@eyeauras/insight-cli 0.2.0 → 0.2.1

package/runtime/managed/insight-managed/Insight.Managed.deps.json

@@ -0,0 +1,41 @@
+{
+  "runtimeTarget": {
+    "name": ".NETCoreApp,Version=v10.0",
+    "signature": ""
+  },
+  "compilationOptions": {},
+  "targets": {
+    ".NETCoreApp,Version=v10.0": {
+      "Insight.Managed/1.0.0": {
+        "dependencies": {
+          "dnlib": "4.5.0"
+        },
+        "runtime": {
+          "Insight.Managed.dll": {}
+        }
+      },
+      "dnlib/4.5.0": {
+        "runtime": {
+          "lib/net6.0/dnlib.dll": {
+            "assemblyVersion": "4.5.0.0",
+            "fileVersion": "4.5.0.0"
+          }
+        }
+      }
+    }
+  },
+  "libraries": {
+    "Insight.Managed/1.0.0": {
+      "type": "project",
+      "serviceable": false,
+      "sha512": ""
+    },
+    "dnlib/4.5.0": {
+      "type": "package",
+      "serviceable": true,
+      "sha512": "sha512-YkwstIbjyiJ12uGIAN8oSmImgVFkPHit7MJXPHvJqeKV1DMNqxZWszjHfykgiSs4Y/XmjnZts7pI2/AYme5/uA==",
+      "path": "dnlib/4.5.0",
+      "hashPath": "dnlib.4.5.0.nupkg.sha512"
+    }
+  }
+}

package/runtime/managed/insight-managed/Insight.Managed.runtimeconfig.json

@@ -0,0 +1,13 @@
+{
+  "runtimeOptions": {
+    "tfm": "net10.0",
+    "framework": {
+      "name": "Microsoft.NETCore.App",
+      "version": "10.0.0"
+    },
+    "configProperties": {
+      "System.Reflection.Metadata.MetadataUpdater.IsSupported": false,
+      "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false
+    }
+  }
+}

package/runtime/managed/insight-managed/LICENSE.dnlib.txt

@@ -0,0 +1,20 @@
+Copyright (C) 2012-2019 de4dot@gmail.com
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/runtime/managed/insight-managed/NuGet.Config

@@ -0,0 +1 @@
+<?xml version="1.0" encoding="utf-8"?><configuration><packageSources><clear/><add key="nuget.org" value="https://api.nuget.org/v3/index.json"/></packageSources></configuration>

