c1efa6467d
Add optional finalization_ms to keep observing a captured root after SIGTERM, record the actual finalizer exit and each signal attempt, and escalate once when needed. Bind the initial root identity to captured ownership and preserve observations through cleanup uncertainty. Fixes #1253. Co-authored-by: Mykola Dementiev <16836724+nikolay-dementiev@users.noreply.github.com> Co-authored-by: N0zoM1z0 <161784452+N0zoM1z0@users.noreply.github.com>
81 lines
3.1 KiB
TypeScript
81 lines
3.1 KiB
TypeScript
import type { JsonValue } from "../domain/jsonValue.js";
|
|
import { UNKNOWN_CONTRACT_EXAMPLES } from "./unknownContractExamples.js";
|
|
import { ARTIFACT_COMPARISON_EXAMPLE } from "./artifactComparisonExample.js";
|
|
import { FUNCTION_COMPARISON_EXAMPLE } from "./functionComparisonExample.js";
|
|
import {
|
|
INVESTIGATION_EXAMPLES,
|
|
PROCESS_CAPTURE_REFERENCE,
|
|
PROCESS_CAPTURE_RECONSTRUCTION,
|
|
} from "./investigationExamples.js";
|
|
|
|
/** Canonical examples for contracts whose required inputs have no defaults. */
|
|
export const TOOL_EXAMPLE_OVERRIDES: Readonly<
|
|
Record<string, Readonly<Record<string, JsonValue>>>
|
|
> = {
|
|
...UNKNOWN_CONTRACT_EXAMPLES,
|
|
...INVESTIGATION_EXAMPLES,
|
|
goto_address: { address: "0x1000" },
|
|
procedure_address: { procedure: "main" },
|
|
procedure_assembly: { procedure: "main" },
|
|
procedure_callees: { procedure: "main" },
|
|
procedure_callers: { procedure: "main" },
|
|
procedure_info: { procedure: "main" },
|
|
trace_native_values: { procedure: "0x1000" },
|
|
inspect_native_data_type: { type: "/MyStruct" },
|
|
inspect_native_instruction: { address: "0x1000" },
|
|
resolve_native_call_targets: { address: "0x1000" },
|
|
read_function_instructions: { procedure: "main" },
|
|
read_bytes: { address: "0x1000", length: 16 },
|
|
address_to_file_offset: { address: "0x1000" },
|
|
procedure_references: { procedure: "main" },
|
|
procedure_pseudo_code: { procedure: "main" },
|
|
resolve_containing_procedure: { address: "0x1000" },
|
|
search_procedures: { pattern: "main" },
|
|
search_strings: { pattern: "authorization failed" },
|
|
set_address_name: { address: "0x1000", name: "entry" },
|
|
set_addresses_names: { names: { "0x1000": "entry" } },
|
|
set_bookmark: { address: "0x1000" },
|
|
set_comment: { address: "0x1000", comment: "validated entry point" },
|
|
set_inline_comment: { address: "0x1000", comment: "calls parser" },
|
|
unset_bookmark: { address: "0x1000" },
|
|
get_call_graph: { address: "0x1000" },
|
|
find_xrefs_to_name: { name: "malloc" },
|
|
analyze_function: { procedure: "main" },
|
|
annotate_native_function: {
|
|
procedure: "0x10100",
|
|
name: "entry",
|
|
comment: "Analyst observation",
|
|
},
|
|
analyze_swift_types: { category: "classes", pattern: "Account" },
|
|
inspect_native_api: { procedure: "main" },
|
|
trace_feature: { query: "license" },
|
|
trace_call_path: { start: "0x1000", goal: "0x1100" },
|
|
trace_native_ui_action: { action: "buildTapped:" },
|
|
open_binary: { path: "/tmp/fixture" },
|
|
export_evidence_bundle: { path: "/tmp/evidence.json" },
|
|
inspect_address_context: { address: "0x1000" },
|
|
import_evidence_bundle: { path: "/tmp/evidence.json" },
|
|
capture_process_scenario: {
|
|
executable: "/usr/bin/true",
|
|
working_directory: "/tmp",
|
|
timeout_ms: 30_000,
|
|
finalization_ms: 1_500,
|
|
},
|
|
compare_process_captures: {
|
|
left: PROCESS_CAPTURE_REFERENCE,
|
|
right: PROCESS_CAPTURE_RECONSTRUCTION,
|
|
},
|
|
compare_artifacts: {
|
|
left: ARTIFACT_COMPARISON_EXAMPLE.left,
|
|
right: ARTIFACT_COMPARISON_EXAMPLE.right,
|
|
},
|
|
compare_functions: {
|
|
left: FUNCTION_COMPARISON_EXAMPLE.left,
|
|
right: FUNCTION_COMPARISON_EXAMPLE.right,
|
|
},
|
|
compare_bundles: {
|
|
left_bundle_path: "/tmp/left-evidence.json",
|
|
right_bundle_path: "/tmp/right-evidence.json",
|
|
},
|
|
};
|