The cws=8 class/field extraction (f85bd3b) enabled the macOS OBJECT_HEADER
path but only iOS Runner goldens covered it. dump-classes-macos asserts
real class/field recovery on hello.aot (_Closure size=64, _Uri size=96,
field offsets) and, negatively, that the old size=0 fallback garbage is
gone. Verified as a real anchor: reverting the cws==8 gate fails all six
of its assertions.
Co-Authored-By: Claude Fable 5 <[email protected]>
The r2 6.1.6 release parses the bare '>' redirect inside the quoted
!!sh -c one-liner and truncates the command, so the test produced no
output on CI while passing against r2 git. Move the pipeline into a
helper script so the r2 command line carries no quotes or redirects.
Co-Authored-By: Claude Fable 5 <[email protected]>
Rewrites the roadmap now that four items have landed. Adds a status table
(d387c0b fingerprinting/provenance, 2391781 explicit 3.7-3.12 profiles, cd6b655
discovery hardening, 0716a95 structural instruction location) and records the two
corrected assumptions worth remembering: the CID tables were already correct by
floor across 2.10-3.12, and the kDart* symbols survive strip.
Re-ranks everything P0..P4 by concrete failure instead of the old section order,
driven by a new finding: only 1 of 5 sample binaries (mafia, 3.9.2) exercises the
modern cluster decoder, because dart_modern_is_supported_snapshot() also gates on
compressed_word_size == 4. That makes two items P0 -- the modern_get_fill_spec
rules[] table is keyed on absolute 3.6/3.9-era CIDs and desyncs the fill stream on
Dart 3.4/3.5 compressed snapshots (cid 46 TYPE_ARGUMENTS read as LIBRARY_PREFIX,
89 ARRAY as CONST_SET), invisible to CI for exactly that reason; and widening the
modern decoder to uncompressed snapshots, which currently skips most iOS/macOS
samples. Also notes the new latent P2.3: the CID fallback still uses a literal
3.9.2 while unknown-hash fingerprinting now resolves to 3.12.0.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
The four kDart*Snapshot* symbols are external/global and load-bearing (the engine
resolves them at runtime), so they survive strip; but obfuscators/repackagers can
remove them, leaving only the two data snapshots findable by magic scan
(instruction images carry no magic) and iso_instr=0, which disables IT name
recovery.
Add locate_instr_images_structural(): vm_instr = start of the first executable
section; read the Dart Image header (word0=ImageSize) and chain
iso_instr = align_up(vm_instr + ImageSize, 64). Every step is cross-checked
(plausible headers; the isolate image must end where the first data image
begins), so an unknown/gapped layout degrades to 0 (no IT names) rather than junk
addresses. No-op when symbols already resolved the instructions.
Verified against symbol-derived ground truth: Runner (0x4000/0xe700, full 7671
IT entries recovered) and AuthPass (0x5a80/0xfdc0); the gapped macOS hello.aot
safely falls back to 0. Symbol-present bins unchanged; suite green (95 db/cmd,
3 extras, 35 custom).
Adds scripts/strip_macho_symbols.py (zeroes LC_SYMTAB + dyld export trie, since
strip cannot) and test/db/cmd/discovery-stripped-ios which builds the fixture
from the committed Runner App and asserts structural recovery. Remaining
follow-ups tracked in COMMIT2.md.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* Only data snapshots carry the 0xf5f5dcdc magic
* A stray f5f5dcdc byte run could poison vm_instr/iso_instr on symbol-stripped Mach-O
* Preserve symbol-derived addresses instead of letting scan guesses overwrite them
- Replaces the hardcoded 'v3.9.2 defaults' fallback
- Fix load_layout_from_json to use that profile on the -f/-A decode path for
unknown hashes, instead of a degenerate zeroed layout (cws=0/alignment=0);
- Adds a version_source field to -H, guessed layout is never exact match now
pancake