package/runtime/managed/insight-managed/Program.cs

@@ -0,0 +1,31 @@
+// MIT first-party static metadata API. Target assemblies are parsed, never loaded for execution.
+using System.Security.Cryptography;using System.Text;using System.Text.Json;using System.Text.Json.Serialization;using dnlib.DotNet;using dnlib.DotNet.Emit;
+sealed class Plan {public int Schema{get;set;}public string Mode{get;set;}="query";public string Input{get;set;}="";public string? Other{get;set;}public string View{get;set;}="overview";public string? Type{get;set;}public uint? Token{get;set;}public string? Filter{get;set;}public string? NameFilter{get;set;}public int Limit{get;set;}=50;public int Offset{get;set;}=0;}
+sealed class NoAssemblyResolution:IAssemblyResolver {public AssemblyDef? Resolve(IAssembly assembly,ModuleDef sourceModule)=>null;}
+static class Program {
+ static readonly JsonSerializerOptions Json=new(){PropertyNamingPolicy=JsonNamingPolicy.CamelCase,DefaultIgnoreCondition=JsonIgnoreCondition.WhenWritingNull};
+ static string Hash(string value)=>Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(value)));
+ static string Token(MethodDef method)=>"0x"+method.MDToken.Raw.ToString("x8");
+ static object? ImportState(MethodDef method)=>method.HasImplMap?new {module=method.ImplMap.Module.Name.ToString(),entryPoint=method.ImplMap.Name.ToString(),attributes=method.ImplMap.Attributes.ToString()}:null;
+ static object Import(MethodDef method)=>new {module=method.ImplMap.Module.Name.ToString(),entryPoint=method.ImplMap.Name.ToString(),attributes=method.ImplMap.Attributes.ToString(),signature=method.FullName,token=Token(method)};
+ static string OperandAt(object? operand,Func<Instruction,int> index)=>operand switch {null=>"",Instruction i=>"label:"+index(i),Instruction[] a=>string.Join(",",a.Select(i=>"label:"+index(i))),IMethod m=>"method:"+m.FullName,IField f=>"field:"+f.FullName,ITypeDefOrRef t=>"type:"+t.FullName,TypeSig t=>"type:"+t.FullName,dnlib.DotNet.Emit.Local local=>"local:"+local.Index+":"+local.Type.FullName,Parameter parameter=>"parameter:"+parameter.Index+":"+parameter.Type.FullName,string s=>"string:"+JsonSerializer.Serialize(s),IFormattable f=>f.ToString(null,System.Globalization.CultureInfo.InvariantCulture)??"",_=>operand.ToString()??""};
+ static string Operand(object? operand,IList<Instruction> instructions)=>OperandAt(operand,instructions.IndexOf);
+ static object? Body(MethodDef method){if(method.Body is null)return null;var body=method.Body;var instructions=body.Instructions;if(instructions.Count>100000)throw new InvalidOperationException("A method exceeds 100000 instructions; narrow the comparison/query");var indices=instructions.Select((i,n)=>(i,n)).ToDictionary(p=>p.i,p=>p.n);int At(Instruction? i)=>i is null?instructions.Count:indices[i];
+  return new{initLocals=body.InitLocals,locals=body.Variables.Select(v=>v.Type.FullName).ToArray(),instructions=instructions.Select(i=>i.IsLdcI4()?new{opcode="ldc.i4",operand=i.GetLdcI4Value().ToString(System.Globalization.CultureInfo.InvariantCulture)}:new{opcode=i.OpCode.OperandType is OperandType.ShortInlineBrTarget?i.OpCode.Name.Replace(".s",""):i.OpCode.Name,operand=OperandAt(i.Operand,i=>indices[i])}).ToArray(),handlers=body.ExceptionHandlers.Select(h=>new{kind=h.HandlerType.ToString(),@try=At(h.TryStart),tryEnd=At(h.TryEnd),handler=At(h.HandlerStart),handlerEnd=At(h.HandlerEnd),filter=At(h.FilterStart),catchType=h.CatchType?.FullName}).ToArray()};
+ }
+ static string Fingerprint(MethodDef method)=>Hash(JsonSerializer.Serialize(new{signature=method.FullName,attributes=method.Attributes.ToString(),implementation=method.ImplAttributes.ToString(),import=method.HasImplMap?new{module=method.ImplMap.Module.Name.ToString(),entryPoint=method.ImplMap.Name.ToString(),attributes=method.ImplMap.Attributes.ToString()}:null,body=Body(method)},Json));
+ static bool Matches(Plan p,MethodDef method)=>(p.Type is null||method.DeclaringType.FullName==p.Type)&&(!p.Token.HasValue||method.MDToken.Raw==p.Token)&&(p.Filter is null||method.FullName.Contains(p.Filter,StringComparison.Ordinal))&&(p.NameFilter is null||method.Name.ToString().Contains(p.NameFilter,StringComparison.OrdinalIgnoreCase));
+ static object Query(Plan p,ModuleDefMD module){var types=module.GetTypes().Take(100001).ToArray();if(types.Length>100000)throw new InvalidOperationException("Assembly exceeds the 100000-type query bound");var methods=types.SelectMany(t=>t.Methods).ToArray();if(methods.Length>1000000)throw new InvalidOperationException("Assembly exceeds the million-method query bound");var scope="Static dnlib metadata/IL only; no target execution, dependency resolution or PDB loading. Tokens belong to this exact module. Structural equality is not semantic equivalence.";
+  object Result(object data)=>new{state="completed",complete=true,view=p.View,data,scope};object Rows(object[] rows)=>new{state="completed",complete=true,view=p.View,items=rows.Skip(p.Offset).Take(p.Limit),total=rows.Length,limit=p.Limit,offset=p.Offset,truncated=p.Offset+p.Limit<rows.Length,scope};
+  if(p.View=="overview"){var refs=module.GetAssemblyRefs().Take(257).Select(a=>a.FullName).ToArray();var resources=module.Resources.Take(257).Select(r=>r.Name.ToString()).ToArray();return Result(new{assembly=module.Assembly?.FullName,module=module.Name.ToString(),mvid=module.Mvid,metadataRuntimeVersion=module.RuntimeVersion,targetFramework=module.Assembly?.CustomAttributes.Find("System.Runtime.Versioning.TargetFrameworkAttribute")?.ConstructorArguments.FirstOrDefault().Value?.ToString(),machine=module.Machine.ToString(),ilOnly=module.IsILOnly,types=types.Length,methods=methods.Length,imports=methods.Count(m=>m.HasImplMap),entryPoint=module.EntryPoint?.FullName,references=refs.Take(256).ToArray(),referencesTruncated=refs.Length>256,resources=resources.Take(256).ToArray(),resourcesTruncated=resources.Length>256,referenceResourceBound=256});}
