mirror of
https://github.com/morluto/rea.git
synced 2026-11-10 00:36:35 +00:00
morluto
5f702dd6cc
Normalize parsed facts at their owning boundaries across PE exports and certificates, ELF section names, GPU bundles, IL2CPP generic types, dyld slice selection, source maps, environment replay, and JavaScript mapped arguments. Preserve partial facts and explicit unsupported cases; clarify the corresponding documentation. Validation: 831 affected tests passed with one existing skip across 23 files; build, typecheck/lint, documentation, formatting, and 2133-file test discovery passed. Format controls are synthetic; real Unity, GPU, and ARM-device execution is unverified. Fixes #6709 Fixes #6688 Fixes #6719 Fixes #6718 Fixes #6704 Fixes #6703 Fixes #6692 Fixes #6723 Fixes #6687 Fixes #6726 Fixes #6696 Fixes #6691 Fixes #6727
59 lines
2.6 KiB
Markdown
59 lines
2.6 KiB
Markdown
# ELF note tables
|
|
|
|
`inspect_elf_notes` / `inspect-elf-notes` answers whether one selected local
|
|
ELF32/ELF64 image declares `PT_NOTE` program headers or `SHT_NOTE` sections,
|
|
which note owners and types those tables store, and which GNU build-id or
|
|
ABI-tag fields those notes carry. It reads the file without executing it and
|
|
does not require a disassembler, debug package, or package catalog.
|
|
|
|
```bash
|
|
rea inspect-elf-notes /absolute/path/to/program --json
|
|
```
|
|
|
|
The CLI resolves relative paths against the caller's working directory. MCP
|
|
requires an absolute filesystem path and preserves that exact selection:
|
|
|
|
```json
|
|
{
|
|
"name": "inspect_elf_notes",
|
|
"arguments": { "path": "/artifacts/program" }
|
|
}
|
|
```
|
|
|
|
## Observations
|
|
|
|
The inline Evidence result contains the artifact path, SHA-256, and byte length.
|
|
`tables` lists each declared note program header or section, including the
|
|
section name when a string table is present. Zlib-compressed section-name
|
|
tables are decompressed within the selected file-size budget. An unsupported
|
|
compression type leaves section names unknown and adds a limitation; note bytes
|
|
remain independently examined. Each `entries[]` item reports owner, type,
|
|
descriptor SHA-256, and a hex preview for descriptors of 64 bytes or less.
|
|
|
|
For GNU notes, `gnu.build_id_hex`, `gnu.abi_tag`, or `gnu.gold_version` are
|
|
filled when the descriptor matches that type. Other owners keep `gnu` null.
|
|
|
|
`PT_NOTE` and `SHT_NOTE` are examined independently. The same file range may
|
|
appear twice when both tables declare it.
|
|
|
|
A missing table list is observed absence of those declarations. It is not proof
|
|
the image never carried notes in another container or overlay.
|
|
|
|
## Limits and failures
|
|
|
|
The selected file is limited to 64 MiB by default (512 MiB maximum). At most
|
|
32 note entries are examined by default across every table. Retained note
|
|
names, section names, and GNU descriptor text share a scan budget based on
|
|
the source bytes plus any decoded section-name table, capped at
|
|
`max_file_bytes`. The raw source and decoded table must also fit together
|
|
within that ceiling; repeated table ranges count again. Each descriptor range is hashed once,
|
|
and each GNU version's trailing NUL run is scanned once; neither walk may
|
|
exceed that byte ceiling. Malformed ELF headers, truncated header
|
|
tables, declared note tables that extend past the file, and truncated
|
|
note entries fail without partial success. ELF extended
|
|
numbering (`PN_XNUM`, including a section count stored when `e_shnum` is 0) is
|
|
unsupported.
|
|
|
|
This workflow does not execute the image or verify GNU build-id uniqueness
|
|
against package catalogs.
|