Files
reverse-engineering-anything/tests/fixtures/nativeLoadImage.ts
T
morluto 3afd8a16ee feat(evidence)!: give Evidence bundles a format revision owned by one module (#10861)
* feat(evidence)!: give Evidence bundles a format revision owned by one module

`src/domain/evidenceFormat.ts` owns Evidence format evolution. Bundles now
carry `evidence_format: 1`; every bundle reader admits only the current
revision and refuses an unmarked or other-revision bundle once, with the
single recreate-observations guidance, instead of admitting earlier shapes
one optional field at a time.

The 6.7-era artifact inventory summary identities are no longer rebuilt:
compare_artifacts checks the current projection only and reports a mismatch
with the owner's guidance. The pre-6.6 identity diagnosis uses the same
guidance. SQLite `worker_timeout_ms` and Dart AOT `string_pool.policy`,
optional only for historical Evidence, are now required.

BREAKING CHANGE: Evidence bundles written by REA 6.x (no `evidence_format`)
are refused by import, comparison, reconstruction and analysis-snapshot
readers as an integrity mismatch telling the caller to recreate the
observations; re-exporting an earlier bundle does not update its format or
identities. Bundles constructed by hand must include `"evidence_format": 1`.
6.7-era artifact summaries are refused by compare_artifacts, and SQLite and
Dart AOT Evidence without the newly required fields fails validation.

* fix(evidence): let the ledger application admit its bundle's format

build_reconstruction_obligation_ledger registered the full bundle schema with the SDK, so an unmarked or other-revision bundle was refused as invalid_request before the format owner ran. Register it like coverage: the application parses the request envelope and admits the bundle.

* feat(pcap)!: read capture Evidence through the current result schema only (#10879)

Delete the pcap read-compatibility schema that defaulted executable identity for historical capture Evidence, and require query_labels_hex (null when unknown) now that every producer writes it. Evidence from an earlier format is refused at the bundle format owner; a record that omits these fields is reported as malformed instead of defaulted.

BREAKING CHANGE: inspect_pcap_capture results always carry query_labels_hex, and analysis views no longer default missing tshark/capinfos identity fields.

* feat(desktop)!: require the effective view policy in desktop state Evidence (#10886)

inspect_desktop_application_state always records the complete policy it used, including sqlite_view_bytes. Drop the optional historical shape and the task draft's absent-policy branch.

BREAKING CHANGE: desktop application state results without effective_view_policy, or with a policy missing sqlite_view_bytes, are refused as malformed.

* feat(android)!: require component declaration facets and reference aggregates in Android Evidence (#10904)

* feat(android)!: require component declaration facets and reference aggregates in Android Evidence

The JADX producers always write the manifest component projection with every declaration facet, target_definition and direct_invokes_coverage. Require them, delete the duplicate observed component schema, drop the unknown declaration coverage that only described historical omission, and give manifest view results their explicit facet.

BREAKING CHANGE: Android package, component and reference results missing these fields are refused as malformed; component declaration_coverage and its summary counts no longer include unknown; manifest view results always carry facet manifest.

* refactor(android): parse package results with the domain schema directly

* feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts (#10897)

* feat(browser)!: require the DOM length unit and redirect-scoped prior-hop facts

Both CDP producers always declare node_value_length_unit, and the observation session writes redirect_response on every redirect event and no other. Require the unit, drop the diff's absent-unit branch, and admit redirect_response exactly on redirect rows.

BREAKING CHANGE: DOM snapshots without node_value_length_unit and redirect timeline rows without redirect_response are refused as malformed, including inline inspections passed to compare_web_captures.

* docs(browser): drop the historical redirect_response omission note

* feat(native)!: require native Evidence fields that were optional only for historical Evidence (#10946)

Mach-O encryption, slice malformed cause, symbol runtime names and import
facts; ELF export encoding facts and visibility; value-flow limits; load-image
permissions and relocation symbols; Swift type-reference kind and GPU AMD
target metadata are required. Legacy enum values (unrecorded, unknown
visibility, undecodable, modinfo_field_exceeds_limit) and the retained
schemas, view defaults and reinterpretations that served historical Evidence
are deleted.

