dsh-plugin-rea

English · 简体中文

Which version is this? 2.x — and main is it. 2.x provisions the runtime itself (Node, the REA CLI, a JDK, Ghidra) and then wires the row: install the plugin, run scripts/setup.mjs once, restart dsh. 1.x is the older configuration-only adapter — it expects rea on PATH and Ghidra installed by you — kept on the v1 branch and on npm as [email protected]. Full comparison: Two lines: 1.x and 2.x · upgrading: Upgrading from 1.x.

REA 6.8.0 — this package's pin — still accepts Ghidra 12.1.x only (12.2 is unsupported, and the whole Ghidra decompile/analysis group disappears) and the jadx bridge 0.7.1 only (0.8.0 fails on its first call with Expected engine 0.7.1, before any APK is loaded). Both gates were re-checked against 6.8.0 on 2026-10-26 and neither one moved. JDK 21.0.13 is out upstream, but Adoptium publishes no Windows build of it, so there is nothing to point at here — and it drops only three of the four eMudhra anchors. The trade-off is therefore "all tools green, CVE still open": Ghidra 12.1.4's CVE-2026-100504 / 100505 / 100503 / 113604 stay in the chain — do not analyse untrusted samples with this environment — and the JDK still trusts the eMudhra anchors. Evidence, mitigations and revisit triggers: docs/update-review-2026-10-24.md and docs/update-review-2026-10-26.md.

Ghidra 12.2 itself works — measured 2026-10-26: same 9 segments, same 341 procedures, byte-identical entry pseudocode as 12.1.4, through REA's own bridge. What blocks it is REA's version-equality check, not the bridge. If you want the CVE-fixed engine anyway, node scripts/ghidra-gate-override.mjs --enable --version 12.2 rewrites that one constant in the vendored copy, records what it changed in <bundle>/ghidra-gate-override.json, and --disable restores it; re-running setup reverts it too. It needs JDK 25+ (application.java.min=25).

You must run node scripts/setup.mjs yourself — once after installing, and once after every plugin upgrade. Nothing runs it for you: a market install or update replaces the package and stops there. Since 2.0.8 a market upgrade keeps the row working (the mirrored launcher re-execs the new one), but it does not move the bundle to the new pins — REA and the engines stay at the versions recorded by the last setup run. Skip it on a first install and the row exits MODULE_NOT_FOUND with no tools and no message; skip it after an upgrade and you keep running the old REA silently (check-updates.ps1 reports the drift). If you had enabled the Ghidra gate override (see §9 of the 2026-10-26 review), that setup run re-provisions the bundled REA and the patch goes with it — re-enable it afterwards, or accept the pinned Ghidra again. The full rule set is under Updating.

…