[PR #7175] [CLOSED] feat(native): add bounded physical register backward slicing #7695

Closed
opened 2026-11-03 13:39:43 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7175
Author: @rozling
Created: 10/25/2026
Status: ❌ Closed

Base: main ← Head: codex/native-register-slice


📝 Commits (1)

  • 0af5d48 feat(native): add bounded physical register backward slicing

📊 Changes

21 files changed (+1386 additions, -0 deletions)

View changed files

📝 bridge/ghidra/ReaGhidraBridge.java (+152 -0)
➕ docs/native-register-slicing.md (+68 -0)
📝 package.json (+3 -0)
➕ scripts/fixtures/native/register-slice.mjs (+22 -0)
➕ scripts/verify/ghidra/register-slice-mcp.mjs (+169 -0)
➕ scripts/verify/ghidra/register-slice-results.mjs (+48 -0)
📝 src/application/DirectAnalysis.ts (+1 -0)
📝 src/cli/coreNativeCommands.ts (+50 -0)
📝 src/cliCommandNames.ts (+1 -0)
📝 src/contracts/officialToolContracts.ts (+8 -0)
📝 src/contracts/toolContractExamples.ts (+10 -0)
📝 src/contracts/toolEffects.ts (+1 -0)
📝 src/contracts/toolOutputSchemaGroups.ts (+6 -0)
📝 src/domain/analysisView/analysisView.ts (+25 -0)
➕ src/domain/analysisView/nativeRegisterSliceView.ts (+87 -0)
➕ src/domain/native/NativeRegisterSlice.test.ts (+307 -0)
➕ src/domain/native/nativeRegisterSlice.ts (+89 -0)
➕ src/domain/native/nativeRegisterSlicing.ts (+259 -0)
📝 src/ghidra/GhidraFunctionValues.ts (+10 -0)
📝 src/server/registerOfficialTools.ts (+1 -0)

...and 1 more files

📄 Description

Summary

Add slice_native_register and slice-native-register to trace possible origins of a physical ARM32 register immediately before an exact instruction. The result preserves control-flow alternatives, original instruction bytes, unresolved dependencies, and explicit analysis cutoffs. This is a standalone tooling enhancement; no linked issue exists.

Problem and expected behavior

Function-wide value graphs do not directly answer an exact physical-register boundary query. For synthetic mov r0,#7; bx lr, querying r0 before 0x1004 now reports COPY of 0x7 at 0x1000, with a retained dependency graph and target/provider/profile provenance. Results describe possible origins under the declared model, not path feasibility or pointer validity.

Change and scope

Capture instruction-level Ghidra p-code and traverse storage values at operation boundaries. Preserve joins, predicated writes, entry values and loop cycles. Loads, stack reloads, call effects, unsupported operations and overlapping storage remain unresolved where necessary. Explicit instruction/operation budgets bound capture; node/edge budgets bound the result.

Reuse existing provider dispatch, Evidence retention, CLI/MCP contracts and analysis-view paging. The bridge checks CFG destinations as well as decoded byte coverage, so an edge into an uncaptured instruction boundary cannot imply a complete slice. Node exhaustion at function entry reports only the budget actually exhausted.

Contract and boundary impact

  • Semantic owner: Ghidra captures machine operations and storage; the native domain computes the backward slice. CLI/MCP deliver the same retained result.
  • Contribution scope: read-only static analysis using the existing provider. No new target execution, injection, mutation or protection recovery. A separate maintainer scope decision for those capabilities is not applicable.
  • Compatibility: Ghidra ARM:LE:32:v7, known ARM mode, four-byte instructions, r0–r12, sp, and lr. Thumb and other profiles are rejected.
  • Evidence: original file-backed bytes must match analyzed bytes. Raw p-code, exact query, derived graph, uncertainty and provenance are retained; summaries link to graph pages.
  • Lifecycle: existing ephemeral Ghidra processes and request cancellation. No installation, service configuration, active analysis session or deployment changes.
  • Metadata: additive tool/CLI contracts and package verification scripts. CI generates ignored catalogs; no generated catalogs, binaries or provider databases are committed.

Expected effects:

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code. Existing Ghidra analysis scripts only; no target-code execution or instrumentation injection.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.

