4ef916da03
* feat(pe): inspect import and delay-load tables Add inspect_pe_imports / inspect-pe-imports to read PE32/PE32+ import and delay-load directories without executing the image. The report keeps DLL names, named and ordinal functions, ILT/IAT RVAs, and a pefile import hash of the standard import table. A missing directory is observed absence, not proof the image never imported APIs. * fix(pe): default PE import fixture options Allow peImportImage() without an argument so CLI and filesystem tests can use the KERNEL32 sample without repeating an empty options object. * test(pe): keep import path cases on the dedicated MCP contract inspect_pe_imports already rejects relative MCP paths in its own boundary test. Leave the shared absolute-path matrix to tools whose handler issue projection matches that suite's expected shape. * fix(native): index virtual-to-file mapping lookups mappedFileOffset scans every mapping twice per span, so a parser that translates one span per table entry costs sections x entries. Add fileMappingLookup, which builds an O(n log n) interval index once and answers each span in O(log n) with the same accept, reject and translation results. A differential test checks it against mappedFileOffset over randomized overlapping mappings and zero fills. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(pe): report partial import evidence and exact pefile hashes - Withhold imphash with an explicit reason whenever the standard import table is partial (unreadable names or thunks, missing tables), or when pefile 2024.8.26 would hash a different row sequence: invalid or truncated names, ordinal 0, descriptors without functions, tables its bounds or repeat/spread heuristics discard, and its 8192-thunk import symbol cap. Delay-load issues do not withhold it. - Hash ordinal imports with pefile's complete ordlookup tables and its ord<decimal> fallback instead of declining unmapped ordinals. - Report a nonterminal descriptor whose FirstThunk is zero, and a delay-load descriptor whose IAT or INT RVA is zero, as malformed_entry partial coverage instead of a complete empty inventory. - Directory evidence lists the file spans actually consumed for the descriptor array and terminator; discontiguous mappings produce separate spans and separate Evidence ranges. - Carry exhausted limits as PeImportLimitFailure.limit and derive recovery from it; the fixed 16 MiB retained-text ceiling reports a fixed allowance instead of max_file_bytes advice. - Translate RVAs through the indexed mapping lookup and yield with a cancellation check every 1024 table entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(pe): read only own ordinal tables for DLL names DLL names such as constructor and __proto__ pass pefile's name rule but resolved inherited object members, throwing before the ord<n> fallback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(native): preserve PE import facts and prove hash compatibility * test(native): verify PE import workflows and measured costs * refactor(native): narrow PE facts across the container union * docs(native): record integrated PE import validation * fix(native): bound every PE import RVA span * docs(native): measure RVA guard completed workflows * fix(pe): reconcile import coverage with retained rows * fix(pe): retain partial imports at descriptor mapping gaps --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
118 lines
4.5 KiB
TypeScript
118 lines
4.5 KiB
TypeScript
import { defineConfig } from "vitepress";
|
|
|
|
export default defineConfig({
|
|
title: "REA",
|
|
description:
|
|
"Reverse engineer binaries, applications, and runtime behavior with one CLI and MCP server.",
|
|
lang: "en-US",
|
|
base: "/rea/",
|
|
srcExclude: ["readme/**"],
|
|
themeConfig: {
|
|
