OpenSource/reverse-engineering-anything

0 Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-10 00:36:35 +00:00

Files

T

22f28644fe feat(artifacts): inventory and extract Deno compile executables (#8527 )

* feat(artifacts): inventory and extract Deno compile executables

Adds Deno standalone artifact support for Mach-O, ELF, and PE carriers,
exposing virtual files, entry points, recorded options, and file digests
without running the executable. Extraction uses the existing safe output
tree, preserves symlink targets as metadata, and assigns indexed paths
to unsafe or oversized names. Environment-file values and certificate
bytes remain in local Evidence; npm snapshots are reported by length
without decoding. The documentation describes supported layouts, parsing
limits, and refusal behavior.

* fix(artifacts): resolve nested Intel Deno carriers to the enclosing app

The backward trailer search stopped at the first confirmed sentinel, so an
Intel app storing another Intel Deno executable as a virtual file reported
the inner app. Search to the slice start, drop sentinels inside a confirmed
payload, and fail closed on side-by-side trailers that differ.

Correct the docs on retained environment values and generated regions.

* fix(artifacts): keep Deno coverage, remote paths and PE resources truthful

Report unknown coverage when the virtual filesystem cannot be listed, keep
resolved specifiers when another remote ID is missing, and percent-encode
characters in remote paths that a Windows destination would refuse. Reject a
directory at the PE resource language level, and correct the guide's
description of colliding generated regions.

* fix(artifacts): normalize Deno remote escapes so hex case cannot collide

Uppercase every percent escape in a generated remote path, so specifiers that
differ only in escape case reach the path registry as one name and the second
gets an indexed path instead of colliding on a case-insensitive disk.

* fix(artifacts): fail closed on truncated enclosing Deno trailers and encode reserved remote path characters

The Intel trailer scan rejected an overlong sentinel before reading its
marker, so a truncated enclosing app vanished and the nested app was
reported. Read the marker first and fail closed when a confirmed overlong
trailer encloses another trailer.

encodeURIComponent leaves `*` alone and the sanitizer covered only part of
the Windows reserved set. remoteDestination now encodes the whole set once
as uppercase percent hex; source_path keeps the original.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH

* fix(artifacts): defer truncated Intel Deno trailer failure until enclosing trailers resolve

A damaged Intel asset stored before a valid one inside a valid app made the
backward trailer search fail before it reached the outer trailer. Hold that
failure until the search ends and drop it when a confirmed enclosing trailer
holds the sentinel as data.

* fix(pe): fail closed when a resource type branch is unreadable beside a found name

namedResourceTargets skipped a type branch whose names directory, or a
name entry whose string, could not be read. A duplicate RT_RCDATA entry
pointing out of bounds therefore vanished once another branch matched,
and locatePeResourcePayloads returned only the readable ranges while
parsePeResources rejected the same tree.

The walk now records unresolved branches. hasPeResourceName still
reports false for a tree that never reaches the name, but once
locatePeResourcePayloads finds the name it raises a format failure if
any branch was left unresolved.

* fix(artifacts): skip Intel Deno sentinels that a native segment maps

A non-Deno x86_64 Mach-O that stores an Intel Deno executable in __DATA
had the asset's trailer promoted to the root application, because the
backward sentinel search never checked who owned the bytes it scanned.

locateMachOSlice now records the file ranges of every segment other than
__SUI and __LINKEDIT (libsui extends __LINKEDIT over the trailer), and
the Intel search skips any sentinel inside one of them. A slice whose
load commands do not frame stays with native inventory, since ownership
cannot be shown there.

* fix(artifacts): reject a universal Deno image with an unreadable sibling slice

The universal Mach-O locator skipped any slice whose load commands could
not be read or framed, and any slice with a FAT range issue. When another
slice confirmed Deno, that slice was reported as the whole image, so a
sibling declaring a different Deno application went unexamined.

locateMachOSlice now reports why part of a slice was not examined
(unreadable or unframed load commands, a truncated slice, or the Intel
sentinel allowance). locateMachO collects those reasons for every
declared and hidden slice and fails closed once any slice confirms a
Deno section. With none confirmed, the image stays with native inventory
as before.