+  if(p.View=="types")return Rows(types.Where(t=>(p.Type is null||t.FullName==p.Type)&&(p.Filter is null||t.FullName.Contains(p.Filter,StringComparison.Ordinal))).Select(t=>(object)new{name=t.FullName,token="0x"+t.MDToken.Raw.ToString("x8"),baseType=t.BaseType?.FullName,attributes=t.Attributes.ToString(),methods=t.Methods.Count,fields=t.Fields.Count}).ToArray());
+  if(p.View=="methods")return Rows(methods.Where(m=>Matches(p,m)).Select(m=>(object)new{name=m.FullName,token=Token(m),declaringType=m.DeclaringType.FullName,hasBody=m.HasBody,isImport=m.HasImplMap}).ToArray());
+  if(p.View=="imports")return Rows(methods.Where(m=>m.HasImplMap&&Matches(p,m)).Select(Import).ToArray());
+  if(p.View!="method"||!p.Token.HasValue)throw new InvalidOperationException("Method view requires a MethodDef token");var method=methods.SingleOrDefault(m=>Matches(p,m))??throw new InvalidOperationException("Selected MethodDef was not found in the exact captured module");var instructions=method.Body?.Instructions??[];return new{state="completed",complete=true,view=p.View,method=method.FullName,token=Token(method),attributes=method.Attributes.ToString(),implementation=method.ImplAttributes.ToString(),import=method.HasImplMap?Import(method):null,instructions=instructions.Skip(p.Offset).Take(p.Limit).Select(i=>new{offset=i.Offset,opcode=i.OpCode.Name,operand=Operand(i.Operand,instructions)}).ToArray(),totalInstructions=instructions.Count,limit=p.Limit,offset=p.Offset,truncated=p.Offset+p.Limit<instructions.Count,normalizedBodySha256=method.HasBody?Hash(JsonSerializer.Serialize(Body(method),Json)):null,parameters=method.Parameters.Select(v=>new{index=v.Index,name=v.Name,type=v.Type.FullName}).ToArray(),scope};
+ }
+ static object Compare(Plan p,ModuleDefMD left,ModuleDefMD right){Dictionary<string,MethodDef> Index(ModuleDefMD m){var types=m.GetTypes().Take(100001).ToArray();if(types.Length>100000)throw new InvalidOperationException("Assembly exceeds comparison type bound");var methods=types.SelectMany(t=>t.Methods).Where(method=>Matches(p,method)).Take(100001).ToArray();if(methods.Length>100000)throw new InvalidOperationException("Comparison exceeds 100000 methods; narrow with a type/filter");return methods.ToDictionary(m=>m.FullName,StringComparer.Ordinal);}
+  var a=Index(left);var b=Index(right);var changes=new List<object>();int unchanged=0;foreach(var name in a.Keys.Union(b.Keys).Order(StringComparer.Ordinal)){a.TryGetValue(name,out var l);b.TryGetValue(name,out var r);if(l is null||r is null){changes.Add(new{name,state=l is null?"added":"removed",left=l is null?null:Token(l),right=r is null?null:Token(r)});continue;}if(Fingerprint(l)==Fingerprint(r)){unchanged++;continue;}changes.Add(new{name,state="changed",left=Token(l),right=Token(r),ilChanged=Hash(JsonSerializer.Serialize(Body(l),Json))!=Hash(JsonSerializer.Serialize(Body(r),Json)),importChanged=JsonSerializer.Serialize(ImportState(l),Json)!=JsonSerializer.Serialize(ImportState(r),Json)});}
+  var ar=left.GetAssemblyRefs().Select(a=>a.FullName).Order(StringComparer.Ordinal).ToArray();var br=right.GetAssemblyRefs().Select(a=>a.FullName).Order(StringComparer.Ordinal).ToArray();return new{state="completed",complete=true,leftAssembly=left.Assembly?.FullName,rightAssembly=right.Assembly?.FullName,unchanged,total=changes.Count,items=changes.Skip(p.Offset).Take(p.Limit).ToArray(),limit=p.Limit,offset=p.Offset,truncated=p.Offset+p.Limit<changes.Count,referencesChanged=!ar.SequenceEqual(br),leftReferences=ar,rightReferences=br,scope="Static structural comparison by exact managed signature. Signature changes appear as removed/added methods; operands resolve to names and branch/local indices rather than unstable metadata RIDs. Dependencies/runtime/environment can change behavior despite equal IL. No target execution or automatic publication."};
+ }
+ public static int Main(string[] args){try{if(args.Length!=1||!Path.IsPathFullyQualified(args[0])||new FileInfo(args[0]).Length>16384)throw new InvalidOperationException("A bounded absolute private plan is required");var p=JsonSerializer.Deserialize<Plan>(File.ReadAllText(args[0]),new JsonSerializerOptions{PropertyNameCaseInsensitive=true})??throw new InvalidOperationException("Missing plan");if(p.Schema!=1||!Path.IsPathFullyQualified(p.Input)||new FileInfo(p.Input).Length>64*1024*1024||p.Limit<1||p.Limit>1000||p.Offset<0)throw new InvalidOperationException("Invalid metadata query bounds");var options=new ModuleCreationOptions{TryToLoadPdbFromDisk=false,Context=new ModuleContext(new NoAssemblyResolution())};using var input=ModuleDefMD.Load(p.Input,options);object result;if(p.Mode=="query")result=Query(p,input);else if(p.Mode=="compare"&&p.Other is not null&&Path.IsPathFullyQualified(p.Other)&&new FileInfo(p.Other).Length<=64*1024*1024){using var other=ModuleDefMD.Load(p.Other,options);result=Compare(p,input,other);}else throw new InvalidOperationException("Unknown static metadata operation");Console.WriteLine(JsonSerializer.Serialize(result,Json));return 0;}catch(Exception error){Console.WriteLine(JsonSerializer.Serialize(new{state="failed",error=error.Message.Length>4096?error.Message[..4096]:error.Message},Json));return 70;}}
+}

