518 lines
13 KiB
JSON
518 lines
13 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"title": "SuccessEnvelope",
|
|
"description": "Versioned successful response.",
|
|
"type": "object",
|
|
"properties": {
|
|
"data": {
|
|
"description": "Operation-specific result.",
|
|
"$ref": "#/$defs/InspectionData"
|
|
},
|
|
"kind": {
|
|
"type": "string",
|
|
"const": "inspection"
|
|
},
|
|
"provenance": {
|
|
"description": "Reproducibility and execution context.",
|
|
"$ref": "#/$defs/QueryProvenance"
|
|
},
|
|
"schema_version": {
|
|
"type": "integer",
|
|
"const": 1
|
|
},
|
|
"warnings": {
|
|
"description": "Deduplicated stable warnings.",
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/Warning"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"schema_version",
|
|
"kind",
|
|
"provenance",
|
|
"data",
|
|
"warnings"
|
|
],
|
|
"$defs": {
|
|
"Address": {
|
|
"description": "A Ghidra address with an explicit, case-sensitive address space.",
|
|
"type": "object",
|
|
"properties": {
|
|
"offset": {
|
|
"description": "Canonical lowercase, `0x`-prefixed, even-width hexadecimal offset.",
|
|
"type": "string"
|
|
},
|
|
"space": {
|
|
"description": "Exact Ghidra address-space name.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"space",
|
|
"offset"
|
|
]
|
|
},
|
|
"AnalysisDisposition": {
|
|
"description": "Analysis selection disposition.",
|
|
"oneOf": [
|
|
{
|
|
"description": "A new Analysis was created.",
|
|
"type": "string",
|
|
"const": "created"
|
|
},
|
|
{
|
|
"description": "A compatible Analysis was reused.",
|
|
"type": "string",
|
|
"const": "reused"
|
|
},
|
|
{
|
|
"description": "Corrupt stored data was quarantined and rebuilt once.",
|
|
"type": "string",
|
|
"const": "rebuilt"
|
|
}
|
|
]
|
|
},
|
|
"AnalysisStoreProvenance": {
|
|
"description": "Analysis Store provenance.",
|
|
"type": "object",
|
|
"properties": {
|
|
"path": {
|
|
"description": "Tagged absolute store path.",
|
|
"$ref": "#/$defs/TaggedPath"
|
|
},
|
|
"source": {
|
|
"description": "Store resolution source.",
|
|
"$ref": "#/$defs/StoreSource"
|
|
}
|
|
},
|
|
"required": [
|
|
"path",
|
|
"source"
|
|
]
|
|
},
|
|
"AnalysisSummary": {
|
|
"description": "Analysis selection summary.",
|
|
"type": "object",
|
|
"properties": {
|
|
"disposition": {
|
|
"description": "Whether compatible analysis was built or reused.",
|
|
"$ref": "#/$defs/AnalysisDisposition"
|
|
}
|
|
},
|
|
"required": [
|
|
"disposition"
|
|
]
|
|
},
|
|
"Digest": {
|
|
"description": "A lowercase SHA-256 digest.",
|
|
"type": "string"
|
|
},
|
|
"InspectionData": {
|
|
"description": "Sample inspection data.",
|
|
"type": "object",
|
|
"properties": {
|
|
"analysis": {
|
|
"description": "Reuse disposition.",
|
|
"$ref": "#/$defs/AnalysisSummary"
|
|
},
|
|
"program": {
|
|
"description": "Program address and Function summary.",
|
|
"$ref": "#/$defs/ProgramSummary"
|
|
},
|
|
"sample": {
|
|
"description": "Sample identity and size.",
|
|
"$ref": "#/$defs/SampleSummary"
|
|
}
|
|
},
|
|
"required": [
|
|
"sample",
|
|
"program",
|
|
"analysis"
|
|
]
|
|
},
|
|
"Limits": {
|
|
"description": "Resource policy selected for one invocation.",
|
|
"type": "object",
|
|
"properties": {
|
|
"analysis_timeout_seconds": {
|
|
"description": "Native analysis timeout.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
"child_watchdog_seconds": {
|
|
"description": "Derived process watchdog.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
"decompile_timeout_seconds": {
|
|
"description": "Optional native decompilation timeout.",
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"max_cpu": {
|
|
"description": "Maximum Ghidra analysis CPU count.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
"max_heap_mib": {
|
|
"description": "Maximum Java heap, in MiB.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
"max_inline_bytes": {
|
|
