scientific-method-engine 0.1.0__py3-none-any.whl

scientific_method_engine/__init__.py

@@ -0,0 +1,5 @@
+"""Bounded instruction-derived x86 evidence reports."""
+
+# The reader passes this number with every prepared config it pipes to the engine. A reader and
+# engine that disagree on it refuse to run instead of exchanging relocation data in another shape.
+PREPARED_PROTOCOL = 1

scientific_method_engine/__main__.py

@@ -0,0 +1,3 @@
+from .cli import run
+
+run()

scientific_method_engine/cli.py

@@ -0,0 +1,75 @@
+"""Read-only bounded x86 evidence reports. Keep configs and reports in GAME_DIR, uncommitted."""
+import json
+import sys
+from pathlib import Path
+
+from . import PREPARED_PROTOCOL
+
+CONFIG_LIMIT = 1024 * 1024
+PREPARED_CONFIG_LIMIT = 16 * 1024 * 1024
+USAGE = ("Usage: scientific-method-engine <operand|operand-candidates|target|bounds|owner|callees|trace|uses|arguments|"
+         "effects|returns|memory|incoming|guards|allocation|dispatch> <config.json|->\n"
+         "       scientific-method-engine ghidra-scripts")
+
+
+def ghidra_scripts():
+    """The directory to pass to Ghidra's analyzeHeadless -scriptPath."""
+    return Path(__file__).resolve().parent / "ghidra"
+
+
+def main(argv):
+    """Run one command (``argv`` excludes the program name) and print its JSON report."""
+    from .x86.image import read_source
+    from .x86.reports import run_report
+    if argv == ["ghidra-scripts"]:
+        print(ghidra_scripts())
+        return
+    if len(argv) != 2:
+        raise ValueError(USAGE)
+    command, config_path = argv
+    reject_derived = False
+    if config_path == "-":
+        # The reader caps its input at 1 MiB, then adds every source relocation.
+        limit, label = PREPARED_CONFIG_LIMIT, "Prepared config exceeds 16 MiB"
+        text = sys.stdin.read(limit + 1)
+        base = Path.cwd()
+    else:
+        limit, label = CONFIG_LIMIT, "Config exceeds 1 MiB"
+        path = Path(config_path).resolve()
+        if path.stat().st_size > limit:
+            raise ValueError(label)
+        text, base = path.read_text(encoding="utf-8"), path.parent
+        reject_derived = True
+    if len(text.encode("utf-8")) > limit:
+        raise ValueError(label)
+    config = json.loads(text)
+    if not isinstance(config, dict):
+        raise ValueError("Config must be an object")
+    if reject_derived and "overlayExports" in config:
+        # Only the reader's MZ/FBOV loader (stdin mode) derives overlay exports from source tables.
+        raise ValueError("overlayExports is source-derived and cannot be supplied")
+    if config_path == "-":
+        protocol = config.pop("preparedProtocol", None)
+        if protocol != PREPARED_PROTOCOL:
+            raise ValueError(f"Reader sent prepared config protocol {protocol}; this engine reads protocol "
+                             f"{PREPARED_PROTOCOL}. Install matching @scientific-method/executable-reader and "
+                             "scientific-method-engine releases.")
+    elif "preparedProtocol" in config:
+        raise ValueError("preparedProtocol is set by the reader and cannot be supplied")
+    data, identity = read_source(config, base)
+    result = run_report(data, config, command)
+    print(json.dumps({"schema": "bounded-x86-v1", "decoder": "capstone 5.0.7", "sourceIdentity": identity,
+                      "status": "Conditional static report; never promotes an evidence entry", **result}, indent=2))
+
+
+def run():
+    """Entry point of the ``scientific-method-engine`` command; exits with 1 on any error."""
+    try:
+        main(sys.argv[1:])
+    except (ValueError, TypeError, KeyError, OSError, ImportError) as error:
+        print("Evidence report: " + str(error), file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    run()

scientific_method_engine/ghidra/ClearNoReturnFunctions.java

@@ -0,0 +1,22 @@
+// Clears incorrect no-return markings at explicitly supplied function addresses.
+// @category Restoration
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+
+public class ClearNoReturnFunctions extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        for (String argument : getScriptArgs()) {
+            Address address = toAddr(argument);
+            Function function = getFunctionContaining(address);
+            if (function == null) {
+                printerr("No function contains " + address);
+                continue;
+            }
+            function.setNoReturn(false);
+            println("Cleared no-return on " + function.getName() + " at " + function.getEntryPoint());
+        }
+    }
+}