package/runtime/managed/insight-managed/README.md

@@ -0,0 +1,16 @@
+# First-party managed metadata capability
+
+This internal helper is not a standalone application or a separately installed tool.
+It runs under an existing private .NET 10 runtime. dnlib 4.5.0 is packaged with its full
+MIT license, exact NuGet URL/SHA and locked dependency metadata. Original library source:
+https://github.com/0xd4d/dnlib/tree/v4.5.0
+
+`build-managed-helper.mjs` requires maintainer SDK 10.0.303, builds twice from independent
+temporary directories, compares all four shipped artifacts and records source/binary
+hashes. Consumers require no SDK/compiler. PDB loading is disabled; target assemblies
+are parsed as metadata and are never loaded for execution. Comparisons use static
+structure, not semantic equivalence, and retain tokens scoped to each exact input.
+
+Method selection supports a case-insensitive short managed-name substring, independent of
+namespace, declaring type and signature. The existing full-name filter remains case-sensitive.
+Both filters apply before pagination; an overview/type query rejects a method-name filter.

package/runtime/managed/insight-managed/packages.lock.json

@@ -0,0 +1,13 @@
+{
+  "version": 1,
+  "dependencies": {
+    "net10.0": {
+      "dnlib": {
+        "type": "Direct",
+        "requested": "[4.5.0, )",
+        "resolved": "4.5.0",
+        "contentHash": "YkwstIbjyiJ12uGIAN8oSmImgVFkPHit7MJXPHvJqeKV1DMNqxZWszjHfykgiSs4Y/XmjnZts7pI2/AYme5/uA=="
+      }
+    }
+  }
+}

package/runtime/managed/insight-managed/provenance.json

@@ -0,0 +1,40 @@
+{
+  "schema": 1,
+  "sdk": "10.0.303",
+  "target": "net10.0",
+  "sourceLicense": "MIT",
+  "inputs": {
+    "Program.cs": "3cdfd46473dac5920cd23335cd3ae2c877ddf534714a22537e02a0af85618080",
+    "Insight.Managed.csproj": "7b7e0c1c36b99fe97920f5ad8fa760b37061e7ebb7ea53dfd3ef9db74b10eeb8",
+    "NuGet.Config": "7a77c63a438cdf0524dc336da4bf2191d3f259645de430f5a4c61b3edd52fa9f",
+    "packages.lock.json": "e01c42d403cd2dfaa4fead9496fb339c1c33e24c6c509a658d3ea7a8b4cba82e"
+  },
+  "files": {
+    "Insight.Managed.dll": {
+      "sha256": "5952a9a181d451954a380558dc1c988737e6246285f1f96f658425b32c967fec",
+      "size": 55808
+    },
+    "Insight.Managed.deps.json": {
+      "sha256": "d7fccba042e3b7b676a5dd392c480b4c509c6d5e222573b307907b4dee45bc88",
+      "size": 940
+    },
+    "Insight.Managed.runtimeconfig.json": {
+      "sha256": "9950d4583cfc9a106857c0d5b8a75b53e8774852b57b80bc3823a74d44a4d87f",
+      "size": 330
+    },
+    "dnlib.dll": {
+      "sha256": "3b88e0948e2a6c49e5372c7e7d27817f5d2fb7ffed949b40cc98a2e5037b73ef",
+      "size": 1182720
+    }
+  },
+  "reproducible": true,
+  "targetExecution": false,
+  "dependencies": {
+    "dnlib": {
+      "version": "4.5.0",
+      "nupkgSha256": "63bc2f9579568204cc8b30fa9f6700a231bcf868a8032e09118887af3eafee58",
+      "url": "https://api.nuget.org/v3-flatcontainer/dnlib/4.5.0/dnlib.4.5.0.nupkg",
+      "license": "MIT"
+    }
+  }
+}

package/runtime/native/binary/README.md

@@ -0,0 +1,22 @@
+# Packaged structured binary helper
+
+First-party MIT C++ facade linked statically against unmodified LIEF 1.0.0 (Apache-2.0)
+and its published dependencies. Consumer installation needs no compiler or SDK. Only
+system libc++/libSystem are linked dynamically. Native host profile: macOS14+ ARM64.
+
+The maintainer builder consumes the exact hash-bound SDK and original full source
+archive, extracts its bundled JSON header and builds twice in independent temporary
+directories with Apple clang 17.0.0/SDK26.0, reproducible linking and canonical source
+paths. Output hashes must match; source, original notices and binary hashes are checked
+before packaging. The library/source mirror URLs and original URLs are both recorded.
+
+All original available vendored notices are retained, including an explicit build/test
+superset. JSON's missing archive license is retained from its exact upstream version.
+The span source's original attribution/declaration and the official Boost license it
+references are retained; its old short source revision no longer resolves upstream.
+The full original header remains available in the mirrored LIEF source archive.
+
+Queries cover parsed structures and selected native linkage; malformed/omitted tables
+are never proof of global absence. The only edit assigns the original two-byte PE
+subsystem field on a new copy, verifies LIEF readback and proves every other byte equal.
+It never executes target code, repairs signatures or rewrites arbitrary binary data.

