@eyeauras/insight-cli 0.0.0-stage → 0.2.0

package/references/native/InsightApplyDocumentation.java

@@ -0,0 +1,48 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.app.util.parser.FunctionSignatureParser;
+import ghidra.program.model.data.DataType;
+import ghidra.program.model.listing.CodeUnit;
+import ghidra.program.model.symbol.SourceType;
+import com.google.gson.*;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+/** Apply typed documentation without the pinned endpoint's regex parsing/silent skips. */
+public class InsightApplyDocumentation extends GhidraScript {
+  String value(JsonObject object,String key){return object.has(key)&&!object.get(key).isJsonNull()?object.get(key).getAsString():"";}
+  DataType resolve(String name)throws Exception{
+    return new FunctionSignatureParser(currentProgram.getDataTypeManager(),null).parse(null,name+" __insight_resolve(void)").getReturnType();
+  }
+  public void run()throws Exception {
+    JsonObject document=JsonParser.parseString(new String(Base64.getDecoder().decode(getScriptArgs()[0]),StandardCharsets.UTF_8)).getAsJsonObject();
+    var at=toAddr(value(document,"target_address"));if(at==null)throw new IllegalArgumentException("Invalid target address");
+    var function=currentProgram.getFunctionManager().getFunctionAt(at);if(function==null)throw new IllegalArgumentException("Function missing");
+    int transaction=currentProgram.startTransaction("Apply typed documentation");boolean committed=false;
+    try {
+      String name=value(document,"function_name"),result=value(document,"return_type"),convention=value(document,"calling_convention"),plate=value(document,"plate_comment");
+      if(!name.isEmpty())function.setName(name,SourceType.USER_DEFINED);
+      if(!convention.isEmpty())function.setCallingConvention(convention);
+      if(!result.isEmpty())function.setReturnType(resolve(result),SourceType.USER_DEFINED);
+      if(!plate.isEmpty())function.setComment(plate);
+      if(document.has("parameters"))for(JsonElement raw:document.getAsJsonArray("parameters")) {
+        JsonObject parameter=raw.getAsJsonObject();int ordinal=parameter.get("ordinal").getAsInt();var params=function.getParameters();
+        if(ordinal<0||ordinal>=params.length)throw new IllegalArgumentException("Parameter ordinal missing");
+        String requestedName=value(parameter,"name"),requestedType=value(parameter,"type");
+        if(!requestedName.isEmpty())params[ordinal].setName(requestedName,SourceType.USER_DEFINED);
+        if(!requestedType.isEmpty())params[ordinal].setDataType(resolve(requestedType),SourceType.USER_DEFINED);
+      }
+      if(document.has("comments"))for(JsonElement raw:document.getAsJsonArray("comments")) {
+        JsonObject comment=raw.getAsJsonObject();long offset=comment.get("relative_offset").getAsLong();if(offset<0)throw new IllegalArgumentException("Negative comment offset");
+        var address=at.add(offset);var unit=currentProgram.getListing().getCodeUnitAt(address);if(unit==null)throw new IllegalArgumentException("Comment code unit missing");
+        for(String kind:new String[]{"eol_comment","pre_comment"})if(comment.has(kind)&&!value(comment,kind).isEmpty())
+          unit.setComment(kind.equals("eol_comment")?CodeUnit.EOL_COMMENT:CodeUnit.PRE_COMMENT,value(comment,kind));
+      }
+      if(document.has("labels"))for(JsonElement raw:document.getAsJsonArray("labels")) {
+        JsonObject label=raw.getAsJsonObject();long offset=label.get("relative_offset").getAsLong();if(offset<0)throw new IllegalArgumentException("Negative label offset");
+        String labelName=value(label,"name");if(labelName.isEmpty())throw new IllegalArgumentException("Label name missing");
+        currentProgram.getSymbolTable().createLabel(at.add(offset),labelName,SourceType.USER_DEFINED);
+      }
+      committed=true;println("insight-documentation:completed");
+    }finally{currentProgram.endTransaction(transaction,committed);}
+  }
+}

package/references/native/InsightArchivePayloads.java

@@ -0,0 +1,36 @@
+import com.google.gson.*;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.listing.*;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+
+/** Build the pinned archive contract without networking or archive credentials in the JVM. */
+public class InsightArchivePayloads extends GhidraScript {
+  @Override public void run() throws Exception {
+    JsonObject p=JsonParser.parseString(new String(Base64.getDecoder().decode(getScriptArgs()[0]),StandardCharsets.UTF_8)).getAsJsonObject();
+    Class<?> service=Class.forName("com.xebyte.core.DocumentationHashService");
+    Object instance=service.getConstructors()[0].newInstance(new Object[]{null,null,null});
+    var build=service.getDeclaredMethod("buildArchivePayload",Program.class,Function.class,String.class,String.class,String.class);build.setAccessible(true);
+    var defaults=service.getDeclaredMethod("isDefaultSymbolName",String.class);defaults.setAccessible(true);
+    int offset=p.get("offset").getAsInt(),limit=p.get("limit").getAsInt();
+    if(offset<0||limit<1||limit>100)throw new IllegalArgumentException();
+    List<Object> rows=new ArrayList<>();int visited=0,skipped=0;boolean more=false;
+    Iterable<Function> functions=currentProgram.getFunctionManager().getFunctions(true);
+    if(p.has("function")){
+      var address=currentProgram.getAddressFactory().getAddress(p.get("function").getAsString());
+      var function=address==null?null:currentProgram.getFunctionManager().getFunctionAt(address);
+      if(function==null)throw new IllegalArgumentException("No function at the selected address");functions=List.of(function);
+    }
+    for(var function:functions){
+      if(visited++<offset)continue;
+      if(rows.size()+skipped>=limit){more=true;visited--;break;}
+      if(p.get("skip_default_named").getAsBoolean()&&(Boolean)defaults.invoke(null,function.getName())){skipped++;continue;}
+      Object payload=build.invoke(instance,currentProgram,function,p.get("binary_name").getAsString(),p.get("version").getAsString(),p.get("run_id").getAsString());
+      if(new Gson().toJson(payload).getBytes(StandardCharsets.UTF_8).length>262144)throw new IllegalArgumentException("Function archive payload exceeds 256 KiB");
+      rows.add(payload);
+    }
+    var result=Map.of("payloads",rows,"visited",Math.min(limit,Math.max(0,visited-offset)),"skipped",skipped,"more",more);
+    String json=new Gson().toJson(result);if(json.getBytes(StandardCharsets.UTF_8).length>786432)throw new IllegalArgumentException("Archive page exceeds 768 KiB; reduce the page size");
+    println("INSIGHT_ARCHIVE_PAYLOADS "+json);
+  }
+}

