mirror of
https://github.com/morluto/rea.git
synced 2026-11-14 18:52:48 +00:00
Artifact classification probes every ELF root for a Node SEA note. Each PT_NOTE program header was scanned on its own, one read per note, so headers that declare the same note bytes multiplied the work: a 295 KB ELF with 4,096 such headers kept inspect-artifact busy for about three and a half minutes. Every note header takes at least 12 bytes, so disjoint tables hold at most one note per 12 file bytes. The scan now stops there. Past that count the remaining tables are unreadable: an ELF without a confirmed blob keeps its native classification, and a confirmed blob fails closed.