windows-exe-decompiler-mcp-server 0.1.0 → 0.1.3

package/dist/decompiler-worker.js

@@ -16,6 +16,8 @@ import { logger } from './logger.js';
 import { ghidraConfig, createGhidraProject, buildProcessInvocation, } from './ghidra-config.js';
 import { findBestGhidraAnalysis, getGhidraCapabilityStatus, isGhidraCapabilityReady, parseGhidraAnalysisMetadata, } from './ghidra-analysis-status.js';
 import { buildRawCommandLine, decodeProcessStreams, } from './process-output.js';
+import { smartRecoverFunctionsFromPE } from './pe-runtime-functions.js';
+import { formatMissingOriginalError, resolvePrimarySamplePath } from './sample-workspace.js';
 export class GhidraProcessError extends Error {
     errorCode;
     diagnostics;
@@ -250,27 +252,75 @@ export class DecompilerWorker {
         }
         throw lastError instanceof Error ? lastError : new Error(`${operationLabel} failed`);
     }
-    /**
-     * Resolve sample file path in workspace/original.
-     * Prefer legacy "sample.exe" name, then fall back to first regular file.
-     */
-    resolveSamplePath(originalDir) {
-        const legacyPath = path.join(originalDir, 'sample.exe');
-        if (fs.existsSync(legacyPath)) {
-            return legacyPath;
+    async resolveSamplePathForSample(sampleId) {
+        const { samplePath, integrity } = await resolvePrimarySamplePath(this.workspaceManager, sampleId);
+        if (!samplePath) {
+            throw new Error(formatMissingOriginalError(sampleId, integrity));
+        }
+        return samplePath;
+    }
+    getAlternateWorkspaceRoot() {
+        const currentRoot = this.workspaceManager.getWorkspaceRoot();
+        const siblingRoot = path.join(path.dirname(path.dirname(currentRoot)), 'workspaces');
+        if (path.resolve(siblingRoot) === path.resolve(currentRoot)) {
+            return null;
+        }
+        return fs.existsSync(siblingRoot) ? siblingRoot : null;
+    }
+    findLatestProjectInGhidraDir(ghidraDir) {
+        if (!fs.existsSync(ghidraDir)) {
+            return null;
         }
-        if (!fs.existsSync(originalDir)) {
-            throw new Error(`Sample directory not found: ${originalDir}`);
+        const candidates = fs
+            .readdirSync(ghidraDir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && entry.name.startsWith('project_'))
+            .map((entry) => {
+            const projectPath = path.join(ghidraDir, entry.name);
+            const projectKey = entry.name.slice('project_'.length);
+            const gprPath = path.join(projectPath, `${projectKey}.gpr`);
+            const stats = fs.statSync(projectPath);
+            return {
+                projectPath,
+                projectKey,
+                gprPath,
+                mtimeMs: stats.mtimeMs,
+            };
+        })
+            .filter((item) => fs.existsSync(item.gprPath))
+            .sort((left, right) => right.mtimeMs - left.mtimeMs);
+        if (candidates.length === 0) {
+            return null;
         }
-        const files = fs
-            .readdirSync(originalDir, { withFileTypes: true })
-            .filter(entry => entry.isFile())
-            .map(entry => entry.name)
-            .sort((a, b) => a.localeCompare(b));
-        if (files.length === 0) {
-            throw new Error(`Sample file not found in workspace: ${originalDir}`);
+        return {
+            projectPath: candidates[0].projectPath,
+            projectKey: candidates[0].projectKey,
+        };
+    }
+    findRecoveredProject(sampleId, originalProjectPath) {
+        const sha256 = sampleId.startsWith('sha256:') ? sampleId.slice('sha256:'.length) : sampleId;
+        const bucket1 = sha256.slice(0, 2);
+        const bucket2 = sha256.slice(2, 4);
+        const projectDirName = path.basename(originalProjectPath);
+        const currentRoot = this.workspaceManager.getWorkspaceRoot();
+        const roots = [currentRoot, this.getAlternateWorkspaceRoot()].filter((value) => Boolean(value));
+        for (const root of roots) {
+            const ghidraDir = path.join(root, bucket1, bucket2, sha256, 'ghidra');
+            const mappedProjectPath = path.join(ghidraDir, projectDirName);
+            if (fs.existsSync(mappedProjectPath)) {
+                const projectKey = projectDirName.startsWith('project_')
+                    ? projectDirName.slice('project_'.length)
+                    : projectDirName;
+                return {
+                    projectPath: mappedProjectPath,
+                    projectKey,
+                };
+            }
+            const latestProject = this.findLatestProjectInGhidraDir(ghidraDir);
+            if (latestProject) {
+                return latestProject;
+            }
         }
-        return path.join(originalDir, files[0]);
+        return null;
     }
     /**
      * Spawn Ghidra process with Windows batch-script compatibility.