package/references/native/InsightBlockTransfer.java

@@ -0,0 +1,57 @@
+package db.buffers;
+
+import java.io.IOException;
+import java.util.TreeSet;
+import java.util.Arrays;
+import java.nio.ByteBuffer;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.HexFormat;
+
+/** Pinned native block-stream protocol; avoids RMI serialization of DataBuffer objects. */
+public class InsightBlockTransfer {
+  /** Exact live DB buffers/parameters; ignores physical headers and unused free allocation. */
+  public static String fingerprint(BufferFile file) throws Exception {
+    MessageDigest hash=MessageDigest.getInstance("SHA-256");
+    String[] parameters=file.getParameterNames();Arrays.sort(parameters);
+    for(String name:parameters) {
+      byte[] key=name.getBytes(StandardCharsets.UTF_8);
+      hash.update(ByteBuffer.allocate(4).putInt(key.length).array());hash.update(key);
+      hash.update(ByteBuffer.allocate(4).putInt(file.getParameter(name)).array());
+    }
+    TreeSet<Integer> free=new TreeSet<>();for(int index:file.getFreeIndexes())free.add(index);
+    InputBlockStream stream=file instanceof LocalBufferFile local?local.getInputBlockStream():
+      file instanceof BufferFileAdapter remote?remote.getInputBlockStream():null;
+    if(stream==null)throw new IOException("Unsupported saved buffer protocol");
+    try(InputBlockStream input=stream) {
+      BufferFileBlock block;int previous=-1;
+      while((block=input.readBlock())!=null) {
+        if(block.getIndex()<=previous)throw new IOException("Saved block stream order is inconsistent");previous=block.getIndex();
+        if(block.getIndex()==0||free.contains(block.getIndex()-1))continue;
+        hash.update(ByteBuffer.allocate(4).putInt(block.getIndex()).array());hash.update(block.getData());
+      }
+    }
+    return HexFormat.of().formatHex(hash.digest());
+  }
+  public static void copy(LocalBufferFile source, ManagedBufferFile destination) throws Exception {
+    if (!(destination instanceof BufferFileAdapter remote)) throw new IOException("Expected remote save buffer");
+    try (InputBlockStream input=source.getInputBlockStream()) {
+      boolean header=input.includesHeaderBlock();
+      int expected=input.getBlockCount()-(header?1:0), written=0;
+      try (OutputBlockStream output=remote.getOutputBlockStream(expected)) {
+        BufferFileBlock block;
+        while((block=input.readBlock())!=null) {
+          if(header && block.getIndex()==0) continue;
+          output.writeBlock(block); written++;
+        }
+      }
+      if(written!=expected) throw new IOException("Incomplete block transfer");
+    }
+    destination.clearParameters();
+    for(String name:source.getParameterNames()) destination.setParameter(name,source.getParameter(name));
+    TreeSet<Integer> free=new TreeSet<>();
+    for(int index:source.getFreeIndexes()) free.add(index);
+    for(int index=source.getIndexCount();index<destination.getIndexCount();index++) free.add(index);
+    destination.setFreeIndexes(free.stream().mapToInt(Integer::intValue).toArray());
+  }
+}

