Matt Van Horn
2edf3b23c1
Inspect selected ELF32/ELF64 PT_NOTE and SHT_NOTE declarations without executing the artifact, retaining independent table identities, source ranges, descriptor digests, GNU build-id/ABI fields and explicit coverage limitations. Integrate mvanhorn's implementation and hardening with current main while preserving byte-entropy registration and the Windows curated regression suite. The maintainer follow-up uses ordinary merges/pushes, not history rewriting. Executed validation: 96 focused/shared/docs tests, complete static/docs checks, eleven real CLI/MCP pairs including GCC ELF32 and Clang big-endian PowerPC64, and two actual Codex task traces checked against their Evidence. Full costs, grader correction and verification limits are recorded in PR #4837. Refs #6262.
2.2 KiB
ELF note tables
inspect_elf_notes / inspect-elf-notes answers whether one selected local
ELF32/ELF64 image declares PT_NOTE program headers or SHT_NOTE sections,
which note owners and types those tables store, and which GNU build-id or
ABI-tag fields those notes carry. It reads the file without executing it and
does not require a disassembler, debug package, or package catalog.
rea inspect-elf-notes /absolute/path/to/program --json
The CLI resolves relative paths against the caller's working directory. MCP requires an absolute filesystem path and preserves that exact selection:
{
"name": "inspect_elf_notes",
"arguments": { "path": "/artifacts/program" }
}
Observations
The inline Evidence result contains the artifact path, SHA-256, and byte length.
tables lists each declared note program header or section, including the
section name when a string table is present. Each entries[] item reports owner,
type, descriptor SHA-256, and a hex preview for descriptors of 64 bytes or less.
For GNU notes, gnu.build_id_hex, gnu.abi_tag, or gnu.gold_version are
filled when the descriptor matches that type. Other owners keep gnu null.
PT_NOTE and SHT_NOTE are examined independently. The same file range may
appear twice when both tables declare it.
A missing table list is observed absence of those declarations. It is not proof the image never carried notes in another container or overlay.
Limits and failures
The selected file is limited to 64 MiB by default (512 MiB maximum). At most
32 note entries are examined by default across every table. Retained note
names, section names, and GNU descriptor text share that file's byte budget,
and repeated table ranges count again. Each descriptor range is hashed once,
and each GNU version's trailing NUL run is scanned once; neither walk may
exceed that byte ceiling. Malformed ELF headers, truncated header
tables, declared note tables that extend past the file, and truncated
note entries fail without partial success. ELF extended
numbering (PN_XNUM, including a section count stored when e_shnum is 0) is
unsupported.
This workflow does not execute the image or verify GNU build-id uniqueness against package catalogs.