scientific_method_engine/ghidra/CreateFunctions.java

@@ -0,0 +1,27 @@
+// Creates functions at explicitly supplied indirect-call targets.
+// @category Restoration
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+
+public class CreateFunctions extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length == 0) {
+            printerr("Pass one or more function entry addresses.");
+            return;
+        }
+        for (String argument : arguments) {
+            Address address = toAddr(argument);
+            Function function = getFunctionAt(address);
+            if (function == null) function = createFunction(address, null);
+            if (function == null) {
+                printerr("Could not create function at " + address);
+                continue;
+            }
+            println("FUNCTION " + function.getName() + " " + function.getEntryPoint());
+        }
+    }
+}

scientific_method_engine/ghidra/ExportBoundedFlow.java

@@ -0,0 +1,59 @@
+// Exports instruction metadata for one entry. Output belongs in ignored analysis/original/.
+// @category Restoration
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.Function;
+import java.nio.file.*;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+
+public class ExportBoundedFlow extends GhidraScript {
+    @Override protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        if (args.length != 3) throw new IllegalArgumentException("Supply entry, instruction limit (1..10000), ignored analysis/original/output.json");
+        Address entry = toAddr(args[0]);
+        int limit = Integer.parseInt(args[1]);
+        if (limit < 1 || limit > 10000) throw new IllegalArgumentException("Limit must be 1..10000");
+        Path output = Path.of(args[2]).toAbsolutePath().normalize();
+        if (!output.toString().replace('\\', '/').contains("/analysis/original/")) throw new IllegalArgumentException("Flow reports stay under ignored analysis/original/");
+        Set<Address> visited = new HashSet<>();
+        Deque<Address> pending = new ArrayDeque<>();
+        List<String> rows = new ArrayList<>();
+        Set<Long> entries = new TreeSet<>();
+        entries.add(entry.getOffset()); pending.push(entry);
+        while (!pending.isEmpty()) {
+            if (monitor.isCancelled()) throw new InterruptedException("Cancelled");
+            Address at = pending.pop();
+            if (visited.contains(at)) continue;
+            if (visited.size() >= limit) break; // Missing edge targets remain explicit review gaps.
+            visited.add(at);
+            Function owner = currentProgram.getFunctionManager().getFunctionContaining(at);
+            Function exact = currentProgram.getFunctionManager().getFunctionAt(at);
+            if (!at.equals(entry) && exact != null) { entries.add(at.getOffset()); continue; }
+            Instruction ins = currentProgram.getListing().getInstructionAt(at);
+            if (ins == null) continue;
+            List<Long> next = new ArrayList<>(), calls = new ArrayList<>();
+            var type = ins.getFlowType();
+            Address fall = ins.getFallThrough();
+            if (fall != null) { next.add(fall.getOffset()); pending.push(fall); }
+            for (Address target : ins.getFlows()) {
+                if (type.isCall()) calls.add(target.getOffset());
+                else { next.add(target.getOffset()); pending.push(target); }
+            }
+            String kind = type.isComputed() ? "indirect" : type.isCall() ? "call" : type.isTerminal() ? "terminal" : type.isJump() ? "branch" : "ordinary";
+            // A terminal mnemonic alone is insufficient to identify interrupt/OS semantics.
+            String mnemonic = ins.getMnemonicString().toUpperCase(Locale.ROOT);
+            if (mnemonic.startsWith("RET")) kind = "return";
+            boolean hardware = mnemonic.matches("(?:IN|OUT)(?:S[BDW]?)?(?:\\.REP\\w*)?|INT(?:[13O])?|HLT");
+            rows.add("{\"start\":" + at.getOffset() + ",\"size\":" + ins.getLength()
+                + ",\"kind\":\"" + kind + "\",\"next\":" + next + ",\"calls\":" + calls
+                + ",\"externalEffects\":" + (hardware ? "[\"instruction requires hardware/OS review\"]" : "[]")
+                + ",\"owner\":" + (owner == null ? "null" : owner.getEntryPoint().getOffset()) + "}");
+        }
+        Files.createDirectories(output.getParent());
+        String text = "{\"entries\":" + entries + ",\"instructions\":[" + String.join(",", rows) + "]}";
+        Files.writeString(output, text, StandardCharsets.UTF_8, StandardOpenOption.CREATE_NEW);
+        println("Exported " + rows.size() + " instruction metadata records. Ghidra addresses are view-specific; retain the import mapping separately.");
+    }
+}