@@ -391,14 +441,28 @@ export class DecompilerWorker {
             });
         });
     }
-    buildAnalyzeBaseArgs(projectPath, projectKey) {
-        return [projectPath, projectKey];
+    buildAnalyzeBaseArgs(projectPath, projectKey, options) {
+        const args = [projectPath, projectKey];
+        const processor = options?.languageId || options?.processor;
+        if (processor) {
+            args.push('-processor', processor);
+        }
+        if (options?.cspec) {
+            args.push('-cspec', options.cspec);
+        }
+        return args;
+    }
+    buildScriptPath(options) {
+        const scriptPaths = Array.from(new Set([ghidraConfig.scriptsDir, ...(options?.scriptPaths || [])]
+            .map((item) => item?.trim())
+            .filter((item) => Boolean(item))));
+        return scriptPaths.join(path.delimiter);
     }
     buildAnalysisArgs(projectPath, projectKey, samplePath, options) {
         const timeout = options.timeout || 300000; // Default 5 minutes
         const maxCpu = options.maxCpu || '4';
         return [
-            ...this.buildAnalyzeBaseArgs(projectPath, projectKey),
+            ...this.buildAnalyzeBaseArgs(projectPath, projectKey, options),
             '-import',
             samplePath,
             '-max-cpu',
@@ -407,13 +471,13 @@ export class DecompilerWorker {
             String(Math.floor(timeout / 1000)),
         ];
     }
-    buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName) {
+    buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName, options) {
         return [
-            ...this.buildAnalyzeBaseArgs(projectPath, projectKey),
+            ...this.buildAnalyzeBaseArgs(projectPath, projectKey, options),
             '-process',
             path.basename(samplePath),
             '-scriptPath',
-            ghidraConfig.scriptsDir,
+            this.buildScriptPath(options),
             '-postScript',
             scriptName,
             '-noanalysis',
@@ -445,9 +509,9 @@ export class DecompilerWorker {
             throw error;
         }
     }
-    async executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs) {
+    async executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs, options) {
         const command = ghidraConfig.analyzeHeadlessPath;
-        const args = this.buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName);
+        const args = this.buildExtractFunctionsArgs(projectPath, projectKey, samplePath, scriptName, options);
         logger.debug({
             command,
             args,
@@ -456,7 +520,7 @@ export class DecompilerWorker {
         }, 'Executing Ghidra function extraction post-script');
         return this.runGhidraCommand(command, args, projectPath, timeoutMs, undefined, `E_TIMEOUT: Function extraction (${scriptName}) exceeded timeout of ${timeoutMs}ms`, `Function extraction (${scriptName}) failed`);
     }
-    async tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, timeoutMs) {
+    async tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, timeoutMs, options) {
         const warnings = [];
         const attempts = [];
         const primaryScript = 'ExtractFunctions.java';
@@ -464,7 +528,7 @@ export class DecompilerWorker {
         const runAndParse = async (scriptName) => {
             let output;
             try {
-                output = await this.executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs);
+                output = await this.executeFunctionExtractionScript(projectPath, projectKey, samplePath, scriptName, timeoutMs, options);
             }
             catch (error) {
                 const diagnostics = error instanceof GhidraProcessError || error instanceof GhidraOutputParseError
@@ -547,6 +611,53 @@ export class DecompilerWorker {
             functions[0];
         return preferred?.address;
     }
+    tryRecoverFunctionsFromPE(samplePath) {
+        const recovery = smartRecoverFunctionsFromPE(samplePath);
+        const functions = recovery.functions.map((item) => ({
+            address: item.address,
+            name: item.name,
+            size: item.size,
+            is_thunk: false,
+            is_external: false,
+            calling_convention: 'unknown',
+            signature: `${item.name}()`,
+            callers: [],
+            caller_count: 0,
+            callees: [],
