GRAB Racem
e10c934d5a
The cross-format oracle requires a callee whose recovered control flow has more than one basic block, and rea_cross_branch provided it through a symmetric if/else of tail calls. Clang 21 folds that shape into a conditional negate plus one tail branch, a single basic block, so the lane rejected a correct Ghidra analysis of the fixture. Give the branch a loop whose trip count depends on a volatile global: no compiler can eliminate the backedge, and the callee stays multi-block at every optimization level on every toolchain.
Ghidra conformance corpus
These source-owned fixtures are compiled at verification time; generated binaries and Ghidra projects are never committed.
inventory.cproduces separate x86-64 debug and stripped ELF executables. It covers imports, an externalputsfunction, linker thunks, source symbols, direct calls, a targetless callback call, two referenced strings, and a multi-block branch.entry-aliases.cpreserves secondary imported entry labels, a bare-hex alias, and an interior label. The native CLI/MCP lane verifies entry selection, annotation, interior-label rejection, and unchanged source bytes.cross-format.cis freestanding so the verifier can produce AArch64 ELF, x86-64 PE, and x86-64 Mach-O targets from the same semantics. It preserves an exported entry, direct and indirect calls, a volatile string reference, and a multi-block branch across loaders.
scripts/verify-real-ghidra.mjs uses cc, clang, and lld-link by default;
REA_CC, REA_CLANG, and REA_LLD_LINK can select alternate commands. The
verifier requires the verified bring-your-own Ghidra 12.1.4 installation through
GHIDRA_INSTALL_DIR and validates header classification before starting the
provider. Provider admission accepts the rest of the 12.1.x line; this lane does
not.
Conformance compares semantic facts: provider/profile identity, function classification, resolved call edges, typed references, strings/xrefs, and CFG topology. It only requires provider pseudocode and assembly to be non-empty, bounded, and address-bearing; it never compares their text with Hopper. The callback fixture also proves that an unresolved targetless flow is not silently promoted to a direct callee. Every target runs in a separate owned project and must leave no process, socket, project, or runtime root after close.