rea-agents 6.3.0 → 6.5.0

package/dist/native/AppleMachoFixups.js

@@ -33,7 +33,8 @@ const readImport = (data, header, index) => {
     const at = base + header.offset + index * size;
     if (header.format === 3) {
         const word = bytes.readBigUInt64LE(at);
-        const ordinal = Number(signed(bits(word, 0, 16), 16));
+        const encodedOrdinal = Number(bits(word, 0, 16));
+        const ordinal = encodedOrdinal > 0xfff0 ? encodedOrdinal - 0x10000 : encodedOrdinal;
         return {
             symbol: cString(bytes, base + header.symbols + Number(bits(word, 32, 32)), end),
             library: libraryName(ordinal, dylibs),
@@ -42,7 +43,8 @@ const readImport = (data, header, index) => {
         };
     }
     const word = bytes.readUInt32LE(at);
-    const ordinal = Number(signed(BigInt(word & 0xff), 8));
+    const encodedOrdinal = word & 0xff;
+    const ordinal = encodedOrdinal > 0xf0 ? encodedOrdinal - 0x100 : encodedOrdinal;
     return {
         symbol: cString(bytes, base + header.symbols + (word >>> 9), end),
         library: libraryName(ordinal, dylibs),
@@ -83,12 +85,49 @@ export const decodeChainedPointer = (raw, format, baseAddress, imports) => {
     }
     throw new RangeError(`Unsupported chained pointer format ${format}`);
 };
-const chainedFixups = (image, range) => {
+/** Parse one physical page; a failed tail retains established locations. */
+const readChainedPage = (bytes, source) => {
+    let locations = new Uint8Array(0);
+    let lastOffset;
+    let failure;
+    try {
+        if ((source.start & 0x8000) !== 0)
+            throw new RangeError("Multiple chained starts are not valid for 64-bit pointers");
+        if (source.start + 8 > source.size)
+            throw new RangeError("Chained pointer leaves its file-backed page");
+        // At most one eighth of this file-backed page, not one object per fixup.
+        locations = new Uint8Array(Math.ceil(source.size / 8));
+        const generic = source.format === 2 || source.format === 6;
+        let at = source.start;
+        while (true) {
+            locations[at >>> 3] = (locations[at >>> 3] ?? 0) | (1 << (at & 7));
+            lastOffset = at;
+            const raw = bytes.readBigUInt64LE(source.offset + at);
+            const next = Number(bits(raw, 51, generic ? 12 : 11)) * (generic ? 4 : 8);
+            if (next === 0)
+                break;
+            if (at + next + 8 > source.size)
+                throw new RangeError("Chained pointer link leaves its file-backed page");
+            at += next;
+        }
+    }
+    catch (cause) {
+        failure = cause instanceof Error ? cause.message : String(cause);
+    }
+    return { locations, lastOffset, failure };
+};
+const chainedFixups = (image, range, unreadRebaseBytes) => {
     const { bytes, segments, dylibs, baseAddress } = image;
     const base = range.offset;
     const end = range.offset + range.size;
-    if (range.size < 28 || end > bytes.length)
+    if (!Number.isSafeInteger(base) ||
+        base < 0 ||
+        !Number.isSafeInteger(range.size) ||
+        range.size < 28 ||
+        end > bytes.length)
         throw new RangeError("Chained fixup header exceeds the target");
+    if (bytes.readUInt32LE(base) !== 0)
+        throw new RangeError("Unsupported chained fixup header version");
     const startsOffset = bytes.readUInt32LE(base + 4);
     const importHeader = {
         offset: bytes.readUInt32LE(base + 8),
@@ -100,53 +139,176 @@ const chainedFixups = (image, range) => {
     const importTableEnd = base + importHeader.offset + importHeader.count * importSize;
     if (importHeader.format < 1 || importHeader.format > 3)
         throw new RangeError(`Unsupported chained import format ${importHeader.format}`);
-    if (!Number.isSafeInteger(importHeader.count) || importTableEnd > end)
+    if (importHeader.offset < 28 ||
+        importHeader.symbols < importHeader.offset ||
+        importTableEnd > base + importHeader.symbols ||
+        base + importHeader.symbols > end)
         throw new RangeError("Chained import table exceeds the fixup data");
     const imports = (index) => readImport({ bytes, base, end, dylibs }, importHeader, index);
     if (bytes.readUInt32LE(base + 24) !== 0)
         throw new RangeError("Compressed chained-fixup symbol names are not supported");
     const starts = base + startsOffset;
+    const startsEnd = base + importHeader.offset;
+    const requireStartsRange = (at, size) => {
+        if (at < base + 28 || at > startsEnd - size)
+            throw new RangeError("Chained starts table exceeds its fixup data");
+    };
+    requireStartsRange(starts, 4);
     const segmentCount = bytes.readUInt32LE(starts);
+    if (segmentCount > segments.length)
+        throw new RangeError("Chained starts segment count exceeds the Mach-O layout");
+    requireStartsRange(starts, 4 + segmentCount * 4);
     const ranges = [];
+    // A non-overlapping file view has at most file-size/minimum-page-size
+    // pages plus two partial pages per segment. Keep both metadata entries and
+    // bitmap bytes within that format-derived working set. Aliased/exhausted
+    // views remain readable by transient recomputation, not input rejection.
