N0zoM1z0
a6a8f67649
* feat(ghidra): verify DOS load images and expose memory evidence Verify measured source bytes, mapped regions, fixups and entries against the immutable MZ snapshot, retaining independent checks and raw evidence. Expose loaded byte reads and authoritative original file offsets through both CLI and MCP, with focused and actual Ghidra DOS verification. Assisted-by: Nitori (gensokyo-skills:nitori-reverse-engineering) * fix(cli): describe memory inspection arguments * test(ghidra): align bridge fixtures and CLI capability accounting
153 lines
5.4 KiB
TypeScript
153 lines
5.4 KiB
TypeScript
/** Canonical names used by every one-shot CLI command registration. */
|
|
export const CLI_COMMANDS = Object.freeze({
|
|
analyze: "analyze",
|
|
inspect: "inspect",
|
|
decompile: "decompile",
|
|
setup: "setup",
|
|
doctor: "doctor",
|
|
uninstall: "uninstall",
|
|
update: "update",
|
|
xrefs: "xrefs",
|
|
trace: "trace",
|
|
traceNativeUiAction: "trace-native-ui-action",
|
|
inspectNativeDispatchMetadata: "inspect-native-dispatch-metadata",
|
|
capabilities: "capabilities",
|
|
providers: "providers",
|
|
function: "function",
|
|
inspectNativeApi: "inspect-native-api",
|
|
instructions: "instructions",
|
|
search: "search",
|
|
importReferenceSource: "import-reference-source",
|
|
inspectArtifact: "inspect-artifact",
|
|
extractArtifact: "extract-artifact",
|
|
decodeInterfaceBuilder: "decode-interface-builder",
|
|
inspectKeyedArchive: "inspect-keyed-archive",
|
|
inspectNativeDataType: "inspect-native-data-type",
|
|
inspectNativeLoadImage: "inspect-native-load-image",
|
|
readBytes: "read-bytes",
|
|
addressToFileOffset: "address-to-file-offset",
|
|
traceNativeValues: "trace-native-values",
|
|
inspectNativeInstruction: "inspect-native-instruction",
|
|
resolveNativeCallTargets: "resolve-native-call-targets",
|
|
inspectAssetCatalog: "inspect-asset-catalog",
|
|
inspectManagedArtifact: "inspect-managed-artifact",
|
|
inspectManagedMembers: "inspect-managed-members",
|
|
inspectManagedNativeBoundaries: "inspect-managed-native-boundaries",
|
|
compareManagedMembers: "compare-managed-members",
|
|
verifyManagedNativeBoundaries: "verify-managed-native-boundaries",
|
|
importManagedReconstruction: "import-managed-reconstruction",
|
|
projectManagedApplicationGraph: "project-managed-application-graph",
|
|
observeNativeUi: "observe-native-ui",
|
|
captureNativeUiScenario: "capture-native-ui-scenario",
|
|
inspectMacho: "inspect-macho",
|
|
inspectSignature: "inspect-signature",
|
|
listArchitectures: "list-architectures",
|
|
inspectPlist: "inspect-plist",
|
|
demangleSwift: "demangle-swift",
|
|
evidenceImport: "evidence-import",
|
|
evidenceExport: "evidence-export",
|
|
compare: "compare",
|
|
captureProcess: "capture-process",
|
|
compareProcessCaptures: "compare-process-captures",
|
|
listBrowserTargets: "list-browser-targets",
|
|
inspectWebPage: "inspect-web-page",
|
|
analyzeWebBundle: "analyze-web-bundle",
|
|
observeWebSession: "observe-web-session",
|
|
discoverWebMcpTools: "discover-webmcp-tools",
|
|
compareWebCaptures: "compare-web-captures",
|
|
captureWebScreenshot: "capture-web-screenshot",
|
|
compareWebScreenshots: "compare-web-screenshots",
|
|