"description": "Maximum serialized successful stdout size.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
},
|
|
"max_sample_bytes": {
|
|
"description": "Maximum accepted Sample size.",
|
|
"$ref": "#/$defs/PositiveU64"
|
|
}
|
|
},
|
|
"required": [
|
|
"max_heap_mib",
|
|
"max_cpu",
|
|
"analysis_timeout_seconds",
|
|
"child_watchdog_seconds",
|
|
"max_sample_bytes",
|
|
"max_inline_bytes"
|
|
]
|
|
},
|
|
"PositiveU64": {
|
|
"description": "A validated positive integer accepted by resource-limit flags.",
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 1
|
|
},
|
|
"ProgramSummary": {
|
|
"description": "Program summary.",
|
|
"type": "object",
|
|
"properties": {
|
|
"function_count": {
|
|
"description": "Count of memory, external, and thunk Functions.",
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
},
|
|
"image_base": {
|
|
"description": "Image base when applicable.",
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/Address"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"maximum_address": {
|
|
"description": "Maximum Address when applicable.",
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/Address"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
},
|
|
"minimum_address": {
|
|
"description": "Minimum Address when applicable.",
|
|
"anyOf": [
|
|
{
|
|
"$ref": "#/$defs/Address"
|
|
},
|
|
{
|
|
"type": "null"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"function_count"
|
|
]
|
|
},
|
|
"QueryProvenance": {
|
|
"description": "Fixed provenance for every Sample-backed Query.",
|
|
"type": "object",
|
|
"properties": {
|
|
"adapter_protocol_version": {
|
|
"description": "Rust/Java protocol version.",
|
|
"type": "integer",
|
|
"format": "uint32",
|
|
"minimum": 0
|
|
},
|
|
"analysis_profile_sha256": {
|
|
"description": "Canonical Analysis Profile identity.",
|
|
"$ref": "#/$defs/Digest"
|
|
},
|
|
"analysis_store": {
|
|
"description": "Selected Analysis Store.",
|
|
"$ref": "#/$defs/AnalysisStoreProvenance"
|
|
},
|
|
"ghidr_version": {
|
|
"description": "CLI package version.",
|
|
"type": "string"
|
|
},
|
|
"ghidra_version": {
|
|
"description": "Ghidra version.",
|
|
"type": "string"
|
|
},
|
|
"java_version": {
|
|
"description": "Java major version.",
|
|
"type": "string"
|
|
},
|
|
"limits": {
|
|
"description": "Selected and derived resource limits.",
|
|
"$ref": "#/$defs/Limits"
|
|
},
|
|
"sample_sha256": {
|
|
"description": "Sample content identity.",
|
|
"$ref": "#/$defs/Digest"
|
|
},
|
|
"sandbox": {
|
|
"description": "Selected sandbox policy.",
|
|
"$ref": "#/$defs/SandboxProvenance"
|
|
},
|
|
"source_path": {
|
|
"description": "Exact caller-supplied path.",
|
|
"$ref": "#/$defs/TaggedPath"
|
|
},
|
|
"target": {
|
|
"description": "Resolved Target Specification and verification.",
|
|
"$ref": "#/$defs/TargetProvenance"
|
|
}
|
|
},
|
|
"required": [
|
|
"ghidr_version",
|
|
"adapter_protocol_version",
|
|
"ghidra_version",
|
|
"java_version",
|
|
"sample_sha256",
|
|
"source_path",
|
|
"analysis_profile_sha256",
|
|
"target",
|
|
"analysis_store",
|
|
"sandbox",
|
|
"limits"
|
|
]
|
|
},
|
|
"SampleSummary": {
|
|
"description": "Sample identity summary.",
|
|
"type": "object",
|
|
"properties": {
|
|
"sha256": {
|
|
"description": "SHA-256 content identity.",
|
|
"$ref": "#/$defs/Digest"
|
|
},
|
|
"size_bytes": {
|
|
"description": "Exact byte length.",
|
|
"type": "integer",
|
|
"format": "uint64",
|
|
"minimum": 0
|
|
}
|
|
},
|
|
"required": [
|
|
"sha256",
|
|
"size_bytes"
|
|
]
|
|
},
|
|
"SandboxBackend": {
|
|
"description": "Sandbox backend.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Bubblewrap namespaces.",
|
|
"type": "string",
|
|
"const": "bubblewrap"
|
|
},
|
|
{
|
|
"description": "Caller-supplied isolation.",
|
|
"type": "string",
|
|
"const": "external"
|
|
},
|
|
{
|
|
"description": "Isolation disabled.",
|
|
