reverseport 0.0.0-stage → 1.0.0

package/dist/domain/native/nativeAotPe.js

@@ -0,0 +1,1408 @@
+import { createHash } from "node:crypto";
+const RTR_SIGNATURE = 0x00525452;
+const RTR_ROW_SIZE = 24;
+const RTR_ROW_TYPE = 1;
+const DEHYDRATED_DATA = 207;
+const FROZEN_OBJECT_REGION = 206;
+export const NATIVE_AOT_MAX_SOURCE_BYTES = 128 * 1024 * 1024;
+/** Bound one parser-produced JSON report independently of any transport. */
+export const NATIVE_AOT_MAX_REPORT_BYTES = 4 * 1024 * 1024;
+export const NATIVE_AOT_MAX_WORK_UNITS = 64 * 1024 * 1024;
+export const NATIVE_AOT_MAX_WORKING_MEMORY_BYTES = 64 * 1024 * 1024;
+/** Version of the built-in read-only PE metadata interpretation in profiles. */
+export const NATIVE_AOT_PROFILE_CONTRACT_REVISION = "rtr-9.1-x64-pe-read-only-v3";
+export const DEFAULT_NATIVE_AOT_PARSER_LIMITS = {
+    sourceBytes: NATIVE_AOT_MAX_SOURCE_BYTES,
+    workUnits: NATIVE_AOT_MAX_WORK_UNITS,
+    workingMemoryBytes: NATIVE_AOT_MAX_WORKING_MEMORY_BYTES,
+};
+class NativeAotParserBudget {
+    limits;
+    workUnits = 0;
+    workingMemoryBytes = 0;
+    workingMemoryBytesPeak = 0;
+    truncationReason;
+    constructor(limits) {
+        this.limits = limits;
+    }
+    consumeWork(bytes) {
+        if (!Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > this.limits.workUnits - this.workUnits) {
+            this.truncationReason ??= "work-unit-budget";
+            return false;
+        }
+        this.workUnits += bytes;
+        return true;
+    }
+    reserveWorkingMemory(bytes) {
+        if (!Number.isSafeInteger(bytes) ||
+            bytes < 0 ||
+            bytes > this.limits.workingMemoryBytes - this.workingMemoryBytes) {
+            this.truncationReason ??= "working-memory-budget";
+            return false;
+        }
+        this.workingMemoryBytes += bytes;
+        this.workingMemoryBytesPeak = Math.max(this.workingMemoryBytesPeak, this.workingMemoryBytes);
+        return true;
+    }
+    releaseWorkingMemory(bytes) {
+        this.workingMemoryBytes = Math.max(0, this.workingMemoryBytes - bytes);
+    }
+}
+// Compatible PE loaders use raw size when VirtualSize is zero. Otherwise,
+// RVA containment follows the declared VirtualSize, independent of file size.
+const virtualExtent = (section) => section.virtualSize === 0 ? section.rawSize : section.virtualSize;
+const fileBackedVirtualExtent = (section) => Math.min(virtualExtent(section), section.rawSize);
+const METHOD_TABLE_RECORD_BYTES = 32;
+class MethodTableIndex {
+    budget;
+    #records = Buffer.alloc(0);
+    #count = 0;
+    #includedCount = 0;
+    constructor(budget) {
+        this.budget = budget;
+    }
+    get count() {
+        return this.#count;
+    }
+    get includedCount() {
+        return this.#includedCount;
+    }
+    append(table) {
+        if (!this.#ensureCapacity(this.#count + 1))
+            return false;
+        const offset = this.#count * METHOD_TABLE_RECORD_BYTES;
+        this.#records.writeBigUInt64LE(table.address, offset);
+        this.#records.writeUInt32LE(table.flags, offset + 8);
+        this.#records.writeUInt32LE(table.baseSize, offset + 12);
+        this.#records.writeBigUInt64LE(table.related, offset + 16);
+        this.#records.writeUInt16LE(table.slotsCount, offset + 24);
+        this.#records.writeUInt16LE(table.interfacesCount, offset + 26);
+        this.#records.writeUInt8(0, offset + 28);
+        this.#records.writeUInt8(0, offset + 29);
+        this.#records.writeUInt16LE(0, offset + 30);
+        this.#count++;
+        return true;
+    }
+    at(index) {
+        if (!Number.isSafeInteger(index) || index < 0 || index >= this.#count)
+            return undefined;
+        const offset = index * METHOD_TABLE_RECORD_BYTES;
+        return {
+            address: this.#records.readBigUInt64LE(offset),
+            flags: this.#records.readUInt32LE(offset + 8),
+            baseSize: this.#records.readUInt32LE(offset + 12),
+            related: this.#records.readBigUInt64LE(offset + 16),
+            slotsCount: this.#records.readUInt16LE(offset + 24),
+            interfacesCount: this.#records.readUInt16LE(offset + 26),
+        };
+    }
+    isIncluded(index) {
+        return (index >= 0 &&
+            index < this.#count &&
+            this.#records.readUInt8(index * METHOD_TABLE_RECORD_BYTES + 28) !== 0);
+    }
+    include(index) {
+        if (!this.isIncluded(index)) {
+            this.#records.writeUInt8(1, index * METHOD_TABLE_RECORD_BYTES + 28);
+            this.#includedCount++;
+        }
+    }
+    find(address, budget) {
+        let low = 0;
+        let high = this.#count;
+        while (low < high) {
+            if (!budget.consumeWork(8))
+                return -1;
+            const middle = low + ((high - low) >>> 1);
+            const record = middle * METHOD_TABLE_RECORD_BYTES;
+            const candidate = this.#records.readBigUInt64LE(record);
+            if (candidate < address)
+                low = middle + 1;
+            else
+                high = middle;
+        }
+        return low < this.#count &&
+            this.#records.readBigUInt64LE(low * METHOD_TABLE_RECORD_BYTES) === address
+            ? low
+            : -1;
+    }
+    forEach(callback) {
+        for (let index = 0; index < this.#count; index++) {
+            const table = this.at(index);
+            if (table !== undefined)
+                callback(table, index);
+        }
+    }
+    forEachIncluded(callback) {
+        for (let index = 0; index < this.#count; index++) {
+            if (!this.isIncluded(index))
+                continue;
+            const table = this.at(index);
+            if (table !== undefined)
+                callback(table, index);
+        }
+    }
+    #ensureCapacity(requiredRecords) {
+        const requiredBytes = requiredRecords * METHOD_TABLE_RECORD_BYTES;
+        if (requiredBytes <= this.#records.byteLength)
+            return true;
+        const capacityBytes = Math.min(this.budget.limits.workingMemoryBytes, Math.max(requiredBytes, this.#records.byteLength * 2 || 4096));
+        if (capacityBytes < requiredBytes ||
+            !this.budget.reserveWorkingMemory(capacityBytes))
+            return false;
+        const expanded = Buffer.allocUnsafe(capacityBytes);
+        this.#records.copy(expanded, 0, 0, this.#count * METHOD_TABLE_RECORD_BYTES);
+        this.budget.releaseWorkingMemory(this.#records.byteLength);
+        this.#records = expanded;
+        return true;
+    }
+}
+export const nativeAotSnapshotOverCapacity = (sha256, sourceBytesAtLeast, maximumSummaryBytes, limits = DEFAULT_NATIVE_AOT_PARSER_LIMITS) => assertNativeAotReportFits({
