morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #8709] [Bug] inspect-binary-layout rejects ARM64 (EM_AARCH64) ELF targets, pwntools-elf provider appears x64-only #7518

New issue

Open

opened 2026-11-03 00:30:29 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-11-03 00:30:29 +00:00

Owner

Originally created by @GoldenSyrup1 on GitHub (Nov 2, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8709

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Provider or capability discovery

Observed behavior

Running rea inspect-binary-layout against a genuine ARM64 (aarch64) ELF
executable returns an immediate capability_unavailable error rather than
analyzing the binary:

code: capability_unavailable
category: unsupported_provider
message: The initial real-verified pwntools artifact profile supports Linux x64 only.
retryable: false
remediation:
action: The initial real-verified pwntools artifact profile supports Linux x64 only.
details:
provider_id: pwntools-elf
operation: inspect_binary_layout
reason: The initial real-verified pwntools artifact profile supports Linux x64 only.

Observed directly from this exact run, not inferred.

Reproduction

On an ARM64 Linux host (WSL2 Ubuntu 24.04 in this case), obtain any
genuine aarch64 ELF binary. Used the Node.js v22.23.4 linux-arm64
release build at ~/node22/bin/node (122,293,360 bytes,
sha256:7e48183361053f039294fbbc3ba586722fe756bf296d6cb8195356d10819cd16).
file confirms: "ELF 64-bit LSB executable, ARM aarch64, version 1
(GNU/Linux), dynamically linked, ... not stripped".
Run: npx rea-agents@6.8.0 inspect-binary-layout ~/node22/bin/node --format yaml
Observe the capability_unavailable response above instead of a layout result.

Reproduced on first and only attempt (100% so far, single run).

Expected behavior

Expected either a successful binary-layout result for the aarch64 target, or
at minimum an architecture-specific unsupported-target error (e.g. naming
EM_AARCH64 explicitly) rather than a blanket "supports Linux x64 only"
message. No documentation reviewed to confirm x64-only is the intended
permanent scope vs. an initial-release limitation; the command's own help
text ("Inspect binary file/linked layout without executing the selected
object") does not state an architecture restriction.

Impact and scope

Scoped to this one provider/command as far as observed. In the same session,
against the identical binary, inspect-native-exports and inspect-byte-entropy
both succeeded and inspect-native-exports correctly reported
architecture: arm64 in its output, so artifact parsing generally works for
this file outside pwntools-elf. No effect on evidence integrity or process
isolation observed; the command fails closed with a typed error rather than
producing incorrect output, which is the correct failure mode, just a
narrower-than-expected one. Frequency/breadth across other pwntools-backed
commands not tested.

REA version

6.8.0 (via npx rea-agents@6.8.0 --version equivalent; confirmed from this exact invocation)

Runtime and platform

Node 22.23.4; Ubuntu 24.04 (WSL2) on Windows 11 ARM64 host; no Hopper/Ghidra/IDA involved in this command

Target and artifact context

ELF 64-bit executable, ARM aarch64, dynamically linked, not stripped; standalone binary, not an app bundle/container

Interface

CLI

Earliest failure stage

Setup or provider admission

Relevant output or evidence

Command or MCP request actually run:
npx rea-agents@6.8.0 inspect-binary-layout ~/node22/bin/node --format yaml

Relevant result, error, or artifact:
code: capability_unavailable
category: unsupported_provider
message: The initial real-verified pwntools artifact profile supports Linux x64 only.
details:
provider_id: pwntools-elf
operation: inspect_binary_layout
reason: The initial real-verified pwntools artifact profile supports Linux x64 only.

For source-only findings, link the file/revision and relevant code:
NOT_ENOUGH_INFO — have not located the pwntools-elf provider source in this
repo to cite the exact architecture check; flagging from observed behavior only.

Missing evidence or remaining uncertainty:
Have not tested other pwntools-backed commands (if any share this provider)
or other target architectures (e.g. 32-bit ARM, RISC-V) to see if the
restriction is x64-only specifically or x86_64-vs-everything-else.

Typed outcome or recovery expected

Either a successful typed inspect-binary-layout result for aarch64 targets,
or a more specific typed error identifying the detected e_machine value as
unsupported, so callers can distinguish "wrong architecture" from other
capability_unavailable causes.

Analysis or suspected cause

Hypothesis, not confirmed against source: the pwntools-elf provider likely
validates e_machine == EM_X86_64 (or equivalent) before proceeding, rather
than branching on the target's declared architecture. This is a hypothesis
from the error message's wording ("supports Linux x64 only") and from the
fact that sibling commands against the same artifact (inspect-native-exports,
inspect-byte-entropy) completed normally and correctly identified the
artifact as arm64, so the artifact itself is not the blocker.

Additional context

Happy to test a fix/PR extending the provider's architecture check if that's
in scope, flagging first per the repo's contribution process.