package/references/native/InsightEmulation.java

@@ -0,0 +1,93 @@
+import ghidra.app.script.GhidraScript;
+import ghidra.app.emulator.EmulatorHelper;
+import ghidra.program.model.address.*;
+import ghidra.program.model.listing.*;
+import ghidra.program.model.lang.Register;
+import ghidra.program.model.data.*;
+import com.google.gson.*;
+import java.nio.*;
+import java.nio.charset.*;
+import java.math.BigInteger;
+import java.util.*;
+
+/** Isolated instruction stepping. No writes to Program memory, no external process execution. */
+public class InsightEmulation extends GhidraScript {
+  JsonObject p;String abi;int bits,maxSteps;long deadline;int totalSteps;final long stackTop=0x7fff0000L,sentinel=0x7ffd0000L,scratch=0x7ffc0000L;
+  Map<String,Object> map(Object... pairs){Map<String,Object> out=new LinkedHashMap<>();for(int i=0;i<pairs.length;i+=2)out.put((String)pairs[i],pairs[i+1]);return out;}
+  String str(String name,String fallback){return !p.has(name)||p.get(name).isJsonNull()?fallback:p.get(name).getAsString();}
+  int number(String name,int fallback,int min,int max){int value=p.has(name)?p.get(name).getAsInt():fallback;if(value<min||value>max)throw new IllegalArgumentException(name+" outside supported range");return value;}
+  JsonElement json(String name){if(!p.has(name)||p.get(name).isJsonNull()||p.get(name).isJsonPrimitive()&&p.get(name).getAsString().isEmpty())return JsonNull.INSTANCE;var value=p.get(name);return value.isJsonPrimitive()?JsonParser.parseString(value.getAsString()):value;}
+  Address at(String value){var address=currentProgram.getAddressFactory().getAddress(value);if(address==null)throw new IllegalArgumentException("Invalid emulation address");return address;}
+  Address absolute(long value){return currentProgram.getAddressFactory().getDefaultAddressSpace().getAddress(value);}
+  Function function(String value)throws Exception{Function found=null;try{found=currentProgram.getFunctionManager().getFunctionAt(at(value));}catch(Exception ignored){}if(found!=null)return found;
+    var iter=currentProgram.getFunctionManager().getFunctions(true);int visited=0;while(iter.hasNext()){if(++visited>100000||System.nanoTime()>deadline)throw new IllegalArgumentException("Function lookup budget exceeded; use entry address");var f=iter.next();if(f.getName().equals(value)||f.getName(true).equals(value)){if(found!=null)throw new IllegalArgumentException("Ambiguous function");found=f;}}if(found==null)throw new IllegalArgumentException("Function not found");return found;}
+  BigInteger integer(String input){String value=input.trim();return value.startsWith("0x")||value.startsWith("0X")?new BigInteger(value.substring(2),16):new BigInteger(value);}
+  String hex(BigInteger value){return "0x"+value.toString(16);}
+  void policy(){
+    bits=currentProgram.getLanguage().getLanguageDescription().getSize();
+    if(!currentProgram.getLanguage().getProcessor().toString().equalsIgnoreCase("x86")||currentProgram.getLanguage().isBigEndian()||!List.of(32,64).contains(bits))throw new UnsupportedOperationException("Emulation supports little-endian x86 32/64 only; this language is unsupported");
+    String selected=str("abi","auto"),compiler=currentProgram.getCompilerSpec().getCompilerSpecID().toString();
+    abi=selected.equals("auto")?(bits==32?"x86-cdecl":List.of("windows","clangwindows").contains(compiler)?"windows-x64":"sysv-x64"):selected;
+    if(bits==32&&!abi.equals("x86-cdecl")||bits==64&&!List.of("windows-x64","sysv-x64").contains(abi))throw new UnsupportedOperationException("ABI does not match supported language/width");
+    if(selected.equals("auto")&&!List.of("windows","clangwindows","gcc","clang","default").contains(compiler))throw new UnsupportedOperationException("Compiler ABI is unknown; select an explicit supported --abi");
+    if(currentProgram.getMemory().intersects(absolute(stackTop-65536),absolute(stackTop+256)))throw new UnsupportedOperationException("Reserved ABI stack overlaps program memory");
+    for(long base:new long[]{sentinel,scratch})if(currentProgram.getMemory().intersects(absolute(base),absolute(base+65535)))throw new UnsupportedOperationException("Reserved emulation stack/sentinel/scratch overlaps program memory");
+    maxSteps=number("max_steps",10000,1,100000);number("timeout_seconds",5,1,30);
+  }
+  void registers(EmulatorHelper emu,JsonElement raw){if(raw.isJsonNull())return;if(!raw.isJsonObject())throw new IllegalArgumentException("Registers must be an object");for(var entry:raw.getAsJsonObject().entrySet()){
+    Register register=currentProgram.getRegister(entry.getKey());if(register==null||register.getBitLength()>64)throw new IllegalArgumentException("Unknown or unsupported register");
+    if(register.getBaseRegister().equals(emu.getPCRegister().getBaseRegister())||register.getBaseRegister().equals(emu.getStackPointerRegister().getBaseRegister()))throw new IllegalArgumentException("PC and SP are owned by the selected emulation ABI");
+    BigInteger value=integer(entry.getValue().getAsString());if(value.signum()<0||value.bitLength()>register.getBitLength())throw new IllegalArgumentException("Register value exceeds its unsigned width");emu.writeRegister(register,value);
+  }}
+  void memory(EmulatorHelper emu,JsonElement raw){if(raw.isJsonNull())return;if(raw.isJsonObject()&&raw.getAsJsonObject().has("regions"))raw=raw.getAsJsonObject().get("regions");if(!raw.isJsonArray()||raw.getAsJsonArray().size()>64)throw new IllegalArgumentException("Memory needs at most 64 regions");int total=0;
+    for(var item:raw.getAsJsonArray()){var region=item.getAsJsonObject();byte[] bytes;if(region.has("string"))bytes=region.get("string").getAsString().getBytes(StandardCharsets.UTF_8);else if(region.has("data"))bytes=Base64.getDecoder().decode(region.get("data").getAsString());else if(region.has("hex"))bytes=java.util.HexFormat.of().parseHex(region.get("hex").getAsString().replace(" ",""));else throw new IllegalArgumentException("Memory region needs string, base64 data or hex");if((total+=bytes.length)>65536)throw new IllegalArgumentException("Initial memory exceeds 64 KiB");var dest=at(region.get("address").getAsString());if(dest.getAddressSpace()!=currentProgram.getAddressFactory().getDefaultAddressSpace())throw new IllegalArgumentException("Emulation inputs require default address space");long offset=dest.getOffset();if(offset>=stackTop-65536&&offset<stackTop||offset<=sentinel&&offset+bytes.length>sentinel)throw new IllegalArgumentException("Caller memory overlaps the ABI-owned stack/return sentinel");emu.writeMemory(dest,bytes);}
+  }
+  boolean scalar(DataType type){while(type instanceof TypeDef alias)type=alias.getBaseDataType();return type instanceof Pointer||type instanceof AbstractIntegerDataType||type instanceof BooleanDataType||type instanceof ghidra.program.model.data.Enum||type instanceof VoidDataType||type.getName().startsWith("undefined");}
+  Map<String,Object> runFunction(Function function,JsonElement registers,JsonElement memory,String returns)throws Exception{
+    if(!scalar(function.getReturnType()))throw new UnsupportedOperationException("Floating-point/aggregate return lowering is unsupported by the integer-slot ABI helper");
+    if(!json("arguments").isJsonNull()){
+      if(function.hasVarArgs())throw new UnsupportedOperationException("Variadic argument lowering is unsupported");
+      for(var parameter:function.getParameters())if(!scalar(parameter.getDataType()))throw new UnsupportedOperationException("Floating-point/aggregate argument lowering is unsupported");
+      if(bits==32&&!List.of("unknown","default","__cdecl").contains(function.getCallingConventionName()))throw new UnsupportedOperationException("Only x86 cdecl integer/pointer argument lowering is supported");
+    }