"type": "string",
|
|
"const": "off"
|
|
}
|
|
]
|
|
},
|
|
"SandboxProvenance": {
|
|
"description": "Worker sandbox provenance.",
|
|
"type": "object",
|
|
"properties": {
|
|
"backend": {
|
|
"description": "Selected backend.",
|
|
"$ref": "#/$defs/SandboxBackend"
|
|
},
|
|
"verification": {
|
|
"description": "Isolation verification state.",
|
|
"$ref": "#/$defs/SandboxVerification"
|
|
}
|
|
},
|
|
"required": [
|
|
"backend",
|
|
"verification"
|
|
]
|
|
},
|
|
"SandboxVerification": {
|
|
"description": "Sandbox verification state.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Verified by `ghidr`.",
|
|
"type": "string",
|
|
"const": "verified"
|
|
},
|
|
{
|
|
"description": "Declared but not verifiable by `ghidr`.",
|
|
"type": "string",
|
|
"const": "unverified"
|
|
},
|
|
{
|
|
"description": "Explicitly disabled.",
|
|
"type": "string",
|
|
"const": "disabled"
|
|
}
|
|
]
|
|
},
|
|
"StoreSource": {
|
|
"description": "Analysis Store resolution source.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Explicit `--store` flag.",
|
|
"type": "string",
|
|
"const": "cli"
|
|
},
|
|
{
|
|
"description": "`GHIDR_STORE` environment variable.",
|
|
"type": "string",
|
|
"const": "environment"
|
|
},
|
|
{
|
|
"description": "Explicit `XDG_CACHE_HOME` fallback.",
|
|
"type": "string",
|
|
"const": "xdg"
|
|
},
|
|
{
|
|
"description": "Home-directory fallback.",
|
|
"type": "string",
|
|
"const": "home_fallback"
|
|
}
|
|
]
|
|
},
|
|
"TaggedPath": {
|
|
"description": "A path preserving either UTF-8 text or exact Unix bytes.",
|
|
"oneOf": [
|
|
{
|
|
"description": "An unmodified UTF-8 path.",
|
|
"type": "object",
|
|
"properties": {
|
|
"encoding": {
|
|
"type": "string",
|
|
"const": "utf8"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"encoding",
|
|
"value"
|
|
]
|
|
},
|
|
{
|
|
"description": "Standard padded Base64 over exact Unix path bytes.",
|
|
"type": "object",
|
|
"properties": {
|
|
"encoding": {
|
|
"type": "string",
|
|
"const": "unix_bytes_base64"
|
|
},
|
|
"value": {
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"encoding",
|
|
"value"
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"TargetProvenance": {
|
|
"description": "Target Specification provenance.",
|
|
"type": "object",
|
|
"properties": {
|
|
"compiler_specification": {
|
|
"description": "Exact compiler-specification identifier.",
|
|
"type": "string"
|
|
},
|
|
"format": {
|
|
"description": "Executable format name.",
|
|
"type": "string"
|
|
},
|
|
"loader": {
|
|
"description": "Exact loader identifier.",
|
|
"type": "string"
|
|
},
|
|
"processor_language": {
|
|
"description": "Exact processor-language identifier.",
|
|
"type": "string"
|
|
},
|
|
"verification": {
|
|
"description": "Project integration-test coverage.",
|
|
"$ref": "#/$defs/TargetVerification"
|
|
}
|
|
},
|
|
"required": [
|
|
"loader",
|
|
"format",
|
|
"processor_language",
|
|
"compiler_specification",
|
|
"verification"
|
|
]
|
|
},
|
|
"TargetVerification": {
|
|
"description": "Project integration-test coverage for a recognized target.",
|
|
"oneOf": [
|
|
{
|
|
"description": "Covered by version 0.1 real-Ghidra fixtures.",
|
|
"type": "string",
|
|
"const": "verified"
|
|
},
|
|
{
|
|
"description": "Recognized by Ghidra but outside the tested matrix.",
|
|
"type": "string",
|
|
"const": "unverified"
|
|
}
|
|
]
|
|
},
|
|
"Warning": {
|
|
"description": "Stable non-fatal warning.",
|
|
"type": "object",
|
|
"properties": {
|
|
"code": {
|
|
"description": "Stable machine identifier.",
|
|
"type": "string"
|
|
},
|
|
"details": {
|
|
"description": "Warning-specific context, always an object.",
|
|
"type": "object",
|
|
"additionalProperties": true
|
|
},
|
|
"message": {
|
|
"description": "Concise human context.",
|
|
"type": "string"
|
|
}
|
|
},
|
|
"required": [
|
|
"code",
|
|
"message",
|
|
"details"
|
|
]
|
|
}
|
|
}
|
|
}
|