mirror of
https://codeberg.org/reverse-skill-lab/exe-reverse
synced 2026-11-15 20:34:25 +08:00
root
e5b45d9072
references/iat-virtualization-and-call-site-rewriting.md records the two edits one protector family makes to a native image: the import slot stops holding an address and the indirect call that read it becomes a relative call to a stub. It carries the pairing rule -- a site's target equals a slot's value -- the three placements of the filler byte in a six-byte rewrite and the refusal when there is none, the divergence between builds that modify the code section and builds that only redirect the table, the small set of imports redirected twice, the choice between repairing, extracting a payload, observing and reporting, and the limits an automatic unpacker inherits from its own dump. scripts/iat_callsite_restore.py implements the mechanical half offline: inventory the slots from three sources, pair by value, decide the six-byte window per site, refuse an ambiguous slot and a site whose sixth byte is the next instruction, rewrite, then re-decode every written site from the file it wrote. It is report-only unless --out is given, and it does not unpack: a virtualised entry has no site list to restore. Registered in both symptom tables, the routing, reference and script indexes, the capability registry as call_site_restore, and the coverage, route-inventory and evidence tables. dynamic-debugging.md gains the instrument rule the second write-up demonstrates (a target that runs at full speed and dies when stopped has a perturbation detector), memory-and-dumps.md gains the call-site step of a rebuild, environment.md gains the compatibility-shim trap, and protectors-and-packers.md gains one recognition row plus a pointer rather than the detail, because that file makes no product-level claims. The target-behaviour claims stay unverified: no protected sample was analysed here. What is observed is the tool's behaviour on a generated image -- both filler positions, both refusals, both displacement forms -- and what the source material states about itself. FINDINGS F16 records the defect this pass produced, a slot's magnitude read as its meaning, with the test that fails without the fix. .gitignore gains ref/, which was not covered by the existing rule because that rule carries a leading dot.
67 lines
1.7 KiB
Plaintext
67 lines
1.7 KiB
Plaintext
# Local build products. The kit ships source only: every PE the tests need is generated into a
|
|
# pytest temp directory by skills/exe-reverse/scripts/make_fixture_pe.py, so nothing here is an input
|
|
# the repository could not rebuild.
|
|
*.obj
|
|
*.lib
|
|
*.exp
|
|
*.ilk
|
|
*.idb
|
|
*.i64
|
|
*.til
|
|
*.nam
|
|
*.map
|
|
|
|
# Working data -- never commit samples, dumps or captures.
|
|
*.exe
|
|
*.dll
|
|
*.sys
|
|
*.ocx
|
|
*.cpl
|
|
*.scr
|
|
*.pdb
|
|
*.zip
|
|
*.7z
|
|
*.bin
|
|
*.dmp
|
|
*.etl
|
|
*.pcap
|
|
*.png
|
|
*.jpg
|
|
|
|
# local scratch
|
|
_tmp/
|
|
out/
|
|
work/
|
|
audit_out/
|
|
|
|
# local extension-pass workspace: toolchains, vendor SDKs, unpacked installers, scratch notes.
|
|
# Nothing under tools/ belongs to the repository -- the skill's own evidence record lives in
|
|
# docs/tool-verification/ and carries no target identity or vendored binaries.
|
|
tools/
|
|
|
|
# Local copies of the third-party write-ups an absorption pass reads. They are someone else's text,
|
|
# not content of this repository: what ships is the absorbed method under an `inferred` label, plus
|
|
# the anonymized source line in docs/tool-verification/EXTENSION-absorption-*.md. One `git add -A`
|
|
# is all it would take to commit them, so the rule is explicit here rather than resting on "nobody
|
|
# has added them yet".
|
|
.ref/
|
|
# The same corpus under the undotted name. Both spellings exist because a clone lands as `ref/`
|
|
# and a hand-made workspace as `.ref/`, and only one of them was covered: `git add -A` with the
|
|
# undotted name staged 3.9 MB of third-party write-ups, upstream .git directories and GPL sources
|
|
# into a repository that ships neither. One rule per spelling, so neither depends on the other.
|
|
ref/
|
|
|
|
# sandbox installs made while testing `npx skills add .` against this repo
|
|
.claude/
|
|
.agents/
|
|
*.log
|
|
*.jsonl
|
|
|
|
# python / editors
|
|
__pycache__/
|
|
*.pyc
|
|
.venv/
|
|
.vscode/
|
|
.idea/
|
|
.DS_Store
|