+    const maximumCachedPages = Math.ceil(bytes.length / 0x1000) + 2 * segmentCount;
+    let remainingLocationBytes = Math.ceil(bytes.length / 8);
+    const cachedPages = new Map();
+    const pageFacts = (chain, page, start) => {
+        const pageOffset = page * chain.pageSize;
+        const source = {
+            offset: chain.segment.offset + pageOffset,
+            size: Math.min(chain.pageSize, Number(chain.segment.size) - pageOffset, bytes.length - chain.segment.offset - pageOffset),
+            format: chain.format,
+            start,
+        };
+        const key = `${source.offset}:${source.size}:${source.format}:${source.start}`;
+        const cached = cachedPages.get(key);
+        if (cached !== undefined)
+            return cached;
+        // Decide retention before allocating the page facts. An exhausted cache
+        // uses only one transient, format-bounded page, preserving decode behavior.
+        const retain = cachedPages.size < maximumCachedPages &&
+            Math.ceil(Math.max(source.size, 0) / 8) <= remainingLocationBytes;
+        const facts = readChainedPage(bytes, source);
+        if (retain) {
+            remainingLocationBytes -= facts.locations.byteLength;
+            cachedPages.set(key, facts);
+        }
+        return facts;
+    };
     for (let index = 0; index < segmentCount; index++) {
         const infoOffset = bytes.readUInt32LE(starts + 4 + index * 4);
         if (infoOffset === 0)
             continue;
         const segment = segments[index];
-        if (segment === undefined || starts + infoOffset + 22 > end)
+        if (segment === undefined)
             throw new RangeError("Chained fixup segment table is out of range");
+        const info = starts + infoOffset;
+        requireStartsRange(info, 22);
+        const infoSize = bytes.readUInt32LE(info);
+        const pageSize = bytes.readUInt16LE(info + 4);
+        const pageCount = bytes.readUInt16LE(info + 20);
+        if (infoSize < 22 + pageCount * 2)
+            throw new RangeError("Chained page starts exceed the segment table size");
+        requireStartsRange(info, infoSize);
+        if (pageSize !== 0x1000 && pageSize !== 0x4000)
+            throw new RangeError("Chained page size must be 4096 or 16384 bytes");
+        if (bytes.readBigUInt64LE(info + 8) !== segment.address - baseAddress)
+            throw new RangeError("Chained segment offset disagrees with its Mach-O layout");
         ranges.push({
-            from: segment.address,
-            to: segment.address + segment.size,
-            format: bytes.readUInt16LE(starts + infoOffset + 6),
+            segment,
+            format: bytes.readUInt16LE(info + 6),
+            pageSize,
+            pageCount,
+            pageStarts: info + 22,
         });
     }
     const formats = [
         ...new Set(ranges.map(({ format }) => POINTER_FORMATS[format] ?? `format-${format}`)),
     ];
-    const issues = ranges.flatMap(({ format, from }) => POINTER_FORMATS[format] === undefined
+    const issues = ranges.flatMap(({ format, segment }) => POINTER_FORMATS[format] === undefined
         ? [
-            issue("pointer_fixups", "unsupported_pointer_format", `Unsupported chained pointer format ${format}`, `0x${from.toString(16)}`),
+            issue("pointer_fixups", "unsupported_pointer_format", `Unsupported chained pointer format ${format}`, `0x${segment.address.toString(16)}`),
         ]
         : []);
+    const examinedViews = new Map();
+    const decodedRanges = new Set();
+    for (const [chainIndex, chain] of ranges.entries()) {
+        // Unknown formats retain their compact starts table; only a queried page
+        // needs its NONE/presence value. Do not expand unsupported declarations.