+    format: "dotnet-nativeaot",
+    status: "partial",
+    reason: "The captured PE exceeds the read-only NativeAOT snapshot byte budget.",
+    analysis_artifact_sha256: sha256,
+    analysis_mode: "read-only-derived-overlay",
+    header_address: null,
+    discovery: null,
+    format_major: null,
+    format_minor: null,
+    method_tables: 0,
+    types: [],
+    frozen_strings: [],
+    truncated: true,
+    types_omitted: 0,
+    frozen_strings_omitted: 0,
+    output_budget_bytes: maximumSummaryBytes,
+    derived_overlay: null,
+    derived_memory: null,
+    coverage: {
+        pointer_candidates_examined: 0,
+        scan_bytes_examined: 0,
+        scan_bytes_omitted: 0,
+        method_table_validation_items_examined: 0,
+        work_units_examined: 0,
+        method_tables_recovered: 0,
+        frozen_string_candidates: 0,
+        frozen_scan_bytes_examined: 0,
+        frozen_scan_bytes_omitted: 0,
+        frozen_string_data_bytes_examined: 0,
+        source_bytes_examined: 0,
+        work_budget_units: limits.workUnits,
+        source_byte_budget_bytes: limits.sourceBytes,
+        working_memory_budget_bytes: limits.workingMemoryBytes,
+        working_memory_bytes_peak: 0,
+        truncation_reason: "source-byte-budget",
+        basis: "unsupported-layout",
+    },
+    diagnostics: [
+        `The private snapshot was observed to contain at least ${sourceBytesAtLeast} bytes, above the ${limits.sourceBytes} byte NativeAOT source limit; no parser snapshot was admitted.`,
+    ],
+    limitations: [
+        "NativeAOT metadata was not inspected because the captured snapshot exceeded the local source-byte budget.",
+        "The artifact digest identifies the selected target; no metadata facts are inferred from the omitted snapshot.",
+        "No Ghidra database types, labels, functions, or bytes are created or changed.",
+    ],
+}, maximumSummaryBytes);
+const assertNativeAotReportFits = (report, maximumBytes) => {
+    if (!Number.isSafeInteger(maximumBytes) ||
+        maximumBytes < 0 ||
+        Buffer.byteLength(JSON.stringify(report)) > maximumBytes)
+        throw new Error("NativeAOT report-byte budget is too small for the minimum truthful report");
+    return report;
+};
+const parsedSummary = (summary, maximumBytes) => ({
+    summary: assertNativeAotReportFits(summary, maximumBytes),
+    readTypeDetail: () => undefined,
+});
+class PeImage {
+    imageBase;
+    sizeOfImage;
+    sections;
+    #bytes;
+    #sizeOfHeaders;
+    #machine;
+    #overlays = [];
+    #budget;
+    constructor(bytes) {
+        this.#bytes = bytes;
+        if (bytes.length < 0x40 || bytes.toString("ascii", 0, 2) !== "MZ")
+            throw new Error("Not a PE image");
+        const peOffset = this.#u32(0x3c);
+        this.#range(peOffset, 24);
+        if (bytes.toString("ascii", peOffset, peOffset + 4) !== "PE\0\0")
+            throw new Error("Invalid PE signature");
+        this.#machine = this.#u16(peOffset + 4);
+        const count = this.#u16(peOffset + 6);
+        // Microsoft documents a 96-section Windows image-loader limit. This
+        // parser accepts executable PE images, not arbitrary COFF object files.
+        if (count > 96)
+            throw new Error("PE image exceeds the Windows 96-section limit");
+        const optionalSize = this.#u16(peOffset + 20);
+        const optional = peOffset + 24;
+        this.#range(optional, optionalSize);
+        const magic = this.#u16(optional);
+        if (magic !== 0x20b || this.#machine !== 0x8664)
+            throw new Error("Only x64 PE32+ is supported");
+        this.imageBase = this.#u64(optional + 24);
+        this.sizeOfImage = this.#u32(optional + 56);
+        this.#sizeOfHeaders = this.#u32(optional + 60);
+        if (count < 1 || this.sizeOfImage === 0)
+            throw new Error("Unsupported PE image extent");
+        const sectionOffset = optional + optionalSize;
+        this.#range(sectionOffset, count * 40);
+        this.sections = Array.from({ length: count }, (_, index) => {
+            const p = sectionOffset + index * 40;
+            const name = bytes.toString("ascii", p, p + 8).replace(/\0.*$/u, "");
+            return {
+                name,
+                virtualSize: this.#u32(p + 8),
+                rva: this.#u32(p + 12),
+                rawSize: this.#u32(p + 16),
+                rawOffset: this.#u32(p + 20),
+                characteristics: this.#u32(p + 36),
+            };
+        });
+        for (const section of this.sections) {
+            this.#range(section.rawOffset, section.rawSize);
+            if (section.rva + virtualExtent(section) > this.sizeOfImage)
+                throw new Error("PE section exceeds the declared image extent");
+        }
+    }
+    addressForRva(rva) {
+        return this.imageBase + BigInt(rva);
+    }
+    setBudget(budget) {
+        this.#budget = budget;
+    }
+    hasImageRange(start, end) {
+        return (end >= start &&
+            start >= this.imageBase &&
+            end - this.imageBase <= BigInt(this.sizeOfImage));
+    }
+    read(address, size) {
+        if (address < this.imageBase || !Number.isSafeInteger(size) || size < 0)
+            return null;
+        for (const overlay of this.#overlays) {
+            const offset = address - overlay.base;
+            if (offset >= 0n && offset <= BigInt(overlay.sizeBytes - size)) {
+                const start = Number(offset);
+                return overlay.bytes.subarray(start, start + size);
+            }
+        }
+        const rva = address - this.imageBase;
+        if (rva > BigInt(Number.MAX_SAFE_INTEGER))
+            return null;
+        const relative = Number(rva);
+        if (relative < this.#sizeOfHeaders && relative <= this.#bytes.length - size)
+            return this.#bytes.subarray(relative, relative + size);
+        for (const section of this.sections) {
+            if (this.#budget !== undefined && !this.#budget.consumeWork(1))
+                return null;
+            const extent = virtualExtent(section);
+            if (relative < section.rva || relative - section.rva > extent - size)
+                continue;
+            const delta = relative - section.rva;
+            if (delta > section.rawSize - size)
+                return null;
+            const offset = section.rawOffset + delta;
+            return this.#bytes.subarray(offset, offset + size);
+        }
+        return null;
+    }
+    // This checks executable section membership, not file-backed instruction bytes.
