[GH-ISSUE #2534] fix(ghidra): unapplied PE debug symbols lack a coverage warning #852

New issue

Closed

opened 2026-10-15 18:28:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:28:59 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2534

Summary

When an admitted PE references a PDB whose symbols were not applied, the Ghidra adapter has no symbol-application coverage signal to include in Evidence. A supplied Windows fixture demonstrates failed source-name lookups and generated function names without a limitation identifying that gap, even though address-based analysis succeeds.

Steps to reproduce

The following engine steps are supplied by the existing incident report and were not run locally against the current source. Build this fixture with MSVC x64 and keep its matching PDB beside the executable.

#include <stdio.h>
__declspec(noinline) int add_numbers(int a, int b) { return a + b; }
int main(int argc, char **argv) {
    (void)argv;
    printf("%d\n", add_numbers(argc, 41));
    return 0;
}

cl /nologo /O1 /GS- /Zi fixture.c /link /INCREMENTAL:NO /OPT:REF /PDB:fixture.pdb
rea decompile fixture.exe add_numbers --provider ghidra --format json

With the matching Ghidra/JDK installation configured, also open the fixture through MCP, list and search its procedures, and inspect their Evidence limitations. Compare with a direct Ghidra headless import of the same executable that reports PDB Loaded = true. The missing local fact is the full current-source engine result for this exact fixture; source inspection confirmed the adapter still lacks the coverage projection.

Expected behavior

For an admitted PE whose referenced PDB was not applied, caller-visible Evidence should preserve that omission and qualify the available procedure names. A complete search of Ghidra's own inventory should remain distinguishable from coverage of the target's referenced debug names. This does not require admitting a sidecar or promising recovery of every source name.

Actual behavior

The supplied incident reports an invalid_request for add_numbers, an empty procedure search, and generated FUN_

names with no limitation identifying unapplied PDB symbols. Its direct-headless control loads the PDB and names the fixture functions. Current source inspection establishes that no PE debug-symbol application fact enters the adapter's session or operation limitations. Runtime engine behavior at the current source was not reproduced locally, and no explicit complete-naming flag was found.

Evidence

Expected source: AGENTS.md:19-22 requires preserving omission and uncertainty; docs/ghidra-provider.md:28-36 scopes complete inventory/search results to the provider-defined inventory.
Failure source: src/ghidra/GhidraProviderClient.ts:507-534 and :660-708 construct and project limitations without PE symbol-application facts; src/ghidra/GhidraProviderCapabilities.ts:28-45 and :102-118 have no referenced-PDB coverage caveat.
Evidence provenance: supplied
Local verification: static-proof
Reproduction completeness: incomplete
Missing fact: The current-source Ghidra engine output for the reduced PE/PDB fixture, including symbol-application state and caller-visible Evidence limitations.

Static verification followed the admitted PE session into the shared limitations projection and the list/search result paths. Neither target facts nor bridge outcomes supply a referenced-PDB application fact. These paths are unchanged since the supplied hunt baseline. This proves the missing projection, while PDB loading and exact function-name outcomes still depend on the actual engine and target.

Restoration check

Run the reduced fixture on the current engine and establish whether its referenced PDB was applied. If unapplied, procedure/search Evidence should expose the missing-symbol coverage rather than leave an empty name search unqualified. A PE without a debug-symbol reference and a PE whose matching symbols were actually applied should avoid a false unapplied-symbol warning. Preserve complete searches of the existing provider inventory and correct address-based analysis.

Additional contex

Source inspected at 8b181716ac. The supplied incident uses REA 6.4.0, Node 24.20.0, Windows 11 x64, Ghidra 12.1.4 PUBLIC, Temurin JDK 21.0.12 and MSVC cl 19.51; these engine steps were not run locally.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: The supplied fixture loses source-name workflows and provides no symbol-coverage warning, while its address-based analysis remains correct. Current source confirms the missing projection, but current engine incidence was not measured.
Workaround status: available
Workaround basis: The incident reporter verified address-based analysis and a REA_GHIDRA_SEED_FILE containing address/function/name entries. Seeding requires independently obtained addresses and affects the server process; neither workaround was rerun locally.

