mirror of
https://github.com/morluto/rea.git
synced 2026-10-31 03:45:39 +00:00
Dragolone
95637a3d70
TYPE_NAMES stopped at flat_dt (8), while the U-Boot include/image.h commit that the tables are pinned to defines image types 0-47. A header declaring a later type, such as kernel_noload (14) or tfa-bl31 (45), was reported with type_name "unknown". Add types 9-47 with their mkimage -T short names from boot/image.c at the same commit. IH_TYPE_LOADABLE (22) has no short name there and is named "loadable", as other tables already name identifiers U-Boot does not list. Identifiers past the enum stay "unknown".
77 lines
4.3 KiB
Markdown
77 lines
4.3 KiB
Markdown
# U-Boot legacy uImage containers
|
|
|
|
`inspect-artifact` and `extract-artifact` recognize the big-endian
|
|
`0x27051956` legacy uImage signature regardless of filename. They read local
|
|
stored bytes without booting, executing, decompressing or modifying the image.
|
|
FIT is a different format; its analysis is outside this reader.
|
|
|
|
The same domain header/table facts and artifact reader serve CLI and MCP.
|
|
The root is an archive with unknown executable architecture. The header's CPU,
|
|
OS, type, compression, load address and entry address are declarations, not proof of
|
|
compatible or executable payloads. Raw numeric identifiers remain available
|
|
alongside names. Type names cover every image type in the pinned
|
|
`include/image.h`, using U-Boot's `mkimage -T` names; `IH_TYPE_LOADABLE` (22)
|
|
has none and is named `loadable`. Unrecognized identifiers have the name
|
|
`unknown`.
|
|
|
|
The header's CRC32 and the declared payload's CRC32 must verify before a
|
|
successful inventory. `payload.bin` contains the complete stored payload.
|
|
Multi-file images also expose `image-0.bin`, `image-1.bin`, and so on. These
|
|
component names are generated from table order. Components follow the zero-terminated big-endian size table, with four-byte
|
|
padding after every nonfinal component. Script images (`boot.scr`) carry the
|
|
same table, so their script text is `image-0.bin`. Component physical source
|
|
ranges and content hashes retain precise provenance. Extraction writes the complete
|
|
payload and every component, so multi-file output can approach twice the input
|
|
size. Compressed payloads remain compressed.
|
|
|
|
The fixed 32-byte name field is retained as `name_bytes_hex`. `name` contains
|
|
the UTF-8 bytes before the first NUL, or null when those bytes cannot be decoded
|
|
exactly. For example, a producer can truncate a multibyte character at the
|
|
32-byte boundary; replacement characters do not establish a source name.
|
|
|
|
## Bounded work and retained facts
|
|
|
|
The reader admits at most 4,096 components, a resource policy rather than a
|
|
format maximum. It reads at most 16,388 bytes for the size table and refuses an
|
|
excess count as a capacity limit before its remaining payload CRC scan.
|
|
Shared artifact identity hashing has separate cost. The
|
|
same prefix participates in the native incremental CRC32 calculation; no
|
|
custom bytewise CRC table or full-payload buffer is retained. Remaining CRC
|
|
reads and member streams use 64 KiB chunks. Parsed facts are cached for one reader. Carrier state is checked during
|
|
directory preparation, at member open and after stream completion; metadata
|
|
getters return the retained facts. Close joins active member
|
|
pipelines and final validation before releasing the descriptor; failed cleanup
|
|
remains owned for retry.
|
|
|
|
Prefer a retained summary when only a few facts are needed:
|
|
|
|
```sh
|
|
rea inspect-artifact firmware.bin --detail summary \
|
|
--evidence_output firmware.evidence.json --json
|
|
rea extract-artifact firmware.bin --json
|
|
```
|
|
|
|
With MCP, `inspect_artifact` with `detail: "summary"` retains the complete
|
|
Evidence. Use `inspect_analysis_view` and its `parent_evidence_id` for exact
|
|
logical paths, batches of occurrence/content IDs, selected fields and pages.
|
|
Coverage and limitations remain attached. Retained views are historical
|
|
observations tied to the saved Evidence. Complete Evidence remains available;
|
|
these views do not narrow the examined inventory.
|
|
|
|
## Verification scope
|
|
|
|
The public OpenWrt 24.10.0 GL-AR150 initramfs kernel is checked against its
|
|
[published digest](https://downloads.openwrt.org/releases/24.10.0/targets/ath79/generic/sha256sums):
|
|
`027c60a7061462d8145b11efa23ab02b334acb9a23a215f9095860b632ace4ff`.
|
|
Independent `mkimage`/`dumpimage` 2023.01 provide producer and extraction
|
|
oracles. Generated containers use real host ELF files, system metadata and
|
|
stored gzip bytes; their declared ARM64, VxWorks or RISC-V labels do not prove
|
|
boot/runtime compatibility. U-Boot's identifier and alignment definitions are
|
|
pinned to commit `ece349ade2973e220f524ce59e59711cc919263f`.
|
|
|
|
Source and compiled CLI/full/compact MCP tests cover aligned component ranges,
|
|
unknown identifiers/text, malformed/truncated inputs, CRC failures, capacity,
|
|
source changes, cancellation, pending reads, final validation and cleanup
|
|
retry. Real producer results, complete-task cost measurements and limitations
|
|
are reported in the PR. No target runtime or decompressor behavior is verified.
|