Originally created by @GoldenSyrup1 on GitHub (Nov 2, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8709 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Provider or capability discovery ### Observed behavior Running `rea inspect-binary-layout` against a genuine ARM64 (aarch64) ELF executable returns an immediate capability_unavailable error rather than analyzing the binary: code: capability_unavailable category: unsupported_provider message: The initial real-verified pwntools artifact profile supports Linux x64 only. retryable: false remediation: action: The initial real-verified pwntools artifact profile supports Linux x64 only. details: provider_id: pwntools-elf operation: inspect_binary_layout reason: The initial real-verified pwntools artifact profile supports Linux x64 only. Observed directly from this exact run, not inferred. ### Reproduction 1. On an ARM64 Linux host (WSL2 Ubuntu 24.04 in this case), obtain any genuine aarch64 ELF binary. Used the Node.js v22.23.4 linux-arm64 release build at ~/node22/bin/node (122,293,360 bytes, sha256:7e48183361053f039294fbbc3ba586722fe756bf296d6cb8195356d10819cd16). `file` confirms: "ELF 64-bit LSB executable, ARM aarch64, version 1 (GNU/Linux), dynamically linked, ... not stripped". 2. Run: npx rea-agents@6.8.0 inspect-binary-layout ~/node22/bin/node --format yaml 3. Observe the capability_unavailable response above instead of a layout result. Reproduced on first and only attempt (100% so far, single run). ### Expected behavior Expected either a successful binary-layout result for the aarch64 target, or at minimum an architecture-specific unsupported-target error (e.g. naming EM_AARCH64 explicitly) rather than a blanket "supports Linux x64 only" message. No documentation reviewed to confirm x64-only is the intended permanent scope vs. an initial-release limitation; the command's own help text ("Inspect binary file/linked layout without executing the selected object") does not state an architecture restriction. ### Impact and scope Scoped to this one provider/command as far as observed. In the same session, against the identical binary, inspect-native-exports and inspect-byte-entropy both succeeded and inspect-native-exports correctly reported architecture: arm64 in its output, so artifact parsing generally works for this file outside pwntools-elf. No effect on evidence integrity or process isolation observed; the command fails closed with a typed error rather than producing incorrect output, which is the correct failure mode, just a narrower-than-expected one. Frequency/breadth across other pwntools-backed commands not tested. ### REA version 6.8.0 (via npx rea-agents@6.8.0 --version equivalent; confirmed from this exact invocation) ### Runtime and platform Node 22.23.4; Ubuntu 24.04 (WSL2) on Windows 11 ARM64 host; no Hopper/Ghidra/IDA involved in this command ### Target and artifact context ELF 64-bit executable, ARM aarch64, dynamically linked, not stripped; standalone binary, not an app bundle/container ### Interface CLI ### Earliest failure stage Setup or provider admission ### Relevant output or evidence Command or MCP request actually run: npx rea-agents@6.8.0 inspect-binary-layout ~/node22/bin/node --format yaml Relevant result, error, or artifact: code: capability_unavailable category: unsupported_provider message: The initial real-verified pwntools artifact profile supports Linux x64 only. details: provider_id: pwntools-elf operation: inspect_binary_layout reason: The initial real-verified pwntools artifact profile supports Linux x64 only. For source-only findings, link the file/revision and relevant code: NOT_ENOUGH_INFO — have not located the pwntools-elf provider source in this repo to cite the exact architecture check; flagging from observed behavior only. Missing evidence or remaining uncertainty: Have not tested other pwntools-backed commands (if any share this provider) or other target architectures (e.g. 32-bit ARM, RISC-V) to see if the restriction is x64-only specifically or x86_64-vs-everything-else. ### Typed outcome or recovery expected Either a successful typed inspect-binary-layout result for aarch64 targets, or a more specific typed error identifying the detected e_machine value as unsupported, so callers can distinguish "wrong architecture" from other capability_unavailable causes. ### Analysis or suspected cause Hypothesis, not confirmed against source: the pwntools-elf provider likely validates e_machine == EM_X86_64 (or equivalent) before proceeding, rather than branching on the target's declared architecture. This is a hypothesis from the error message's wording ("supports Linux x64 only") and from the fact that sibling commands against the same artifact (inspect-native-exports, inspect-byte-entropy) completed normally and correctly identified the artifact as arm64, so the artifact itself is not the blocker. ### Additional context Happy to test a fix/PR extending the provider's architecture check if that's in scope, flagging first per the repo's contribution process.

bsakaguchi added the

bug

triage

labels

2026-11-03 00:30:29 +00:00

bsakaguchi commented

2026-11-03 10:21:15 +00:00

Author

Owner

@BeqaKs commented on GitHub (Nov 3, 2026):

Closing as fixed on main by #8711. Stayed open because the PR referenced rather than closed it.

@BeqaKs commented on GitHub (Nov 3, 2026): Closing as fixed on main by #8711. Stayed open because the PR referenced rather than closed it.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7518

No description provided.

Rows
Columns