package/runtime/native/binary/dependencies.json

@@ -0,0 +1,166 @@
+{
+  "schema": 1,
+  "library": {
+    "name": "LIEF",
+    "version": "1.0.0",
+    "sdk": {
+      "name": "LIEF-1.0.0-Darwin-arm64.tar.gz",
+      "sha256": "c7bedf2e2acab9bced1c8701b06261fc6f4eba1957f80cbf86323a3f5e172167",
+      "url": "https://github.com/lief-project/LIEF/releases/download/1.0.0/LIEF-1.0.0-Darwin-arm64.tar.gz",
+      "mirror": "https://github.com/iXab3r/insight-cli/releases/download/tool-lief-1.0.0-r1/LIEF-1.0.0-Darwin-arm64.tar.gz"
+    },
+    "source": {
+      "name": "lief-1.0.0-source.tar.gz",
+      "sha256": "2cf412695ff739d82e129db441e5c2025f3bb4873a3d3a1d3dd4cf300b682abd",
+      "url": "https://codeload.github.com/lief-project/LIEF/tar.gz/refs/tags/1.0.0",
+      "mirror": "https://github.com/iXab3r/insight-cli/releases/download/tool-lief-1.0.0-r1/lief-1.0.0-source.tar.gz"
+    },
+    "license": "Apache-2.0"
+  },
+  "thirdPartySources": [
+    {
+      "name": "Catch2-3.12.0.zip",
+      "sha256": "e1e1592dbc971d9196b379aef1882f7d427ceaf0ecf6cae40b575d580dd83648",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "Melkor_ELF_Fuzzer-ac2495b.zip",
+      "sha256": "8cccc4ca5e05e305215cc74761413746b660b76f5869a563f52cec1f23d79f2e",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "expected-1.3.1.zip",
+      "sha256": "68bbfd81a6d312c4518b5a1831f465fa03811355af9aa9c7403348545d1d2a56",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "frozen-61dce5a.zip",
+      "sha256": "c94ba33d5369749e8d8ba12fb87d60de02ddac981051383a8d321968abb6a314",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "json-3.12.0.zip",
+      "sha256": "6a2249e5d61c2a8351abfac218e08e9a43426dddb493950d30f3b8acfbbc648d",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "mbedtls-4.0.0.r0.gec4044008d.zip",
+      "sha256": "01aec4471547dec5308853ff0d797611a68a521a10496898b626035dfdc07183",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "nanobind-2.13.0.r18.g4db9ed3f.zip",
+      "sha256": "e5a4617f3d0df623c84cdc7d56361ccc61e73d83029a1e006a82e283caf57c01",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "spdlog-1.17.0.zip",
+      "sha256": "b11912a82d149792fef33fabd0503b13d54aeac25c1464755461d4108ea71fc2",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "tcb-span-b70b0ff.zip",
+      "sha256": "f3d47ed83507fce94245a9f3cf97bc433cd1116f94d11ac0dca1a6f53bbeb239",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    },
+    {
+      "name": "utfcpp-4.0.9.zip",
+      "sha256": "73802895d0cf7b000cdf8e6ee5d69b963a829d4ea419562afd8f190adef87d5f",
+      "scope": "Published source/build/test superset; not a claim that every component is compiled"
+    }
+  ],
+  "notices": [
+    {
+      "path": "notices/LIEF-LICENSE.txt",
+      "sha256": "998dc6a9d251b4d9d4274d8a7e121fe20c33b1dfd4300bca276e87da23dc582e",
+      "origin": "LIEF-1.0.0/LICENSE"
+    },
+    {
+      "path": "notices/LIEF-attribution.txt",
+      "sha256": "14353f94305648fa88cf28a78fe92ea24420e7851802b8f01930b3f09eee2656",
+      "origin": "Original LIEF version header copyright and Apache license declaration"
+    },
+    {
+      "path": "notices/Catch2-3.12.0--Catch2-3.12.0__LICENSE.txt",
+      "sha256": "c9bff75738922193e67fa726fa225535870d2aa1059f91452c411736284ad566",
+      "origin": "LIEF third-party/Catch2-3.12.0.zip:Catch2-3.12.0/LICENSE.txt"
+    },
+    {
+      "path": "notices/Melkor_ELF_Fuzzer-ac2495b--elf_fuzzer-master__LICENSE.txt",
+      "sha256": "8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903",
+      "origin": "LIEF third-party/Melkor_ELF_Fuzzer-ac2495b.zip:elf_fuzzer-master/LICENSE.txt"
+    },
+    {
+      "path": "notices/expected-1.3.1--expected-1.3.1__COPYING",