+    isExecutable(address) {
+        if (address < this.imageBase)
+            return false;
+        const rva = address - this.imageBase;
+        for (const section of this.sections) {
+            if (this.#budget !== undefined && !this.#budget.consumeWork(1))
+                return false;
+            if ((section.characteristics & 0x20000000) !== 0 &&
+                rva >= BigInt(section.rva) &&
+                rva < BigInt(section.rva + virtualExtent(section)))
+                return true;
+        }
+        return false;
+    }
+    addOverlay(overlay) {
+        this.#overlays.push(overlay);
+    }
+    virtualBytesRemaining(address) {
+        if (address < this.imageBase)
+            return 0;
+        const rva = address - this.imageBase;
+        let section;
+        for (const candidate of this.sections) {
+            if (this.#budget !== undefined && !this.#budget.consumeWork(1))
+                return 0;
+            if (rva >= BigInt(candidate.rva) &&
+                rva < BigInt(candidate.rva + virtualExtent(candidate))) {
+                section = candidate;
+                break;
+            }
+        }
+        return section === undefined
+            ? 0
+            : section.rva + virtualExtent(section) - Number(rva);
+    }
+    #range(offset, size) {
+        if (!Number.isSafeInteger(offset) ||
+            !Number.isSafeInteger(size) ||
+            offset < 0 ||
+            size < 0 ||
+            offset > this.#bytes.length - size)
+            throw new Error("PE field leaves the captured file");
+    }
+    #u16(offset) {
+        this.#range(offset, 2);
+        return this.#bytes.readUInt16LE(offset);
+    }
+    #u32(offset) {
+        this.#range(offset, 4);
+        return this.#bytes.readUInt32LE(offset);
+    }
+    #u64(offset) {
+        this.#range(offset, 8);
+        return this.#bytes.readBigUInt64LE(offset);
+    }
+}
+const hex = (value) => `0x${value.toString(16)}`;
+const readU64 = (bytes, offset = 0) => bytes === null || offset > bytes.length - 8
+    ? null
+    : bytes.readBigUInt64LE(offset);
+const readU32 = (bytes, offset = 0) => bytes === null || offset > bytes.length - 4
+    ? null
+    : bytes.readUInt32LE(offset);
+const notApplicable = (sha, reason, basis) => ({
+    format: "dotnet-nativeaot",
+    status: "not_applicable",
+    reason,
+    analysis_artifact_sha256: sha,
+    analysis_mode: "read-only-derived-overlay",
+    header_address: null,
+    discovery: null,
+    format_major: null,
+    format_minor: null,
+    method_tables: 0,
+    types: [],
+    frozen_strings: [],
+    derived_overlay: null,
+    derived_memory: null,
+    coverage: {
+        pointer_candidates_examined: 0,
+        method_tables_recovered: 0,
+        frozen_string_candidates: 0,
+        basis,
+    },
+    diagnostics: [],
+    limitations: [
+        "This report is derived from the admitted file snapshot; it does not define or annotate Ghidra database types.",
+    ],
+});
+const findDirectory = (image, bytes, budget) => {
+    let found = null;
+    let matches = 0;
+    let scanBytesExamined = 0;
+    let totalScanBytes = 0;
+    let truncated = false;
+    scan: for (const section of image.sections) {
+        if ((section.characteristics & 0x40000000) === 0 ||
+            (section.characteristics & 0x20000000) !== 0)
+            continue;
+        const begin = section.rawOffset;
+        const end = begin + fileBackedVirtualExtent(section);
+        const first = (begin + 7) & ~7;
+        const candidateBytes = first <= end - 16 ? (Math.floor((end - 16 - first) / 8) + 1) * 8 : 0;
+        totalScanBytes += candidateBytes;
+        for (let offset = first; offset <= end - 16; offset += 8) {
+            if (!budget.consumeWork(8)) {
+                truncated = true;
+                break scan;
+            }
+            scanBytesExamined += 8;
+            if (bytes.readUInt32LE(offset) !== RTR_SIGNATURE)
+                continue;
+            if (!budget.consumeWork(16)) {
+                truncated = true;
+                break scan;
+            }
+            const count = bytes.readUInt16LE(offset + 12);
+            if (bytes.readUInt8(offset + 14) !== RTR_ROW_SIZE ||
+                bytes.readUInt8(offset + 15) !== RTR_ROW_TYPE ||
+                count < 1 ||
+                offset > end - (16 + count * RTR_ROW_SIZE))
+                continue;
+            const rows = [];
+            let valid = true;
+            for (let row = 0; row < count; row++) {
+                if (!budget.consumeWork(RTR_ROW_SIZE)) {
+                    truncated = true;
+                    break scan;
+                }
+                const p = offset + 16 + row * RTR_ROW_SIZE;
+                const type = bytes.readUInt32LE(p);
+                const start = bytes.readBigUInt64LE(p + 8);
+                const finish = bytes.readBigUInt64LE(p + 16);
+                const isConsumedRange = type === FROZEN_OBJECT_REGION || type === DEHYDRATED_DATA;
+                const isTypeManagerIndirection = type === 204;
+                if (isConsumedRange &&
+                    finish !== start &&
+                    !image.hasImageRange(start, finish)) {
+                    valid = false;
+                    break;
+                }
+                if (isTypeManagerIndirection &&
+                    start !== 0n &&
+                    image.read(start, 8) === null) {
+                    valid = false;
+                    break;
+                }
+                if (isConsumedRange || isTypeManagerIndirection) {
+                    if (rows.some((existing) => existing.type === type)) {
+                        valid = false;
+                        break;
+                    }
+                    rows.push({
+                        type,
+                        flags: bytes.readUInt32LE(p + 4),
+                        start,
+                        end: finish,
+                    });
+                }
+            }
+            if (valid) {
+                matches++;
+                if (found === null)
+                    found = {
+                        address: image.addressForRva(section.rva + offset - begin),
+                        major: bytes.readUInt16LE(offset + 4),
+                        minor: bytes.readUInt16LE(offset + 6),
+                        sections: rows,
+                    };
+            }
+        }
+    }
+    return {
+        directory: found,
+        matches,
+        scanBytesExamined,
+        scanBytesOmitted: Math.max(0, totalScanBytes - scanBytesExamined),
+        truncated,
+    };
+};
+const parseMethodTable = (image, address, remainingValidationItems) => {
+    const header = image.read(address, 16);
+    if (header === null)
+        return null;
+    const flags = header.readUInt32LE(0), baseSize = header.readUInt32LE(4), related = header.readBigUInt64LE(8);
+    const counts = image.read(address + 16n, 4);
+    if (counts === null)
+        return null;
+    const slotsCount = counts.readUInt16LE(0), interfacesCount = counts.readUInt16LE(2);
+    if (baseSize > 0x10000000 || (baseSize !== 0 && baseSize < 16))
+        return null;
+    const itemCount = slotsCount + interfacesCount;
+    if (itemCount > remainingValidationItems)
+        return null;
+    const tableBytes = 24 + itemCount * 8;
+    const table = image.read(address, tableBytes);
+    if (table === null)
+        return null;
+    for (let slot = 0; slot < slotsCount; slot++) {
+        const target = table.readBigUInt64LE(24 + slot * 8);
+        if (target !== 0n && !image.isExecutable(target))
+            return null;
+    }
+    for (let index = 0; index < interfacesCount; index++) {
+        const iface = table.readBigUInt64LE(24 + (slotsCount + index) * 8);
+        if (iface !== 0n && image.read(iface, 20) === null)
+            return null;
+    }
+    return { address, flags, baseSize, related, slotsCount, interfacesCount };
+};
+const readRelativePointer = (image, address) => {
+    const raw = image.read(address, 4);
+    return raw === null ? null : address + BigInt(raw.readInt32LE(0));
+};
+/** Exact UTF-8 length of JSON.stringify for a UTF-16 string without allocating it. */
+const jsonUtf16StringBytes = (bytes, codeUnits) => {
+    let total = 2;
+    for (let index = 0; index < codeUnits; index++) {
+        const value = bytes.readUInt16LE(index * 2);
+        if (value === 0x22 || value === 0x5c)
+            total += 2;
+        else if (value < 0x20)
+            total +=
+                value === 8 ||
+                    value === 9 ||
+                    value === 10 ||
+                    value === 12 ||
+                    value === 13
+                    ? 2
+                    : 6;
+        else if (value >= 0xd800 && value <= 0xdbff) {
+            const next = index + 1 < codeUnits ? bytes.readUInt16LE((index + 1) * 2) : 0;
+            if (next >= 0xdc00 && next <= 0xdfff) {
+                total += 4;
+                index++;
+            }
+            else
+                total += 6;
+        }
+        else if (value >= 0xdc00 && value <= 0xdfff)
+            total += 6;
+        else if (value <= 0x7f)
+            total++;
+        else if (value <= 0x7ff)
+            total += 2;
+        else
+            total += 3;
+    }
+    return total;
+};
+/** Versioned .NET 8 RTR9.1 hydration, adapted from Washi's MIT-licensed
+ * `ghidra-nativeaot` at effeb734fc570c32650f88b159608979dc7b423e. The
+ * MethodTable layout is cross-checked against the .NET Foundation MIT-licensed
+ * MethodTable.h at runtime commit a3b2d40328be0be3f8dd43f0e5cc925b8827b044.