+        if (POINTER_FORMATS[chain.format] === undefined)
+            continue;
+        const view = `${chain.pageStarts}:${chain.segment.offset}:${chain.segment.size}:${chain.segment.address}:${chain.format}:${chain.pageSize}:${chain.pageCount}`;
+        const prior = examinedViews.get(view);
+        if (prior !== undefined) {
+            if (prior)
+                decodedRanges.add(chainIndex);
+            continue;
+        }
+        let complete = true;
+        for (let page = 0; page < chain.pageCount; page++) {
+            const start = bytes.readUInt16LE(chain.pageStarts + page * 2);
+            if (start === 0xffff)
+                continue;
+            const facts = pageFacts(chain, page, start);
+            if (facts.failure !== undefined) {
+                complete = false;
+                issues.push(issue("pointer_fixups", "chained_pointer_walk_failed", facts.failure, `0x${(chain.segment.address + BigInt(page * chain.pageSize)).toString(16)}`));
+                // Coverage is partial after this failure, not exhaustive. Keep the
+                // unexpanded descriptor: later pages are still independently readable
+                // through pageFacts when metadata requests them.
+                break;
+            }
+        }
+        examinedViews.set(view, complete);
+        if (complete)
+            decodedRanges.add(chainIndex);
+    }
+    const failures = issues.map(({ message }) => message);
     return {
         kind: "chained",
         formats,
-        failures: issues.map(({ message }) => message),
+        failures,
         issues,
+        examined: Math.max(ranges.length, 1),
+        get decoded() {
+            return ranges.length === 0 ? 1 : decodedRanges.size;
+        },
+        unreadRebaseBytes,
         decode(address, raw) {
-            const segment = ranges.find(({ from, to }) => address >= from && address < to);
+            const chainIndex = ranges.findIndex(({ segment }) => address >= segment.address &&
+                address < segment.address + segment.size);
+            const chain = ranges[chainIndex];
             // Pointers outside fixup segments, such as in __TEXT, are stored plainly.
-            if (segment === undefined)
+            if (chain === undefined)
+                return { kind: "rebase", target: raw };
+            const within = Number(address - chain.segment.address);
+            const page = Math.floor(within / chain.pageSize);
+            if (page >= chain.pageCount)
                 return { kind: "rebase", target: raw };
-            if (raw === 0n)
-                return { kind: "rebase", target: 0n };
-            if (POINTER_FORMATS[segment.format] === undefined)
+            const start = bytes.readUInt16LE(chain.pageStarts + page * 2);
+            if (start === 0xffff)
+                return { kind: "rebase", target: raw };
+            if (POINTER_FORMATS[chain.format] === undefined)
                 return {
                     kind: "unsupported",
-                    reason: `Unsupported chained pointer format ${segment.format}`,
+                    reason: `Unsupported chained pointer format ${chain.format}`,
                 };
-            return decodeChainedPointer(raw, segment.format, baseAddress, imports);
+            try {
+                const facts = pageFacts(chain, page, start);
+                const at = within % chain.pageSize;
+                const locations = facts.locations;
+                if (((locations[at >>> 3] ?? 0) & (1 << (at & 7))) !== 0)
+                    return decodeChainedPointer(raw, chain.format, baseAddress, imports);
+                if (facts.failure !== undefined &&
+                    (facts.lastOffset === undefined || at > facts.lastOffset))
+                    throw new RangeError(facts.failure);
+                return { kind: "rebase", target: raw };
+            }
+            catch (cause) {
+                const reason = cause instanceof Error ? cause.message : String(cause);
+                const location = `0x${address.toString(16)}`;
+                if (!issues.some((entry) => entry.code === "chained_pointer_decode_failed" &&
+                    entry.location === location)) {
+                    issues.push(issue("pointer_fixups", "chained_pointer_decode_failed", reason, location));
