Features / Repository inventory
From bytes to evidence
The current workflows, their artifacts, and the boundaries that matter when reading a result.
Reviewed against this checkout on 1 October 2026. Some source documents describe older contracts; use the current README and implementation references together.
Ghidra analysis, P-code, and call tracing#
Opening a local ELF starts a managed headless Ghidra worker. A pinned container is the default; HYDIR_GHIDRA_HOME selects a local Ghidra 12.1.4 installation. Cached projects support later function selections. A closed existing Ghidra project can be imported through an isolated copy with executable digest checks.
Snapshot v2 retains raw instruction P-code, function and call evidence, memory blocks, and optional high P-code and type hints. Rust handles semantic classification, ordered state effects, simplification, CFG construction, and bounded dependency slices. High P-code remains analysis evidence.
Seeded path and call tracing share registers and RAM across loaded snapshots, check return targets, and stop at missing or unsupported effects. Automatic call tracing prioritizes the concrete callee reached by the seed. Bounded LLVM variants cover prefixes, standalone operations, CFG paths, and caller/callee state machines. The image variant embeds up to 64 KiB of validated read-only ELF bytes.
DynamicTrace v3 can produce a byte-checked candidate plan for observed indirect jumps. Targeted reanalysis applies the plan in an isolated project copy and retains the unknown computed edge. This is input-specific recovery evidence.
Ghidra integration and command reference · Stripped password example
Independent native ELF analysis#
The Rust frontend imports linked and relocatable little-endian x86-64 ELF files. ProgramSpec v5 records address spaces, segments, relocations, symbols, imports, ABI facts, and the binary digest. FunctionIndex combines symbol, unwind, runtime, direct-call, PLT, Go-pclntab, and bounded jump-table evidence.
The pipeline is MachineIR → StateIR → FunctionIR → CIR → DecompilationUnit, with LLVM as an optional export. StateIR tracks register, flag, control, and memory-region components with SSA versions. Native C uses an explicit machine-state ABI; structured output covers accepted decisions, switches, and loop regions while retaining conservative fallbacks.
Implemented families include broad integer operations, BMI2, REP strings, common atomics and fences, scalar and packed floating point, x87, SSE/AVX/AVX2, and bounded AVX-512 and XSAVE effects. Coverage is instruction- and environment-dependent; unmodeled decorators, faults, and effects remain visible. PE, Mach-O, other architectures, and big-endian ELF are outside this import contract.
Native stages, instruction inventory, and remaining gates · Dated capability matrix
Native analysis commands and contracts →
Editable types and analyst facts#
AnalysisModel v1 binds function names, prototypes, stack objects, and named primitive, pointer, array, struct, union, enum, and alias types to one ELF SHA-256. Bounded DWARF import and native inference attach evidence and expose conflicts. An inferred aggregate size is a lower bound unless other evidence establishes its extent.
HighLevelCIR and HighLevelCfgCir provide bounded typed C with instruction provenance, checked field offsets, alias-aware memory helpers, and selected branches, joins, and loops. Typed C remains semantically conservative and is never rewrite ready. Unsupported functions retain the native low-level and structured views.
Local projects save models with revision checks and idempotency keys. The desktop Types and Typed C views link statements and evidence to machine addresses. Remote model edits refresh typed output through the v3 service. Local caches distinguish model revisions and selectively retain unaffected entries.
Typed model workflow and supported CFG subset
Frida, replay, and captured-state exploration#
Frida observes a selected local ELF function for one input and records byte-checked blocks, calls, entry state, and observed targets. In the current desktop, Frida → Session accepts one program argument per line; successful observations open Events. An InputSpec file supports file inputs and custom limits. Nonempty stdin is currently rejected.
The Windows release carries a dedicated Linux worker with Frida and its userland. WSL2 is installed separately; the GUI checks readiness and explicitly installs the hash-verified packaged worker. A source checkout needs the generated worker bundle. This supports x86-64 ELF observation, with isolation probes and resource limits.
Native replay is a separate experimental Linux/Bubblewrap path supporting argv, stdin, and read-only input files. GDB capture records bounded registers and pages at a selected stop. Missing state remains unavailable. Origin probes establish byte equality only; bounded Triton return solving can produce a function witness, and fresh original-ELF replay is required for a native-validated candidate.
InputConditionSlice, InvestigationClaim, and AnalysisRecipe retain seed dependencies, changed input bytes, assumptions, and artifact hashes. Recipe verification checks consistency; recipe replay performs fresh before-and-after observations.
Windows Frida setup and limits · Replay, capture, solve, and recipe contracts
Replay, capture, and investigation guide →
LLVM experiments, patches, and rebuilds#
The legacy scalar path uses an explicit u64(u64,u64) assertion. Named LLVM experiments accept instcombine, sccp, simplifycfg, and dce, retaining before/after IR and digests. LLVM verification checks the module rather than behavioral equivalence.
Restricted scalar patches bind the exact ELF, sized function, prototype, and entry-only assertion. Current PatchBundle output records PatchIR, placement, byte differences, hashes, and structural checks. A supported fitting replacement goes in a new ELF copy; a larger accepted replacement can use an entry jump into a new executable segment. Reversion checks the matching bundle. The PatchLang parser accepts more syntax than the scalar backend can lower; a parsed program may still be refused.
The separate whole-executable rebuild path requires a static freestanding ELF with sized _start, complete nonoverlapping text coverage, supported direct flow, initialized state, and bounded data. Stack accesses, indirect edges, and unsupported syscalls remain outside that contract. Native decompilation artifacts do not authorize patching.
On-site operation guides · PatchLang parser and lowering · Scalar patch contract
Transformation and region contracts →
Projects, regions, and interchange#
Private local SQLite projects save analyst models and workbench settings with digest and revision checks. Remote projects support explicit uploads, immutable revisions, durable jobs, cancellation, sequenced event replay, and role-based access. Credentials and binary bytes are separate from saved pane settings.
HydIR interchange preserves original protobuf bytes and unknown fields within bounded decoding limits. A selected block binds to matching ELF bytes before becoming RegionSpec v3. PhysicalRegionIR records typed effects, successors, physical boundaries, stack deltas, and unresolved facts. Importing region liveness or stack assertions does not turn them into semantic proof.
Interchange and service contracts · Region and interchange boundaries · Service and SDK tools
Symbolic and VM exploration#
The optional Triton bridge explores selected function paths. VM profiles describe an analyst-scoped interpreter and support bounded host/VPC graph exploration. These outputs retain assumptions and unsupported boundaries.