+      "sha256": "a2010f343487d3f7618affe54f789f5487602331c0a8d03f49e9a7c547cf0499",
+      "origin": "LIEF third-party/expected-1.3.1.zip:expected-1.3.1/COPYING"
+    },
+    {
+      "path": "notices/frozen-61dce5a--frozen-61dce5ae18ca59931e27675c468e64118aba8744__AUTHORS",
+      "sha256": "e87cb6aaac199b412d4a0c85b3507891dfa5054a5b80169b07e39142a9226264",
+      "origin": "LIEF third-party/frozen-61dce5a.zip:frozen-61dce5ae18ca59931e27675c468e64118aba8744/AUTHORS"
+    },
+    {
+      "path": "notices/frozen-61dce5a--frozen-61dce5ae18ca59931e27675c468e64118aba8744__LICENSE",
+      "sha256": "f6099ed23682840ae60a76fce378faae9b5c75f7d162188883e13b790ca18b98",
+      "origin": "LIEF third-party/frozen-61dce5a.zip:frozen-61dce5ae18ca59931e27675c468e64118aba8744/LICENSE"
+    },
+    {
+      "path": "notices/mbedtls-4.0.0.r0.gec4044008d--LICENSE",
+      "sha256": "9b405ef4c89342f5eae1dd828882f931747f71001cfba7d114801039b52ad09b",
+      "origin": "LIEF third-party/mbedtls-4.0.0.r0.gec4044008d.zip:LICENSE"
+    },
+    {
+      "path": "notices/mbedtls-4.0.0.r0.gec4044008d--framework__LICENSE",
+      "sha256": "11402351e38392230bb8934ba1095c0c0049a296c0f8821f76e4672dff54b490",
+      "origin": "LIEF third-party/mbedtls-4.0.0.r0.gec4044008d.zip:framework/LICENSE"
+    },
+    {
+      "path": "notices/mbedtls-4.0.0.r0.gec4044008d--tf-psa-crypto__framework__LICENSE",
+      "sha256": "11402351e38392230bb8934ba1095c0c0049a296c0f8821f76e4672dff54b490",
+      "origin": "LIEF third-party/mbedtls-4.0.0.r0.gec4044008d.zip:tf-psa-crypto/framework/LICENSE"
+    },
+    {
+      "path": "notices/mbedtls-4.0.0.r0.gec4044008d--tf-psa-crypto__LICENSE",
+      "sha256": "da8c58f05f135a9d15e9ffad4ecf854cfcc1f014c8abfd75ba05f62630ccc118",
+      "origin": "LIEF third-party/mbedtls-4.0.0.r0.gec4044008d.zip:tf-psa-crypto/LICENSE"
+    },
+    {
+      "path": "notices/nanobind-2.13.0.r18.g4db9ed3f--LICENSE",
+      "sha256": "f305091a4e57805870b217a28ea4b1f16610eece8457d2370f822a9696b75836",
+      "origin": "LIEF third-party/nanobind-2.13.0.r18.g4db9ed3f.zip:LICENSE"
+    },
+    {
+      "path": "notices/nanobind-2.13.0.r18.g4db9ed3f--ext__robin_map__LICENSE",
+      "sha256": "11f2c685ba565a31aef1219f63a7a8845602c97bff70016b9e3278dfe51a2ec5",
+      "origin": "LIEF third-party/nanobind-2.13.0.r18.g4db9ed3f.zip:ext/robin_map/LICENSE"
+    },
+    {
+      "path": "notices/spdlog-1.17.0--spdlog-1.17.0__LICENSE",
+      "sha256": "d678c20826e1392578508e1c78649a1e3c31bda05ef4388d967dbd654461b140",
+      "origin": "LIEF third-party/spdlog-1.17.0.zip:spdlog-1.17.0/LICENSE"
+    },
+    {
+      "path": "notices/span-attribution.txt",
+      "sha256": "2bb98c5155725644491fe894aa468d0b76f17b90d378d0990d723b36e17cab85",
+      "origin": "LIEF third-party/tcb-span-b70b0ff.zip:span.hpp original attribution and license declaration"
+    },
+    {
+      "path": "notices/utfcpp-4.0.9--utfcpp-4.0.9__LICENSE",
+      "sha256": "c9bff75738922193e67fa726fa225535870d2aa1059f91452c411736284ad566",
+      "origin": "LIEF third-party/utfcpp-4.0.9.zip:utfcpp-4.0.9/LICENSE"
+    },
+    {
+      "path": "notices/json-LICENSE.MIT",
+      "sha256": "46a65cffd1ea955132d95a8dd921640714a8d6b537d2e4e482d31145ae95b603",
+      "origin": "https://raw.githubusercontent.com/nlohmann/json/v3.12.0/LICENSE.MIT"
+    },
+    {
+      "path": "notices/span-LICENSE_1_0.txt",
+      "sha256": "c9bff75738922193e67fa726fa225535870d2aa1059f91452c411736284ad566",
+      "origin": "https://www.boost.org/LICENSE_1_0.txt (license reference supplied by original span header)"
+    }
+  ],
+  "extendedFeatures": false,
+  "unmodifiedLibrary": true
+}