+                    failures.push(reason);
+                }
+                decodedRanges.delete(chainIndex);
+                return { kind: "unsupported", reason };
+            }
         },
     };
 };
@@ -211,6 +373,7 @@ const setBindRegister = (image, stream, state, byte) => {
             const segment = image.segments[immediate];
             if (segment === undefined)
                 throw new RangeError("Bind segment index is out of range");
+            state.segmentIndex = immediate;
             state.address = segment.address + uleb(bytes, cursor, end);
             return true;
         }
@@ -232,21 +395,52 @@ const readBindStream = (image, range, binds) => {
     const cursor = { at: range.offset };
     const state = {
         ordinal: 0,
+        segmentIndex: -1,
         symbol: "",
         weak: false,
         addend: 0n,
         address: 0n,
     };
-    const bind = (skip) => {
-        binds.set(state.address, {
+    const preflightRun = (count, skip) => {
+        if (count === 0n)
+            return;
+        const segment = image.segments[state.segmentIndex];
+        if (segment === undefined)
+            throw new RangeError("Bind location has no selected segment");
+        const stride = 8n + skip;
+        const end = state.address + (count - 1n) * stride + 8n;
+        if (state.address < segment.address || end > segment.address + segment.size)
+            throw new RangeError("Bind expansion leaves its file-backed segment");
+    };
+    const bind = (count, skip) => {
+        if (count === 0n)
+            return;
+        preflightRun(count, skip);
+        const stride = 8n + skip;
+        const binding = {
             symbol: state.symbol,
             library: range.stream === "weak"
                 ? null
                 : libraryName(state.ordinal, image.dylibs),
             weak: state.weak,
             addend: state.addend,
-        });
-        state.address += 8n + skip;
+        };
+        const previous = binds.at(-1);
+        if (previous !== undefined &&
+            previous.stride === stride &&
+            previous.start + previous.count * stride === state.address &&
+            previous.binding.symbol === binding.symbol &&
+            previous.binding.library === binding.library &&
+            previous.binding.weak === binding.weak &&
+            previous.binding.addend === binding.addend) {
+            previous.count += count;
+        }
+        else {
+            binds.push({ start: state.address, count, stride, binding });
+        }
+        // The dyld bind stream advances addresses modulo 64 bits; ld uses -8 to
+        // bind the current pointer slot again with DO_BIND_ADD_ADDR_ULEB.
+        state.address = (state.address + count * stride) & 0xffffffffffffffffn;
     };
     while (cursor.at < end) {
         const byte = bytes[cursor.at++] ?? 0;
@@ -259,19 +453,20 @@ const readBindStream = (image, range, binds) => {
                     return;
                 break;
             case 0x90:
-                bind(0n);
+                bind(1n, 0n);
                 break;
             case 0xa0:
-                bind(uleb(bytes, cursor, end));
+                bind(1n, uleb(bytes, cursor, end));
                 break;
             case 0xb0:
-                bind(BigInt(byte & 0x0f) * 8n);
+                bind(1n, BigInt(byte & 0x0f) * 8n);
                 break;
             case 0xc0: {
+                if (range.stream === "lazy")
+                    throw new RangeError("Lazy bind streams do not support repeated bind opcodes");
                 const count = uleb(bytes, cursor, end);
                 const skip = uleb(bytes, cursor, end);
-                for (let index = 0n; index < count; index++)
-                    bind(skip);
+                bind(count, skip);
                 break;
             }
             default:
@@ -282,21 +477,28 @@ const readBindStream = (image, range, binds) => {
 /** Build pointer decoding for one slice from its fixup load commands. */
 export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
     const image = { bytes, segments, dylibs: commands.dylibs, baseAddress };
-    if (commands.chained !== null)
-        return chainedFixups(image, commands.chained);
+    const unreadRebaseBytes = commands.rebases.reduce((total, rebase) => total + rebase.size, 0);