captureBrowserScenario: "capture-browser-scenario",
|
|
listElectronTargets: "list-electron-targets",
|
|
inspectElectronPage: "inspect-electron-page",
|
|
captureElectronScenario: "capture-electron-scenario",
|
|
listJavaScriptRuntimeTargets: "list-javascript-runtime-targets",
|
|
observeJavaScriptRuntime: "observe-javascript-runtime",
|
|
analyzeJavaScriptApplication: "analyze-javascript-application",
|
|
reconcileJavaScriptRuntime: "reconcile-javascript-runtime",
|
|
traceApplicationFeature: "trace-application-feature",
|
|
traceJavaScriptSemantics: "trace-javascript-semantics",
|
|
compareApplicationVersions: "compare-application-versions",
|
|
compareSourceToBundle: "compare-source-to-bundle",
|
|
compareJavaScriptExportShapes: "compare-javascript-export-shapes",
|
|
buildReconstructionObligationLedger: "build-reconstruction-obligation-ledger",
|
|
evaluateReconstructionCoverage: "evaluate-reconstruction-coverage",
|
|
});
|
|
|
|
/** Ordered primary CLI inventory; aliases are intentionally excluded. */
|
|
export const CLI_COMMAND_NAMES = Object.freeze(Object.values(CLI_COMMANDS));
|
|
|
|
/** Command aliases registered on top of the primary CLI command inventory. */
|
|
export const CLI_COMMAND_ALIASES = Object.freeze(["compare-bundles"]);
|
|
|
|
/** Canonical MCP operations reached by CLI commands with different names. */
|
|
export const CLI_COMMAND_TOOL_ALIASES = Object.freeze({
|
|
analyze: ["binary_overview"],
|
|
inspect: ["binary_overview"],
|
|
decompile: ["procedure_pseudo_code"],
|
|
function: ["analyze_function"],
|
|
instructions: ["read_function_instructions"],
|
|
trace: ["trace_feature"],
|
|
search: ["search_strings", "search_procedures"],
|
|
"capture-process": ["capture_process_scenario"],
|
|
"compare-bundles": ["compare_bundles"],
|
|
});
|
|
|
|
/** MCP operations without a dedicated CLI command or direct command alias. */
|
|
export const MCP_TOOLS_WITHOUT_DEDICATED_CLI = Object.freeze([
|
|
"address_name",
|
|
"comment",
|
|
"current_address",
|
|
"current_procedure",
|
|
"current_document",
|
|
"goto_address",
|
|
"inline_comment",
|
|
"list_bookmarks",
|
|
"list_documents",
|
|
"list_names",
|
|
"list_procedures",
|
|
"list_segments",
|
|
"list_strings",
|
|
"next_address",
|
|
"prev_address",
|
|
"procedure_address",
|
|
"procedure_assembly",
|
|
"procedure_callees",
|
|
"procedure_callers",
|
|
"procedure_info",
|
|
"procedure_references",
|
|
"resolve_containing_procedure",
|
|
"set_address_name",
|
|
"set_addresses_names",
|
|
"set_bookmark",
|
|
"set_comment",
|
|
"set_current_document",
|
|
"set_inline_comment",
|
|
"unset_bookmark",
|
|
"get_objc_classes",
|
|
"get_objc_protocols",
|
|
"batch_decompile",
|
|
"get_call_graph",
|
|
"analyze_swift_types",
|
|
"find_xrefs_to_name",
|
|
"trace_call_path",
|
|
"open_binary",
|
|
"close_binary",
|
|
"binary_session",
|
|
"export_evidence_bundle",
|
|
"import_evidence_bundle",
|
|
"compare_artifacts",
|
|
"compare_functions",
|
|
"find_changed_behavior",
|
|
"build_call_path",
|
|
"correlate_static_and_runtime",
|
|
"verify_reconstruction",
|
|
"list_unknowns",
|
|
"record_unknown",
|
|
"update_unknown",
|
|
"verify_unknown_resolution",
|
|
"get_evidence_bundle",
|
|
"get_navigation_context",
|
|
"inspect_address_context",
|
|
]);
|