` token where the lower 24 bits represent the direct byte offset into the `#US` stream. - **Safety / Memory Limits:** String literals should be bounded (e.g., truncate strings longer than 1024 characters with an explicit `truncated: true` limitation indicator) to prevent oversized payloads from blowing up MCP JSON responses.

bsakaguchi referenced this issue

2026-10-16 21:15:25 +00:00

[PR #707] [MERGED] fix(browser): classify CSP host sources by their own origin #2187

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:29 +00:00