{
  "added_at": "2026-10-18",
  "additional_evidence_urls": [
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/testing.md",
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/licenses/nativeaot-parser-MIT.txt",
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/package.json",
    "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/LICENSE",
    "https://github.com/morluto/rea/pull/748",
    "https://github.com/morluto/rea/issues/744"
  ],
  "category": "workflow-guides",
  "description_en": "Recovers .NET 8 NativeAOT metadata from x64 PE executables during REA’s Ghidra analysis: MethodTable relationships, virtual slots and frozen strings from RTR 9.1 data, through a built-in read-only parser or an optional headless adapter that annotates the Ghidra database. Generated names, inferred prototypes and recovered native pseudocode stay separate from the unknown original C# names, fields and source.",
  "description_zh": "在 REA 的 Ghidra 分析中，从 x64 PE 可执行文件恢复 .NET 8 NativeAOT 元数据：通过内置只读解析器或可选的无界面适配器（会为 Ghidra 数据库添加注释），从 RTR 9.1 数据中取得 MethodTable 关系、虚表槽位与冻结字符串。生成的名称、推断的原型和恢复的原生伪代码，与未知的原始 C# 名称、字段和源码明确区分。",
  "entry_url": "https://awesomerea.org/resources/rea-ghidra-nativeaot-guide/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/rea-ghidra-nativeaot-guide/",
  "evidence_url": "https://github.com/morluto/rea/blob/093ce695f0a7c3407c7fde520ed8b20c0981b408/docs/ghidra-nativeaot.md",
  "group": "rea",
  "id": "rea-ghidra-nativeaot-guide",
  "json_url": "https://awesomerea.org/resources/rea-ghidra-nativeaot-guide/record.json",
  "kind": "documentation",
  "markdown_url": "https://awesomerea.org/resources/rea-ghidra-nativeaot-guide/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/rea-ghidra-nativeaot-guide/index.md",
  "name": "NativeAOT metadata recovery with Ghidra",
  "name_zh": "借助 Ghidra 恢复 NativeAOT 元数据",
  "record_type": "resource",
  "relationship": "official-documentation",
  "requirements": [
    "Reviewed on main as rea-agents 6.7.0, which declares Node ^22.19.0, ^24.11.0 or 26+. Bring your own Ghidra and JDK; the guide’s Windows check used Ghidra 12.1.4 and JDK 21. The built-in parser handles x64 PE32+ with .NET 8 RTR 9.1 metadata and needs a unique RTR header and exactly one DEHYDRATED_DATA row; other RTR versions and PE architectures are reported as unsupported or partial. Ordinary PE/CLI or ReadyToRun assemblies belong to REA’s managed-code tools instead.",
    "The optional adapter is built from a clean pinned checkout of Washi1337/ghidra-nativeaot with existing git, javac and jar; REA records the JAR’s SHA-256, copies it and rechecks the digest before loading, and JARs run inside Ghidra, so supply a trusted build. It annotates within an ephemeral Program transaction and never changes the original executable. It is unavailable on Windows Ghidra P0, where database tools do not see rehydrated bytes and slot targets come from the parser report.",
    "Outputs include MethodTable addresses, base types, interfaces, virtual slots and frozen strings, within documented local limits such as 128 MiB of captured PE bytes and 4 MiB of report JSON; rows beyond the report budget are omitted with partial coverage. Type identification uses upstream heuristics and prototypes remain inferences. Pseudocode is recovered native logic, not original C# source, and original class/member names and custom field layouts stay unknown.",
    "Verification uses benign source-built .NET 8.0.22 fixtures with independent compiler/linker-symbol and directory-byte oracles, plus stripped and negative inputs; fixtures are never executed, and building them needs .NET SDK 8.0.416 and platform NativeAOT tools. The real MCP lane runs only on Linux x64 with the adapter. Windows-host behavior was checked manually once on Windows 11 x64 without the JAR against the fixture oracle and linker map; no CI lane repeats that check.",
    "REA declares MIT. The parser’s hydration semantics are adapted from Washi1337/ghidra-nativeaot (MIT, with its notice shipped under licenses/) and cross-checked against .NET’s MethodTable.h. Analysed executables keep their own licenses. Merged PR #748 introduced the integration and issue #744 records the request and its closure."
  ],
  "requirements_zh": [
    "审阅时 main 上为 rea-agents 6.7.0，声明支持 Node ^22.19.0、^24.11.0 或 26 及以上。需自备 Ghidra 与 JDK；指南中的 Windows 检查使用 Ghidra 12.1.4 与 JDK 21。内置解析器支持带 .NET 8 RTR 9.1 元数据的 x64 PE32+，要求 RTR 头唯一且恰有一行 DEHYDRATED_DATA；其他 RTR 版本与 PE 架构会报告为不支持或部分覆盖。普通 PE/CLI 或 ReadyToRun 程序集应改用 REA 的托管代码工具。",
    "可选适配器需用现有的 git、javac 与 jar，从固定版本且未修改的 Washi1337/ghidra-nativeaot 检出构建；REA 记录 JAR 的 SHA-256，复制后在加载前重新校验摘要。JAR 在 Ghidra 内执行，请使用可信的构建。适配器在临时 Program 事务中添加注释，从不修改原始可执行文件。它在 Windows Ghidra P0 上不可用；在该环境中，读取数据库的工具看不到重新水合的字节，槽位目标来自解析器报告。",
    "输出包括 MethodTable 地址、基类型、接口、虚表槽位与冻结字符串，并受文档列明的本地上限约束，例如采集的 PE 字节最多 128 MiB、报告 JSON 最多 4 MiB；超出报告预算的行会被省略并标为部分覆盖。类型识别采用上游的启发式方法，方法原型仍属推断。伪代码是恢复的原生逻辑，并非原始 C# 源码；原始类／成员名称及自定义字段布局仍然未知。",
    "验证使用自行构建的无害 .NET 8.0.22 测试程序，以独立的编译器／链接器符号和目录字节作为对照基准，另有去除符号的样本和负面输入；测试程序从不执行，构建它们需要 .NET SDK 8.0.416 及对应平台的 NativeAOT 工具。真实 MCP 测试流程只在装有适配器的 Linux x64 主机上运行。Windows 主机行为仅在 Windows 11 x64 上不带 JAR 手动检查过一次，对照测试程序基准与链接映射；没有 CI 流程重复该检查。",
    "REA 声明 MIT。解析器的水合语义改编自 Washi1337/ghidra-nativeaot（MIT，其声明随附于 licenses/ 目录），并对照 .NET 的 MethodTable.h 核对。被分析的可执行文件保留各自许可。已合并的 PR #748 引入了该集成，issue #744 记录了相应请求及其关闭。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/morluto/rea/blob/main/docs/ghidra-nativeaot.md",
  "verification": "source-reviewed",
  "verified_at": "2026-10-18"
}