scientific_method_engine/ghidra/ExportFunctionFingerprints.java

@@ -0,0 +1,135 @@
+// Exports normalized function and instruction fingerprints for cross-version mapping.
+// @category Restoration
+
+import java.io.BufferedWriter;
+import java.io.File;
+import java.io.FileWriter;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.ArrayList;
+import java.util.List;
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.lang.Register;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionIterator;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.listing.InstructionIterator;
+import ghidra.program.model.scalar.Scalar;
+
+public class ExportFunctionFingerprints extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        if (args.length != 1) {
+            throw new IllegalArgumentException("Expected output TSV path.");
+        }
+
+        File output = new File(args[0]);
+        File parent = output.getParentFile();
+        if (parent != null) {
+            parent.mkdirs();
+        }
+
+        try (BufferedWriter writer = new BufferedWriter(new FileWriter(output, StandardCharsets.UTF_8))) {
+            writer.write("kind\tfunction\taddress\tend\tsize\tinstructionCount\tfingerprint\tsignature\n");
+            FunctionIterator functions = currentProgram.getFunctionManager().getFunctions(true);
+            while (functions.hasNext() && !monitor.isCancelled()) {
+                Function function = functions.next();
+                List<Instruction> instructions = new ArrayList<>();
+                InstructionIterator iterator = currentProgram.getListing()
+                    .getInstructions(function.getBody(), true);
+                StringBuilder functionSignature = new StringBuilder();
+                while (iterator.hasNext()) {
+                    Instruction instruction = iterator.next();
+                    instructions.add(instruction);
+                    functionSignature.append(normalize(instruction)).append(';');
+                }
+
+                String entry = hex(function.getEntryPoint());
+                writer.write(String.join("\t",
+                    "F", entry, entry, hex(function.getBody().getMaxAddress()),
+                    Long.toString(function.getBody().getNumAddresses()),
+                    Integer.toString(instructions.size()), sha256(functionSignature.toString()),
+                    functionSignature.toString()));
+                writer.newLine();
+
+                for (Instruction instruction : instructions) {
+                    String signature = normalize(instruction);
+                    writer.write(String.join("\t",
+                        "I", entry, hex(instruction.getAddress()),
+                        hex(instruction.getMaxAddress()), Integer.toString(instruction.getLength()),
+                        "1", sha256(signature), signature));
+                    writer.newLine();
+                }
+            }
+
+            InstructionIterator allInstructions = currentProgram.getListing().getInstructions(true);
+            while (allInstructions.hasNext() && !monitor.isCancelled()) {
+                Instruction instruction = allInstructions.next();
+                Function function = currentProgram.getFunctionManager()
+                    .getFunctionContaining(instruction.getAddress());
+                String owner = function == null ? "" : hex(function.getEntryPoint());
+                String signature = normalize(instruction);
+                writer.write(String.join("\t",
+                    "A", owner, hex(instruction.getAddress()),
+                    hex(instruction.getMaxAddress()), Integer.toString(instruction.getLength()),
+                    "1", sha256(signature), signature));
+                writer.newLine();
+            }
+        }
+        println("Wrote " + output.getAbsolutePath());
+    }
+
+    // A scalar that names an address in the program is relocatable between versions, so it is
+    // fingerprinted as an address rather than by value.
+    private boolean isProgramAddress(long value) {
+        try {
+            return currentProgram.getMemory().contains(toAddr(value));
+        } catch (RuntimeException outOfRange) {
+            return false;
+        }
+    }
+
+    private String normalize(Instruction instruction) {
+        StringBuilder result = new StringBuilder(instruction.getMnemonicString().toLowerCase());
+        for (int operand = 0; operand < instruction.getNumOperands(); operand++) {
+            result.append('|');
+            Object[] objects = instruction.getOpObjects(operand);
+            for (Object object : objects) {
+                if (object instanceof Register register) {
+                    result.append('R').append(register.getName().toLowerCase());
+                } else if (object instanceof Address address) {
+                    result.append(address.isMemoryAddress() ? "A" : "X");
+                } else if (object instanceof Scalar scalar) {
+                    long value = scalar.getSignedValue();
+                    long unsigned = scalar.getUnsignedValue();
+                    if (instruction.getFlowType().isFlow() || isProgramAddress(unsigned)) {
+                        result.append('A');
+                    } else {
+                        result.append('S').append(value);
+                    }
+                } else {
+                    result.append('O').append(object.getClass().getSimpleName());
+                }
+                result.append(',');
+            }
+        }
+        return result.toString();
+    }
+
+    private static String hex(Address address) {
+        return String.format("%08x", address.getOffset());
+    }
+
+    private static String sha256(String value) throws Exception {
+        MessageDigest digest = MessageDigest.getInstance("SHA-256");
+        byte[] hash = digest.digest(value.getBytes(StandardCharsets.UTF_8));
+        StringBuilder text = new StringBuilder(hash.length * 2);
+        for (byte b : hash) {
+            text.append(String.format("%02x", b & 0xff));
+        }
+        return text.toString();
+    }
+}