+    var emu=new EmulatorHelper(currentProgram);int steps=0;boolean returned=false;String reason="step_limit",error=null;
+    try{
+      long stack=bits==64?stackTop-8:stackTop-4;emu.writeMemory(absolute(stackTop-65536),new byte[65536+256]);emu.writeRegister(emu.getStackPointerRegister(),stack);emu.writeRegister(bits==64?"RBP":"EBP",stack);
+      byte[] returnBytes=bits==64?ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(sentinel).array():ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt((int)sentinel).array();emu.writeMemory(absolute(stack),returnBytes);
+      JsonElement arguments=json("arguments");if(!arguments.isJsonNull()){
+        if(!arguments.isJsonArray()||arguments.getAsJsonArray().size()>16)throw new IllegalArgumentException("At most 16 unsigned integer/pointer arguments are supported");
+        String[] argumentRegisters=bits==32?new String[0]:abi.equals("windows-x64")?new String[]{"RCX","RDX","R8","R9"}:new String[]{"RDI","RSI","RDX","RCX","R8","R9"};
+        int index=0;for(var argument:arguments.getAsJsonArray()){BigInteger value=integer(argument.getAsString());if(value.signum()<0||value.bitLength()>bits)throw new IllegalArgumentException("Argument exceeds pointer width");
+          if(index<argumentRegisters.length)emu.writeRegister(argumentRegisters[index],value);else {long location=stack+bits/8+(abi.equals("windows-x64")?32:0)+(long)(index-argumentRegisters.length)*(bits/8);byte[] data=bits==64?ByteBuffer.allocate(8).order(ByteOrder.LITTLE_ENDIAN).putLong(value.longValue()).array():ByteBuffer.allocate(4).order(ByteOrder.LITTLE_ENDIAN).putInt(value.intValue()).array();emu.writeMemory(absolute(location),data);}index++;}
+      }
+      registers(emu,registers);memory(emu,memory);emu.writeRegister(emu.getPCRegister(),function.getEntryPoint().getOffset());
+      while(steps<maxSteps){monitor.checkCancelled();if(System.nanoTime()>deadline){reason="timeout";break;}if(totalSteps>=200000){reason="batch_step_limit";break;}if(emu.getExecutionAddress().equals(absolute(sentinel))){returned=true;reason="return";break;}
+        if(!emu.step(monitor)){reason="emulator_error";error=Objects.toString(emu.getLastError(),"Emulator stopped");break;}steps++;totalSteps++;
+      }
+      if(!returned&&emu.getExecutionAddress().equals(absolute(sentinel))){returned=true;reason="return";}
+      Map<String,Object> values=new LinkedHashMap<>();List<String> requested=returns.isEmpty()?(bits==64?List.of("RAX","RBX","RCX","RDX","RSI","RDI","R8","R9","RSP","RIP"):List.of("EAX","EBX","ECX","EDX","ESI","EDI","ESP","EIP")):Arrays.asList(returns.split(","));
+      if(requested.size()>32)throw new IllegalArgumentException("At most 32 output registers");for(String name:requested){var register=currentProgram.getRegister(name.trim());if(register==null||register.getBitLength()>64)throw new IllegalArgumentException("Unknown or oversized output register");values.put(register.getName(),hex(emu.readRegister(register)));}
+      List<Object> observed=new ArrayList<>();var reads=json("read_memory_after");int totalRead=0;if(!reads.isJsonNull()){if(!reads.isJsonArray()||reads.getAsJsonArray().size()>64)throw new IllegalArgumentException("Readback needs at most 64 regions");for(var raw:reads.getAsJsonArray()){var r=raw.getAsJsonObject();int size=r.get("length").getAsInt();if(size<0||(totalRead+=size)>65536)throw new IllegalArgumentException("Readback exceeds 64 KiB");var address=at(r.get("address").getAsString());observed.add(map("address",address.toString(),"length",size,"hex",java.util.HexFormat.of().formatHex(emu.readMemory(address,size))));}}
+      return map("success",true,"completed",returned,"hit_return",returned,"steps_executed",steps,"stop_reason",reason,"error",error,"registers",values,"memory_after",observed,"abi",abi,"language",currentProgram.getLanguageID().toString(),"stack_pointer",hex(BigInteger.valueOf(stack)),"pointer_bytes",bits/8,"step_unit","instruction","limitations",List.of("Isolated computation only; imports, OS services, syscalls and arbitrary ABI variants are unsupported.","Budget exhaustion is not a completed execution; inspect completed and stop_reason."));
+    }finally{emu.dispose();}
+  }
+  Object execute(String operation)throws Exception{
+    policy();if(operation.equals("/emulate_function"))return runFunction(function(str("function","")),json("registers"),json("memory"),str("return_registers",""));
+    var function=function(str("hash_function_address",""));var candidates=json("candidates");if(!candidates.isJsonArray()||candidates.getAsJsonArray().size()>256)throw new IllegalArgumentException("Hash emulation supports at most 256 candidates per bounded call");
+    String output=str("result_register","EAX"),input=str("string_register","");Register resultRegister=currentProgram.getRegister(output);if(resultRegister==null||resultRegister.getBitLength()>64)throw new IllegalArgumentException("Invalid result register");BigInteger wanted=integer(str("target_hash","")).and(BigInteger.ONE.shiftLeft(resultRegister.getBitLength()).subtract(BigInteger.ONE));
+    List<Object> matches=new ArrayList<>(),outcomes=new ArrayList<>();int tested=0;boolean complete=true;String best=null;
+    for(var candidate:candidates.getAsJsonArray()){
+      if(System.nanoTime()>deadline||totalSteps>=200000){complete=false;break;}String text=candidate.getAsString();byte[] bytes=(text+"\0").getBytes(p.has("wide_string")&&p.get("wide_string").getAsBoolean()?StandardCharsets.UTF_16LE:StandardCharsets.US_ASCII);if(bytes.length>65536)throw new IllegalArgumentException("Candidate exceeds scratch buffer");
+      JsonObject regs=json("initial_registers").isJsonNull()?new JsonObject():json("initial_registers").getAsJsonObject().deepCopy();regs.addProperty(input,"0x"+Long.toHexString(scratch));JsonObject region=new JsonObject();region.addProperty("address","0x"+Long.toHexString(scratch));region.addProperty("data",Base64.getEncoder().encodeToString(bytes));JsonArray memory=new JsonArray();memory.add(region);
+      JsonElement original=p.get("arguments");JsonArray arguments=new JsonArray();arguments.add("0x"+Long.toHexString(scratch));p.add("arguments",arguments);
+      Map<String,Object> result;try{result=runFunction(function,regs,memory,output);}finally{if(original==null)p.remove("arguments");else p.add("arguments",original);}tested++;boolean ended=(boolean)result.get("completed");outcomes.add(map("candidate",text,"completed",ended,"stop_reason",result.get("stop_reason"),"steps_executed",result.get("steps_executed")));if(!ended){complete=false;continue;}
+      String value=(String)((Map<?,?>)result.get("registers")).get(resultRegister.getName());if(integer(value).equals(wanted)){matches.add(map("candidate",text,"hash",value));if(best==null)best=text;}
+    }
+    return map("tested",tested,"total_candidates",candidates.getAsJsonArray().size(),"complete",complete,"truncated",tested<candidates.getAsJsonArray().size(),"resolved",!matches.isEmpty(),"matches",matches,"best_match",best,"outcomes",outcomes,"abi",abi,"steps_executed",totalSteps,"algorithm","isolated-exact-register-comparison-v1");
+  }
+  public void run()throws Exception{
+    var request=JsonParser.parseString(new String(Base64.getDecoder().decode(getScriptArgs()[0]),StandardCharsets.UTF_8)).getAsJsonObject();p=request.getAsJsonObject("parameters");deadline=System.nanoTime()+number("timeout_seconds",5,1,30)*1000000000L;Map<String,Object> result;
+    try{result=map("value",execute(request.get("operation").getAsString()));}catch(Exception error){result=map("error",map("code",error instanceof UnsupportedOperationException?"unsupported":error instanceof IllegalArgumentException?"invalid":"partial","message",Objects.toString(error.getMessage(),"Emulation failed")));}
+    println("INSIGHT_QUERY:"+new GsonBuilder().serializeNulls().create().toJson(result));
+  }
+}