nav: [
|
|
{ text: "Get started", link: "/installation" },
|
|
{ text: "Reference", link: "/mcp-contracts" },
|
|
{ text: "Roadmap", link: "/roadmap" },
|
|
],
|
|
sidebar: [
|
|
{
|
|
text: "Getting started",
|
|
items: [
|
|
{ text: "Installation and setup", link: "/installation" },
|
|
{ text: "Client configuration", link: "/client-configuration" },
|
|
{ text: "CLI and Evidence", link: "/cli" },
|
|
{ text: "Agent prompts", link: "/mcp-prompts" },
|
|
{ text: "Roadmap", link: "/roadmap" },
|
|
],
|
|
},
|
|
{
|
|
text: "Investigation guides",
|
|
items: [
|
|
{ text: "Native binaries", link: "/native-investigation" },
|
|
{ text: "Go build metadata", link: "/go-binaries" },
|
|
{ text: "IL2CPP metadata", link: "/il2cpp-metadata" },
|
|
{ text: "Model artifacts", link: "/model-artifacts" },
|
|
{ text: "Rust dependencies", link: "/rust-binaries" },
|
|
{ text: "PE certificates", link: "/pe-certificates" },
|
|
{ text: "PE imports", link: "/pe-imports" },
|
|
{ text: "ELF notes", link: "/elf-notes" },
|
|
{ text: "CPython pyc files", link: "/python-pyc" },
|
|
{ text: "Erlang BEAM", link: "/erlang-beam" },
|
|
{
|
|
text: "JavaScript and Electron",
|
|
link: "/javascript-artifact-reconstruction",
|
|
},
|
|
{
|
|
text: "JavaScript workflows",
|
|
link: "/javascript-application-workflows",
|
|
},
|
|
{ text: "Browser observation", link: "/browser-observation" },
|
|
{
|
|
text: "Web network captures",
|
|
link: "/web-network-captures",
|
|
},
|
|
{ text: "Agent environments", link: "/agent-environments" },
|
|
{ text: "Electron observation", link: "/electron-observation" },
|
|
{ text: "Electron fuses", link: "/electron-fuses" },
|
|
{ text: "Process capture", link: "/process-capture" },
|
|
{ text: ".NET assemblies", link: "/managed-code-analysis" },
|
|
{
|
|
text: "Python packaged applications",
|
|
link: "/python-packaged-applications",
|
|
},
|
|
{ text: "Android applications", link: "/android-analysis" },
|
|
{ text: "Apple applications", link: "/apple-application-analysis" },
|
|
{ text: "Desktop installations", link: "/desktop-applications" },
|
|
{ text: "Firmware", link: "/firmware-analysis" },
|
|
{ text: "SQLite databases", link: "/sqlite-databases" },
|
|
{ text: "Packet captures", link: "/packet-captures" },
|
|
{ text: "Signal recordings", link: "/signal-recordings" },
|
|
],
|
|
},
|
|
{
|
|
text: "Provider guides",
|
|
collapsed: true,
|
|
items: [
|
|
{ text: "IDA", link: "/ida-provider" },
|
|
{ text: "Kuna", link: "/kuna-provider" },
|
|
{ text: "Ghidra on Windows", link: "/windows-ghidra-p0" },
|
|
{ text: "Ghidra DOS analysis", link: "/ghidra-dos" },
|
|
{ text: "Ghidra raw binary", link: "/raw-binary" },
|
|
{ text: "Ghidra NativeAOT", link: "/ghidra-nativeaot" },
|
|
{ text: "Ghidra PowerPC", link: "/ghidra-ppc" },
|
|
{ text: "Ghidra semantics", link: "/ghidra-provider" },
|
|
],
|
|
},
|
|
{
|
|
text: "Reference and development",
|
|
collapsed: true,
|
|
items: [
|
|
{ text: "MCP contracts", link: "/mcp-contracts" },
|
|
{ text: "Tool design", link: "/tool-design" },
|
|
{
|
|
text: "Admission limits and recovery",
|
|
link: "/design/limits-and-recovery",
|
|
},
|
|
{ text: "Testing", link: "/testing" },
|
|
{ text: "Client verification", link: "/client-verification" },
|
|
{
|
|
text: "Reconstruction readiness",
|
|
link: "/reconstruction-readiness",
|
|
},
|
|
{ text: "Releasing", link: "/releasing" },
|
|
],
|
|
},
|
|
],
|
|
search: { provider: "local" },
|
|
socialLinks: [
|
|
{ icon: "github", link: "https://github.com/morluto/rea" },
|
|
{ icon: "discord", link: "https://discord.gg/GkcryMnJDM" },
|
|
],
|
|
editLink: {
|
|
pattern: "https://github.com/morluto/rea/edit/main/docs/:path",
|
|
},
|
|
footer: {
|
|
message: "Released under the MIT License.",
|
|
},
|
|
},
|
|
});
|