package/runtime/native/binary/helper.cpp

@@ -0,0 +1,44 @@
+// MIT first-party facade over the unmodified Apache-2.0 LIEF library.
+#include <LIEF/LIEF.hpp>
+#include "json.hpp"
+#include <fstream>
+#include <iostream>
+#include <sstream>
+#include <filesystem>
+#include <limits>
+using Json=nlohmann::json;
+static std::string hex(uint64_t value){std::ostringstream out;out<<"0x"<<std::hex<<value;return out.str();}
+static std::string label(const std::string& name){if(name.size()>4096)throw std::runtime_error("Binary metadata string exceeds 4096 bytes");return name;}
+static std::string format(const LIEF::Binary& binary){switch(binary.format()){case LIEF::Binary::PE:return "PE";case LIEF::Binary::ELF:return "ELF";case LIEF::Binary::MACHO:return "MachO";default:throw std::runtime_error("Only PE, ELF and thin Mach-O are admitted");}}
+static uint64_t absolute(uint64_t base,uint64_t rva){if(rva>std::numeric_limits<uint64_t>::max()-base)throw std::runtime_error("PE address overflow");return base+rva;}
+static Json query(const Json& plan,LIEF::Binary& binary){
+ const auto view=plan.value("view",std::string("overview"));const auto filter=plan.value("filter",std::string(""));const size_t limit=plan.value("limit",50),offset=plan.value("offset",0);Json rows=Json::array();size_t scanned=0,matching=0;bool complete=true;
+ auto add=[&](const std::string& name,Json row){if(++scanned>100000){complete=false;return false;}if(!filter.empty()&&name.find(filter)==std::string::npos)return true;if(matching++>=offset&&rows.size()<limit)rows.push_back(std::move(row));return true;};
+ Json result={{"state","completed"},{"complete",true},{"format",format(binary)},{"view",view},{"scope","Static parsed LIEF metadata; no target execution. Warnings or omitted/malformed tables do not prove absence. Addresses belong to this exact input and declared format; Mach-O universal containers require explicit slice extraction."}};
+ if(view=="overview"){
+  auto header=binary.header();Json data={{"architecture",LIEF::to_string(header.architecture())},{"objectType",LIEF::to_string(header.object_type())},{"entryPoint",hex(binary.entrypoint())},{"imageBase",hex(binary.imagebase())},{"sections",binary.sections().size()},{"libraries",binary.imported_libraries().size()},{"importedFunctions",binary.imported_functions().size()},{"exportedFunctions",binary.exported_functions().size()}};
+  if(auto* pe=dynamic_cast<LIEF::PE::Binary*>(&binary)){data["subsystem"]=static_cast<unsigned>(pe->optional_header().subsystem());data["hasAuthenticode"]=pe->has_signatures();}
+  result["data"]=data;return result;
+ }
+ if(view=="sections"){for(const auto& section:binary.sections())if(!add(section.name(),{{"name",label(section.name())},{"fileOffset",hex(section.offset())},{"fileSize",std::to_string(section.size())},{"virtualAddress",hex(section.virtual_address())}}))break;}
+ else if(view=="libraries"){for(const auto& library:binary.imported_libraries())if(!add(library,{{"name",label(library)}}))break;}
+ else if(view=="exports"){
+  if(auto* pe=dynamic_cast<LIEF::PE::Binary*>(&binary)){if(const auto* table=pe->get_export())for(const auto& symbol:table->entries()){Json row={{"name",label(symbol.name())},{"ordinal",symbol.ordinal()},{"rva",hex(symbol.address())},{"forwarded",symbol.is_forwarded()}};if(symbol.is_forwarded()){const auto forward=symbol.forward_information();row["forward"]={{"library",label(forward.library)},{"function",label(forward.function)}};}else row["virtualAddress"]=hex(absolute(binary.imagebase(),symbol.address()));if(!add(symbol.name(),row))break;}}
+  else for(const auto& symbol:binary.exported_functions())if(!add(symbol.name(),{{"name",label(symbol.name())},{"virtualAddress",hex(symbol.address())},{"forwarded",false}}))break;
+ }
+ else if(view=="imports"){
+  if(auto* pe=dynamic_cast<LIEF::PE::Binary*>(&binary)){bool stop=false;for(const auto& library:pe->imports()){for(const auto& entry:library.entries()){Json row={{"library",label(library.name())},{"byOrdinal",entry.is_ordinal()}};if(entry.is_ordinal())row["ordinal"]=entry.ordinal();else row["name"]=label(entry.name());if(!add(library.name()+"!"+entry.name(),row)){stop=true;break;}}if(stop)break;}}
+  else for(const auto& symbol:binary.imported_functions())if(!add(symbol.name(),{{"name",label(symbol.name())},{"virtualAddress",hex(symbol.address())},{"libraryKnown",false}}))break;
+ }
+ else throw std::runtime_error("Unknown structured binary view");
+ result["state"]=complete?"completed":"partial";result["complete"]=complete;if(!complete)result["reason"]="metadata_scan_bound";result["items"]=rows;result["matchingInScannedPrefix"]=matching;result["scannedRecords"]=std::min(scanned,size_t(100000));result["limit"]=limit;result["offset"]=offset;result["truncated"]=offset+limit<matching;return result;