package/references/native/InsightExtensions.java

@@ -0,0 +1,36 @@
+package insight;
+import com.google.gson.*;
+import ghidra.app.services.Analyzer;
+import ghidra.framework.plugintool.*;
+import ghidra.framework.plugintool.util.PluginDescription;
+import ghidra.program.util.DefaultLanguageService;
+import ghidra.util.classfinder.ClassSearcher;
+import java.io.File;
+import java.nio.file.*;
+import java.util.*;
+
+/** Native discovery for pinned modules, with logical identities rather than installation paths. */
+public class InsightExtensions {
+    public static boolean managed(Class<?> c) throws Exception {
+        var source=c.getProtectionDomain().getCodeSource();if(source==null)return false;
+        Path location=Path.of(source.getLocation().toURI()).toRealPath();
+        for(String root:System.getProperty("ghidra.external.modules","").split(java.util.regex.Pattern.quote(File.pathSeparator)))
+            if(!root.isBlank()&&location.startsWith(Path.of(root).toRealPath()))return true;
+        return false;
+    }
+    public static Object inventory(JsonObject p) throws Exception {
+        String kind=p.get("kind").getAsString(),filter=p.get("filter").getAsString().toLowerCase(Locale.ROOT);
+        int limit=p.get("limit").getAsInt(),offset=p.get("offset").getAsInt();if(limit<1||limit>100||offset<0)throw new IllegalArgumentException();
+        List<Map<String,Object>> rows=new ArrayList<>();
+        if(kind.equals("languages"))for(var language:DefaultLanguageService.getLanguageService().getLanguageDescriptions(false)){
+            var compilers=language.getCompatibleCompilerSpecDescriptions().stream().map(c->Map.of("id",c.getCompilerSpecID().toString(),"name",c.getCompilerSpecName())).toList();
+            rows.add(Map.of("id",language.getLanguageID().toString(),"processor",language.getProcessor().toString(),"description",language.getDescription(),"size",language.getSize(),"endian",language.getEndian().toString(),"compilers",compilers));
+        }else if(kind.equals("analyzers"))for(Analyzer a:ClassSearcher.getInstances(Analyzer.class))rows.add(Map.of("id",a.getClass().getName(),"name",a.getName(),"description",a.getDescription(),"managed",managed(a.getClass())));
+        else if(kind.equals("plugins"))for(Class<? extends Plugin> c:ClassSearcher.getClasses(Plugin.class)){
+            PluginDescription d=PluginDescription.getPluginDescription(c);rows.add(Map.of("id",c.getName(),"name",d.getName(),"description",d.getShortDescription(),"managed",managed(c),"status",d.getStatus().toString()));
+        }else throw new IllegalArgumentException("Expected languages, analyzers or plugins");
+        rows.removeIf(r->!r.toString().toLowerCase(Locale.ROOT).contains(filter));rows.sort(Comparator.comparing(r->r.get("id").toString()));
+        int start=Math.min(offset,rows.size()),end=(int)Math.min((long)rows.size(),(long)start+limit);
+        return Map.of("kind",kind,"items",rows.subList(start,end),"total",rows.size(),"offset",offset,"limit",limit,"truncated",end<rows.size());
+    }
+}

