mirror of
https://github.com/morluto/rea.git
synced 2026-11-13 18:22:42 +00:00
* feat(elf): inspect Linux kernel module metadata Adds inspect-kernel-module and inspect_kernel_module for ELF32/ELF64 ET_REL Linux kernel modules, read statically without executing them. Reports ordered .modinfo entries with duplicates preserved, __versions symbol CRCs, the presence of .gnu.linkonce.this_module and __ksymtab, .init.text and .exit.text sizes, and an appended module signature trailer with its PKCS#7 byte range and SHA-256. gzip, xz and zstd containers are reported unsupported with external decompression as the next probe. Malformed headers and exhausted entry budgets return no partial success. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * fix(elf): bound kernel module ksymtab listing and tighten contracts Charge listed __ksymtab* sections against max_entries, omit section names longer than 256 bytes with ksymtab_name_exceeds_limit, and aggregate the non-file-backed limitation so repeated huge names cannot inflate Evidence. Use fixedTupleSchema for the signature pad bytes with projection parity tests, and assert the late-cancellation reason and retained observation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * fix: resolve merge integration errors --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
21 lines
648 B
TypeScript
21 lines
648 B
TypeScript
import type {
|
|
ExecutionOptions,
|
|
ProviderIdentity,
|
|
} from "../AnalysisProvider.js";
|
|
import type { AnalysisError } from "../../domain/analysisErrorBase.js";
|
|
import type {
|
|
InspectKernelModuleInput,
|
|
KernelModule,
|
|
} from "../../domain/native/kernelModule.js";
|
|
import type { Result } from "../../domain/result.js";
|
|
|
|
/** Stable read and kernel-module metadata decoding, independent of a disassembler session. */
|
|
export interface KernelModulePort {
|
|
readonly identity: ProviderIdentity;
|
|
close?(): Promise<void>;
|
|
inspect(
|
|
input: InspectKernelModuleInput,
|
|
options?: ExecutionOptions,
|
|
): Promise<Result<KernelModule, AnalysisError>>;
|
|
}
|