scientific_method_engine/ghidra/ExportFunctionInventory.java

@@ -0,0 +1,50 @@
+// Exports only function starts and body sizes for the committed coverage inventory.
+// @category Restoration
+
+import java.io.BufferedWriter;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.FunctionIterator;
+
+public class ExportFunctionInventory extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length != 1) {
+            throw new IllegalArgumentException("Supply one output TSV path.");
+        }
+
+        Path output = Path.of(arguments[0]).toAbsolutePath().normalize();
+        if (Files.exists(output)) {
+            throw new IllegalArgumentException("Inventory output already exists: " + output);
+        }
+        Files.createDirectories(output.getParent());
+
+        long count = 0;
+        Path temporary = Files.createTempFile(output.getParent(), "inventory-", ".partial");
+        try {
+        try (BufferedWriter writer = Files.newBufferedWriter(temporary, StandardCharsets.UTF_8)) {
+            writer.write("start\tsize\n");
+            FunctionIterator functions = currentProgram.getFunctionManager().getFunctions(true);
+            while (functions.hasNext()) {
+                if (monitor.isCancelled()) {
+                    throw new InterruptedException("Function inventory export cancelled.");
+                }
+                Function function = functions.next();
+                writer.write(function.getEntryPoint().toString());
+                writer.write('\t');
+                writer.write(Long.toString(function.getBody().getNumAddresses()));
+                writer.write('\n');
+                count++;
+            }
+        }
+        Files.move(temporary, output); // No replacement, and no final file until traversal completes.
+        }
+        finally { Files.deleteIfExists(temporary); }
+        println("Exported " + count + " function starts and body sizes to " + output);
+    }
+}

scientific_method_engine/ghidra/MergeFallThroughFragment.java

@@ -0,0 +1,63 @@
+// Merges a verified orphan function fragment reached by its parent's fall-through.
+// @category Restoration
+
+import ghidra.app.cmd.function.CreateFunctionCmd;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.symbol.Reference;
+import ghidra.program.model.symbol.ReferenceIterator;
+
+public class MergeFallThroughFragment extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        if (args.length != 2) {
+            throw new IllegalArgumentException("Pass parent and orphan fragment function entries.");
+        }
+        Address parentEntry = toAddr(args[0]);
+        Address fragmentEntry = toAddr(args[1]);
+        Function parent = getFunctionAt(parentEntry);
+        Function fragment = getFunctionAt(fragmentEntry);
+        if (parent == null || fragment == null || parent.equals(fragment)) {
+            throw new IllegalArgumentException("Pass two different existing function entries.");
+        }
+        Instruction previous = currentProgram.getListing().getInstructionBefore(fragmentEntry);
+        Address expectedNext = fragmentEntry;
+        int bridgeInstructions = 0;
+        while (previous != null && expectedNext.equals(previous.getFallThrough())) {
+            Function owner = getFunctionContaining(previous.getAddress());
+            if (parent.equals(owner)) break;
+            if (owner != null || previous.getFlowType().isCall() ||
+                    previous.getFlowType().isJump() || previous.getFlowType().isTerminal() ||
+                    ++bridgeInstructions > 64) {
+                throw new IllegalArgumentException("Fragment bridge rejected at " + previous.getAddress() + " owner=" + (owner == null ? "none" : owner.getEntryPoint()) + " flow=" + previous.getFlowType());
+            }
+            expectedNext = previous.getAddress();
+            previous = currentProgram.getListing().getInstructionBefore(expectedNext);
+        }
+        if (previous == null || !expectedNext.equals(previous.getFallThrough()) ||
+                !parent.getBody().contains(previous.getAddress())) {
+            throw new IllegalArgumentException("Fragment is not reached by its parent's adjacent fall-through.");
+        }
+        ReferenceIterator references = currentProgram.getReferenceManager().getReferencesTo(fragmentEntry);
+        while (references.hasNext()) {
+            Reference reference = references.next();
+            if (!parent.getBody().contains(reference.getFromAddress()) ||
+                    reference.getReferenceType().isCall() || reference.getReferenceType().isData()) {
+                throw new IllegalArgumentException("Fragment entry has an independent caller/data reference: " + reference);
+            }
+        }
+        long previousSize = parent.getBody().getNumAddresses();
+        println("MERGE fragment=" + fragmentEntry + " parent=" + parentEntry +
+            " preceding=" + previous.getAddress() + " bridgeInstructions=" + bridgeInstructions + " fragmentBytes=" + fragment.getBody().getNumAddresses());
+        currentProgram.getFunctionManager().removeFunction(fragmentEntry);
+        CreateFunctionCmd.fixupFunctionBody(currentProgram, parent, monitor);
+        if (!parent.getBody().contains(fragmentEntry)) {
+            throw new IllegalStateException("Recomputed parent body does not include the fragment entry.");
+        }
+        println("PARENT " + parentEntry + " bodyBytes=" + previousSize +
+            " -> " + parent.getBody().getNumAddresses() + " end=" + parent.getBody().getMaxAddress());
+    }
+}