* fix(scripts): supervise the Deno verifier version check

Run `deno --version` through the verifier command owner with a deadline
instead of raw execFile, and close the owner when the version is refused.

* fix(artifacts): keep unconfirmed Deno carriers native and fail truncated Intel trailers

An ELF SUI note whose descriptor is too short for the full d3n0l4nd name
now stays unconfirmed instead of failing closed; failures after the name
matches still fail closed.

Every marker-confirmed Intel trailer whose payload runs past the slice is
now kept until the backward search ends and fails unless an enclosing
payload contains it, so an Intel Deno app missing its last byte reports a
Deno failure instead of native inventory.

The Deno MCP boundary test now calls open_binary and inspect_artifact
through artifactMcpCall, as docs/testing.md requires.

* test(deno): drop source-text checks from verifier pin test

Keep the wrong-version subprocess check, which covers the pinned
release through behavior, and stop asserting on the verifier script's
source spelling.

* test(deno): close readers in finally in symlink and cancellation tests

A failed assertion or read error in either test skipped reader.close(),
leaving the file open while temp-directory cleanup ran. Both tests now
close the reader in finally, as CONTRIBUTING.md requires. The
closed-reader assertion in the symlink test stays after the finally.

* docs(specs): add deno-standalone spec, plan and tasks

Add docs/specs/artifacts/deno-standalone/ with spec.md, plan.md and
tasks.md for the Deno compile executable reader, as AGENTS.md requires
for a feature, and list them in the specifications index.

* docs: list the Deno compile guide in the documentation sidebar

* fix(deno): confirm the d3n0l4nd section before claiming Mach-O damage

A __SUI segment alone no longer makes later load-command damage Deno's.
A Mach-O whose __SUI segment holds only a differently named section now
stays absent and keeps native inventory, while damage seen before or
beside a confirmed d3n0l4nd section still fails closed.

* fix(deno): keep a slice with an unparsed segment command unread

A Mach-O segment command that frames but cannot be parsed may be the
__SUI segment, so the slice is no longer treated as fully examined. A
universal image whose other slice confirms Deno now fails closed instead
of letting that sibling supply the whole inventory, and with no confirmed
sibling the image still keeps native inventory.

* fix(deno): confirm an ELF SUI note before rejecting its length

A SUI note whose descsz runs past its note table was recorded as plain
damage before its descriptor name was read, so a malformed Deno carrier
fell back to native inventory. The owner and the d3n0l4nd name prefix are
now read within the table apart from the claimed extent, and a confirmed
note with an oversized extent fails closed.

* fix(deno): confirm a truncated __SUI section record by its name

A section record cut short after its 16-byte name was skipped, so a
damaged Deno carrier fell back to native inventory. The name is now read
apart from the rest of the record, and a truncated record that names
d3n0l4nd fails closed. The range checks for a confirmed record move into
their own helper.

* fix(deno): reject nonzero bytes after the last ELF note

When fewer than 12 bytes remained in a note table after its last note,
the walk stopped without looking at them, so a Deno note was selected
with complete coverage beside unaccounted data. The remainder is now
read: zero padding is accepted, and nonzero bytes are recorded as damage,
which fails closed once a SUI note is confirmed and otherwise leaves the
ELF to native inventory, matching the native note parser.

* fix(deno): validate FAT slice identity before choosing the search

The locator took a universal slice's CPU type from its FAT row, so a row
that called an x86_64 slice arm64 skipped that slice's Intel trailer and
let the arm64 payload stand for the whole image. Each slice's header is
now checked against its row with validateFatSliceIdentity. A mismatch
leaves the slice unread, so a universal image whose other slice confirms
Deno fails closed. The Intel fixture header now states
CPU_SUBTYPE_X86_64_ALL so its FAT rows can match it exactly.

* fix(deno): check the Intel trailer marker before judging its length

A trailer length word of 2^53 or more was dropped before its d3n0l4nd
marker was read, so an enclosing app with that length was skipped and a
nested app's range stood for the whole image. The marker is now read
first, and a marker-confirmed trailer whose length runs past the slice,
safe or not, joins the deferred truncated candidates and fails closed
unless an enclosing trailer holds it as data.

