rea-agents 6.4.0 → 6.7.0

package/dist/native/AppleMachoFixups.js

@@ -33,7 +33,8 @@ const readImport = (data, header, index) => {
     const at = base + header.offset + index * size;
     if (header.format === 3) {
         const word = bytes.readBigUInt64LE(at);
-        const ordinal = Number(signed(bits(word, 0, 16), 16));
+        const encodedOrdinal = Number(bits(word, 0, 16));
+        const ordinal = encodedOrdinal > 0xfff0 ? encodedOrdinal - 0x10000 : encodedOrdinal;
         return {
             symbol: cString(bytes, base + header.symbols + Number(bits(word, 32, 32)), end),
             library: libraryName(ordinal, dylibs),
@@ -42,7 +43,8 @@ const readImport = (data, header, index) => {
         };
     }
     const word = bytes.readUInt32LE(at);
-    const ordinal = Number(signed(BigInt(word & 0xff), 8));
+    const encodedOrdinal = word & 0xff;
+    const ordinal = encodedOrdinal > 0xf0 ? encodedOrdinal - 0x100 : encodedOrdinal;
     return {
         symbol: cString(bytes, base + header.symbols + (word >>> 9), end),
         library: libraryName(ordinal, dylibs),
@@ -83,12 +85,49 @@ export const decodeChainedPointer = (raw, format, baseAddress, imports) => {
     }
     throw new RangeError(`Unsupported chained pointer format ${format}`);
 };
-const chainedFixups = (image, range) => {
+/** Parse one physical page; a failed tail retains established locations. */
+const readChainedPage = (bytes, source) => {
+    let locations = new Uint8Array(0);
+    let lastOffset;
+    let failure;
+    try {
+        if ((source.start & 0x8000) !== 0)
+            throw new RangeError("Multiple chained starts are not valid for 64-bit pointers");
+        if (source.start + 8 > source.size)
+            throw new RangeError("Chained pointer leaves its file-backed page");
+        // At most one eighth of this file-backed page, not one object per fixup.
+        locations = new Uint8Array(Math.ceil(source.size / 8));
+        const generic = source.format === 2 || source.format === 6;
+        let at = source.start;
+        while (true) {
+            locations[at >>> 3] = (locations[at >>> 3] ?? 0) | (1 << (at & 7));
+            lastOffset = at;
+            const raw = bytes.readBigUInt64LE(source.offset + at);
+            const next = Number(bits(raw, 51, generic ? 12 : 11)) * (generic ? 4 : 8);
+            if (next === 0)
+                break;
+            if (at + next + 8 > source.size)
+                throw new RangeError("Chained pointer link leaves its file-backed page");
+            at += next;
+        }
+    }
+    catch (cause) {
+        failure = cause instanceof Error ? cause.message : String(cause);
+    }
+    return { locations, lastOffset, failure };
+};
+const chainedFixups = (image, range, unreadRebaseBytes) => {
     const { bytes, segments, dylibs, baseAddress } = image;
     const base = range.offset;
     const end = range.offset + range.size;
-    if (range.size < 28 || end > bytes.length)
+    if (!Number.isSafeInteger(base) ||
+        base < 0 ||
+        !Number.isSafeInteger(range.size) ||
+        range.size < 28 ||
+        end > bytes.length)
         throw new RangeError("Chained fixup header exceeds the target");
+    if (bytes.readUInt32LE(base) !== 0)
+        throw new RangeError("Unsupported chained fixup header version");
     const startsOffset = bytes.readUInt32LE(base + 4);
     const importHeader = {
         offset: bytes.readUInt32LE(base + 8),
@@ -100,85 +139,216 @@ const chainedFixups = (image, range) => {
     const importTableEnd = base + importHeader.offset + importHeader.count * importSize;
     if (importHeader.format < 1 || importHeader.format > 3)
         throw new RangeError(`Unsupported chained import format ${importHeader.format}`);
