mirror of
https://github.com/morluto/rea.git
synced 2026-11-10 00:36:35 +00:00
f21fda0fc0
* feat(elf): report a Linux kernel image's version banner and embedded build config inspect_kernel_build_config and inspect-kernel-build-config read one local vmlinux, raw arm64 Image, gzip bzImage or zImage, or configs.ko and report its Linux version banner and the IKCONFIG .config embedded between IKCFG_ST and IKCFG_ED, without executing it. A config is present only when a gzip member ends exactly at IKCFG_ED, passes its CRC-32 and ISIZE checks and parses as .config text; framing that fails is reported malformed, never absent. bzImage gzip payloads are inflated within a budget and other codecs are named as unsupported, using codec detection now shared with the kernel module parser. The config search, inflate sizes and option counts are bounded, scans honor cancellation, and target-derived text is marked untrusted. * fix(elf): reject a gzip member whose header checksum fails When FHCRC is set, compare the low 16 bits of the header CRC-32 before inflating, so a damaged header no longer yields a present config or an inflated bzImage payload. * fix(elf): detect the bzImage codec inside the declared payload Codec detection now reads the same payload_offset/payload_length slice that is inflated, so bytes past a short payload cannot name its codec. * fix(elf): report a framed config that does not decode as malformed A damaged or cut-off deflate stream between IKCFG_ST and IKCFG_ED was skipped and could end as an absent config with complete coverage. It is now malformed with config_gzip_invalid, and a later valid config still wins. * fix(elf): scan config lines in place and accept long string values Config text is read one line at a time instead of split into an array, and a quoted value is validated before it is decoded once. The 4096-character string cap is removed: Kconfig has no such limit and max_config_bytes already bounds every line, so a long CONFIG_EXTRA_FIRMWARE list is no longer reported as malformed. * fix(elf): let a live cancellation reach the kernel config parser The parser ran synchronously, so an abort raised during parsing could not change the signal before it returned. Inflation now runs on the zlib thread pool and each scan yields to the event loop once per MiB, so the existing cancellation checks observe a real abort. * refactor(elf): carry the refused kernel config budget as a typed fact Budget failures are now KernelBuildConfigBudgetFailure with a knob field, and the provider builds its recovery advice from that field instead of searching the diagnostic message for an option name. * docs(elf): move the kernel build config guide under docs/guides/native The documentation guide assigns analyst workflows to docs/guides/<domain>/. Move the guide there, place its navigation and directory entries in the Native binaries group, and update links from the docs index, CLI guide, spec and authored skill. The public /kernel-build-config route is unchanged. * fix(elf): yield while checking one long config line A config made of one long quoted value never reached the per-line yield, so the control-byte check, value validation and SHA-256 ran in one synchronous block. Each now works one MiB window per event-loop turn, and the line patterns match only a bounded name prefix instead of the whole value. * fix(elf): return paged config entries that do not pin the decoded text Entry names and values were V8 slices of the whole decoded config, so a one-entry page kept the full text alive. Entries in the returned page are now standalone copies, so retained memory follows the page size. * fix(elf): yield while kernel marker searches find nothing IKCFG_ST, IKCFG_ED and banner searches used one Buffer.indexOf over the rest of the image, so a large image with no marker never yielded. They now search overlapping one MiB windows and yield after each window without a match. * fix(elf): preserve long kernel config names * fix(elf): frame kernel configs by gzip member boundaries --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
Documentation directory
REA documentation is organized by reader task and document owner. This directory
links every authored guide; the site also serves separate
product pages. The VitePress documentation source is this docs/ tree.
Getting started
- Installation and setup
- Client configuration and troubleshooting
- CLI and Evidence
- Guided MCP prompts and completion
Native binaries
- Native binary investigation
- Go binary build metadata
- Offline binary diagnostics
- Linux kernel build config
- Recorded crash evidence
- Windows Shell Link shortcuts
JavaScript and Electron
- JavaScript Application Graph
- Cross-layer JavaScript application workflows
- JavaScript artifact reconstruction
- JavaScript source recovery
- Passive Node and Electron runtime observation
- JavaScript static/runtime reconciliation
- Electron file-page observation
- V8 code cache inspection
Browser and captured websites
- Website observation with CDP
- Browser scenario contract
- Website runtime source attribution
- Historical web network captures
- HTTP/3 capture lab
- Captured website source locations
- Captured website module relationships
- Captured website scripts and static JavaScript analysis
Android applications
- Static Android APK analysis
- Apktool resource decoding
- ADB device inspection and acquisition
- Flutter build identification
Apple applications
.NET assemblies
Firmware
HarmonyOS packages
WebAssembly
EVM contracts
Databases and recorded packets
Process capture and instrumentation
Signal recordings
Provider setup and formats
- Ghidra provider semantics
- DOS MZ and COM analysis with Ghidra
- Optional NativeAOT metadata recovery
- MIPS ELF analysis through Ghidra
- PSP static ELF analysis through Ghidra
- RISC-V ELF analysis through Ghidra
- Windows Ghidra P0
- Headerless raw-binary analysis with Ghidra
- IDA provider
- JEB instrumentation and analysis
Contracts and evidence
Development and verification
- Settings and recovery
- MCP tool design
- Testing REA
- Client and agent verification
- Reconstruction readiness conformance
- Releasing REA
- REA roadmap
Release migrations
Architecture and authoring
- Architecture map
- Documentation ownership and contribution model
- Feature specifications
- Architectural decision records
Machine-owned documentation
| Path | Owner and update command |
|---|---|
public/product-catalog.json |
Ignored contract projection; npm run docs:generate |
verification/managed-conformance-*.json |
Ignored managed conformance projections; npm run evidence:generate |
error-contract.schema.json |
Tracked schema from contracts; npm run docs:error-schema |
user-visible-errors.csv |
Authored error classification inventory; preserve its schema |
releases/<version>.contributions.json |
Durable release contribution record; follow the release guide |
assets/ |
Shared authored images referenced by guides |
Do not edit generated catalogs or evidence to change product facts. Change their canonical contracts or producer and regenerate. Historical release records retain the exact commit messages and references from the release they describe.
Additional guides
- Offline API contract inventory
- Bun standalone executables
- Capability composition and ownership
- .NET single-file bundles
- ESP flash images
- U-Boot FIT images
- Measure MCP catalog costs in Codex
- Offline Playwright traces
- Testing lanes and provider verification
- UF2 and DfuSe images
- WeChat mini-program wxapkg archives
- Binary hardening
- Desktop application capture
- Desktop application export
- Desktop application state
- Desktop application tasks
- Desktop build computer
- Desktop build witness
- iNES containers
- Build RL environments with REA
- Agent environments from recorded captures
- APK signature schemes
- Apple IPS crash reports
- Static analysis in GitHub Actions
- Desktop installation directories
- Flattened devicetree inspection
- Electron fuse state
- ELF note tables
- Erlang BEAM files
- ESP images
- GameCube DOL analysis through Ghidra
- PowerPC ELF analysis through Ghidra
- Godot PCK archives
- Static CUDA and HIP code objects
- Intel HEX and S-record images
- IL2CPP metadata
- Static JavaScript route inventory
- Linux kernel modules
- Kuna provider
- Model file declarations
- Match native functions across builds
- Node.js single executable applications
- PE Authenticode certificate tables
- PE import and delay-load tables
- PE TLS callbacks and load configuration
- Python packaged applications
- CPython pyc inspection
- Reconstruction coverage
- Reverse-engineering tool integrations
- Rust binary dependency metadata
- U-Boot legacy uImage containers
- UnityFS AssetBundle archives