+ * See licenses/nativeaot-parser-MIT.txt. Output is an isolated parser overlay;
+ * input snapshot bytes stay immutable. */
+const hydrate = (image, dehydrated, budget) => {
+    const length = dehydrated.end - dehydrated.start;
+    if (length < 5n ||
+        length > BigInt(image.virtualBytesRemaining(dehydrated.start)))
+        throw new Error("DEHYDRATED_DATA length is outside its mapped section");
+    const first = image.read(dehydrated.start, Number(length));
+    if (first === null)
+        throw new Error("DEHYDRATED_DATA leaves captured PE sections");
+    const base = readRelativePointer(image, dehydrated.start);
+    if (base === null)
+        throw new Error("DEHYDRATED_DATA has no hydration base pointer");
+    const outputLimit = Math.min(image.virtualBytesRemaining(base), budget.limits.workUnits - budget.workUnits, budget.limits.workingMemoryBytes - budget.workingMemoryBytes);
+    if (outputLimit === 0)
+        throw new Error("DEHYDRATED_DATA hydration base is outside mapped PE sections");
+    let output = Buffer.alloc(Math.min(outputLimit, 64 * 1024));
+    if (!budget.reserveWorkingMemory(output.byteLength))
+        throw new Error("NativeAOT working-memory budget is exhausted");
+    let outputLength = 0;
+    let cursor = 4;
+    const ensureOutput = (length) => {
+        if (!Number.isSafeInteger(length) ||
+            length < 0 ||
+            length > outputLimit - outputLength) {
+            if (length > budget.limits.workUnits - budget.workUnits)
+                throw new Error("NativeAOT parser work budget is exhausted");
+            throw new Error("Hydrated metadata exceeds its mapped PE section");
+        }
+        const start = outputLength;
+        const required = start + length;
+        if (required > output.length) {
+            const capacity = Math.min(outputLimit, Math.max(required, Math.min(outputLimit, output.length * 2 || 64 * 1024)));
+            if (!budget.reserveWorkingMemory(capacity))
+                throw new Error("NativeAOT working-memory budget is exhausted");
+            const expanded = Buffer.allocUnsafe(capacity);
+            output.copy(expanded, 0, 0, outputLength);
+            budget.releaseWorkingMemory(output.byteLength);
+            output = expanded;
+        }
+        outputLength = required;
+        return start;
+    };
+    const append = (chunk) => {
+        if (!budget.consumeWork(chunk.length))
+            throw new Error("NativeAOT parser work budget is exhausted");
+        chunk.copy(output, ensureOutput(chunk.length));
+    };
+    const appendZero = (length) => {
+        if (!budget.consumeWork(length))
+            throw new Error("NativeAOT parser work budget is exhausted");
+        const start = ensureOutput(length);
+        output.fill(0, start, outputLength);
+    };
+    const appendRel = (target) => {
+        if (!budget.consumeWork(4))
+            throw new Error("NativeAOT parser work budget is exhausted");
+        const delta = target - (base + BigInt(outputLength));
+        if (delta < -0x80000000n || delta > 0x7fffffffn)
+            throw new Error("Hydrated relative pointer does not fit int32");
+        const offset = ensureOutput(4);
+        output.writeInt32LE(Number(delta), offset);
+    };
+    const appendPtr = (target) => {
+        if (!budget.consumeWork(8))
+            throw new Error("NativeAOT parser work budget is exhausted");
+        const offset = ensureOutput(8);
+        output.writeBigUInt64LE(target, offset);
+    };
+    const readFixup = (index) => {
+        const fixupLocation = dehydrated.end + BigInt(index * 4);
+        const target = readRelativePointer(image, fixupLocation);
+        if (target === null)
+            throw new Error("DEHYDRATED_DATA fixup leaves captured PE sections");
+        return target;
+    };
+    try {
+        while (cursor < first.length) {
+            if (!budget.consumeWork(1))
+                throw new Error("NativeAOT parser work budget is exhausted");
+            const encoded = first[cursor];
+            if (encoded === undefined)
+                break;
+            cursor++;
+            const command = encoded & 7;
+            let payload = encoded >>> 3;
+            const extraBytes = payload - 28;
+            if (extraBytes > 0) {
+                if (extraBytes > 3 || cursor > first.length - extraBytes)
+                    throw new Error("Invalid DEHYDRATED_DATA payload encoding");
+                payload = 0;
+                for (let i = 0; i < extraBytes; i++)
+                    payload += (first[cursor++] ?? 0) * 2 ** (8 * i);
+                payload += 28;
+            }
+            switch (command) {
+                case 0: {
+                    if (cursor > first.length - payload)
+                        throw new Error("DEHYDRATED_DATA COPY leaves its section");
+                    append(first.subarray(cursor, cursor + payload));
+                    cursor += payload;
+                    break;
+                }
+                case 1:
+                    appendZero(payload);
+                    break;
+                case 2:
+                    appendRel(readFixup(payload));
+                    break;
+                case 3:
+                    appendPtr(readFixup(payload));
+                    break;
+                case 4:
+                    if (!budget.consumeWork(payload * 4))
+                        throw new Error("NativeAOT parser work budget is exhausted");
+                    if (payload > Math.floor((first.length - cursor) / 4) ||
+                        payload > Math.floor((outputLimit - outputLength) / 4))
+                        throw new Error("Inline relative fixups leave DEHYDRATED_DATA");
+                    for (let i = 0; i < payload; i++) {
+                        const target = readRelativePointer(image, dehydrated.start + BigInt(cursor));
+                        if (target === null)
+                            throw new Error("Invalid inline relative pointer");
+                        cursor += 4;
+                        appendRel(target);
+                    }
+                    break;
+                case 5:
+                    if (!budget.consumeWork(payload * 4))
+                        throw new Error("NativeAOT parser work budget is exhausted");
+                    if (payload > Math.floor((first.length - cursor) / 4) ||
+                        payload > Math.floor((outputLimit - outputLength) / 8))
+                        throw new Error("Inline pointer fixups leave DEHYDRATED_DATA");
+                    for (let i = 0; i < payload; i++) {
+                        const target = readRelativePointer(image, dehydrated.start + BigInt(cursor));
+                        if (target === null)
+                            throw new Error("Invalid inline pointer");
+                        cursor += 4;
+                        appendPtr(target);
+                    }
+                    break;
+                default:
+                    throw new Error(`Unsupported DEHYDRATED_DATA command ${command}`);
+            }
+        }
+    }
+    catch (cause) {
+        budget.releaseWorkingMemory(output.byteLength);
+        throw cause;
+    }
+    const hydrated = output.subarray(0, outputLength);
+    const sha256 = createHash("sha256").update(hydrated).digest("hex");
+    image.addOverlay({ base, sizeBytes: outputLength, sha256, bytes: hydrated });
+    return { base, sizeBytes: outputLength, sha256 };
+};
+const discoverTables = (image, hydrated, budget) => {
+    const ranges = [];
+    for (const section of image.sections) {
+        if ((section.characteristics & 0x40000000) === 0 ||
+            (section.characteristics & 0x20000000) !== 0)
+            continue;
+        const extent = fileBackedVirtualExtent(section);
+        if (extent > 0) {
+            ranges.push({
+                start: image.addressForRva(section.rva),
+                end: image.addressForRva(section.rva + extent),
+            });
+        }
+    }
+    if (hydrated !== null) {
+        const section = image.sections.find((candidate) => (candidate.characteristics & 0x40000000) !== 0 &&