+    if (commands.chained !== null) {
+        return chainedFixups(image, commands.chained, unreadRebaseBytes);
+    }
     if (commands.binds.length === 0)
         return {
             kind: "none",
             formats: [],
             failures: [],
             issues: [],
+            examined: 0,
+            decoded: 0,
+            unreadRebaseBytes,
             decode: (_address, raw) => ({ kind: "rebase", target: raw }),
         };
-    const binds = new Map();
+    const binds = [];
     const failures = [];
+    let decoded = 0;
     for (const stream of commands.binds)
         try {
             readBindStream(image, stream, binds);
+            decoded++;
         }
         catch (cause) {
             failures.push(`${stream.stream} bind opcodes: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -306,11 +508,28 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
         formats: [],
         failures,
         issues: failures.map((message) => issue("pointer_fixups", "bind_stream_decode_failed", message)),
+        examined: commands.binds.length,
+        decoded,
+        unreadRebaseBytes,
         decode(address, raw) {
-            const bound = binds.get(address);
-            return bound === undefined
+            let match;
+            for (const run of binds) {
+                const { start, count, stride } = run;
+                const distance = address - start;
+                if (distance >= 0n &&
+                    distance % stride === 0n &&
+                    distance / stride < count) {
+                    if (match !== undefined)
+                        return {
+                            kind: "unsupported",
+                            reason: `Ambiguous bind records target pointer location 0x${address.toString(16)}`,
+                        };
+                    match = run;
+                }
+            }
+            return match === undefined
                 ? { kind: "rebase", target: raw }
-                : { kind: "bind", ...bound };
+                : { kind: "bind", ...match.binding };
         },
     };
 };

package/dist/native/AppleMachoSelection.js

@@ -1,3 +1,5 @@
+import { MACHO_ARCHITECTURE_POLICIES, machoSubtypeRank, } from "./MachoArchitectureSelection.js";
+import { machoCpuSubtypeBase } from "../domain/apple/machoCpuIdentity.js";
 import { readFatSliceDeclarations, validateFatSlice, } from "../domain/apple/machoContainer.js";
 const hex = (value) => `0x${value.toString(16)}`;
 /** Classify a FAT magic word; thin Mach-O returns null. */
@@ -35,7 +37,9 @@ export const selectMachoSlice = (bytes, architecture) => {
     const headerEnd = 8 + count * stride;
     if (count > 128 || headerEnd > bytes.length)
         throw malformed("Malformed FAT architecture table");
-    const cpu = architecture === "arm64" ? 0x0100000c : 0x01000007;
+    const policy = MACHO_ARCHITECTURE_POLICIES[architecture];
+    if (policy === undefined)
+        throw invalid("Requested FAT architecture is absent");
     const declarations = readFatSliceDeclarations(bytes.subarray(8, headerEnd), {
         count,
         wide: fat64,
@@ -43,28 +47,46 @@ export const selectMachoSlice = (bytes, architecture) => {
     });
     if (declarations.status !== "parsed")
         throw malformed(declarations.reason);
-    let selected;
+    let best;
+    let bestRank = Number.POSITIVE_INFINITY;
+    let ambiguous = false;
     for (const declaration of declarations.slices) {
         const issue = validateFatSlice(declaration, bytes.length, headerEnd);
         if (issue !== null)
             throw malformed(issue);
-        if (declaration.cpuType !== cpu)
+        if (declaration.cpuType !== policy.cpuType)
             continue;
-        if (selected !== undefined)
-            throw invalid("Ambiguous FAT architecture slice");
-        selected = {
-            slice: declaration.offset,
-            sliceEnd: declaration.offset + declaration.size,
-            fatDeclaration: {
-                ...declaration,
-                tableEnd: headerEnd,
-            },
-        };
+        const rank = machoSubtypeRank(policy, declaration.cpuSubtype);
+        if (best !== undefined && rank >= bestRank) {
+            // Equal ranks keep FAT table order unless the slices share a subtype.