-    if (!Number.isSafeInteger(importHeader.count) || importTableEnd > end)
+    if (importHeader.offset < 28 ||
+        importHeader.symbols < importHeader.offset ||
+        importTableEnd > base + importHeader.symbols ||
+        base + importHeader.symbols > end)
         throw new RangeError("Chained import table exceeds the fixup data");
     const imports = (index) => readImport({ bytes, base, end, dylibs }, importHeader, index);
     if (bytes.readUInt32LE(base + 24) !== 0)
         throw new RangeError("Compressed chained-fixup symbol names are not supported");
     const starts = base + startsOffset;
+    const startsEnd = base + importHeader.offset;
+    const requireStartsRange = (at, size) => {
+        if (at < base + 28 || at > startsEnd - size)
+            throw new RangeError("Chained starts table exceeds its fixup data");
+    };
+    requireStartsRange(starts, 4);
     const segmentCount = bytes.readUInt32LE(starts);
+    if (segmentCount > segments.length)
+        throw new RangeError("Chained starts segment count exceeds the Mach-O layout");
+    requireStartsRange(starts, 4 + segmentCount * 4);
     const ranges = [];
+    // A non-overlapping file view has at most file-size/minimum-page-size
+    // pages plus two partial pages per segment. Keep both metadata entries and
+    // bitmap bytes within that format-derived working set. Aliased/exhausted
+    // views remain readable by transient recomputation, not input rejection.
+    const maximumCachedPages = Math.ceil(bytes.length / 0x1000) + 2 * segmentCount;
+    let remainingLocationBytes = Math.ceil(bytes.length / 8);
+    const cachedPages = new Map();
+    const pageFacts = (chain, page, start) => {
+        const pageOffset = page * chain.pageSize;
+        const source = {
+            offset: chain.segment.offset + pageOffset,
+            size: Math.min(chain.pageSize, Number(chain.segment.size) - pageOffset, bytes.length - chain.segment.offset - pageOffset),
+            format: chain.format,
+            start,
+        };
+        const key = `${source.offset}:${source.size}:${source.format}:${source.start}`;
+        const cached = cachedPages.get(key);
+        if (cached !== undefined)
+            return cached;
+        // Decide retention before allocating the page facts. An exhausted cache
+        // uses only one transient, format-bounded page, preserving decode behavior.
+        const retain = cachedPages.size < maximumCachedPages &&
+            Math.ceil(Math.max(source.size, 0) / 8) <= remainingLocationBytes;
+        const facts = readChainedPage(bytes, source);
+        if (retain) {
+            remainingLocationBytes -= facts.locations.byteLength;
+            cachedPages.set(key, facts);
+        }
+        return facts;
+    };
     for (let index = 0; index < segmentCount; index++) {
         const infoOffset = bytes.readUInt32LE(starts + 4 + index * 4);
         if (infoOffset === 0)
             continue;
         const segment = segments[index];
-        if (segment === undefined || starts + infoOffset + 22 > end)
+        if (segment === undefined)
             throw new RangeError("Chained fixup segment table is out of range");
+        const info = starts + infoOffset;
+        requireStartsRange(info, 22);
+        const infoSize = bytes.readUInt32LE(info);
+        const pageSize = bytes.readUInt16LE(info + 4);
+        const pageCount = bytes.readUInt16LE(info + 20);
+        if (infoSize < 22 + pageCount * 2)
+            throw new RangeError("Chained page starts exceed the segment table size");
+        requireStartsRange(info, infoSize);
+        if (pageSize !== 0x1000 && pageSize !== 0x4000)
+            throw new RangeError("Chained page size must be 4096 or 16384 bytes");