Evidence and regression coverage

Synthetic ARM fixtures cover constants, copies/arithmetic, branch joins, conditional writes, loop-carried values, entry values, register reuse, loads, stack reloads, calls, unsupported operations and missing control flow. Negative checks reject interior and foreign-function instruction addresses. Domain tests cover source/predicate mutations, overlapping storage and explicit budgets.

The review added a real-provider regression for an edge to the interior of a decoded instruction, and a domain regression for an exhausted node budget with an available edge budget. Independent review of the bridge/domain code at the submitted head found no unresolved P0–P2 findings; the cutoff diagnostic finding was fixed and re-reviewed.

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity and source provenance remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

On the submitted source, with matching SHA-256 hashes for all 21 changed files:

  • npm run build:cached passed.
  • npm run check passed.
  • npm run docs:check passed.
  • Focused domain/provider/contract tests passed: 109 tests across four files, including 15 slice tests.
  • Ghidra 12.1.4 / JDK 21 production-bridge probe passed all 12 synthetic ARM fixtures plus invalid-boundary, foreign-function and missing-CFG-destination assertions.
  • register-slice-results.mjs passed independently authored expected-origin checks.
  • register-slice-mcp.mjs passed the real public MCP workflow, retained graph paging, target/profile identity, original bytes, rejection/cutoff cases and normalized CLI parity.
  • git diff --check passed.

Build, static, documentation and real-provider validation ran sequentially in an isolated Linux checkout. The full repository test suite was not run. Hosted PR CI is separate and not claimed here.

Compatibility, safety, and release

Additive feature; no migration or version change. Only synthetic inputs were used. No hardware or ARM target code was executed. Memory contents, aliases, stack-store resolution, call preservation and path feasibility remain outside the supported proof. Full-suite hosted PR CI and other provider/platform combinations are not established by these checks.