+            (candidate.characteristics & 0x20000000) === 0 &&
+            hydrated.base >= image.addressForRva(candidate.rva) &&
+            hydrated.base + BigInt(hydrated.sizeBytes) <=
+                image.addressForRva(candidate.rva + virtualExtent(candidate)));
+        if (section !== undefined)
+            ranges.push({
+                start: hydrated.base,
+                end: hydrated.base + BigInt(hydrated.sizeBytes),
+            });
+    }
+    ranges.sort((left, right) => (left.start < right.start ? -1 : 1));
+    const merged = [];
+    for (const range of ranges) {
+        const previous = merged.at(-1);
+        if (previous !== undefined && range.start <= previous.end) {
+            if (range.end > previous.end)
+                previous.end = range.end;
+        }
+        else {
+            merged.push({ ...range });
+        }
+    }
+    const totalScanBytes = merged.reduce((total, range) => total + Number(range.end - range.start), 0);
+    let pointerCount = 0, pointerSlotsExamined = 0, scanBytesExamined = 0, validationItems = 0, workBytesExamined = 0, truncated = false;
+    const candidates = new MethodTableIndex(budget);
+    scan: for (const range of merged) {
+        let address = (range.start + 7n) & ~7n;
+        while (address + 8n <= range.end) {
+            if (!budget.consumeWork(8)) {
+                truncated = true;
+                break scan;
+            }
+            const value = readU64(image.read(address, 8));
+            pointerSlotsExamined++;
+            scanBytesExamined += 8;
+            workBytesExamined += 8;
+            if (value !== null && value !== 0n)
+                pointerCount++;
+            const candidateAddress = address - 8n;
+            const header = candidateAddress >= image.imageBase
+                ? image.read(candidateAddress, 24)
+                : null;
+            if (header !== null) {
+                const flags = header.readUInt32LE(0);
+                const elementType = (flags & 0x7c000000) >>> 26;
+                const baseSize = header.readUInt32LE(4);
+                const related = header.readBigUInt64LE(8);
+                const plausibleHeader = (elementType === 0x14 || elementType === 0x15) &&
+                    baseSize >= 16 &&
+                    baseSize <= 0x10000000 &&
+                    (related === 0n || image.read(related, 24) !== null);
+                if (!plausibleHeader) {
+                    address += 8n;
+                    continue;
+                }
+                const counts = image.read(candidateAddress + 16n, 4);
+                if (counts === null) {
+                    address += 8n;
+                    continue;
+                }
+                const itemCount = counts.readUInt16LE(0) + counts.readUInt16LE(2);
+                if (!budget.consumeWork(itemCount * 8)) {
+                    truncated = true;
+                    break scan;
+                }
+                validationItems += itemCount;
+                workBytesExamined += itemCount * 8;
+                const candidate = parseMethodTable(image, candidateAddress, itemCount);
+                if (candidate !== null) {
+                    if (!candidates.append(candidate)) {
+                        truncated = true;
+                        break scan;
+                    }
+                }
+            }
+            address += 8n;
+        }
+    }
+    let objectRoot = -1;
+    let objectCount = 0;
+    candidates.forEach((candidate, index) => {
+        if (candidate.flags !== 0x50000000 ||
+            candidate.baseSize !== 0x18 ||
+            candidate.related !== 0n ||
+            candidate.slotsCount !== 3 ||
+            candidate.interfacesCount !== 0)
+            return;
+        if (!budget.consumeWork(32)) {
+            truncated = true;
+            return;
+        }
+        const vtable = image.read(candidate.address + 24n, 32);
+        if (vtable !== null &&
+            image.isExecutable(vtable.readBigUInt64LE(0)) &&
+            image.isExecutable(vtable.readBigUInt64LE(8)) &&
+            image.isExecutable(vtable.readBigUInt64LE(16)) &&
+            !image.isExecutable(vtable.readBigUInt64LE(24))) {
+            objectRoot = index;
+            objectCount++;
+        }
+    });
+    if (objectCount !== 1 || objectRoot < 0 || truncated)
+        return {
+            tables: candidates,
+            pointerCount,
+            pointerSlotsExamined,
+            scanBytesExamined,
+            scanBytesOmitted: Math.max(0, totalScanBytes - scanBytesExamined),
+            methodTableValidationItemsExamined: validationItems,
+            workBytesExamined,
+            truncated,
+        };
+    candidates.include(objectRoot);
+    let changed = true;
+    while (changed && !truncated) {
+        changed = false;
+        candidates.forEach((base, baseIndex) => {
+            if (truncated || !candidates.isIncluded(baseIndex))
+                return;
+            for (let candidateIndex = 0; candidateIndex < candidates.count; candidateIndex++) {
+                if (!budget.consumeWork(8)) {
+                    truncated = true;
+                    return;
+                }
+                const candidate = candidates.at(candidateIndex);
+                if (candidate !== undefined &&
+                    candidate.related === base.address &&
+                    !candidates.isIncluded(candidateIndex)) {
+                    candidates.include(candidateIndex);
+                    changed = true;
+                }
+            }
+            for (let index = 0; index < base.interfacesCount; index++) {
+                if (!budget.consumeWork(8)) {
+                    truncated = true;
+                    return;
+                }
+                const ifaceAddress = readU64(image.read(base.address + 24n + BigInt((base.slotsCount + index) * 8), 8));
+                if (ifaceAddress === null)
+                    continue;
+                const interfaceIndex = candidates.find(ifaceAddress, budget);
+                if (budget.truncationReason !== undefined) {
+                    truncated = true;
+                    return;
+                }
+                if (interfaceIndex >= 0 && !candidates.isIncluded(interfaceIndex)) {
+                    candidates.include(interfaceIndex);
+                    changed = true;
+                }
+            }
+        });
+    }
+    return {
+        tables: candidates,
+        pointerCount,
+        pointerSlotsExamined,
+        scanBytesExamined,
+        scanBytesOmitted: Math.max(0, totalScanBytes - scanBytesExamined),
+        methodTableValidationItemsExamined: validationItems,
+        workBytesExamined,
+        truncated,
+    };
+};
+/** Parse only the captured x64 PE snapshot. No file reads or Ghidra database writes occur here. */
+export const parseNativeAotPe = (bytes, expectedSha256, maximumSummaryBytes, loadedImageBase, limits = DEFAULT_NATIVE_AOT_PARSER_LIMITS) => {
+    if (!Number.isSafeInteger(maximumSummaryBytes) || maximumSummaryBytes < 0)
+        throw new Error("NativeAOT summary budget must be a non-negative safe integer");
+    for (const limit of Object.values(limits))
+        if (!Number.isSafeInteger(limit) || limit < 0)
+            throw new Error("NativeAOT parser limits must be non-negative safe integers");
+    if (bytes.byteLength > limits.sourceBytes)
+        return parsedSummary(nativeAotSnapshotOverCapacity(expectedSha256, bytes.byteLength, maximumSummaryBytes, limits), maximumSummaryBytes);
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    if (sha256 !== expectedSha256)
+        throw new Error("NativeAOT snapshot digest does not match the admitted artifact identity");
+    let image;
+    try {
+        image = new PeImage(bytes);
+    }
+    catch (cause) {
+        return parsedSummary(notApplicable(sha256, cause instanceof Error ? cause.message : "Unsupported PE image", "unsupported-layout"), maximumSummaryBytes);
+    }
+    if (loadedImageBase !== undefined &&
+        BigInt(loadedImageBase) !== image.imageBase)