+            callee_count: 0,
+            caller_relationships: [],
+            callee_relationships: [],
+            is_entry_point: item.isEntryPoint,
+            is_exported: item.isExported,
+        }));
+        return {
+            functions,
+            warnings: recovery.warnings,
+            recoveryMetadata: {
+                strategy: recovery.strategy,
+                machine: recovery.machine,
+                machine_name: recovery.machineName,
+                image_base: recovery.imageBase,
+                entry_point_rva: recovery.entryPointRva,
+                count: recovery.count,
+                recovered_functions: recovery.functions.map((item) => ({
+                    address: item.address,
+                    rva: item.rva,
+                    size: item.size,
+                    name: item.name,
+                    name_source: item.nameSource,
+                    confidence: item.confidence,
+                    source: item.source,
+                    section_name: item.sectionName,
+                    executable_section: item.executableSection,
+                    is_entry_point: item.isEntryPoint,
+                    is_exported: item.isExported,
+                    export_name: item.exportName,
+                    evidence: item.evidence,
+                })),
+            },
+        };
+    }
     buildCapabilityReadyStatus(target, warnings) {
         return {
             available: true,
@@ -614,13 +725,35 @@ export class DecompilerWorker {
             };
         }
     }
-    resolveAnalysisProject(analysis) {
+    resolveAnalysisProject(sampleId, analysis) {
         const metadata = parseGhidraAnalysisMetadata(analysis.output_json);
         const projectPath = typeof metadata.project_path === 'string' ? metadata.project_path : '';
         const projectKey = typeof metadata.project_key === 'string' ? metadata.project_key : '';
         if (!projectPath || !projectKey) {
             throw new Error(`Ghidra analysis ${analysis.id} has no reusable project metadata for downstream scripts.`);
         }
+        if (fs.existsSync(projectPath)) {
+            return {
+                analysis,
+                projectPath,
+                projectKey,
+            };
+        }
+        const recoveredProject = this.findRecoveredProject(sampleId, projectPath);
+        if (recoveredProject) {
+            logger.warn({
+                sampleId,
+                analysisId: analysis.id,
+                originalProjectPath: projectPath,
+                recoveredProjectPath: recoveredProject.projectPath,
+                recoveredProjectKey: recoveredProject.projectKey,
+            }, 'Recorded Ghidra project path is missing; using recovered project path from sample ghidra workspace');
+            return {
+                analysis,
+                projectPath: recoveredProject.projectPath,
+                projectKey: recoveredProject.projectKey,
+            };
+        }
         return {
             analysis,
             projectPath,
@@ -643,7 +776,7 @@ export class DecompilerWorker {
             const reason = readiness.reason ? ` ${readiness.reason}` : '';
             throw new Error(`Ghidra ${capability} is not ready for sample: ${sampleId}.${reason}`.trim());
         }
-        const project = this.resolveAnalysisProject(selected);
+        const project = this.resolveAnalysisProject(sampleId, selected);
         return {
             ...project,
             readiness,
@@ -690,7 +823,7 @@ export class DecompilerWorker {
             }
             // 3. Get workspace paths
             const workspace = await this.workspaceManager.getWorkspace(sampleId);
-            const samplePath = this.resolveSamplePath(workspace.original);
+            const samplePath = await this.resolveSamplePathForSample(sampleId);
             // Verify sample file exists
             if (!fs.existsSync(samplePath)) {
                 throw new Error(`Sample file not found: ${samplePath}`);
@@ -706,21 +839,47 @@ export class DecompilerWorker {
             await this.executeMainAnalysis(projectPath, projectKey, samplePath, options);
             // 6. Execute post-processing function extraction with fallback chain.
             // If extraction fails but main analysis succeeded, persist partial_success.