package/references/native/InsightFunctionDatabases.java

@@ -0,0 +1,98 @@
+import com.google.gson.*;
+import ghidra.GhidraApplicationLayout;
+import ghidra.framework.*;
+import ghidra.framework.data.OpenMode;
+import ghidra.framework.store.db.PackedDatabase;
+import ghidra.base.project.GhidraProject;
+import ghidra.program.database.ProgramDB;
+import ghidra.program.model.listing.*;
+import ghidra.feature.fid.db.*;
+import ghidra.feature.fid.service.*;
+import ghidra.features.bsim.query.*;
+import ghidra.features.bsim.query.protocol.*;
+import ghidra.features.bsim.query.description.*;
+import ghidra.features.bsim.query.file.BSimH2FileDBConnectionManager;
+import ghidra.util.task.*;
+import java.nio.file.*;
+import java.util.*;
+import java.util.concurrent.TimeUnit;
+
+/** Genuine FID and embedded BSim/H2; no custom hash results are relabeled as database matches. */
+class InsightFunctionDatabases {
+    static String text(JsonObject p,String key){return p.has(key)?p.get(key).getAsString():"";}
+    static void bounded(Program p){if(p.getFunctionManager().getFunctionCount()>1000)throw new IllegalArgumentException("Database workflow accepts at most 1000 functions per input");}
+    static void only(FidFile file){for(FidFile candidate:FidFileManager.getInstance().getFidFiles())candidate.setActive(candidate.equals(file));}
+    static Map<String,Object> library(LibraryRecord value){return Map.of("name",value.getLibraryFamilyName(),"version",value.getLibraryVersion(),"variant",value.getLibraryVariant(),
+        "ghidra",value.getGhidraVersion(),"language",value.getGhidraLanguageID().toString(),"compiler",value.getGhidraCompilerSpecID().toString());}
+    static Object fidBuild(JsonObject p,TaskMonitor monitor)throws Exception{
+        Path output=Path.of(text(p,"output")),projectRoot=Files.createTempDirectory(Path.of(System.getProperty("java.io.tmpdir")),"fid-source-");Object consumer=new Object();Program program=null;GhidraProject project=null;
+        var manager=FidFileManager.getInstance();manager.createNewFidDatabase(output.toFile());var file=manager.addUserFidFile(output.toFile());only(file);
+        try(FidDB database=file.getFidDB(true)){
+            project=GhidraProject.createProject(projectRoot.toString(),"project",false);var domainFile=project.getProjectData().getRootFolder().createFile("LibraryInput",Path.of(text(p,"snapshot")).toFile(),monitor);
+            program=(Program)domainFile.getDomainObject(consumer,true,false,monitor);bounded(program);
+            FidService service=new FidService();
+            var result=service.createNewLibraryFromPrograms(database,text(p,"library"),text(p,"version"),"insight-snapshot",List.of(domainFile),null,program.getLanguageID(),List.of(),List.of(),monitor);
+            database.saveDatabase("Owned snapshot library",monitor);
+            return Map.of("state","exported","format","FID","library",library(result.getLibraryRecord()),"included",result.getTotalAdded(),"excluded",result.getTotalExcluded(),"attempted",result.getTotalAttempted(),"source_sha256",program.getExecutableSHA256());
+        }finally{if(program!=null)program.release(consumer);if(project!=null)project.close();}
+    }
+    static Object fidQuery(Program program,JsonObject p,TaskMonitor monitor)throws Exception{
+        bounded(program);Path copy=Path.of(System.getProperty("java.io.tmpdir"),"query.fidb");Files.copy(Path.of(text(p,"database")),copy);
+        var file=FidFileManager.getInstance().addUserFidFile(copy.toFile());only(file);FidService service=new FidService();
+        if(!service.canProcess(program.getLanguage()))throw new IllegalArgumentException("FID does not support this language");
+        if(p.has("function")){var address=program.getAddressFactory().getAddress(text(p,"function"));Function function=address==null?null:program.getFunctionManager().getFunctionAt(address);
+            if(function==null)throw new IllegalArgumentException("No function starts at the query address");
+            if(service.hashFunction(function)==null)return Map.of("engine","ghidra.FidService.processProgram","items",List.of(),"complete",false,"no_match",false,"diagnostic","Function has insufficient native FID hash input");}
+        float threshold=p.has("threshold")?p.get("threshold").getAsFloat():service.getDefaultScoreThreshold();int limit=p.has("limit")?p.get("limit").getAsInt():100;
+        List<Object> rows=new ArrayList<>();int total=0,queried=0;List<Object> libraries;
+        try(FidDB database=file.getFidDB(false)){libraries=database.getAllLibraries().stream().map(value->(Object)library(value)).toList();}
+        try(FidQueryService query=service.openFidQueryService(program.getLanguage(),false)){
+            for(FidSearchResult result:service.processProgram(program,query,threshold,monitor)){
+                if(p.has("function")&&!result.function.getEntryPoint().equals(program.getAddressFactory().getAddress(text(p,"function"))))continue;queried++;
+                for(FidMatch match:result.matches){total++;if(rows.size()<limit)rows.add(Map.of("address",result.function.getEntryPoint().toString(),"name",match.getFunctionRecord().getName(),"library",library(match.getLibraryRecord()),
+                    "score",match.getOverallScore(),"mode",match.getPrimaryFunctionMatchMode().toString(),"primary_code_units",match.getPrimaryFunctionCodeUnitScore(),"child_code_units",match.getChildFunctionCodeUnitScore(),"parent_code_units",match.getParentFunctionCodeUnitScore()));}
+            }
+        }
+        return Map.of("engine","ghidra.FidService.processProgram","libraries",libraries,"items",rows,"total",total,"complete",rows.size()==total,"no_match",total==0,"functions_with_results",queried,"score_semantics","Native matching code-unit scores, not probabilities.");
+    }
+    static void check(FunctionDatabase database,Object result)throws Exception{if(result==null)throw new IllegalStateException("Native BSim query failed: "+database.getLastError().category);}
+    static Map<String,Object> information(FunctionDatabase database){var info=database.getInfo();return Map.of("name",info.databasename,"layout_version",info.layout_version,"signature_major",info.major,"signature_minor",info.minor,"settings",Integer.toUnsignedString(info.settings),"engine","Ghidra BSim/H2");}
+    static GenSignatures signatures(Program program,FunctionDatabase database,TaskMonitor monitor,JsonObject p)throws Exception{
+        GenSignatures generator=new GenSignatures(false);boolean ready=false;try{generator.setVectorFactory(database.getLSHVectorFactory());generator.openProgram(program,"OwnedLibraryInput",null,null,null,null);
+            if(p.has("function")){var address=program.getAddressFactory().getAddress(text(p,"function"));Function function=address==null?null:program.getFunctionManager().getFunctionAt(address);if(function==null)throw new IllegalArgumentException("No function starts at the query address");generator.scanFunction(function);}
+            else generator.scanFunctions(program.getFunctionManager().getFunctions(true),program.getFunctionManager().getFunctionCount(),monitor);ready=true;return generator;
+        }finally{if(!ready)generator.dispose();}
+    }
+    static Object bsim(Program program,JsonObject p,TaskMonitor monitor,boolean build)throws Exception{
+        bounded(program);Path file;
+        if(build)file=Path.of(text(p,"output"));else{file=Path.of(System.getProperty("java.io.tmpdir"),"query.mv.db");Files.copy(Path.of(text(p,"database")),file);}
+        FunctionDatabase database=BSimClientFactory.buildClient(new BSimServerInfo(file.toString()),false);
+        try{
+            if(build){CreateDatabase request=new CreateDatabase();request.config_template=program.getDefaultPointerSize()==8?"medium_64":"medium_32";request.info=new DatabaseInformation();request.info.databasename=text(p,"library");request.info.owner="insight-cli";request.info.description="Explicit owned program snapshots";request.info.trackcallgraph=false;check(database,database.query(request));}
+            if(!database.initialize())throw new IllegalStateException("Native BSim database did not initialize");
+            try(var resource=new SignatureResource(signatures(program,database,monitor,p))){GenSignatures generator=resource.value;
+                if(build){InsertRequest request=new InsertRequest();request.manage=generator.getDescriptionManager();check(database,database.query(request));return Map.of("state","exported","format","BSim/H2","database",information(database),"source_sha256",program.getExecutableSHA256(),"functions",program.getFunctionManager().getFunctionCount());}
+                QueryNearest request=new QueryNearest();request.manage=generator.getDescriptionManager();request.thresh=p.has("similarity")?p.get("similarity").getAsDouble():0.7;request.signifthresh=p.has("significance")?p.get("significance").getAsDouble():0;
+                request.max=p.has("limit")?p.get("limit").getAsInt():20;request.vectormax=1000;var response=(ResponseNearest)database.query(request);check(database,response);
+                List<Object> rows=new ArrayList<>();int total=0;for(var result:response.result){total+=result.getTotalCount();for(var note:result){var function=note.getFunctionDescription();rows.add(Map.of("query_name",result.getBase().getFunctionName(),"query_address","0x"+Long.toUnsignedString(result.getBase().getAddress(),16),
+                        "name",function.getFunctionName(),"address","0x"+Long.toUnsignedString(function.getAddress(),16),"executable_md5",function.getExecutableRecord().getMd5(),"similarity",note.getSimilarity(),"significance",note.getSignificance()));}}
+                return Map.of("engine","Ghidra BSim QueryNearest","database",information(database),"items",rows,"total",total,"complete",response.totalfunc>0&&rows.size()==total,"no_match",response.totalfunc>0&&rows.isEmpty(),"queried_functions",response.totalfunc,"score_semantics","Native weighted feature similarity and significance, not probabilities.");
+            }
+        }finally{database.close();var source=BSimH2FileDBConnectionManager.getDataSourceIfExists(database.getServerInfo());if(source!=null)source.dispose();}
+    }
+    static class SignatureResource implements AutoCloseable{final GenSignatures value;SignatureResource(GenSignatures value){this.value=value;}public void close(){value.dispose();}}
+    static Object run(JsonObject p)throws Exception{
+        String operation=text(p,"operation");TimeoutTaskMonitor monitor=TimeoutTaskMonitor.timeoutIn(90,TimeUnit.SECONDS);
+        try{
+            if(operation.equals("fid-build"))return fidBuild(p,monitor);
+            Object consumer=new Object();var db=PackedDatabase.getPackedDatabase(Path.of(text(p,"snapshot")).toFile(),true,monitor).open(monitor);ProgramDB program=new ProgramDB(db,OpenMode.IMMUTABLE,monitor,consumer);
+            try{long before=program.getModificationNumber();Object result=switch(operation){case "fid-query"->fidQuery(program,p,monitor);case "bsim-build"->bsim(program,p,monitor,true);case "bsim-query"->bsim(program,p,monitor,false);default->throw new IllegalArgumentException("Unknown native function database operation");};
+                if(program.getModificationNumber()!=before)throw new IllegalStateException("Function database query modified the source program");return result;
+            }finally{program.release(consumer);}
+        }finally{monitor.finished();}
+    }
+    public static void main(String[] args){var output=System.out;System.setOut(System.err);
+        try{Application.initializeApplication(new GhidraApplicationLayout(),new HeadlessGhidraApplicationConfiguration());JsonObject p=JsonParser.parseString(Files.readString(Path.of(args[0]))).getAsJsonObject();Object value=run(p);InsightNativeReceipt.write(p,value);output.println(new GsonBuilder().serializeNulls().create().toJson(Map.of("value",value)));System.exit(0);}
+        catch(Throwable failure){failure.printStackTrace(System.err);output.println("{\"error\":\"native_function_database_failed\"}");System.exit(1);}
+    }
+}

