morluto
72e75e9a48
Keep malformed canonical devicetree phandles unresolved instead of falling back to legacy identities. Report the PE dynamic relocation offset and section at their exact source widths with Size-gated absence and zero preservation. Clarify classic kernel-module version coverage and byte-preserving string encoding. Validation: 158 focused parser, service, filesystem, and finalization regressions; 14 CLI/MCP tests; build, typecheck/lint, formatting, and docs checks passed. Fixtures establish parser behavior; no external analysis engines were exercised.
8.8 KiB
Linux kernel modules
inspect_kernel_module / inspect-kernel-module reads metadata from one
selected local ELF32/ELF64 relocatable object (.ko) without executing it.
That metadata is the .modinfo key/value strings, the __versions symbol
CRCs, the presence of .gnu.linkonce.this_module and __ksymtab* sections,
the observed file sizes of .init.text and .exit.text, and an optional
appended signature trailer. It does not require a Linux host or the modinfo
program.
rea inspect-kernel-module /absolute/path/to/module.ko --json
The CLI resolves relative paths against the caller's working directory. MCP requires an absolute filesystem path and preserves that exact selection:
{
"name": "inspect_kernel_module",
"arguments": { "path": "/artifacts/demo.ko" }
}
Observations
The inline Evidence result contains the artifact path, SHA-256, and byte
length. applicability is applicable only for ET_REL. Other ELF types are
not_applicable: header facts are filled and .modinfo, __versions, and
the signature trailer are not examined.
.modinfo entries stay in file order. Duplicate keys such as alias and
parm are preserved. Each entry keeps its key, value, file range, and
SHA-256. Values are the bytes after the first =. NUL padding between
strings is skipped. Keys and values use a byte-preserving Latin1 projection:
each source byte becomes the same-numbered Unicode code point. They are not
decoded as UTF-8. raw_sha256 hashes the original entry bytes, including its
terminating NUL when present; raw_hex shows those bytes when they fit the
inline limit.
__versions entries are struct modversion_info: a 64-byte record whose CRC
is an unsigned long and whose name occupies the remaining bytes. ELF32
stores a 32-bit CRC and a 60-byte name. ELF64 stores a 64-bit unsigned long
and a 56-byte name. CRCs are zero-padded lowercase hex, 8 or 16 characters,
not a JavaScript number. The layout is reported from the ELF class even when
the section is absent. Names use the same byte-preserving Latin1 projection
as .modinfo keys and values. Only this classic __versions layout is
decoded. versions.status: "absent" means no __versions section was found
when section names were complete; it does not establish the absence of version
metadata in __version_ext_names and __version_ext_crcs, which Linux uses
with CONFIG_EXTENDED_MODVERSIONS and this workflow does not decode.
.gnu.linkonce.this_module is reported as present, absent, or unknown.
layout is always unknown because struct module changes with the kernel
version and is not decoded. File-backed __ksymtab* sections are listed in
section-header order by name and file range; their records are not decoded.
Sections that are SHT_NOBITS or leave the file are counted in one limitation
without their names. .init.text and .exit.text report the
observed file-