-            const extraction = await this.tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, options.timeout || 300000);
+            const extraction = await this.tryExtractFunctionsWithFallback(projectPath, projectKey, samplePath, options.timeout || 300000, options);
             const analysisOutput = extraction.output;
             const extractionWarnings = extraction.warnings || [];
             const extractionAttempts = extraction.attempts || [];
-            const probeTarget = analysisOutput
-                ? this.selectProbeTarget(analysisOutput.functions)
+            let recoveredFunctions;
+            const combinedWarnings = [...extractionWarnings];
+            const analysisOutputHasFunctions = Boolean(analysisOutput && analysisOutput.functions.length > 0);
+            const shouldRecoverFromPE = !analysisOutput || !analysisOutputHasFunctions;
+            if (analysisOutput && !analysisOutputHasFunctions) {
+                combinedWarnings.push('Ghidra post-script extraction completed but returned zero functions; attempting PE metadata recovery from .pdata / exception directory.');
+            }
+            if (shouldRecoverFromPE) {
+                try {
+                    recoveredFunctions = this.tryRecoverFunctionsFromPE(samplePath);
+                    if (recoveredFunctions.functions.length > 0) {
+                        combinedWarnings.push(`Recovered ${recoveredFunctions.functions.length} function candidates from PE exception metadata after Ghidra post-script extraction failed.`);
+                    }
+                    if (recoveredFunctions.warnings.length > 0) {
+                        combinedWarnings.push(...recoveredFunctions.warnings);
+                    }
+                }
+                catch (recoveryError) {
+                    combinedWarnings.push(`PE metadata recovery failed after Ghidra extraction failure: ${recoveryError instanceof Error ? recoveryError.message : String(recoveryError)}`);
+                }
+            }
+            const effectiveFunctions = analysisOutputHasFunctions
+                ? analysisOutput?.functions || []
+                : recoveredFunctions?.functions || [];
+            const probeTarget = analysisOutputHasFunctions
+                ? this.selectProbeTarget((analysisOutput?.functions || []))
                 : undefined;
             let decompileProbe;
             let cfgProbe;
-            if (analysisOutput) {
+            if (effectiveFunctions.length > 0) {
                 // 7. Store functions to database (Requirement 8.4)
-                await this.storeFunctions(sampleId, analysisOutput.functions);
+                await this.storeFunctions(sampleId, effectiveFunctions);
                 // 8. Store analysis artifact
                 const artifactId = randomUUID();
-                const artifactPath = `ghidra/functions_${projectKey}.json`;
+                const artifactPath = analysisOutput
+                    ? `ghidra/functions_${projectKey}.json`
+                    : `ghidra/recovered_functions_${projectKey}.json`;
                 const artifactFullPath = path.join(workspace.root, artifactPath);
                 // Ensure directory exists
                 const artifactDir = path.dirname(artifactFullPath);
@@ -728,22 +887,30 @@ export class DecompilerWorker {
                     fs.mkdirSync(artifactDir, { recursive: true });
                 }
                 // Write artifact
-                fs.writeFileSync(artifactFullPath, JSON.stringify(analysisOutput, null, 2));
+                const artifactPayload = (analysisOutputHasFunctions ? analysisOutput : undefined) ||
+                    {
+                        program_name: path.basename(samplePath),
+                        program_path: samplePath,
+                        function_count: recoveredFunctions?.functions.length || 0,
+                        functions: recoveredFunctions?.functions || [],
+                        recovery: recoveredFunctions?.recoveryMetadata || {},
+                    };
+                fs.writeFileSync(artifactFullPath, JSON.stringify(artifactPayload, null, 2));
                 // Compute artifact SHA256
                 const artifactSha256 = createHash('sha256')
-                    .update(JSON.stringify(analysisOutput))
+                    .update(JSON.stringify(artifactPayload))
                     .digest('hex');
                 // Insert artifact record
                 this.database.insertArtifact({
                     id: artifactId,
                     sample_id: sampleId,
-                    type: 'ghidra_functions',
+                    type: analysisOutputHasFunctions ? 'ghidra_functions' : 'function_recovery',
                     path: artifactPath,
                     sha256: artifactSha256,
                     mime: 'application/json',
                     created_at: new Date().toISOString()
                 });
-                if (probeTarget) {
+                if (analysisOutput && probeTarget) {
                     const probeTimeoutMs = Math.max(5000, Math.min(15000, Math.floor((options.timeout || 300000) / 6)));
                     decompileProbe = await this.probeCapability('decompile', projectPath, projectKey, samplePath, probeTarget, probeTimeoutMs);
                     cfgProbe = await this.probeCapability('cfg', projectPath, projectKey, samplePath, probeTarget, probeTimeoutMs);
@@ -751,15 +918,21 @@ export class DecompilerWorker {
             }
             // 9. Update analysis status
             const elapsedMs = Date.now() - startTime;
-            const status = analysisOutput ? 'done' : 'partial_success';
-            const functionCount = analysisOutput?.function_count || 0;
-            const functionIndexReady = Boolean(analysisOutput && functionCount > 0);
+            const status = analysisOutputHasFunctions ? 'done' : 'partial_success';
+            const functionCount = analysisOutputHasFunctions
+                ? analysisOutput?.function_count || analysisOutput?.functions.length || 0
+                : recoveredFunctions?.functions.length || 0;
+            const functionIndexRecovered = !analysisOutputHasFunctions && Boolean(recoveredFunctions && functionCount > 0);
+            const functionIndexReady = Boolean(analysisOutputHasFunctions && functionCount > 0);
             const readiness = {
                 function_index: {
-                    available: functionIndexReady,
-                    status: functionIndexReady ? 'ready' : 'missing',
+                    available: functionIndexReady || functionIndexRecovered,
+                    status: functionIndexReady ? 'ready' : functionIndexRecovered ? 'degraded' : 'missing',
+                    reason: functionIndexRecovered
+                        ? 'Function candidates were recovered from PE exception metadata (.pdata) after Ghidra post-script extraction failed.'