package/references/native/InsightGuiMain.java

@@ -0,0 +1,32 @@
+import ghidra.GhidraApplicationLayout;
+import ghidra.framework.Application;
+import ghidra.framework.GhidraApplicationConfiguration;
+import ghidra.framework.main.FrontEndTool;
+import ghidra.framework.model.ProjectLocator;
+import ghidra.framework.project.DefaultProjectManager;
+import javax.swing.SwingUtilities;
+
+/** An isolated frontend for a saved facade context; never loads a user's default project. */
+class InsightGuiMain {
+  static class OwnedProjectManager extends DefaultProjectManager { OwnedProjectManager(){super();} }
+  public static void main(String[] args) throws Exception {
+    if(args.length!=3 || System.getenv("GHIDRA_MCP_AUTH_TOKEN")==null) throw new IllegalArgumentException();
+    GhidraApplicationConfiguration configuration=new GhidraApplicationConfiguration();
+    configuration.setShowSplashScreen(false);
+    Application.initializeApplication(new GhidraApplicationLayout(),configuration);
+    SwingUtilities.invokeAndWait(()->{
+      try {
+        var manager=new OwnedProjectManager();
+        var project=manager.openProject(new ProjectLocator(args[0],args[1]),false,false);
+        var frontend=new FrontEndTool(manager);
+        if(project.getToolManager().getActiveWorkspace()==null) project.getToolManager().createWorkspace("Research").setActive();
+        frontend.setActiveProject(project);
+        var options=frontend.getOptions("GhidraMCP HTTP Server");
+        options.setInt("Server Port",Integer.parseInt(args[2]));
+        options.setBoolean("Enable UDS Transport",false); options.setBoolean("Enable TCP Transport",true);
+        options.setBoolean("Strict Naming Enforcement",false);
+        frontend.addPlugin("com.xebyte.GhidraMCPPlugin"); frontend.setVisible(true);
+      } catch(Exception failure) { throw new RuntimeException(failure); }
+    });
+  }
+}

package/references/native/InsightHeadlessMain.java

@@ -0,0 +1,10 @@
+import com.xebyte.core.NamingPolicy;
+import com.xebyte.headless.GhidraMCPHeadlessServer;
+
+/** Preserve caller-selected names in the owned facade, including structure fields. */
+class InsightHeadlessMain {
+  public static void main(String[] args) {
+    NamingPolicy.getInstance().setStrictNamingEnforcement(false, "insight facade");
+    GhidraMCPHeadlessServer.main(args);
+  }
+}