+            if (rank === bestRank &&
+                machoCpuSubtypeBase(declaration.cpuSubtype) ===
+                    machoCpuSubtypeBase(best.cpuSubtype))
+                ambiguous = true;
+            continue;
+        }
+        best = declaration;
+        bestRank = rank;
+        ambiguous = false;
     }
-    if (selected === undefined)
+    if (best === undefined)
         throw invalid("Requested FAT architecture is absent");
+    if (ambiguous)
+        throw invalid("Ambiguous FAT architecture slice");
+    const selected = {
+        slice: best.offset,
+        sliceEnd: best.offset + best.size,
+        fatDeclaration: { ...best, tableEnd: headerEnd },
+    };
+    if (selected.slice + 4 > bytes.length)
+        throw malformed("Truncated Mach-O header");
+    const sliceMagic = bytes.readUInt32LE(selected.slice);
+    if (sliceMagic === MH_MAGIC || sliceMagic === MH_CIGAM)
+        throw invalid(`Unsupported 32-bit Mach-O metadata for requested CPU type ${architecture}`);
     return selected;
 };
+const MH_MAGIC = 0xfeedface;
+const MH_CIGAM = 0xcefaedfe;
 /** Parse segments/sections for a little-endian 64-bit Mach-O architecture slice. */
 export const parseMachoLayout = (bytes, architecture) => {
     if (bytes.length < 4)
@@ -95,6 +117,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         sections: [],
         dylibs: [],
         binds: [],
+        rebases: [],
         chained: null,
         baseAddress: undefined,
     };
@@ -115,7 +138,7 @@ export const parseMachoLayout = (bytes, architecture) => {
             collectFixupCommand(bytes, command, state);
         cursor += command.size;
     }
-    const { segments, sections, chained, binds, dylibs } = state;
+    const { segments, sections, chained, binds, rebases, dylibs } = state;
     const offset = (address, size = 1) => {
         const matches = segments.filter((segment) => address >= segment.address &&
             address + BigInt(size) <= segment.address + segment.size);
@@ -130,7 +153,7 @@ export const parseMachoLayout = (bytes, architecture) => {
         segments,
         sections,
         offset,
-        fixups: { chained, binds, dylibs },
+        fixups: { chained, binds, rebases, dylibs },
         baseAddress: state.baseAddress ?? 0n,
     };
 };
@@ -160,7 +183,8 @@ const collectSegment = (bytes, { cursor, size }, state) => {
         state.sections.push({
             name: bytes
                 .subarray(position, position + 16)
-                .toString("ascii")
+                // ASCII decoding masks high bits and can fabricate known metadata names.
+                .toString("latin1")
                 .replace(/\0.*$/u, ""),
             address: bytes.readBigUInt64LE(position + 32),
             size: Number(sectionSize),
@@ -190,6 +214,9 @@ const collectFixupCommand = (bytes, { cursor, kind, size }, state) => {
     else if (kind === LC_DYLD_INFO || kind === LC_DYLD_INFO_ONLY) {
         if (size < 48)
             throw new RangeError("Truncated dyld-info command");
+        const rebase = range(cursor + 8);
+        if (rebase.size > 0)
+            state.rebases.push(rebase);
         for (const [at, stream] of [
             [cursor + 16, "bind"],
             [cursor + 24, "weak"],

package/dist/native/AppleObjcCategories.js

@@ -11,7 +11,7 @@ export const boundClassName = (read, field) => {
  * name, cls, instanceMethods, classMethods, protocols, instanceProperties.
  */
 export const decodeObjcCategories = (input) => {
-    const { read, result, failures } = input;
+    const { read, result } = input;
     let examined = 0;
     for (const section of input.sections.filter(({ name }) => name === "__objc_catlist")) {
         if (section.size % 8 !== 0)
@@ -54,7 +54,6 @@ export const decodeObjcCategories = (input) => {
             }
             catch (cause) {
                 const message = cause instanceof Error ? cause.message : String(cause);
-                failures.push(`Category at 0x${field.toString(16)}: ${message}`);
                 input.issues.push(issue("objc_properties_categories", "category_decode_failed", message, `0x${field.toString(16)}`));
             }
         }