scientific_method_engine/ghidra/RecoverCitedFunctions.java

@@ -0,0 +1,93 @@
+// Disassembles and recovers functions at a version-specific list of cited entries.
+// Arguments: a file of 8-digit hex addresses, one per line or in a CSV column, and the optional
+// zero-based column. Addresses outside executable memory blocks are counted and skipped.
+// @category Restoration
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileReader;
+
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.Instruction;
+import ghidra.program.model.mem.MemoryBlock;
+
+public class RecoverCitedFunctions extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] arguments = getScriptArgs();
+        if (arguments.length < 1 || arguments.length > 2) {
+            throw new IllegalArgumentException(
+                "Expected an address/CSV file and optional zero-based CSV column.");
+        }
+        int column = arguments.length == 2 ? Integer.parseInt(arguments[1]) : 0;
+        if (column < 0) {
+            throw new IllegalArgumentException("The CSV column is zero-based and cannot be negative.");
+        }
+
+        int recovered = 0;
+        int alreadyDefined = 0;
+        int failed = 0;
+        int skipped = 0;
+        try (BufferedReader reader = new BufferedReader(new FileReader(new File(arguments[0])))) {
+            String line;
+            while ((line = reader.readLine()) != null && !monitor.isCancelled()) {
+                line = line.strip();
+                if (line.isEmpty() || line.startsWith("#")) {
+                    continue;
+                }
+                if (line.contains(",")) {
+                    String[] fields = line.split(",", -1);
+                    // A CSV written as "a, b" pads its fields; the padding is not part of the address.
+                    if (column >= fields.length || !fields[column].strip().matches("(?i)[0-9a-f]{8}")) {
+                        continue;
+                    }
+                    line = fields[column].strip();
+                }
+                if (!line.matches("(?i)[0-9a-f]{8}")) {
+                    continue;
+                }
+                Address address = toAddr(line);
+                MemoryBlock block = currentProgram.getMemory().getBlock(address);
+                if (block == null || !block.isExecute()) {
+                    skipped++;
+                    continue;
+                }
+                Function function = getFunctionAt(address);
+                Instruction instruction = getInstructionAt(address);
+
+                // A previous address-only pass may have left a one-byte, empty function.
+                // Remove only that unusable placeholder before asking Ghidra to disassemble.
+                if (function != null && instruction == null &&
+                    function.getBody().getNumAddresses() == 1) {
+                    removeFunction(function);
+                    function = null;
+                }
+
+                if (instruction == null && !disassemble(address)) {
+                    printerr("Could not disassemble " + address);
+                    failed++;
+                    continue;
+                }
+                if (function == null) {
+                    function = createFunction(address, null);
+                }
+                if (function == null) {
+                    function = getFunctionContaining(address);
+                }
+                if (function == null) {
+                    printerr("Could not create function " + address);
+                    failed++;
+                } else if (function.getEntryPoint().equals(address)) {
+                    recovered++;
+                } else {
+                    alreadyDefined++;
+                }
+            }
+        }
+        println("Recovered entries: " + recovered +
+            "; already inside functions: " + alreadyDefined + "; failures: " + failed +
+            "; outside executable memory: " + skipped);
+    }
+}