+}
+static Json edit(const Json& plan,LIEF::Binary& binary){
+ auto* pe=dynamic_cast<LIEF::PE::Binary*>(&binary);if(!pe)throw std::runtime_error("Subsystem edit requires a PE input");const auto expected=plan.at("expectedSubsystem").get<unsigned>(),value=plan.at("subsystem").get<unsigned>();if((expected!=2&&expected!=3)||(value!=2&&value!=3)||expected==value)throw std::runtime_error("Select an actual guarded console/GUI subsystem change");if(static_cast<unsigned>(pe->optional_header().subsystem())!=expected)throw std::runtime_error("PE subsystem differs from the explicit expectation");
+ const uint64_t offset=uint64_t(pe->dos_header().addressof_new_exeheader())+4+20+68;const auto input=plan.at("input").get<std::string>(),output=plan.at("output").get<std::string>();std::ifstream in(input,std::ios::binary);std::vector<uint8_t> bytes((std::istreambuf_iterator<char>(in)),{});if(pe->header().sizeof_optional_header()<70||offset+2>bytes.size()||unsigned(bytes[offset]|(bytes[offset+1]<<8))!=expected)throw std::runtime_error("PE optional-header field binding failed");
+ if(std::filesystem::exists(output))throw std::runtime_error("Internal edit output already exists");bytes[offset]=static_cast<uint8_t>(value);bytes[offset+1]=0;std::ofstream out(output,std::ios::binary);out.write(reinterpret_cast<const char*>(bytes.data()),bytes.size());out.close();if(!out)throw std::runtime_error("New PE copy could not be completed");auto readback=LIEF::PE::Parser::parse(output);if(!readback||static_cast<unsigned>(readback->optional_header().subsystem())!=value)throw std::runtime_error("Independent LIEF readback rejected the new subsystem");
+ return {{"state","completed"},{"complete",true},{"format","PE"},{"changedField","optionalHeader.subsystem"},{"before",expected},{"after",value},{"fieldOffset",hex(offset)},{"byteRangeLength",2},{"scope","New copy, original preserved; exactly the existing two-byte subsystem field is assigned. Existing PE checksum/Authenticode signatures are not recomputed and may be invalidated. Header readback is not execution compatibility proof."}};
+}
+int main(int argc,char** argv){try{
+ if(argc!=2||!std::filesystem::path(argv[1]).is_absolute()||std::filesystem::file_size(argv[1])>16384)throw std::runtime_error("A bounded absolute private plan is required");std::ifstream file(argv[1]);const Json plan=Json::parse(file);const auto input=plan.at("input").get<std::string>();if(plan.at("schema")!=1||!std::filesystem::path(input).is_absolute()||std::filesystem::file_size(input)>64*1024*1024)throw std::runtime_error("Unsupported input size or identity");if(LIEF::MachO::is_fat(input))throw std::runtime_error("Select an explicit thin Mach-O slice; universal selection is not implicit");const auto limit=plan.value("limit",50),offset=plan.value("offset",0);if(limit<1||limit>500||offset<0||offset>1000000)throw std::runtime_error("Invalid query page bounds");auto binary=LIEF::Parser::parse(input);if(!binary)throw std::runtime_error("Input is not a parsed supported executable");const auto mode=plan.at("mode").get<std::string>();Json result;if(mode=="query")result=query(plan,*binary);else if(mode=="edit-subsystem")result=edit(plan,*binary);else throw std::runtime_error("Unknown binary operation");std::cout<<result.dump()<<'\n';return 0;
+ }catch(const std::exception& error){std::cout<<Json({{"state","failed"},{"error",std::string(error.what()).substr(0,4096)}}).dump()<<'\n';return 70;}}

package/runtime/native/binary/notices/Catch2-3.12.0--Catch2-3.12.0__LICENSE.txt

@@ -0,0 +1,23 @@
+Boost Software License - Version 1.0 - August 17th, 2003
+
+Permission is hereby granted, free of charge, to any person or organization
+obtaining a copy of the software and accompanying documentation covered by
+this license (the "Software") to use, reproduce, display, distribute,
+execute, and transmit the Software, and to prepare derivative works of the
+Software, and to permit third-parties to whom the Software is furnished to
+do so, all subject to the following:
+
+The copyright notices in the Software and this entire statement, including
+the above license grant, this restriction and the following disclaimer,
+must be included in all copies of the Software, in whole or in part, and
+all derivative works of the Software, unless such copies or derivative
+works are solely in the form of machine-executable object code generated by
+a source language processor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.