morluto
5f702dd6cc
Normalize parsed facts at their owning boundaries across PE exports and certificates, ELF section names, GPU bundles, IL2CPP generic types, dyld slice selection, source maps, environment replay, and JavaScript mapped arguments. Preserve partial facts and explicit unsupported cases; clarify the corresponding documentation. Validation: 831 affected tests passed with one existing skip across 23 files; build, typecheck/lint, documentation, formatting, and 2133-file test discovery passed. Format controls are synthetic; real Unity, GPU, and ARM-device execution is unverified. Fixes #6709 Fixes #6688 Fixes #6719 Fixes #6718 Fixes #6704 Fixes #6703 Fixes #6692 Fixes #6723 Fixes #6687 Fixes #6726 Fixes #6696 Fixes #6691 Fixes #6727
2.6 KiB
ELF note tables
inspect_elf_notes / inspect-elf-notes answers whether one selected local
ELF32/ELF64 image declares PT_NOTE program headers or SHT_NOTE sections,
which note owners and types those tables store, and which GNU build-id or
ABI-tag fields those notes carry. It reads the file without executing it and
does not require a disassembler, debug package, or package catalog.
rea inspect-elf-notes /absolute/path/to/program --json
The CLI resolves relative paths against the caller's working directory. MCP requires an absolute filesystem path and preserves that exact selection:
{
"name": "inspect_elf_notes",
"arguments": { "path": "/artifacts/program" }
}
Observations
The inline Evidence result contains the artifact path, SHA-256, and byte length.
tables lists each declared note program header or section, including the
section name when a string table is present. Zlib-compressed section-name
tables are decompressed within the selected file-size budget. An unsupported
compression type leaves section names unknown and adds a limitation; note bytes
remain independently examined. Each entries[] item reports owner, type,
descriptor SHA-256, and a hex preview for descriptors of 64 bytes or less.
For GNU notes, gnu.build_id_hex, gnu.abi_tag, or gnu.gold_version are
filled when the descriptor matches that type. Other owners keep gnu null.
PT_NOTE and SHT_NOTE are examined independently. The same file range may
appear twice when both tables declare it.
A missing table list is observed absence of those declarations. It is not proof the image never carried notes in another container or overlay.
Limits and failures
The selected file is limited to 64 MiB by default (512 MiB maximum). At most
32 note entries are examined by default across every table. Retained note
names, section names, and GNU descriptor text share a scan budget based on
the source bytes plus any decoded section-name table, capped at
max_file_bytes. The raw source and decoded table must also fit together
within that ceiling; repeated table ranges count again. Each descriptor range is hashed once,
and each GNU version's trailing NUL run is scanned once; neither walk may
exceed that byte ceiling. Malformed ELF headers, truncated header
tables, declared note tables that extend past the file, and truncated
note entries fail without partial success. ELF extended
numbering (PN_XNUM, including a section count stored when e_shnum is 0) is
unsupported.
This workflow does not execute the image or verify GNU build-id uniqueness against package catalogs.