+        if (bytes.readBigUInt64LE(info + 8) !== segment.address - baseAddress)
+            throw new RangeError("Chained segment offset disagrees with its Mach-O layout");
         ranges.push({
-            from: segment.address,
-            to: segment.address + segment.size,
-            format: bytes.readUInt16LE(starts + infoOffset + 6),
+            segment,
+            format: bytes.readUInt16LE(info + 6),
+            pageSize,
+            pageCount,
+            pageStarts: info + 22,
         });
     }
     const formats = [
         ...new Set(ranges.map(({ format }) => POINTER_FORMATS[format] ?? `format-${format}`)),
     ];
-    const issues = ranges.flatMap(({ format, from }) => POINTER_FORMATS[format] === undefined
+    const issues = ranges.flatMap(({ format, segment }) => POINTER_FORMATS[format] === undefined
         ? [
-            issue("pointer_fixups", "unsupported_pointer_format", `Unsupported chained pointer format ${format}`, `0x${from.toString(16)}`),
+            issue("pointer_fixups", "unsupported_pointer_format", `Unsupported chained pointer format ${format}`, `0x${segment.address.toString(16)}`),
         ]
         : []);
+    const examinedViews = new Map();
+    const decodedRanges = new Set();
+    for (const [chainIndex, chain] of ranges.entries()) {
+        // Unknown formats retain their compact starts table; only a queried page
+        // needs its NONE/presence value. Do not expand unsupported declarations.
+        if (POINTER_FORMATS[chain.format] === undefined)
+            continue;
+        const view = `${chain.pageStarts}:${chain.segment.offset}:${chain.segment.size}:${chain.segment.address}:${chain.format}:${chain.pageSize}:${chain.pageCount}`;
+        const prior = examinedViews.get(view);
+        if (prior !== undefined) {
+            if (prior)
+                decodedRanges.add(chainIndex);
+            continue;
+        }
+        let complete = true;
+        for (let page = 0; page < chain.pageCount; page++) {
+            const start = bytes.readUInt16LE(chain.pageStarts + page * 2);
+            if (start === 0xffff)
+                continue;
+            const facts = pageFacts(chain, page, start);
+            if (facts.failure !== undefined) {
+                complete = false;
+                issues.push(issue("pointer_fixups", "chained_pointer_walk_failed", facts.failure, `0x${(chain.segment.address + BigInt(page * chain.pageSize)).toString(16)}`));
+                // Coverage is partial after this failure, not exhaustive. Keep the
+                // unexpanded descriptor: later pages are still independently readable
+                // through pageFacts when metadata requests them.
+                break;
+            }
+        }
+        examinedViews.set(view, complete);
+        if (complete)
+            decodedRanges.add(chainIndex);
+    }
+    const failures = issues.map(({ message }) => message);
     return {
         kind: "chained",
         formats,
-        failures: issues.map(({ message }) => message),
+        failures,
         issues,
         examined: Math.max(ranges.length, 1),
-        unreadRebaseBytes: 0,
+        get decoded() {
+            return ranges.length === 0 ? 1 : decodedRanges.size;
+        },
+        unreadRebaseBytes,
         decode(address, raw) {
-            const segment = ranges.find(({ from, to }) => address >= from && address < to);
+            const chainIndex = ranges.findIndex(({ segment }) => address >= segment.address &&
+                address < segment.address + segment.size);
+            const chain = ranges[chainIndex];
             // Pointers outside fixup segments, such as in __TEXT, are stored plainly.