Author readiness

Human owner: @rozling

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

This PR is intentionally a draft. Human readiness and maintainer integration review remain pending. No merge is requested.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7175 **Author:** [@rozling](https://github.com/rozling) **Created:** 10/25/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `codex/native-register-slice` --- ### 📝 Commits (1) - [`0af5d48`](https://github.com/morluto/rea/commit/0af5d4858c419cce3d939c2527a20ca8a21f0616) feat(native): add bounded physical register backward slicing ### 📊 Changes **21 files changed** (+1386 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `bridge/ghidra/ReaGhidraBridge.java` (+152 -0) ➕ `docs/native-register-slicing.md` (+68 -0) 📝 `package.json` (+3 -0) ➕ `scripts/fixtures/native/register-slice.mjs` (+22 -0) ➕ `scripts/verify/ghidra/register-slice-mcp.mjs` (+169 -0) ➕ `scripts/verify/ghidra/register-slice-results.mjs` (+48 -0) 📝 `src/application/DirectAnalysis.ts` (+1 -0) 📝 `src/cli/coreNativeCommands.ts` (+50 -0) 📝 `src/cliCommandNames.ts` (+1 -0) 📝 `src/contracts/officialToolContracts.ts` (+8 -0) 📝 `src/contracts/toolContractExamples.ts` (+10 -0) 📝 `src/contracts/toolEffects.ts` (+1 -0) 📝 `src/contracts/toolOutputSchemaGroups.ts` (+6 -0) 📝 `src/domain/analysisView/analysisView.ts` (+25 -0) ➕ `src/domain/analysisView/nativeRegisterSliceView.ts` (+87 -0) ➕ `src/domain/native/NativeRegisterSlice.test.ts` (+307 -0) ➕ `src/domain/native/nativeRegisterSlice.ts` (+89 -0) ➕ `src/domain/native/nativeRegisterSlicing.ts` (+259 -0) 📝 `src/ghidra/GhidraFunctionValues.ts` (+10 -0) 📝 `src/server/registerOfficialTools.ts` (+1 -0) _...and 1 more files_ </details> ### 📄 Description ## Summary Add `slice_native_register` and `slice-native-register` to trace possible origins of a physical ARM32 register immediately before an exact instruction. The result preserves control-flow alternatives, original instruction bytes, unresolved dependencies, and explicit analysis cutoffs. This is a standalone tooling enhancement; no linked issue exists. ## Problem and expected behavior Function-wide value graphs do not directly answer an exact physical-register boundary query. For synthetic `mov r0,#7; bx lr`, querying `r0` before `0x1004` now reports `COPY of 0x7 at 0x1000`, with a retained dependency graph and target/provider/profile provenance. Results describe possible origins under the declared model, not path feasibility or pointer validity. ## Change and scope Capture instruction-level Ghidra p-code and traverse storage values at operation boundaries. Preserve joins, predicated writes, entry values and loop cycles. Loads, stack reloads, call effects, unsupported operations and overlapping storage remain unresolved where necessary. Explicit instruction/operation budgets bound capture; node/edge budgets bound the result. Reuse existing provider dispatch, Evidence retention, CLI/MCP contracts and analysis-view paging. The bridge checks CFG destinations as well as decoded byte coverage, so an edge into an uncaptured instruction boundary cannot imply a complete slice. Node exhaustion at function entry reports only the budget actually exhausted. ## Contract and boundary impact - Semantic owner: Ghidra captures machine operations and storage; the native domain computes the backward slice. CLI/MCP deliver the same retained result. - Contribution scope: read-only static analysis using the existing provider. No new target execution, injection, mutation or protection recovery. A separate maintainer scope decision for those capabilities is not applicable. - Compatibility: Ghidra `ARM:LE:32:v7`, known ARM mode, four-byte instructions, `r0`–`r12`, `sp`, and `lr`. Thumb and other profiles are rejected. - Evidence: original file-backed bytes must match analyzed bytes. Raw p-code, exact query, derived graph, uncertainty and provenance are retained; summaries link to graph pages. - Lifecycle: existing ephemeral Ghidra processes and request cancellation. No installation, service configuration, active analysis session or deployment changes. - Metadata: additive tool/CLI contracts and package verification scripts. CI generates ignored catalogs; no generated catalogs, binaries or provider databases are committed. Expected effects: - [x] Read existing files or captured data. - [x] Launch or attach to a process. - [x] Inject instrumentation or run scripts/code. Existing Ghidra analysis scripts only; no target-code execution or instrumentation injection. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. ## Evidence and regression coverage Synthetic ARM fixtures cover constants, copies/arithmetic, branch joins, conditional writes, loop-carried values, entry values, register reuse, loads, stack reloads, calls, unsupported operations and missing control flow. Negative checks reject interior and foreign-function instruction addresses. Domain tests cover source/predicate mutations, overlapping storage and explicit budgets. The review added a real-provider regression for an edge to the interior of a decoded instruction, and a domain regression for an exhausted node budget with an available edge budget. Independent review of the bridge/domain code at the submitted head found no unresolved P0–P2 findings; the cutoff diagnostic finding was fixed and re-reviewed. - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity and source provenance remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed On the submitted source, with matching SHA-256 hashes for all 21 changed files: - `npm run build:cached` passed. - `npm run check` passed. - `npm run docs:check` passed. - Focused domain/provider/contract tests passed: 109 tests across four files, including 15 slice tests. - Ghidra 12.1.4 / JDK 21 production-bridge probe passed all 12 synthetic ARM fixtures plus invalid-boundary, foreign-function and missing-CFG-destination assertions. - `register-slice-results.mjs` passed independently authored expected-origin checks. - `register-slice-mcp.mjs` passed the real public MCP workflow, retained graph paging, target/profile identity, original bytes, rejection/cutoff cases and normalized CLI parity. - `git diff --check` passed. Build, static, documentation and real-provider validation ran sequentially in an isolated Linux checkout. The full repository test suite was not run. Hosted PR CI is separate and not claimed here. ## Compatibility, safety, and release Additive feature; no migration or version change. Only synthetic inputs were used. No hardware or ARM target code was executed. Memory contents, aliases, stack-store resolution, call preservation and path feasibility remain outside the supported proof. Full-suite hosted PR CI and other provider/platform combinations are not established by these checks. ## Author readiness Human owner: @rozling - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge This PR is intentionally a draft. Human readiness and maintainer integration review remain pending. No merge is requested. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-03 13:39:43 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#7695
No description provided.