Ysopwnable
ea4db4c9f7
refactor(native): group analyst semantics workflows and contracts ( #973 )
2026-10-07 22:40:48 +08:00
Iwakurakaoru0822 and Claude Opus 5.5
37fe105ba1
fix(native): keep echoed Mach-O paths out of load commands and symbols
...
otool and dyld_info print the operand path before a slice's records,
and the Mach-O parsers read that header as output. A file name holding
`Load command` blocks or `(from lib)` lines therefore added a forged
LC_MAIN entrypoint, corrupted the Mach header fields, and injected
imports and exports into `inspect_macho`.
Strip the exact echoed operand header (`<path>:`, `<path> (architecture
<arch>):`, `<path> [<arch>]:`) before parsing. Output without that
header, such as replayed captures, is parsed unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-06 23:40:35 -07:00
3af3811ab0
fix: integrate 24 reviewed browser/native/semantics corrections ( #815 )
...
* fix(reference): resolve emitted extensions to TypeScript source
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
* test(reference): retain legitimate declaration import counterparts
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
* fix(mcp): recognize implicit form elicitation capability
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
* fix(ghidra): reject contradictory NativeAOT reports
* fix(native): preserve thin architectures across echoed filename lines
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(native): preserve app bundle executable filename whitespace
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(doctor): validate Node-wrapped client policy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
* fix(reference): preserve observed entry failure reasons
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
* fix(artifacts): verify opaque bytes before reusing inventory identities
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
* fix(browser): resolve DOM destinations against document base URL
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
* fix: recover serialized native NIB view hierarchy
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
* ci: exercise native compiled NIB hierarchy regressions
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
* fix(deps): remediate reachable archive-parsing advisories
Two high-severity advisories are reachable from untrusted target content:
- @xmldom/xmldom 0.9.10 (via plist) parses XML plist bytes from analyzed
app bundles in the keyed-archive reader. Refreshed to 0.9.12.
- brace-expansion 5.0.7 (via @electron/asar -> minimatch) is reached while
analyzing untrusted ASAR archives. Refreshed to 5.0.12.
Both are in-range patch updates (plist declares ^0.9.10, minimatch declares
^5.0.5), so no source or API change is required and no direct dependency
declaration moves. Lockfile-only change.
The remaining smol-toml advisory is not included: it parses operator-owned
client configuration rather than untrusted target content, and its fix moves
outside the declared range and changes leading-BOM handling.
* fix(semantics): link wrapped arrow Promise returns
* fix(reconstruction): preserve unknown graph limitations
* fix(native): preserve exact code signing identifiers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(native): recognize only whole otool command headers
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(native): retain nm-proven literal export names
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(javascript): project decoded file URL paths
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix: preserve explicit source-relative URL observation spelling
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(native): project Mach-O evidence into container file offsets
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(browser): normalize referrer policy fallback lists
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
---------
Signed-off-by: Rudy Celekli <rudy@gradiahq.com >
Signed-off-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
Co-authored-by: Rudy Celekli <rudy@gradiahq.com >
Co-authored-by: RudyCelekli <47457359+rudycelekli@users.noreply.github.com >
Co-authored-by: Kaoru0822 <aisakamimaki@gmail.com >
Co-authored-by: DeryFerd <deryferdikao125@gmail.com >
2026-10-07 10:33:10 +08:00
Kaoru0822
fd3282a87e
fix(native): select concrete arm64e Mach-O slices
2026-10-06 01:25:11 -07:00
morluto
735c10059c
refactor(domain): split error taxonomy into thematic modules ( #636 )
...
Move each error family out of domain/errors.ts into its own module
(base, core, provider selection/adapter, browser observation,
artifact, evidence, unknown registry, hopper, configuration) and
relocate AnalysisErrorProjection to analysisErrorProjection.
Migrate all 162 importers to the owning modules and delete
errors.ts. No re-export shims; behavior is unchanged.
2026-10-06 05:57:38 +08:00
Rudy Mizrahi Celekli
2b7bb3bb6a
fix(native): inspect the selected universal Mach-O architecture ( #601 )
...
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
2026-10-06 02:08:33 +08:00
morluto
d40502aa3b
fix(native): match compound otool keys exactly and badge unknown thread entrypoints ( #534 )
2026-10-05 15:43:20 +08:00
morluto
0f77ada55e
fix(native): retain lazy dylibs, normalize version-min builds, limit thread entrypoints ( #532 )
2026-10-05 15:23:08 +08:00
Rudy Mizrahi Celekli and morluto
a8195ba2cc
fix(native): capture Mach-O header metadata alongside load commands ( #525 )
...
* fix(native): capture Mach-O header metadata alongside load commands
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* style(test): format native Mach-O header regression
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
* fix(native): drop dead bare otool override in header test
---------
Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com >
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com >
2026-10-05 14:50:58 +08:00
morluto
405732a7f5
fix: correct native inventories and bridge error classification ( #503 )
...
* fix(hopper): preserve normalized inventory addresses
* test(hopper): isolate real inventory verification
* fix(native): preserve otool addresses and section alignment
* fix: preserve address spaces in call path evidence
* fix(hopper): distinguish request validation from provider faults
* fix(native): retain tool inventory facts and reject failed signatures
2026-10-04 17:25:09 +08:00
morluto
2f08c7c932
refactor(tools): remove artificial analysis ceilings
2026-09-29 16:29:23 +08:00
N0zoM1z0
d39f98d06d
fix(native): harden command capture edge cases
2026-07-14 16:53:47 +08:00
morluto
4ff4c11a00
Add evidence-backed investigation workflows
2026-07-12 21:12:18 +00:00
Ysopwnable