scientific_method_engine/ghidra/RepairReturningCallers.java

@@ -0,0 +1,76 @@
+// Repairs explicitly verified returning calls and recomputes their caller body.
+// @category Restoration
+
+import java.util.ArrayList;
+import java.util.List;
+import ghidra.app.cmd.function.CreateFunctionCmd;
+import ghidra.app.script.GhidraScript;
+import ghidra.program.model.address.Address;
+import ghidra.program.model.listing.FlowOverride;
+import ghidra.program.model.listing.Function;
+import ghidra.program.model.listing.Instruction;
+
+public class RepairReturningCallers extends GhidraScript {
+    @Override
+    protected void run() throws Exception {
+        String[] args = getScriptArgs();
+        if (args.length < 3) {
+            throw new IllegalArgumentException("Pass callee entry, caller entry, then verified call addresses.");
+        }
+        Address calleeAddress = toAddr(args[0]);
+        Address callerAddress = toAddr(args[1]);
+        Function callee = getFunctionAt(calleeAddress);
+        Function caller = getFunctionAt(callerAddress);
+        if (callee == null || caller == null) {
+            throw new IllegalArgumentException("Callee and caller must be existing function entries.");
+        }
+        List<Instruction> calls = new ArrayList<>();
+        for (int index = 2; index < args.length; index++) {
+            Address callAddress = toAddr(args[index]);
+            Instruction call = getInstructionAt(callAddress);
+            if (call == null || !call.getMnemonicString().equalsIgnoreCase("CALL") ||
+                    callAddress.compareTo(callerAddress) < 0) {
+                throw new IllegalArgumentException("Not a verified caller CALL: " + callAddress);
+            }
+            Address[] targets = call.getDefaultFlows();
+            if (targets.length != 1 || !targets[0].equals(calleeAddress)) {
+                throw new IllegalArgumentException("CALL does not target supplied callee: " + callAddress);
+            }
+            Function owner = getFunctionContaining(callAddress);
+            if (owner != null && !owner.equals(caller)) {
+                throw new IllegalArgumentException("CALL belongs to another function: " + callAddress);
+            }
+            FlowOverride override = call.getFlowOverride();
+            if (override != FlowOverride.NONE && override != FlowOverride.CALL_RETURN) {
+                throw new IllegalArgumentException("Unexpected flow override at " + callAddress + ": " + override);
+            }
+            Address expectedFallThrough = callAddress.add(call.getLength());
+            if (call.isFallThroughOverridden() && call.getFallThrough() != null &&
+                    !call.getFallThrough().equals(expectedFallThrough)) {
+                throw new IllegalArgumentException("Unexpected custom fall-through at " + callAddress);
+            }
+            calls.add(call);
+        }
+        long previousSize = caller.getBody().getNumAddresses();
+        callee.setNoReturn(false);
+        for (Instruction call : calls) {
+            println("REPAIR " + call.getAddress() + " override=" + call.getFlowOverride() +
+                " fallThrough=" + call.getFallThrough());
+            call.setFlowOverride(FlowOverride.NONE);
+            call.clearFallThroughOverride();
+            Address next = call.getAddress().add(call.getLength());
+            if (getInstructionAt(next) == null && !disassemble(next)) {
+                throw new IllegalStateException("Could not disassemble caller continuation at " + next);
+            }
+        }
+        CreateFunctionCmd.fixupFunctionBody(currentProgram, caller, monitor);
+        println("CALLER " + caller.getEntryPoint() + " bodyBytes=" + previousSize +
+            " -> " + caller.getBody().getNumAddresses() + " end=" + caller.getBody().getMaxAddress());
+        for (Instruction call : calls) {
+            if (call.getFallThrough() == null ||
+                    !caller.getBody().contains(call.getAddress().add(call.getLength()))) {
+                throw new IllegalStateException("Caller continuation remains missing after repair: " + call.getAddress());
+            }
+        }
+    }
+}