-            if (segment === undefined)
+            if (chain === undefined)
+                return { kind: "rebase", target: raw };
+            const within = Number(address - chain.segment.address);
+            const page = Math.floor(within / chain.pageSize);
+            if (page >= chain.pageCount)
+                return { kind: "rebase", target: raw };
+            const start = bytes.readUInt16LE(chain.pageStarts + page * 2);
+            if (start === 0xffff)
                 return { kind: "rebase", target: raw };
-            if (raw === 0n)
-                return { kind: "rebase", target: 0n };
-            if (POINTER_FORMATS[segment.format] === undefined)
+            if (POINTER_FORMATS[chain.format] === undefined)
                 return {
                     kind: "unsupported",
-                    reason: `Unsupported chained pointer format ${segment.format}`,
+                    reason: `Unsupported chained pointer format ${chain.format}`,
                 };
-            return decodeChainedPointer(raw, segment.format, baseAddress, imports);
+            try {
+                const facts = pageFacts(chain, page, start);
+                const at = within % chain.pageSize;
+                const locations = facts.locations;
+                if (((locations[at >>> 3] ?? 0) & (1 << (at & 7))) !== 0)
+                    return decodeChainedPointer(raw, chain.format, baseAddress, imports);
+                if (facts.failure !== undefined &&
+                    (facts.lastOffset === undefined || at > facts.lastOffset))
+                    throw new RangeError(facts.failure);
+                return { kind: "rebase", target: raw };
+            }
+            catch (cause) {
+                const reason = cause instanceof Error ? cause.message : String(cause);
+                const location = `0x${address.toString(16)}`;
+                if (!issues.some((entry) => entry.code === "chained_pointer_decode_failed" &&
+                    entry.location === location)) {
+                    issues.push(issue("pointer_fixups", "chained_pointer_decode_failed", reason, location));
+                    failures.push(reason);
+                }
+                decodedRanges.delete(chainIndex);
+                return { kind: "unsupported", reason };
+            }
         },
     };
 };
 const uleb = (bytes, cursor, end) => {
     let value = 0n;
-    let shift = 0n;
+    let shift = 0;
     for (;;) {
         if (cursor.at >= end)
             throw new RangeError("Truncated bind opcode operand");
         const byte = bytes[cursor.at++] ?? 0;
-        value |= BigInt(byte & 0x7f) << shift;
-        shift += 7n;
+        const slice = byte & 0x7f;
+        if ((shift === 63 && slice > 1) || (shift === 64 && slice !== 0))
+            throw new RangeError("Oversized bind opcode operand");
+        if (shift < 64)
+            value |= BigInt(slice) << BigInt(shift);
+        // Padding may extend the encoding, but never the represented integer.
+        shift = Math.min(64, shift + 7);
         if ((byte & 0x80) === 0)
             return value;
-        if (shift > 63n)
-            throw new RangeError("Oversized bind opcode operand");
     }
 };
 const sleb = (bytes, cursor, end) => {
     let value = 0n;
-    let shift = 0n;
+    let shift = 0;
     let byte = 0;
     do {
         if (cursor.at >= end)
             throw new RangeError("Truncated bind opcode operand");
         byte = bytes[cursor.at++] ?? 0;
-        value |= BigInt(byte & 0x7f) << shift;
-        shift += 7n;
-    } while ((byte & 0x80) !== 0 && shift <= 63n);
-    return (byte & 0x40) !== 0 ? value - (1n << shift) : value;
+        const slice = byte & 0x7f;
+        if ((shift === 63 && slice !== 0 && slice !== 0x7f) ||
+            (shift === 64 && slice !== (value < 0n ? 0x7f : 0)))
+            throw new RangeError("Oversized bind opcode operand");
+        if (shift < 64)
+            value = BigInt.asIntN(64, value | (BigInt(slice) << BigInt(shift)));
+        shift = Math.min(64, shift + 7);
+    } while ((byte & 0x80) !== 0);
+    return shift < 64 && (byte & 0x40) !== 0
+        ? value - (1n << BigInt(shift))
+        : value;
 };
 /** Apply a bind opcode that sets a register; false when the opcode is not one. */
 const setBindRegister = (image, stream, state, byte) => {
@@ -278,7 +448,9 @@ const readBindStream = (image, range, binds) => {
         else {
             binds.push({ start: state.address, count, stride, binding });
         }
-        state.address += count * stride;
+        // The dyld bind stream advances addresses modulo 64 bits; ld uses -8 to
+        // bind the current pointer slot again with DO_BIND_ADD_ADDR_ULEB.