+                        : undefined,
                     checked_at: new Date().toISOString(),
-                    warnings: extractionWarnings.length > 0 ? extractionWarnings : undefined,
+                    warnings: combinedWarnings.length > 0 ? combinedWarnings : undefined,
                 },
                 decompile: functionIndexReady
                     ? decompileProbe?.status ||
@@ -772,7 +945,9 @@ export class DecompilerWorker {
                     : {
                         available: false,
                         status: 'missing',
-                        reason: 'Function index is unavailable, so decompile readiness was not probed.',
+                        reason: functionIndexRecovered
+                            ? 'Function candidates were recovered from PE metadata only; Ghidra decompile readiness was not established.'
+                            : 'Function index is unavailable, so decompile readiness was not probed.',
                         checked_at: new Date().toISOString(),
                     },
                 cfg: functionIndexReady
@@ -786,7 +961,9 @@ export class DecompilerWorker {
                     : {
                         available: false,
                         status: 'missing',
-                        reason: 'Function index is unavailable, so CFG readiness was not probed.',
+                        reason: functionIndexRecovered
+                            ? 'Function candidates were recovered from PE metadata only; Ghidra CFG readiness was not established.'
+                            : 'Function index is unavailable, so CFG readiness was not probed.',
                         checked_at: new Date().toISOString(),
                     },
             };
@@ -799,11 +976,16 @@ export class DecompilerWorker {
                     project_key: projectKey,
                     readiness,
                     function_extraction: {
-                        status: analysisOutput ? 'success' : 'failed',
+                        status: analysisOutputHasFunctions
+                            ? 'success'
+                            : functionIndexRecovered
+                                ? 'recovered_via_smart_recover'
+                                : 'failed',
                         script_used: extraction.scriptUsed,
-                        warnings: extractionWarnings,
+                        warnings: combinedWarnings,
                         attempts: extractionAttempts,
                     },
+                    function_recovery: recoveredFunctions?.recoveryMetadata,
                     end_to_end_probe: {
                         target: probeTarget,
                         decompile: decompileProbe?.status,
@@ -841,7 +1023,7 @@ export class DecompilerWorker {
                 functionCount,
                 projectPath,
                 status,
-                warnings: extractionWarnings.length > 0 ? extractionWarnings : undefined,
+                warnings: combinedWarnings.length > 0 ? combinedWarnings : undefined,
                 readiness,
             };
         }
@@ -1126,8 +1308,8 @@ export class DecompilerWorker {
         }
         const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'decompile');
         // 2. Get workspace and project paths
-        const workspace = await this.workspaceManager.getWorkspace(sampleId);
-        const samplePath = this.resolveSamplePath(workspace.original);
+        await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = await this.resolveSamplePathForSample(sampleId);
         // Verify sample file exists
         if (!fs.existsSync(samplePath)) {
             throw new Error(`Sample file not found: ${samplePath}`);
@@ -1533,8 +1715,8 @@ export class DecompilerWorker {
         }
         const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'cfg');
         // 2. Get workspace and project paths
-        const workspace = await this.workspaceManager.getWorkspace(sampleId);
-        const samplePath = this.resolveSamplePath(workspace.original);
+        await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = await this.resolveSamplePathForSample(sampleId);
         // Verify sample file exists
         if (!fs.existsSync(samplePath)) {
             throw new Error(`Sample file not found: ${samplePath}`);
