dba8a31978
* feat(elf): inspect Linux kernel module metadata Adds inspect-kernel-module and inspect_kernel_module for ELF32/ELF64 ET_REL Linux kernel modules, read statically without executing them. Reports ordered .modinfo entries with duplicates preserved, __versions symbol CRCs, the presence of .gnu.linkonce.this_module and __ksymtab, .init.text and .exit.text sizes, and an appended module signature trailer with its PKCS#7 byte range and SHA-256. gzip, xz and zstd containers are reported unsupported with external decompression as the next probe. Malformed headers and exhausted entry budgets return no partial success. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * fix(elf): bound kernel module ksymtab listing and tighten contracts Charge listed __ksymtab* sections against max_entries, omit section names longer than 256 bytes with ksymtab_name_exceeds_limit, and aggregate the non-file-backed limitation so repeated huge names cannot inflate Evidence. Use fixedTupleSchema for the signature pad bytes with projection parity tests, and assert the late-cancellation reason and retained observation. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe * fix: resolve merge integration errors --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
122 lines
4.7 KiB
TypeScript
122 lines
4.7 KiB
TypeScript
import { defineConfig } from "vitepress";
|
|
|
|
export default defineConfig({
|
|
title: "REA",
|
|
description:
|
|
"Reverse engineer binaries, applications, and runtime behavior with one CLI and MCP server.",
|
|
lang: "en-US",
|
|
base: "/rea/",
|
|
srcExclude: ["readme/**"],
|
|
themeConfig: {
|
|
nav: [
|
|
{ text: "Get started", link: "/installation" },
|
|
{ text: "Reference", link: "/mcp-contracts" },
|
|
{ text: "Roadmap", link: "/roadmap" },
|
|
],
|
|
sidebar: [
|
|
{
|
|
text: "Getting started",
|
|
items: [
|
|
{ text: "Installation and setup", link: "/installation" },
|
|
{ text: "Client configuration", link: "/client-configuration" },
|
|
{ text: "CLI and Evidence", link: "/cli" },
|
|
{ text: "Agent prompts", link: "/mcp-prompts" },
|
|
{ text: "Roadmap", link: "/roadmap" },
|
|
],
|
|
},
|
|
{
|
|
text: "Investigation guides",
|
|
items: [
|
|
{ text: "Native binaries", link: "/native-investigation" },
|
|
{ text: "Go build metadata", link: "/go-binaries" },
|
|
{ text: "IL2CPP metadata", link: "/il2cpp-metadata" },
|
|
{ text: "Model artifacts", link: "/model-artifacts" },
|
|
{ text: "Rust dependencies", link: "/rust-binaries" },
|
|
{ text: "PE certificates", link: "/pe-certificates" },
|
|
{ text: "PE imports", link: "/pe-imports" },
|
|
{ text: "PE TLS/load config", link: "/pe-load-config" },
|
|
{ text: "ELF notes", link: "/elf-notes" },
|
|
{ text: "Apple IPS crash reports", link: "/apple-ips" },
|
|
{ text: "Linux kernel modules", link: "/kernel-modules" },
|
|
{ text: "CPython pyc files", link: "/python-pyc" },
|
|
{ text: "Erlang BEAM", link: "/erlang-beam" },
|
|
{
|
|
text: "JavaScript and Electron",
|
|
link: "/javascript-artifact-reconstruction",
|
|
},
|
|
{
|
|
text: "JavaScript workflows",
|
|
link: "/javascript-application-workflows",
|
|
},
|
|
{ text: "Browser observation", link: "/browser-observation" },
|
|
{
|
|
text: "Web network captures",
|
|
link: "/web-network-captures",
|
|
},
|
|
{ text: "Agent environments", link: "/agent-environments" },
|
|
{ text: "Electron observation", link: "/electron-observation" },
|
|
{ text: "Electron fuses", link: "/electron-fuses" },
|
|
{ text: "Process capture", link: "/process-capture" },
|
|
{ text: ".NET assemblies", link: "/managed-code-analysis" },
|
|
{
|
|
text: "Python packaged applications",
|
|
link: "/python-packaged-applications",
|
|
},
|
|
{ text: "Android applications", link: "/android-analysis" },
|
|
{ text: "Apple applications", link: "/apple-application-analysis" },
|
|
{ text: "Desktop installations", link: "/desktop-applications" },
|
|
{ text: "Firmware", link: "/firmware-analysis" },
|
|
{ text: "SQLite databases", link: "/sqlite-databases" },
|
|
{ text: "Packet captures", link: "/packet-captures" },
|
|
{ text: "Signal recordings", link: "/signal-recordings" },
|
|
],
|
|
},
|
|
{
|
|
text: "Provider guides",
|
|
collapsed: true,
|
|
items: [
|
|
{ text: "IDA", link: "/ida-provider" },
|
|
{ text: "Kuna", link: "/kuna-provider" },
|
|
{ text: "Ghidra on Windows", link: "/windows-ghidra-p0" },
|
|
{ text: "Ghidra DOS analysis", link: "/ghidra-dos" },
|
|
{ text: "Ghidra raw binary", link: "/raw-binary" },
|
|
{ text: "Ghidra NativeAOT", link: "/ghidra-nativeaot" },
|
|
{ text: "Ghidra PowerPC", link: "/ghidra-ppc" },
|
|
{ text: "Ghidra GameCube DOL", link: "/ghidra-dol" },
|
|
{ text: "Ghidra semantics", link: "/ghidra-provider" },
|
|
],
|
|
},
|
|
{
|
|
text: "Reference and development",
|
|
collapsed: true,
|
|
items: [
|
|
{ text: "MCP contracts", link: "/mcp-contracts" },
|
|
{ text: "Tool design", link: "/tool-design" },
|
|
{
|
|
text: "Admission limits and recovery",
|
|
link: "/design/limits-and-recovery",
|
|
},
|
|
{ text: "Testing", link: "/testing" },
|
|
{ text: "Client verification", link: "/client-verification" },
|
|
{
|
|
text: "Reconstruction readiness",
|
|
link: "/reconstruction-readiness",
|
|
},
|
|
{ text: "Releasing", link: "/releasing" },
|
|
],
|
|
},
|
|
],
|
|
search: { provider: "local" },
|
|
socialLinks: [
|
|
{ icon: "github", link: "https://github.com/morluto/rea" },
|
|
{ icon: "discord", link: "https://discord.gg/GkcryMnJDM" },
|
|
],
|
|
editLink: {
|
|
pattern: "https://github.com/morluto/rea/edit/main/docs/:path",
|
|
},
|
|
footer: {
|
|
message: "Released under the MIT License.",
|
|
},
|
|
},
|
|
});
|