morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #2734] Ghidra MIPS lane rejects mips1/mips32 — the dominant ISA mix in embedded firmware #986

New issue

Open

opened 2026-10-15 18:30:08 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:30:08 +00:00

Owner

Originally created by @scadastrangelove on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2734

Summary

The Ghidra provider's MIPS admission gate (ghidraMipsUnsupportedReason in
GhidraMipsProfile.js) only accepts EF_MIPS_ARCH_32R2. In practice, router/CPE
firmware — the largest body of real-world MIPS binaries (Realtek/Broadcom
SOC vendor SDKs, uClibc-era userlands) — is overwhelmingly mips1 and mips32,
so rea analyze refuses the entire class:

"The selected analysis provider does not support this target."
reason: "This Ghidra MIPS lane requires EF_MIPS_ARCH_32R2; other ISA revisions need separate verification."

Ghidra itself analyzes these targets fine (MIPS:BE:32:default); I verified on
busybox mips1 and a vendor cwmp mips32 binary (Ghidra 12.1.3, both decompile
with the usual quality) after locally bypassing the gate.

Proposal

Extend the lane to mips1/mips32/mips32r2 (ELF32, ET_EXEC, o32), or
Add an explicit expert override (e.g. REA_ALLOW_UNVERIFIED_ISA=1) that
admits other ISA revisions with a warning in the result's
limitations/confidence fields, keeping the strict default.

Option 2 keeps the "verified lane" guarantee for default users while unblocking
firmware work. Happy to contribute a PR for either — the override variant is a
~5-line change in GhidraMipsProfile.js plus plumbing the flag.

Environment

rea-agents 6.4.0, Node 22.23.3, Ghidra 12.1.3, Ubuntu 24.04
Test binaries: busybox 1.01 (mips1, Flags: 0x1005, noreorder, cpic, o32, mips1),
vendor cwmp (mips32, Flags: 0x50001007, pic, cpic, o32, mips32)

Originally created by @scadastrangelove on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2734 ## Summary The Ghidra provider's MIPS admission gate (`ghidraMipsUnsupportedReason` in `GhidraMipsProfile.js`) only accepts `EF_MIPS_ARCH_32R2`. In practice, router/CPE firmware — the largest body of real-world MIPS binaries (Realtek/Broadcom SOC vendor SDKs, uClibc-era userlands) — is overwhelmingly **mips1 and mips32**, so `rea analyze` refuses the entire class: ``` "The selected analysis provider does not support this target." reason: "This Ghidra MIPS lane requires EF_MIPS_ARCH_32R2; other ISA revisions need separate verification." ``` Ghidra itself analyzes these targets fine (`MIPS:BE:32:default`); I verified on busybox mips1 and a vendor cwmp mips32 binary (Ghidra 12.1.3, both decompile with the usual quality) after locally bypassing the gate. ## Proposal 1. Extend the lane to mips1/mips32/mips32r2 (ELF32, ET_EXEC, o32), or 2. Add an explicit expert override (e.g. `REA_ALLOW_UNVERIFIED_ISA=1`) that admits other ISA revisions with a warning in the result's `limitations`/`confidence` fields, keeping the strict default. Option 2 keeps the "verified lane" guarantee for default users while unblocking firmware work. Happy to contribute a PR for either — the override variant is a ~5-line change in `GhidraMipsProfile.js` plus plumbing the flag. ## Environment - rea-agents 6.4.0, Node 22.23.3, Ghidra 12.1.3, Ubuntu 24.04 - Test binaries: busybox 1.01 (mips1, `Flags: 0x1005, noreorder, cpic, o32, mips1`), vendor cwmp (mips32, `Flags: 0x50001007, pic, cpic, o32, mips32`)

bsakaguchi added the

area: native

enhancement

labels

2026-10-15 18:30:08 +00:00

bsakaguchi referenced this issue

2026-10-17 21:07:32 +00:00

[PR #986] [MERGED] fix(browser): preserve authorized redirect hops #2556

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:29:47 +00:00

bsakaguchi commented

2026-10-31 00:29:47 +00:00

Author

Owner

@morluto commented on GitHub (Oct 26, 2026):

Thanks for the firmware examples. Main now admits a bounded recordless legacy lane for MIPS-I and MIPS32, including the MIPS-I change in #7014. It still refuses those ISA headers when they declare an ABI, so this does not establish support for both samples in the report. I am keeping the issue open for that distinct declared-ABI coverage and verification; the current lane and its assumptions are documented in docs/ghidra-mips.md.

@morluto commented on GitHub (Oct 26, 2026): Thanks for the firmware examples. Main now admits a bounded recordless legacy lane for MIPS-I and MIPS32, including the MIPS-I change in #7014. It still refuses those ISA headers when they declare an ABI, so this does not establish support for both samples in the report. I am keeping the issue open for that distinct declared-ABI coverage and verification; the current lane and its assumptions are documented in `docs/ghidra-mips.md`.

bsakaguchi referenced this issue

2026-10-31 00:51:13 +00:00

[GH-ISSUE #7681] [Bug] Session redirect rows omit the promised prior-hop response context #4603

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#986

No description provided.

Rows
Columns