Originally created by @coygeek on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2534 ## Summary When an admitted PE references a PDB whose symbols were not applied, the Ghidra adapter has no symbol-application coverage signal to include in Evidence. A supplied Windows fixture demonstrates failed source-name lookups and generated function names without a limitation identifying that gap, even though address-based analysis succeeds. ## Steps to reproduce The following engine steps are supplied by the existing incident report and were not run locally against the current source. Build this fixture with MSVC x64 and keep its matching PDB beside the executable. ```c #include <stdio.h> __declspec(noinline) int add_numbers(int a, int b) { return a + b; } int main(int argc, char **argv) { (void)argv; printf("%d\n", add_numbers(argc, 41)); return 0; } ``` ```sh cl /nologo /O1 /GS- /Zi fixture.c /link /INCREMENTAL:NO /OPT:REF /PDB:fixture.pdb rea decompile fixture.exe add_numbers --provider ghidra --format json ``` With the matching Ghidra/JDK installation configured, also open the fixture through MCP, list and search its procedures, and inspect their Evidence limitations. Compare with a direct Ghidra headless import of the same executable that reports PDB Loaded = true. The missing local fact is the full current-source engine result for this exact fixture; source inspection confirmed the adapter still lacks the coverage projection. ## Expected behavior For an admitted PE whose referenced PDB was not applied, caller-visible Evidence should preserve that omission and qualify the available procedure names. A complete search of Ghidra's own inventory should remain distinguishable from coverage of the target's referenced debug names. This does not require admitting a sidecar or promising recovery of every source name. ## Actual behavior The supplied incident reports an invalid_request for add_numbers, an empty procedure search, and generated FUN_<address> names with no limitation identifying unapplied PDB symbols. Its direct-headless control loads the PDB and names the fixture functions. Current source inspection establishes that no PE debug-symbol application fact enters the adapter's session or operation limitations. Runtime engine behavior at the current source was not reproduced locally, and no explicit complete-naming flag was found. ## Evidence - Expected source: AGENTS.md:19-22 requires preserving omission and uncertainty; docs/ghidra-provider.md:28-36 scopes complete inventory/search results to the provider-defined inventory. - Failure source: src/ghidra/GhidraProviderClient.ts:507-534 and :660-708 construct and project limitations without PE symbol-application facts; src/ghidra/GhidraProviderCapabilities.ts:28-45 and :102-118 have no referenced-PDB coverage caveat. - Evidence provenance: supplied - Local verification: static-proof - Reproduction completeness: incomplete - Missing fact: The current-source Ghidra engine output for the reduced PE/PDB fixture, including symbol-application state and caller-visible Evidence limitations. Static verification followed the admitted PE session into the shared limitations projection and the list/search result paths. Neither target facts nor bridge outcomes supply a referenced-PDB application fact. These paths are unchanged since the supplied hunt baseline. This proves the missing projection, while PDB loading and exact function-name outcomes still depend on the actual engine and target. ## Restoration check Run the reduced fixture on the current engine and establish whether its referenced PDB was applied. If unapplied, procedure/search Evidence should expose the missing-symbol coverage rather than leave an empty name search unqualified. A PE without a debug-symbol reference and a PE whose matching symbols were actually applied should avoid a false unapplied-symbol warning. Preserve complete searches of the existing provider inventory and correct address-based analysis. ## Additional contex Source inspected at 8b181716aca2cb467be499cba226abfb5ae19141. The supplied incident uses REA 6.4.0, Node 24.20.0, Windows 11 x64, Ghidra 12.1.4 PUBLIC, Temurin JDK 21.0.12 and MSVC cl 19.51; these engine steps were not run locally. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: The supplied fixture loses source-name workflows and provides no symbol-coverage warning, while its address-based analysis remains correct. Current source confirms the missing projection, but current engine incidence was not measured. - Workaround status: available - Workaround basis: The incident reporter verified address-based analysis and a REA_GHIDRA_SEED_FILE containing address/function/name entries. Seeding requires independently obtained addresses and affects the server process; neither workaround was rerun locally.

bsakaguchi

2026-10-15 18:28:59 +00:00