+        state.address = (state.address + count * stride) & 0xffffffffffffffffn;
     };
     while (cursor.at < end) {
         const byte = bytes[cursor.at++] ?? 0;
@@ -317,10 +489,7 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
     const image = { bytes, segments, dylibs: commands.dylibs, baseAddress };
     const unreadRebaseBytes = commands.rebases.reduce((total, rebase) => total + rebase.size, 0);
     if (commands.chained !== null) {
-        const chained = chainedFixups(image, commands.chained);
-        return unreadRebaseBytes === 0
-            ? chained
-            : { ...chained, unreadRebaseBytes };
+        return chainedFixups(image, commands.chained, unreadRebaseBytes);
     }
     if (commands.binds.length === 0)
         return {
@@ -329,14 +498,17 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
             failures: [],
             issues: [],
             examined: 0,
+            decoded: 0,
             unreadRebaseBytes,
             decode: (_address, raw) => ({ kind: "rebase", target: raw }),
         };
     const binds = [];
     const failures = [];
+    let decoded = 0;
     for (const stream of commands.binds)
         try {
             readBindStream(image, stream, binds);
+            decoded++;
         }
         catch (cause) {
             failures.push(`${stream.stream} bind opcodes: ${cause instanceof Error ? cause.message : String(cause)}`);
@@ -347,6 +519,7 @@ export const parsePointerFixups = (bytes, commands, segments, baseAddress) => {
         failures,
         issues: failures.map((message) => issue("pointer_fixups", "bind_stream_decode_failed", message)),
         examined: commands.binds.length,
+        decoded,
         unreadRebaseBytes,
         decode(address, raw) {
             let match;

package/dist/native/AppleMachoSelection.js

@@ -1,3 +1,5 @@
+import { MACHO_ARCHITECTURE_POLICIES, machoSubtypeRank, } from "./MachoArchitectureSelection.js";
+import { machoCpuSubtypeBase } from "../domain/apple/machoCpuIdentity.js";
 import { readFatSliceDeclarations, validateFatSlice, } from "../domain/apple/machoContainer.js";
 const hex = (value) => `0x${value.toString(16)}`;
 /** Classify a FAT magic word; thin Mach-O returns null. */
@@ -35,8 +37,8 @@ export const selectMachoSlice = (bytes, architecture) => {
     const headerEnd = 8 + count * stride;
     if (count > 128 || headerEnd > bytes.length)
         throw malformed("Malformed FAT architecture table");
-    const cpu = MACHO_CPU_TYPE[architecture];
-    if (cpu === undefined)
+    const policy = MACHO_ARCHITECTURE_POLICIES[architecture];
+    if (policy === undefined)
         throw invalid("Requested FAT architecture is absent");
     const declarations = readFatSliceDeclarations(bytes.subarray(8, headerEnd), {
         count,
@@ -45,26 +47,37 @@ export const selectMachoSlice = (bytes, architecture) => {
     });
     if (declarations.status !== "parsed")
         throw malformed(declarations.reason);
-    let selected;
+    let best;
+    let bestRank = Number.POSITIVE_INFINITY;
+    let ambiguous = false;
     for (const declaration of declarations.slices) {
         const issue = validateFatSlice(declaration, bytes.length, headerEnd);
         if (issue !== null)
             throw malformed(issue);
-        if (declaration.cpuType !== cpu)
+        if (declaration.cpuType !== policy.cpuType)
             continue;
-        if (selected !== undefined)
-            throw invalid("Ambiguous FAT architecture slice");
-        selected = {
-            slice: declaration.offset,
-            sliceEnd: declaration.offset + declaration.size,
-            fatDeclaration: {
-                ...declaration,
-                tableEnd: headerEnd,
-            },
-        };
+        const rank = machoSubtypeRank(policy, declaration.cpuSubtype);
+        if (best !== undefined && rank >= bestRank) {
+            // Equal ranks keep FAT table order unless the slices share a subtype.