+        return parsedSummary(notApplicable(sha256, "Ghidra loaded the PE at a base different from its preferred image base; relocation-aware metadata mapping is not implemented.", "unsupported-layout"), maximumSummaryBytes);
+    const budget = new NativeAotParserBudget(limits);
+    image.setBudget(budget);
+    const directorySearch = findDirectory(image, bytes, budget);
+    if (directorySearch.truncated)
+        return parsedSummary({
+            ...notApplicable(sha256, "RTR signature scanning reached the NativeAOT parser work budget; a unique ReadyToRun directory was not established.", "no-rtr-header"),
+            status: "partial",
+            truncated: true,
+            output_budget_bytes: maximumSummaryBytes,
+            coverage: {
+                pointer_candidates_examined: 0,
+                pointer_slots_examined: 0,
+                scan_bytes_examined: directorySearch.scanBytesExamined,
+                scan_bytes_omitted: directorySearch.scanBytesOmitted,
+                rtr_signature_scan_bytes_examined: directorySearch.scanBytesExamined,
+                rtr_signature_scan_bytes_omitted: directorySearch.scanBytesOmitted,
+                method_tables_recovered: 0,
+                frozen_string_candidates: 0,
+                work_units_examined: budget.workUnits,
+                work_budget_units: budget.limits.workUnits,
+                source_byte_budget_bytes: budget.limits.sourceBytes,
+                working_memory_budget_bytes: budget.limits.workingMemoryBytes,
+                working_memory_bytes_peak: budget.workingMemoryBytesPeak,
+                ...(budget.truncationReason === undefined
+                    ? {}
+                    : { truncation_reason: budget.truncationReason }),
+                basis: "no-rtr-header",
+            },
+            diagnostics: [
+                "No metadata hydration was attempted because signature coverage was incomplete.",
+            ],
+        }, maximumSummaryBytes);
+    if (directorySearch.directory === null && directorySearch.matches === 0)
+        return parsedSummary(notApplicable(sha256, "No supported ReadyToRun directory signature was found in initialized non-executable PE sections.", "no-rtr-header"), maximumSummaryBytes);
+    if (directorySearch.matches !== 1 || directorySearch.directory === null)
+        return parsedSummary(notApplicable(sha256, "Multiple plausible ReadyToRun directories were found; metadata identity is ambiguous.", "unsupported-layout"), maximumSummaryBytes);
+    const directory = directorySearch.directory;
+    if (directory.major !== 9 || directory.minor !== 1)
+        return parsedSummary({
+            ...notApplicable(sha256, `RTR ${directory.major}.${directory.minor} is detected but this parser supports only the .NET 8 RTR 9.1 method-table layout.`, "unsupported-layout"),
+            status: "partial",
+            header_address: hex(directory.address),
+            discovery: "signature-heuristic",
+            format_major: directory.major,
+            format_minor: directory.minor,
+        }, maximumSummaryBytes);
+    const dehydrated = directory.sections.filter((section) => section.type === DEHYDRATED_DATA);
+    if (dehydrated.length !== 1)
+        return parsedSummary({
+            ...notApplicable(sha256, "RTR 9.1 directory does not contain exactly one DEHYDRATED_DATA section; metadata recovery is incomplete.", "unsupported-layout"),
+            status: "partial",
+            header_address: hex(directory.address),
+            discovery: "signature-heuristic",
+            format_major: directory.major,
+            format_minor: directory.minor,
+        }, maximumSummaryBytes);
+    let overlay = null;
+    let hydrationError = null;
+    try {
+        overlay = hydrate(image, dehydrated[0], budget);
+    }
+    catch (cause) {
+        hydrationError =
+            cause instanceof Error
+                ? cause.message
+                : "DEHYDRATED_DATA could not be hydrated";
+    }
+    const discovered = discoverTables(image, overlay, budget);
+    const frozen = directory.sections.find((section) => section.type === FROZEN_OBJECT_REGION);
+    const isRecoveredStringTable = (address) => {
+        const index = discovered.tables.find(address, budget);
+        if (budget.truncationReason !== undefined ||
+            index < 0 ||
+            !discovered.tables.isIncluded(index))
+            return false;
+        const table = discovered.tables.at(index);
+        if (table === undefined ||
+            (table.flags & 0x7c000000) >>> 26 !== 0x14 ||
+            table.baseSize !== 0x16 ||
+            table.related === 0n)
+            return false;
+        const related = discovered.tables.find(table.related, budget);
+        if (budget.truncationReason !== undefined)
+            return false;
+        return related >= 0 && discovered.tables.isIncluded(related);
+    };
+    const types = [];
+    const frozenStrings = [];
+    let frozenCandidates = 0;
+    let frozenStringsOmitted = 0;
+    let frozenScanBytesExamined = 0;
+    let frozenStringDataBytesExamined = 0;
+    let frozenScanTruncated = false;
+    const frozenFirstCandidate = frozen === undefined ? 0n : (frozen.start + 7n) & ~7n;
+    const frozenCandidateBound = frozen === undefined || frozen.end < frozenFirstCandidate + 14n
+        ? 0
+        : Number((frozen.end - 14n - frozenFirstCandidate) / 8n + 1n);
+    const recoveryReason = discovered.truncated && discovered.tables.includedCount === 0
+        ? "RTR 9.1 was found, but method-table discovery reached its resource budget before determining whether a unique System.Object root exists."
+        : discovered.tables.includedCount === 0
+            ? "RTR 9.1 was found, but no unique System.Object method-table root could be recovered from the fully examined image pointers."
+            : hydrationError;
+    const reportLimitations = [
+        "Only x64 PE32+ with RTR 9.1 is supported.",
+        "No Ghidra database types, labels, functions, or bytes are created or changed.",
+        "Names are address identities; original managed type names are unavailable.",
+        "Metadata rows omitted to fit the NativeAOT report-byte budget are counted explicitly.",
+        "Parser work, parser-owned typed buffers, NativeAOT report JSON, and MCP delivery have separate byte budgets; incomplete scans report examined and unexamined coverage.",
+        ...(frozen === undefined
+            ? ["The RTR directory has no FROZEN_OBJECT_REGION section."]
+            : []),
+    ];
+    const budgetSkeleton = {
+        format: "dotnet-nativeaot",
+        status: "complete",
+        reason: recoveryReason,
+        analysis_artifact_sha256: sha256,
+        analysis_mode: "read-only-derived-overlay",
+        header_address: hex(directory.address),
+        discovery: "signature-heuristic",
+        format_major: directory.major,
+        format_minor: directory.minor,
+        method_tables: discovered.tables.includedCount,
+        types: [],
+        frozen_strings: [],
+        truncated: true,
+        types_omitted: discovered.tables.includedCount,
+        frozen_strings_omitted: frozenCandidateBound,
+        output_budget_bytes: maximumSummaryBytes,
+        derived_overlay: overlay === null
+            ? null
+            : {
+                address: hex(overlay.base),
+                size_bytes: overlay.sizeBytes,
+                sha256: overlay.sha256,
+            },
+        derived_memory: null,
+        coverage: {
+            pointer_candidates_examined: discovered.pointerCount,
+            pointer_slots_examined: discovered.pointerSlotsExamined,
+            scan_bytes_examined: discovered.scanBytesExamined,
+            scan_bytes_omitted: discovered.scanBytesOmitted,
+            rtr_signature_scan_bytes_examined: directorySearch.scanBytesExamined,
+            rtr_signature_scan_bytes_omitted: directorySearch.scanBytesOmitted,
+            method_table_validation_items_examined: discovered.methodTableValidationItemsExamined,
+            // Reserve the largest numeric encodings used by the eventual coverage
+            // fields so the summary budget remains valid after frozen-region work.
