Ysopwnable
4fc6565b0f
* feat(native): inspect offline ELF layout through pwntools * fix(build): prepare offline ELF verification on clean runners * fix(native): preserve snapshot acquisition cancellation * fix(native): handle sectionless ELF and retain decoder diagnostics * test(native): verify malformed symbol table entry sizes * fix(native): respect inherited limits and unused segment fields * fix(native): preserve packed relocations and decoder launch constraints * fix(native): validate symbol spans and preserve resource failures * fix(native): preserve diagnostic completeness and memory failures * fix(native): guard bridge imports against allocation failures * fix(native): validate relocation symbol and section references * fix(native): retain diagnostics through compounded cleanup failures * fix(native): preserve unresolved relocation section references * fix(native): bound linkage evidence and preserve CPU signal diagnostics * fix(native): preserve file-size resource failure evidence * fix(native): retain opaque linkage names and late cancellation output * test(native): make CPU-limit fixture robust across runners * fix(native): verify resource failure branches before interpreting exits * fix(native): validate declared ELF string references * fix(native): validate section-name table before decoding * fix(native): enforce canonical ELF name-table escapes
Offline ELF upstream profile
REA uses caller-supplied, unchanged Python packages. It vendors no pwntools, pyelftools or Unicorn implementation and never installs these dependencies.
| Upstream | Exact verified profile | License | Role |
|---|---|---|---|
| pwntools | 4.15.0; tag commit 3ad86ec5adab1abf9781ca7552a6f5d7cff7a33c |
MIT | ELF analysis and static mitigation/GOT/PLT heuristics |
| pyelftools | 0.33 | Public domain | Original ELF sections, segments, symbols and relocations |
| Unicorn | 2.1.2 | GPL-2.0 | Upstream PLT emulation; distinct from executing the target as a host process |
The adapter checks all three runtime versions before importing the ELF engine. Original upstream code/licenses remain in the caller-selected environment. No target or core binaries are committed. Fixtures are compiled in owned temporary storage from repository source and are never executed.
bridge/pwntools/layout.py is an owned allocation-failure bootstrap;
layout_impl.py is the adapter. It reads original tables through
unchanged upstream APIs, preserves raw name bytes/ranges, and serializes uint64
values as strings. It never accesses ELF.libs, ELF.maps, ELF.libc or
process.corefile, which have materially different execution authority.
The real verification lane traces host exec syscalls, checks original artifact hashes and observes released owned processes. No negative claim relies only on an unmodified target's sentinel: upstream can execute a patched copy when its runtime-library accessors are used.
The instance-local adapter subclass forwards the documented pyelftools 0.33
iter_segments(type=...) / iter_sections(type=...) filters missing from
pwntools 4.15.0 cached overrides. No upstream file or global method is changed.
Sectionless dynamic string tables use unique DT_STRTAB/DT_STRSZ mappings to
file-backed PT_LOAD bytes; ambiguous or non-file-backed mappings are explicitly
unsupported. Section-name table escapes follow the ELF ABI:
SHN_XINDEX represents actual indices at least 0xff00; ordinary absence uses index
zero. Raw name offsets remain reported when the name table is absent.
PLT convenience inference uses the unchanged upstream Unicorn instruction emulator. REA labels those maps as derived static evidence. The no-execution verification claim concerns launching the selected object as a host process, not the absence of static instruction emulation inside an analysis engine.