package/references/native/InsightInitialImport.java

@@ -0,0 +1,42 @@
+import com.google.gson.*;
+import ghidra.GhidraApplicationLayout;
+import ghidra.framework.*;
+import insight.InsightInitialJournal;
+import java.nio.file.*;
+import java.nio.channels.*;
+import java.util.*;
+
+/** No repository connection: incomplete analysis can only leave a private attempt. */
+class InsightInitialImport {
+    public static void main(String[] args){var out=System.out;System.setOut(System.err);
+        try{
+            Path root=Path.of(args[0]);JsonObject p=InsightInitialJournal.intent(root);
+            try(var channel=FileChannel.open(root.resolve("lock"),StandardOpenOption.CREATE,StandardOpenOption.WRITE);var lock=channel.tryLock()){
+                if(lock==null){out.println("{\"state\":\"busy\"}");System.exit(0);}
+                Path journal=root.resolve("import.json");
+                if(Files.exists(journal)&&InsightInitialJournal.text(InsightInitialJournal.read(journal),"phase").equals("prepared")){
+                    InsightInitialJournal.prepared(root);out.println("{\"state\":\"prepared\"}");System.exit(0);
+                }
+                if(Files.exists(root.resolve("publication.json")))throw new SecurityException("Publication already started without a prepared snapshot");
+                Path input=Path.of(InsightInitialJournal.text(p,"input"));
+                if(!InsightInitialJournal.hash(input).equals(InsightInitialJournal.text(p,"sha256")))throw new SecurityException("Input bytes changed");
+                JsonObject s=new JsonObject();s.addProperty("intentHash",InsightInitialJournal.hash(root.resolve("intent.json")));
+                s.addProperty("phase","importing");s.addProperty("pid",ProcessHandle.current().pid());s.addProperty("snapshot","attempt-"+UUID.randomUUID()+".gzf");
+                Path attempt=root.resolve(InsightInitialJournal.text(s,"snapshot")+".json");InsightInitialJournal.write(attempt,s);InsightInitialJournal.write(journal,s);
+                Application.initializeApplication(new GhidraApplicationLayout(),new HeadlessGhidraApplicationConfiguration());
+                JsonObject settings=p.getAsJsonObject("settings"),request=new JsonObject();
+                request.addProperty("input",input.toString());request.addProperty("output",root.resolve(InsightInitialJournal.text(s,"snapshot")).toString());
+                request.add("auto_analyze",settings.get("autoAnalyze"));
+                for(String key:List.of("language","loader"))if(settings.has(key))request.add(key,settings.get(key));
+                if(settings.has("compilerSpec"))request.add("compiler_spec",settings.get("compilerSpec"));
+                if(settings.has("imageBase"))request.add("image_base",settings.get("imageBase"));
+                if(settings.has("loaderOptions"))request.add("options",settings.get("loaderOptions"));
+                JsonObject metadata=new Gson().toJsonTree(InsightSdkFiles.importProgram(request)).getAsJsonObject();
+                Path file=root.resolve(InsightInitialJournal.text(s,"snapshot"));InsightInitialJournal.sync(file);
+                s.add("metadata",metadata);s.addProperty("snapshotSha256",InsightInitialJournal.hash(file));s.addProperty("phase","prepared");InsightInitialJournal.write(attempt,s);InsightInitialJournal.write(journal,s);
+                InsightInitialJournal.prepared(root);out.println("{\"state\":\"prepared\"}");
+            }
+            System.exit(0);
+        }catch(Throwable failure){failure.printStackTrace(System.err);out.println("{\"state\":\"failed\"}");System.exit(1);}
+    }
+}

package/references/native/InsightInitialJournal.java

@@ -0,0 +1,48 @@
+package insight;
+
+import com.google.gson.*;
+import java.nio.file.*;
+import java.nio.channels.*;
+import java.security.MessageDigest;
+import java.util.*;
+
+/** Initial-model receipts, shared by private import and conditional create/readback helpers. */
+public class InsightInitialJournal {
+    public static String text(JsonObject p,String key){return p.get(key).getAsString();}
+    public static JsonObject read(Path p)throws Exception{
+        if(!Files.isRegularFile(p,LinkOption.NOFOLLOW_LINKS)||Files.size(p)>1048576)throw new SecurityException("Invalid initial-model receipt");
+        return JsonParser.parseString(Files.readString(p)).getAsJsonObject();
+    }
+    public static String hash(Path p)throws Exception{
+        if(!Files.isRegularFile(p,LinkOption.NOFOLLOW_LINKS))throw new SecurityException("Invalid initial-model file");
+        MessageDigest hash=MessageDigest.getInstance("SHA-256");try(var in=Files.newInputStream(p)){byte[] b=new byte[65536];for(int n;(n=in.read(b))>=0;)if(n>0)hash.update(b,0,n);}
+        return HexFormat.of().formatHex(hash.digest());
+    }
+    public static void sync(Path p)throws Exception{try(var f=FileChannel.open(p,StandardOpenOption.WRITE)){f.force(true);}}
+    public static void write(Path p,JsonObject value)throws Exception{
+        Path temp=p.resolveSibling(p.getFileName()+".new-"+UUID.randomUUID());
+        Files.writeString(temp,new Gson().toJson(value),StandardOpenOption.CREATE_NEW);sync(temp);
+        Files.move(temp,p,StandardCopyOption.ATOMIC_MOVE,StandardCopyOption.REPLACE_EXISTING);
+        if(!System.getProperty("os.name").toLowerCase().contains("win"))try(var d=FileChannel.open(p.getParent(),StandardOpenOption.READ)){d.force(true);}
+    }
+    public static JsonObject intent(Path root)throws Exception{
+        if(!root.toRealPath().equals(root.toAbsolutePath().normalize()))throw new SecurityException("Initial-model root moved");
+        JsonObject p=read(root.resolve("intent.json"));
+        if(p.get("schema").getAsInt()!=1||!text(p,"target").matches("t_[a-f0-9]{32}")||!text(p,"id").matches("[a-f0-9-]{36}")||!text(p,"sha256").matches("[a-f0-9]{64}"))throw new SecurityException("Invalid initial-model identity");
+        return p;
+    }
+    public static JsonObject prepared(Path root)throws Exception{
+        JsonObject p=intent(root),s=read(root.resolve("import.json"));
+        if(!text(s,"intentHash").equals(hash(root.resolve("intent.json")))||!text(s,"phase").equals("prepared"))throw new SecurityException("Import is not prepared");
+        String name=text(s,"snapshot");if(!name.matches("attempt-[a-f0-9-]{36}\\.gzf"))throw new SecurityException();
+        Path file=root.resolve(name);if(!text(s,"snapshotSha256").equals(hash(file)))throw new SecurityException("Initial snapshot changed");
+        JsonObject v=s.getAsJsonObject("metadata"),settings=p.getAsJsonObject("settings");
+        if(!text(v,"sha256").equals(text(p,"sha256"))||v.get("auto_analyzed").getAsBoolean()!=settings.get("autoAnalyze").getAsBoolean())throw new SecurityException();
+        for(String key:List.of("language","compilerSpec","imageBase"))if(settings.has(key)){
+            String field=key.equals("compilerSpec")?"compiler":key.equals("imageBase")?"base_address":key;
+            String got=text(v,field);if(key.equals("imageBase"))got=got.replaceFirst("^0+(?!$)","");
+            if(!got.equals(text(settings,key)))throw new SecurityException("Initial load settings changed");
+        }
+        return s;
+    }
+}