@@ -1628,8 +1810,8 @@ export class DecompilerWorker {
     }
     async searchFunctionsWithGhidra(sampleId, apiQuery, stringQuery, limit, timeout) {
         const resolved = this.resolveGhidraAnalysisForCapability(sampleId, 'function_index');
-        const workspace = await this.workspaceManager.getWorkspace(sampleId);
-        const samplePath = this.resolveSamplePath(workspace.original);
+        await this.workspaceManager.getWorkspace(sampleId);
+        const samplePath = await this.resolveSamplePathForSample(sampleId);
         if (!fs.existsSync(samplePath)) {
             throw new Error(`Sample file not found: ${samplePath}`);
         }

package/dist/dynamic-trace.d.ts

@@ -24,6 +24,8 @@ export interface NormalizedDynamicTraceMemoryRegion {
     base_address?: string;
     size?: number;
     protection?: string;
+    module_name?: string;
+    segment_name?: string;
     indicators: string[];
 }
 export interface NormalizedDynamicTrace {
@@ -66,7 +68,11 @@ export interface DynamicTraceSummary {
     high_signal_apis: string[];
     memory_regions: string[];
     region_types?: string[];
+    protections?: string[];
+    address_ranges?: string[];
+    region_owners?: string[];
     observed_modules?: string[];
+    segment_names?: string[];
     observed_strings?: string[];
     stages: string[];
     risk_hints: string[];

package/dist/dynamic-trace.js

@@ -221,6 +221,8 @@ function normalizeRegion(entry) {
         base_address: normalizeAddress(obj.base_address ?? obj.base ?? obj.start),
         size: readFirstNumber(obj, ['size']),
         protection: readFirstString(obj, ['protection', 'protect']),
+        module_name: readFirstString(obj, ['module_name', 'module', 'image']),
+        segment_name: readFirstString(obj, ['segment_name', 'section', 'segment']),
         indicators,
     };
 }
@@ -280,6 +282,7 @@ export function normalizeDynamicTrace(raw, options) {
     const modules = dedupeStrings([
         ...toStringArray(record.modules),
         ...apiCalls.map((item) => item.module || ''),
+        ...memoryRegions.map((item) => item.module_name || ''),
     ]);
     const strings = dedupeStrings([
         ...toStringArray(record.strings),
@@ -379,6 +382,24 @@ export function summarizeDynamicTrace(trace) {
     const highSignalApis = observedApis.filter((item) => HIGH_SIGNAL_APIS.has(normalizeApiName(item)));
     const memoryRegions = trace.memory_regions.map((item) => item.purpose || item.region_type);
     const regionTypes = trace.memory_regions.map((item) => item.region_type);
+    const protections = trace.memory_regions.map((item) => item.protection || '');
+    const addressRanges = trace.memory_regions
+        .map((item) => {
+        if (!item.base_address) {
+            return '';
+        }
+        if (!item.size) {
+            return item.base_address;
+        }
+        const start = Number.parseInt(item.base_address.replace(/^0x/i, ''), 16);
+        if (!Number.isFinite(start)) {
+            return item.base_address;
+        }
+        return `${item.base_address}-0x${(start + item.size).toString(16)}`;
+    })
+        .filter((item) => item.length > 0);
+    const regionOwners = trace.memory_regions.map((item) => item.module_name || '');
+    const segmentNames = trace.memory_regions.map((item) => item.segment_name || '');
     const evidence = [];
     evidence.push(trace.executed
         ? `Imported runtime trace observed ${trace.api_calls.length} unique API(s).`
@@ -389,6 +410,9 @@ export function summarizeDynamicTrace(trace) {
     if (memoryRegions.length > 0) {
         evidence.push(`Memory regions or plans: ${dedupeStrings(memoryRegions, 8).join(', ')}`);
     }
+    if (protections.some((item) => item.length > 0)) {
+        evidence.push(`Observed protections: ${dedupeStrings(protections, 8).join(', ')}`);
+    }
     if (trace.stages.length > 0) {
         evidence.push(`Derived runtime stages: ${trace.stages.join(', ')}`);
     }
@@ -406,7 +430,11 @@ export function summarizeDynamicTrace(trace) {
         high_signal_apis: dedupeStrings(highSignalApis, 12),
         memory_regions: dedupeStrings(memoryRegions, 12),
         region_types: dedupeStrings(regionTypes, 12),
+        protections: dedupeStrings(protections, 12),
+        address_ranges: dedupeStrings(addressRanges, 12),
