mirror of
https://github.com/morluto/rea.git
synced 2026-11-12 09:52:27 +00:00
morluto
cb4e5cfbff
* refactor(analysis): centralize resource budgets and recovery facts * feat(analysis): expose ASAR and Ghidra runtime admission controls * feat(artifacts): expose reader admission and preserve limited recognition * feat(javascript): expose recoverable semantic precision budgets * feat(web): add recoverable source-map budgets and compact retained views * feat(web): make historical capture decoding budgets recoverable * fix(desktop): enforce selected view policies across capture and export * feat(runtime): make Frida and LLDB retention budgets selectable * feat(native): expose diagnostic budgets and preserve exhaustion causes * feat(managed): expose recoverable snapshot and representation budgets * feat(metadata): make Go and Rust inspection budgets recoverable * feat(wasm): expose representation and producer admissions * feat(evm): expose per-call worker resource budgets * feat(android): make resource and string-pool omissions recoverable * feat(producers): expose command and recorded-capture budgets * docs(analysis): record recovery contracts and integrated validation * fix(docs): link calibration oracle from published verification pages * fix(docs): restore desktop task anchors and receipt links * test(analysis): align fixtures with selectable budget contracts * fix(analysis): remove source-location projector dependency cycle * test(analysis): refresh budget recovery and verifier regressions * test(analysis): preserve format and publication recovery expectations * test(windows): align conformance with owned runtime admission * fix(desktop): preserve selected alias kinds in exported state * test(analysis): align provider fixtures with recoverable budgets * test(desktop): validate emitted alias metadata structurally * fix(ghidra): classify bounded Windows endpoint refusals * test(cli): assert selectable artifact admission recovery * fix(cli): preserve capture provenance in environment builds
63 lines
3.7 KiB
Markdown
63 lines
3.7 KiB
Markdown
# Go static string-header literal recovery
|
|
|
|
## Problem and outcome
|
|
|
|
Go compilers pack static string contents contiguously in read-only sections
|
|
(`.rodata`, `__TEXT,__rodata` / `__TEXT,__const`, `.rdata`) without NUL
|
|
terminators. Generic C-string scans merge adjacent Go literals into multi-kilobyte
|
|
runs. Extend `inspect_go_binary` / `inspect-go-binary` with opt-in, bounded
|
|
`(ptr, len)` `reflect.StringHeader` recovery across ELF, PE and thin Mach-O
|
|
images so static string slices are recovered at their exact boundaries.
|
|
|
|
## Requirements
|
|
|
|
- Keep `include_string_literals` opt-in (`false` by default) so existing
|
|
build-metadata output and payload size are unchanged unless requested.
|
|
- Scan only pointer-aligned non-executable initialized data spans (with indexed
|
|
`O(log R)` readable segment checks on Mach-O and sectionless/unnamed-ELF
|
|
load-region fallbacks) in deduplicated ascending file-offset order.
|
|
- Admit candidate `[ptr, ptr + len)` slices only inside single read-only
|
|
non-executable mapped spans with `1 <= len <= max_string_literal_bytes`
|
|
(default `4096`), non-overlapping with the
|
|
header itself, and valid printable UTF-8 (allowing `\t`, `\n`, `\r`, `U+200C`
|
|
and `U+200D` while rejecting control, surrogate, noncharacter, private-use and
|
|
invisible/bidi `\p{Cf}` code points).
|
|
- Keep the existing defaults for header-scan work (`64 MiB`), tracked candidates
|
|
(`100,000`), returned items (`2,000`), and aggregate returned UTF-8 bytes
|
|
(`512 KiB`). Expose each independent boundary as the positive-safe-integer
|
|
per-call controls `max_string_header_scan_bytes`, `max_string_candidates`,
|
|
`max_string_literals`, `max_string_literal_bytes` and `max_string_bytes`.
|
|
String-byte maxima follow the runtime's string representability; there is no
|
|
separate fixed 10,000-item ceiling. The bounded negative-slice cache (`4,096`)
|
|
affects reuse only and must not discard valid later candidates.
|
|
- Report `evidence_kind: "inferred"`, `discovered_count`, `aggregate_bytes`,
|
|
`truncated` and the exact exhausted `limits_reached` controls honestly.
|
|
Increasing a named control and inspecting the same complete artifact can
|
|
recover omitted facts; output paging cannot recover facts never retained.
|
|
- Deduplicate candidates by their complete offset and length independently of
|
|
the selected literal-length allowance; raising that allowance cannot merge
|
|
distinct slices or inflate their reference counts.
|
|
- Share one Go analysis budget owner with build-info input, representation and
|
|
search controls. Omitted selections keep defaults and remain omitted from
|
|
request Evidence. Representation maxima account for base64 expansion; no
|
|
setting changes the separate shared native structural decoder or MCP budget.
|
|
- Record limitation notes when Mach-O `LC_DYLD_CHAINED_FIXUPS` encodes rebases in
|
|
pointer slots or when truncation occurs, and expose a focused `string_literals`
|
|
projection in `inspect_analysis_view`.
|
|
|
|
## Acceptance
|
|
|
|
Unit, boundary and CLI acceptance tests cover ELF/PE/Mach-O (32/64-bit, little
|
|
and big endian), sectionless and unreadable-`.shstrtab` ELF images, overlapping
|
|
spans, `U+200C`/`U+200D` versus disallowed `\p{Cf}` controls, negative-cache and
|
|
output defaults, named budget recovery, long-literal candidate identity, and
|
|
25,000-region Mach-O indexing/cancellation. Service and provider tests cover
|
|
malformed numeric controls and same-artifact retries with larger budgets. The real Go binary
|
|
verifier validates CLI and advertised-schema MCP parity across compiled targets.
|
|
|
|
## Out of scope
|
|
|
|
Instruction-operand immediate string recovery (stack/register `MOV`/`LEA` pairs
|
|
without static two-word headers), Mach-O chained-fixup rebase decoding, binary
|
|
execution, and non-UTF-8 byte-slice guessing.
|