* fix(deno): count short ELF note tables against the note allowance

A note table shorter than one note header made a read of its trailing
bytes but counted no note, so many distinct tiny tables could force one
sequential read each past the 256-note allowance. Every nonempty table
now counts at least one entry, both in the up-front estimate and while
scanning, so an image past the allowance records the limit instead of
reading every table. The trailing-byte check moves into its own helper.

* fix(deno): fail closed on ELF extended section numbering beside a SUI note

A zero e_shnum with a nonzero e_shoff moves the section count into
section zero, so the section table was skipped and its SHT_NOTE tables
were never compared. Record it as damage, as PN_XNUM already is, so a
confirmed SUI note fails closed instead of reporting full coverage.

* fix(deno): keep undersized Intel trailers until enclosing ownership is known

A trailer length word below 8 was dropped before its d3n0l4nd marker was
read, so an enclosing app with a length of 0 to 7 was skipped and a nested
app's trailer was selected as the root. The marker is now read first, and a
marker-confirmed trailer too short to hold it is kept as malformed and fails
closed unless an enclosing trailer holds it as data.

* fix(pe): treat non-directory RT_RCDATA branches as unresolved

A duplicate typeId root entry whose target is a data entry was skipped
without marking the walk unresolved, so locatePeResourcePayloads returned
the readable named resource as complete. Route non-directory type
branches through the same unresolved path as unreadable names
directories so the Deno reader fails closed.

* fix(deno): fail closed on a zero-fill d3n0l4nd Mach-O section

denoSectionRange admitted the declared offset and size of a confirmed
__SUI,d3n0l4nd record without checking its section type, so a
S_ZEROFILL, S_GB_ZEROFILL or S_THREAD_LOCAL_ZEROFILL section could be
read as a file payload while MachoImage reports it as not file backed.
Reject zero-fill types with the shared isMachoZeroFillSection predicate
before assigning a physical range.

* fix(deno): bound the d3n0l4nd Mach-O section by its segment file extent

denoSectionRange checked a confirmed __SUI,d3n0l4nd record only against
the slice and file bounds, so a section reaching past its segment's
fileoff/filesize was still read as a complete payload while MachoImage
reports the same section as not file backed. Reject a section outside
its enclosing segment's file extent before admitting the physical range.

* style(deno): apply oxfmt to the DenoStandaloneLocation embedding union

* fix(artifacts): preserve Deno carrier ownership

* fix(artifacts): admit Deno parent segments

* fix(deno): preserve native segment ownership

* test(deno): cover mismatched Mach-O segment widths

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

2026-11-09 21:43:01 +08:00

9.3 KiB

Raw Blame History

Documentation directory

REA documentation is organized by reader task and document owner. This directory links every authored guide; the site also serves separate product pages. The VitePress documentation source is this docs/ tree.

Getting started

Native binaries

JavaScript and Electron

Browser and captured websites

Android applications

Apple applications

Apple Application Inventory Projection

.NET assemblies

Managed-code analysis

Firmware

Firmware analysis

HarmonyOS packages

Static HarmonyOS package inventory

WebAssembly

Offline WebAssembly artifacts

EVM contracts

Offline EVM bytecode

Databases and recorded packets

Process capture and instrumentation

Signal recordings

Recorded signal inspection

Provider setup and formats

Contracts and evidence

Development and verification

Release migrations

Upgrading from REA 6.1 to 6.2

Architecture and authoring

Machine-owned documentation

Path	Owner and update command
`public/product-catalog.json`	Ignored contract projection; `npm run docs:generate`
`verification/managed-conformance-*.json`	Ignored managed conformance projections; `npm run evidence:generate`
`error-contract.schema.json`	Tracked schema from contracts; `npm run docs:error-schema`
`user-visible-errors.csv`	Authored error classification inventory; preserve its schema
`releases/<version>.contributions.json`	Durable release contribution record; follow the release guide
`assets/`	Shared authored images referenced by guides

Do not edit generated catalogs or evidence to change product facts. Change their canonical contracts or producer and regenerate. Historical release records retain the exact commit messages and references from the release they describe.

9.3 KiB Raw Blame History