+            work_units_examined: budget.limits.workUnits,
+            work_budget_units: budget.limits.workUnits,
+            source_byte_budget_bytes: budget.limits.sourceBytes,
+            working_memory_budget_bytes: budget.limits.workingMemoryBytes,
+            working_memory_bytes_peak: budget.limits.workingMemoryBytes,
+            truncation_reason: "response-budget",
+            method_tables_recovered: discovered.tables.includedCount,
+            frozen_string_candidates: 0,
+            frozen_scan_bytes_examined: frozenCandidateBound * 8,
+            frozen_string_data_bytes_examined: frozen === undefined ? 0 : Number(frozen.end - frozen.start),
+            frozen_scan_bytes_omitted: frozenCandidateBound * 8,
+            basis: overlay === null
+                ? "raw-image-pointer-scan"
+                : "raw-image-and-rehydrated-pointer-scan",
+        },
+        diagnostics: hydrationError === null
+            ? []
+            : [`Read-only hydration stopped: ${hydrationError}`],
+        limitations: reportLimitations,
+    };
+    let remainingSummaryBytes = maximumSummaryBytes - Buffer.byteLength(JSON.stringify(budgetSkeleton));
+    if (remainingSummaryBytes < 0)
+        throw new Error("NativeAOT metadata summary exceeds its report-byte budget");
+    let typesOmitted = 0;
+    discovered.tables.forEachIncluded((table) => {
+        const row = { address: hex(table.address), type: null };
+        const rowBytes = Buffer.byteLength(JSON.stringify(row)) + (types.length > 0 ? 1 : 0);
+        if (rowBytes > remainingSummaryBytes) {
+            typesOmitted++;
+            return;
+        }
+        types.push(row);
+        remainingSummaryBytes -= rowBytes;
+    });
+    if (frozen !== undefined) {
+        let address = frozenFirstCandidate;
+        while (address + 14n <= frozen.end) {
+            if (!budget.consumeWork(8)) {
+                frozenScanTruncated = true;
+                break;
+            }
+            frozenScanBytesExamined += 8;
+            const table = readU64(image.read(address, 8));
+            if (table === null || !isRecoveredStringTable(table)) {
+                address += 8n;
+                continue;
+            }
+            frozenCandidates++;
+            const length = readU32(image.read(address + 8n, 4));
+            if (length === null || address + 14n + BigInt(length) * 2n > frozen.end) {
+                address += 8n;
+                continue;
+            }
+            const stringBytes = length * 2 + 2;
+            if (!budget.consumeWork(stringBytes)) {
+                frozenScanTruncated = true;
+                break;
+            }
+            frozenStringDataBytesExamined += stringBytes;
+            // NativeAOT's System.String layout is the object header, 32-bit length,
+            // UTF-16 payload, then the terminating code unit. The payload starts at
+            // +12, not +16 (the latter silently shifts every decoded string by two
+            // characters and includes adjacent object padding).
+            const raw = image.read(address + 12n, stringBytes);
+            if (raw === null || raw.readUInt16LE(length * 2) !== 0) {
+                address += 8n;
+                continue;
+            }
+            if (!budget.consumeWork(stringBytes)) {
+                frozenScanTruncated = true;
+                break;
+            }
+            const rowPrefixBytes = Buffer.byteLength(JSON.stringify({ address: hex(address), value: "" }));
+            const rowBytes = rowPrefixBytes -
+                2 +
+                jsonUtf16StringBytes(raw, length) +
+                (frozenStrings.length > 0 ? 1 : 0);
+            if (rowBytes > remainingSummaryBytes) {
+                frozenStringsOmitted++;
+                address += 8n;
+                continue;
+            }
+            const row = {
+                address: hex(address),
+                value: raw.toString("utf16le", 0, length * 2),
+            };
+            frozenStrings.push(row);
+            remainingSummaryBytes -= rowBytes;
+            address += 8n;
+        }
+    }
+    const truncated = discovered.truncated ||
+        frozenScanTruncated ||
+        typesOmitted > 0 ||
+        frozenStringsOmitted > 0;
+    const truncationReason = budget.truncationReason ??
+        (typesOmitted > 0 || frozenStringsOmitted > 0
+            ? "response-budget"
+            : undefined);
+    const summary = {
+        format: "dotnet-nativeaot",
+        status: truncated ||
+            hydrationError !== null ||
+            discovered.tables.includedCount === 0
+            ? "partial"
+            : "complete",
+        reason: recoveryReason,
+        analysis_artifact_sha256: sha256,
+        analysis_mode: "read-only-derived-overlay",
+        header_address: hex(directory.address),
+        discovery: "signature-heuristic",
+        format_major: directory.major,
+        format_minor: directory.minor,
+        method_tables: discovered.tables.includedCount,
+        types,
+        frozen_strings: frozenStrings,
+        truncated,
+        types_omitted: typesOmitted,
+        frozen_strings_omitted: frozenStringsOmitted,
+        output_budget_bytes: maximumSummaryBytes,
+        derived_overlay: overlay === null
+            ? null
+            : {
+                address: hex(overlay.base),
+                size_bytes: overlay.sizeBytes,
+                sha256: overlay.sha256,
+            },
+        derived_memory: null,
+        coverage: {
+            pointer_candidates_examined: discovered.pointerCount,
+            pointer_slots_examined: discovered.pointerSlotsExamined,
+            scan_bytes_examined: discovered.scanBytesExamined,
+            scan_bytes_omitted: discovered.scanBytesOmitted,
+            rtr_signature_scan_bytes_examined: directorySearch.scanBytesExamined,
+            rtr_signature_scan_bytes_omitted: directorySearch.scanBytesOmitted,
+            method_table_validation_items_examined: discovered.methodTableValidationItemsExamined,
+            work_units_examined: budget.workUnits,
+            work_budget_units: budget.limits.workUnits,
+            source_byte_budget_bytes: budget.limits.sourceBytes,
+            working_memory_budget_bytes: budget.limits.workingMemoryBytes,
+            working_memory_bytes_peak: budget.workingMemoryBytesPeak,
+            ...(budget.truncationReason === undefined
+                ? truncationReason === undefined
+                    ? {}
+                    : { truncation_reason: truncationReason }
+                : { truncation_reason: budget.truncationReason }),
+            method_tables_recovered: discovered.tables.includedCount,
+            frozen_string_candidates: frozenCandidates,
+            frozen_scan_bytes_examined: frozenScanBytesExamined,
+            frozen_string_data_bytes_examined: frozenStringDataBytesExamined,
+            frozen_scan_bytes_omitted: Math.max(0, frozenCandidateBound * 8 - frozenScanBytesExamined),
+            basis: overlay === null
+                ? "raw-image-pointer-scan"
+                : "raw-image-and-rehydrated-pointer-scan",
+        },
+        diagnostics: hydrationError === null
+            ? []
+            : [`Read-only hydration stopped: ${hydrationError}`],
+        limitations: reportLimitations,
+    };
+    if (Buffer.byteLength(JSON.stringify(summary)) > maximumSummaryBytes)
+        throw new Error("NativeAOT metadata summary exceeded its report-byte budget after serialization");
+    const readTypeDetail = (address, maximumBytes) => {
+        if (!Number.isSafeInteger(maximumBytes) || maximumBytes < 0)
+            return undefined;
+        if (!/^0x[0-9a-f]+$/iu.test(address))