+        region_owners: dedupeStrings(regionOwners, 12),
         observed_modules: dedupeStrings(trace.modules, 12),
+        segment_names: dedupeStrings(segmentNames, 12),
         observed_strings: dedupeStrings(trace.strings, 12),
         stages: trace.stages,
         risk_hints: trace.risk_hints,
@@ -512,7 +540,26 @@ export async function loadDynamicTraceEvidence(workspaceManager, database, sampl
         observed_apis: dedupeStrings(normalizedTraces.flatMap((item) => item.api_calls.map((entry) => entry.api)), 30),
         memory_regions: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => entry.purpose || entry.region_type)), 20),
         region_types: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => entry.region_type)), 20),
-        observed_modules: dedupeStrings(normalizedTraces.flatMap((item) => item.modules), 20),
+        protections: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => entry.protection || '')), 20),
+        address_ranges: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => {
+            if (!entry.base_address) {
+                return '';
+            }
+            if (!entry.size) {
+                return entry.base_address;
+            }
+            const start = Number.parseInt(entry.base_address.replace(/^0x/i, ''), 16);
+            if (!Number.isFinite(start)) {
+                return entry.base_address;
+            }
+            return `${entry.base_address}-0x${(start + entry.size).toString(16)}`;
+        })), 20),
+        region_owners: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => entry.module_name || '')), 20),
+        observed_modules: dedupeStrings(normalizedTraces.flatMap((item) => [
+            ...item.modules,
+            ...item.memory_regions.map((entry) => entry.module_name || ''),
+        ]), 20),
+        segment_names: dedupeStrings(normalizedTraces.flatMap((item) => item.memory_regions.map((entry) => entry.segment_name || '')), 20),
         observed_strings: dedupeStrings(normalizedTraces.flatMap((item) => item.strings), 20),
         stages: dedupeStrings(normalizedTraces.flatMap((item) => item.stages), 20),
         risk_hints: dedupeStrings(normalizedTraces.flatMap((item) => item.risk_hints), 20),
@@ -605,7 +652,11 @@ export async function loadDynamicTraceEvidence(workspaceManager, database, sampl
         high_signal_apis: dedupeStrings(highSignalApis, 12),
         memory_regions: aggregated.memory_regions,
         region_types: aggregated.region_types,
+        protections: aggregated.protections,
+        address_ranges: aggregated.address_ranges,
+        region_owners: aggregated.region_owners,
         observed_modules: aggregated.observed_modules,
+        segment_names: aggregated.segment_names,
         observed_strings: aggregated.observed_strings,
         stages: aggregated.stages,
         risk_hints: aggregated.risk_hints,

package/dist/ghidra-config.js

@@ -7,6 +7,22 @@ import path from 'path';
 import { spawnSync } from 'child_process';
 import { logger } from './logger.js';
 import { buildRawCommandLine, decodeProcessStreams } from './process-output.js';
+function getWindowsCommandInterpreter() {
+    const envCandidates = [process.env.ComSpec, process.env.COMSPEC].filter((value) => Boolean(value && value.trim()));
+    for (const candidate of envCandidates) {
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    const systemRootCandidates = [process.env.SystemRoot, process.env.SYSTEMROOT].filter((value) => Boolean(value && value.trim()));
+    for (const systemRoot of systemRootCandidates) {
+        const candidate = path.join(systemRoot, 'System32', 'cmd.exe');
+        if (fs.existsSync(candidate)) {
+            return candidate;
+        }
+    }
+    return 'cmd.exe';
+}
 function getPythonCommand(platform = process.platform) {
     return platform === 'win32' ? 'python' : 'python3';
 }
@@ -89,7 +105,7 @@ export function buildWindowsBatchInvocation(command, args) {
     // without this, paths containing '&' are split and fail to execute.
     const wrappedCommandLine = `"${commandLine}"`;
     return {
-        command: 'cmd.exe',
+        command: getWindowsCommandInterpreter(),
         args: ['/d', '/s', '/c', wrappedCommandLine],
         windowsVerbatimArguments: true,
     };