reverse-engineering-anything/src/domain/ghidraValues.fixture.ts

export const ghidraFunctionClassification = () => ({
  external: false,
  thunk: false,
  thunk_target: null,
  provenance: "ghidra-function-manager" as const,
});

/** Wire-boundary fixture, not evidence that a real Ghidra run was performed. */
export const ghidraFunctionBody = () => ({
  available: true as const,
  provenance: "ghidra-function-body-address-set",
  ranges: [{ start: "0x401000", end: "0x401005" }],
  total_bytes: 6,
  span_bytes: 6,
  non_contiguous: false,
  contains_entry: true,
});

export const ghidraFunctionIdentity = () => ({
  address: "0x401000",
  name: "fixture_main",
  classification: ghidraFunctionClassification(),
  body: ghidraFunctionBody(),
});

const ghidraReferenceKind = () => ({
  available: true as const,
  provenance: "ghidra-reference-manager" as const,
  type: "DATA",
  flow: false,
  call: false,
  jump: false,
  data: true,
  read: true,
  write: false,
  indirect: false,
  computed: false,
  conditional: false,
  terminal: false,
  primary: true,
  operand_index: 0,
  external: false,
});

export const ghidraReferenceEdge = () => ({
  source_address: "0x401001",
  target_address: "0x402000",
  source_procedure: ghidraFunctionIdentity(),
  target_procedure: null,
  kind: ghidraReferenceKind(),
});

export const ghidraNativeApiBoundary = () => ({
  available: true as const,
  provenance: "ghidra-high-function",
  signature_source: "analysis",
  calling_convention: "__cdecl",
  return_type: {
    role: "return" as const,
    ordinal: null,
    name: null,
    data_type: "int",
    size_bytes: 4,
    storage: "EAX:4",
    confidence: "medium" as const,
    evidence: [
      {
        kind: "signature-source" as const,
        source: "ghidra-function-manager",
        detail: "Function signature source is analysis.",
      },
      {
        kind: "decompiler-type" as const,
        source: "ghidra-high-function",
        detail: "HighFunction recovered data type int.",
      },
    ],
    decompiler_artifacts: [
      "recovered-signature" as const,
      "register-or-stack-storage" as const,
    ],
  },
  parameters: [],
  jump_tables: [
    {
      dispatch_address: "0x401010",
      data_sources: [
        {
          address: "0x403000",
          provenance: "ghidra-decompiler-load-table" as const,
          entry_size_bytes: 4,
          entry_count: 2,
          confidence: "high" as const,
          evidence: [
            {
              kind: "jump-table" as const,
              source: "ghidra-high-function",
              detail: "Decompiler load table starts at 0x403000.",
            },
          ],
        },
      ],
      mappings: [
        {
          case_value: 0,
          target_address: "0x401020",
          confidence: "medium" as const,
          evidence: [
            {
              kind: "jump-table" as const,
              source: "ghidra-high-function",
              detail: "Recovered target 0x401020 from dispatch 0x401010.",
            },
          ],
        },
      ],
      default_targets: [
        {
          target_address: "0x401030",
          confidence: "high" as const,
          evidence: [
            {
              kind: "jump-table" as const,
              source: "ghidra-clang-case-token",
              detail:
                "Typed default label belongs to the block at 0x401030 with unique indirect dispatch predecessor 0x401010.",
            },
          ],
        },
      ],
      limitations: [],
    },
  ],
  pseudocode: {
    classification: "decompiler-generated-non-source" as const,
    compilable: false as const,
  },
  decompiler_artifacts: [
    "recovered-signature" as const,
    "register-and-stack-variables" as const,
    "compiler-generated-control-flow" as const,
    "pointer-arithmetic" as const,
    "pseudocode" as const,
  ],
  limitations: [
    "Pseudocode is neither original source nor guaranteed to compile.",
  ],
});

export const ghidraFunctionDossier = (includeAssembly = true): JsonValue => {
  const pseudocode = "int fixture_main(void) { return 42; }";
  return {
    procedure: {
      ...ghidraFunctionIdentity(),
      signature: "int fixture_main(void)",
      locals: [],
    },
    pseudocode,
    assembly: includeAssembly
      ? ["0x401000: CALL 0x401020", "0x401005: RET"]
      : [],
    comments: [],
    callers: [],
    callees: [],
    incoming_references: [],
    outgoing_references: [ghidraReferenceEdge()],
    referenced_strings: [
      {
        address: "0x402000",
        value: "inventory fixture",
        source_address: "0x401001",
      },
    ],
    referenced_names: [],
    basic_blocks: [{ start: "0x401000", end: "0x401006", successors: [] }],
    native_api: ghidraNativeApiBoundary(),
    native_value_flow: {
      available: true,
      provenance: "ghidra-high-pcode",
      operations: [
        {
          id: "0x401000#0",
          address: "0x401000",
          sequence: 0,
          opcode: "COPY",
          is_dead: false,
          inputs: [
            {
              kind: "constant",
              size_bytes: 4,
              location: null,
              constant_hex: "2a",
            },
          ],
          output: {
            kind: "register",
            size_bytes: 4,
            location: "register:0x0",
            constant_hex: null,
          },
        },
      ],
      def_use: [],
      effects: [],
      truncated: false,
      omitted_operations_lower_bound: 0,
      known_omitted_inputs: 0,
      known_omitted_edges: 0,
      limitations: [
        "High p-code is a decompiler-derived intra-function representation, not original source or runtime behavior.",
      ],
    },
    limitations: [
      "Unresolved computed or indirect flows without target addresses are not represented as reference edges.",
      "Thunk and external classifications are Ghidra FunctionManager observations; they do not resolve targetless calls.",
      "Pseudocode and assembly are Ghidra-specific representations, not original source or Hopper-equivalent text.",
    ],
  };
};
import type { JsonValue } from "./jsonValue.js";