+            return undefined;
+        let tableAddress;
+        try {
+            tableAddress = BigInt(address);
+        }
+        catch {
+            return undefined;
+        }
+        const detailBudget = new NativeAotParserBudget(limits);
+        const tableIndex = discovered.tables.find(tableAddress, detailBudget);
+        if (tableIndex < 0 || !discovered.tables.isIncluded(tableIndex))
+            return undefined;
+        const table = discovered.tables.at(tableIndex);
+        if (table === undefined)
+            return undefined;
+        const metadata = {
+            source: "read-only-derived-overlay",
+            format: "dotnet-nativeaot",
+            status: "complete",
+            header_address: hex(directory.address),
+            format_major: directory.major,
+            format_minor: directory.minor,
+            method_table_address: hex(table.address),
+            name_origin: "generated",
+            original_name: null,
+            base_size_bytes: table.baseSize,
+            related_type: table.related === 0n
+                ? null
+                : { address: hex(table.related), type: null },
+            interfaces: [],
+            virtual_slots: [],
+            derived_memory: null,
+            truncated: true,
+            virtual_slots_omitted: table.slotsCount,
+            interfaces_omitted: table.interfacesCount,
+            output_budget_bytes: maximumBytes,
+            diagnostics: [],
+            limitations: [
+                "Address-derived MethodTable identity; no original managed type name is available.",
+                "This result is parser-derived and does not claim that Ghidra defined a database DataType.",
+                "Slot and interface details are generated only for the requested address and bounded by the NativeAOT report-byte budget.",
+            ],
+        };
+        let remaining = maximumBytes - Buffer.byteLength(JSON.stringify(metadata));
+        if (remaining < 0) {
+            metadata.diagnostics.push("The NativeAOT detail report budget is too small for the requested MethodTable summary.");
+            metadata.truncated = true;
+            metadata.status = "partial";
+            return Buffer.byteLength(JSON.stringify(metadata)) <= maximumBytes
+                ? metadata
+                : undefined;
+        }
+        const maxInterfaceRowBytes = Buffer.byteLength(JSON.stringify({ address: `0x${"f".repeat(16)}`, type: null }));
+        let interfacesOmitted = 0;
+        for (let index = 0; index < table.interfacesCount; index++) {
+            if (remaining < maxInterfaceRowBytes) {
+                interfacesOmitted += table.interfacesCount - index;
+                break;
+            }
+            if (!detailBudget.consumeWork(8)) {
+                interfacesOmitted += table.interfacesCount - index;
+                break;
+            }
+            const row = {
+                address: hex(table.address),
+                type: null,
+            };
+            const value = readU64(image.read(table.address + 24n + BigInt((table.slotsCount + index) * 8), 8));
+            if (value === null) {
+                interfacesOmitted += table.interfacesCount - index;
+                break;
+            }
+            row.address = hex(value);
+            const rowBytes = Buffer.byteLength(JSON.stringify(row)) +
+                (metadata.interfaces.length > 0 ? 1 : 0);
+            if (rowBytes > remaining) {
+                interfacesOmitted++;
+                continue;
+            }
+            metadata.interfaces.push(row);
+            remaining -= rowBytes;
+        }
+        const maxVirtualSlotRowBytes = Buffer.byteLength(JSON.stringify({
+            slot: 65535,
+            slot_address: `0x${"f".repeat(16)}`,
+            target_address: `0x${"f".repeat(16)}`,
+            procedure_name: null,
+            basis: "method-table-pointer",
+        }));
+        let slotsOmitted = 0;
+        for (let slot = 0; slot < table.slotsCount; slot++) {
+            if (remaining < maxVirtualSlotRowBytes) {
+                slotsOmitted += table.slotsCount - slot;
+                break;
+            }
+            if (!detailBudget.consumeWork(8)) {
+                slotsOmitted += table.slotsCount - slot;
+                break;
+            }
+            const value = readU64(image.read(table.address + 24n + BigInt(slot * 8), 8));
+            if (value === null) {
+                slotsOmitted += table.slotsCount - slot;
+                break;
+            }
+            const row = {
+                slot,
+                slot_address: hex(table.address + 24n + BigInt(slot * 8)),
+                target_address: value === 0n ? null : hex(value),
+                procedure_name: null,
+                basis: "method-table-pointer",
+            };
+            const rowBytes = Buffer.byteLength(JSON.stringify(row)) +
+                (metadata.virtual_slots.length > 0 ? 1 : 0);
+            if (rowBytes > remaining) {
+                slotsOmitted++;
+                continue;
+            }
+            metadata.virtual_slots.push(row);
+            remaining -= rowBytes;
+        }
+        const tableBytes = 24 + (table.slotsCount + table.interfacesCount) * 8;
+        // The descriptor size is independent of the source table size. Admit the
+        // output representation first, then bound source hashing by parser work.
+        const descriptor = {
+            address: hex(table.address),
+            size_bytes: tableBytes,
+            sha256: "0".repeat(64),
+            file_offset: null,
+        };
+        const withDescriptor = { ...metadata, derived_memory: descriptor };
+        const descriptorBytes = Buffer.byteLength(JSON.stringify(withDescriptor)) -
+            Buffer.byteLength(JSON.stringify(metadata));
+        if (descriptorBytes <= remaining && detailBudget.consumeWork(tableBytes)) {
+            const raw = image.read(table.address, tableBytes);
+            if (raw !== null) {
+                metadata.derived_memory = {
+                    ...descriptor,
+                    sha256: createHash("sha256").update(raw).digest("hex"),
+                };
+                remaining -= descriptorBytes;
+            }
+        }
+        if (detailBudget.truncationReason !== undefined)
+            metadata.diagnostics.push("MethodTable memory hashing stopped at the parser work budget.");
+        metadata.interfaces_omitted = interfacesOmitted;
+        metadata.virtual_slots_omitted = slotsOmitted;
+        metadata.truncated =
+            discovered.truncated ||
+                hydrationError !== null ||
+                detailBudget.truncationReason !== undefined ||
+                interfacesOmitted > 0 ||
+                slotsOmitted > 0 ||
+                metadata.derived_memory === null;
+        if (metadata.truncated)
+            metadata.status = "partial";
+        if (Buffer.byteLength(JSON.stringify(metadata)) > maximumBytes) {
+            metadata.derived_memory = null;
+            metadata.interfaces_omitted += metadata.interfaces.length;
+            metadata.interfaces.length = 0;
+            metadata.virtual_slots_omitted += metadata.virtual_slots.length;
+            metadata.virtual_slots.length = 0;
+            metadata.diagnostics.push("MethodTable detail rows were omitted because the final serialized report exceeded its byte budget.");
+            metadata.truncated = true;
+            metadata.status = "partial";
+            if (Buffer.byteLength(JSON.stringify(metadata)) > maximumBytes)
+                return undefined;
+        }
+        return metadata;
+    };
+    return { summary, readTypeDetail };
+};