+            if (rank === bestRank &&
+                machoCpuSubtypeBase(declaration.cpuSubtype) ===
+                    machoCpuSubtypeBase(best.cpuSubtype))
+                ambiguous = true;
+            continue;
+        }
+        best = declaration;
+        bestRank = rank;
+        ambiguous = false;
     }
-    if (selected === undefined)
+    if (best === undefined)
         throw invalid("Requested FAT architecture is absent");
+    if (ambiguous)
+        throw invalid("Ambiguous FAT architecture slice");
+    const selected = {
+        slice: best.offset,
+        sliceEnd: best.offset + best.size,
+        fatDeclaration: { ...best, tableEnd: headerEnd },
+    };
     if (selected.slice + 4 > bytes.length)
         throw malformed("Truncated Mach-O header");
     const sliceMagic = bytes.readUInt32LE(selected.slice);
@@ -72,13 +85,6 @@ export const selectMachoSlice = (bytes, architecture) => {
         throw invalid(`Unsupported 32-bit Mach-O metadata for requested CPU type ${architecture}`);
     return selected;
 };
-/** CPU types admitted by `machArchitecture` in the domain binary target parser. */
-const MACHO_CPU_TYPE = {
-    x86: 7,
-    x86_64: 0x01000007,
-    arm: 12,
-    arm64: 0x0100000c,
-};
 const MH_MAGIC = 0xfeedface;
 const MH_CIGAM = 0xcefaedfe;
 /** Parse segments/sections for a little-endian 64-bit Mach-O architecture slice. */
@@ -177,7 +183,8 @@ const collectSegment = (bytes, { cursor, size }, state) => {
         state.sections.push({
             name: bytes
                 .subarray(position, position + 16)
-                .toString("ascii")
+                // ASCII decoding masks high bits and can fabricate known metadata names.
+                .toString("latin1")
                 .replace(/\0.*$/u, ""),
             address: bytes.readBigUInt64LE(position + 32),
             size: Number(sectionSize),

package/dist/native/AppleObjcCategories.js

@@ -11,7 +11,7 @@ export const boundClassName = (read, field) => {
  * name, cls, instanceMethods, classMethods, protocols, instanceProperties.
  */
 export const decodeObjcCategories = (input) => {
-    const { read, result, failures } = input;
+    const { read, result } = input;
     let examined = 0;
     for (const section of input.sections.filter(({ name }) => name === "__objc_catlist")) {
         if (section.size % 8 !== 0)
@@ -24,9 +24,20 @@ export const decodeObjcCategories = (input) => {
             try {
                 const category = read.pointer(field);
                 const name = read.string(read.pointer(category));
+                if (name.length === 0)
+                    throw new TypeError("Objective-C category has an empty name");
                 const external = boundClassName(read, category + 8n);
                 const local = read.pointer(category + 8n);
-                const className = external ?? (local === 0n ? null : input.localClassName(local));
+                let className = external ?? null;
+                if (external === undefined && local !== 0n)
+                    try {
+                        className = input.localClassName(local);
+                    }
+                    catch (cause) {
+                        // The category's own name and methods do not depend on its owner;
+                        // keep them and report the unreadable class reference.
+                        input.issues.push(issue("objc_properties_categories", "category_class_unresolved", `Category ${name} class reference 0x${local.toString(16)}: ${cause instanceof Error ? cause.message : String(cause)}`, `0x${(category + 8n).toString(16)}`));
+                    }
                 const owner = className ?? `(${name})`;
                 result.objc_categories.push({
                     name,
@@ -54,7 +65,6 @@ export const decodeObjcCategories = (input) => {
             }
             catch (cause) {
                 const message = cause instanceof Error ? cause.message : String(cause);
-                failures.push(`Category at 0x${field.toString(16)}: ${message}`);
                 input.issues.push(issue("objc_properties_categories", "category_decode_failed", message, `0x${field.toString(16)}`));
             }
         }