BREAKING CHANGE: native records missing these fields are refused as
malformed; recreate the observation.
2026-11-15 17:25:31 +08:00

147 lines
3.6 KiB
TypeScript

import type {
NativeLoadImage,
NativeLoadImageObservation,
} from "../../src/domain/native/nativeLoadImage.js";
/** Authored domain observations; these projection fixtures run no provider. */
export const nativeLoadImageObservationFixture =
(): NativeLoadImageObservation => ({
executable_format: "Old-style DOS Executable (MZ)",
language_id: "x86:LE:16:Real Mode",
compiler_spec_id: "default",
image_base: "0x0",
default_address_space: "ram",
source_files: [
{
name: "fixture.exe",
size: 64,
original_sha256: "a".repeat(64),
modified_sha256: "a".repeat(64),
},
],
mappings: [
{
block: "module",
start: "ram:0x0010",
end: "ram:0x001f",
address_space: "ram",
initialized: true,
loaded: true,
overlay: false,
readable: true,
writable: false,
executable: true,
length: 16,
source_file_index: 0,
file_offset: 32,
sha256: "b".repeat(64),
},
],
relocations: [],
entry_points: ["ram:0x0010"],
entry_context: [],
});
/** A recorded producer verification claim, not a runtime attestation by this fixture. */
export const nativeDosLoadImageFixture = (): Extract<
NativeLoadImage,
{ format: "dos-mz" | "dos-com" }
> => ({
status: "verified",
format: "dos-mz",
target_sha256: "a".repeat(64),
load_segment: 0,
header_bytes: 32,
module_bytes: 32,
overlay_bytes: 0,
entry: { relative_segment: 0, offset: 16, linear_address: "ram:0x0010" },
observations: nativeLoadImageObservationFixture(),
checks: [
{
name: "original_file_sha256",
matched: true,
expected: "a".repeat(64),
observed: "a".repeat(64),
file_offset: null,
address: null,
},
],
limitations: [],
});
export const nativeRawLoadImageFixture = (): Extract<
NativeLoadImage,
{ format: "raw-binary" }
> => ({
status: "verified",
format: "raw-binary",
target_sha256: "c".repeat(64),
architecture: "x86_64",
language_id: "x86:LE:64:default",
compiler_spec_id: "gcc",
base_address: "ram:0x00400000",
file_bytes: 32,
entry: { address: "ram:0x00400000", file_offset: 0 },
observations: {
...nativeLoadImageObservationFixture(),
executable_format: "Raw Binary",
language_id: "x86:LE:64:default",
compiler_spec_id: "gcc",
image_base: "ram:0x00400000",
entry_points: ["ram:0x00400000"],
},
checks: [],
limitations: [],
});
export const nativeDolLoadImageFixture = (): Extract<
NativeLoadImage,
{ format: "gamecube-dol" }
> => ({
status: "mismatch",
format: "gamecube-dol",
target_sha256: "d".repeat(64),
architecture: "powerpc",
language_id: "PowerPC:BE:32:default",
compiler_spec_id: "default",
file_bytes: 288,
entry: { address: "ram:0x80003100" },
sections: [
{
kind: "text",
index: 0,
file_offset: "0x100",
address: "ram:0x80003100",
size: "0x10",
},
{
kind: "data",
index: 0,
file_offset: "0x110",
address: "ram:0x80004000",
size: "0x10",
},
],
bss: { address: "ram:0x80005000", size: "0x20" },
observations: {
...nativeLoadImageObservationFixture(),
executable_format: "Nintendo GameCube DOL",
language_id: "PowerPC:BE:32:default",
image_base: "ram:0x80003100",
entry_points: ["ram:0x80003100"],
},
checks: [
{
name: "bss",
matched: false,
expected: "0x20",
observed: "0x10",
file_offset: null,
address: "ram:0x80005000",
},
],
limitations: [
"Fixture records a BSS mismatch; this is not runtime coverage.",
],
});