rsleigh 0.5.0

SLEIGH (.slaspec) parser and Rust decoder/P-code emitter codegen — Ghidra-compatible disassembly in pure Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

{
  "$schema": "https://context7.com/schema/context7.json",
  "url": "https://context7.com/shanebreazeale/rsleigh",
  "public_key": "pk_k6cH52areD2F2XGgC5xfA",
  "projectTitle": "rsleigh",
  "description": "Rust reverse engineering framework without a JVM dependency, with bounded CLI artifacts for LLM workflows and embeddable decoder/lifter APIs.",
  "branch": "master",
  "folders": [
    "docs"
  ],
  "excludeFolders": [
    ".github",
    ".opt",
    ".claude",
    "generated",
    "target",
    "results",
    "docs/superpowers",
    "test-harness"
  ],
  "excludeFiles": [
    "CLAUDE.md",
    "audit-gpt-5.5.md",
    "llms.txt"
  ],
  "rules": [
    "Use the rsleigh CLI for end-user reverse-engineering workflows and rsleigh-api when embedding decoders in Rust applications.",
    "Check the documented target and analysis-stage support before selecting architecture-dependent features.",
    "Treat rsleigh.finding/v1 NDJSON records as the stable machine-readable finding envelope.",
    "Prefer bounded --agent-brief and --card evidence, semantic --ssa-slice selectors for value questions, and --index for reusable navigation maps.",
    "Treat P-code and decoded bytes as primary evidence; treat decompiler pseudocode as experimental and verify important claims against P-code or disassembly.",
    "Read docs/README.md for navigation, docs/cli-reference.md for command selection, and docs/output-formats.md for renderer-specific validation.",
    "Use one primary mode per command. Cards support --json; --json is not universal. Card v2, P-code v2, and slice v3 include typed raw operations; SSA dumps retain typed expressions and legacy inspection fields.",
    "Native agent briefs, indexes, cards, and P-code/SSA JSON apply to parsed PE/ELF/Mach-O, not the raw or WebAssembly frontends. Raw --disasm currently renders pseudocode.",
    "Output caps alone do not bound runtime. Cards and slices support decode/SSA budgets and cooperative deadlines; slices also cap traversal work. Verify SMT scope addresses; top-N applies after collection.",
    "Indexes publish immutable generations atomically with binary hashes and artifact checksums. Run --verify-index DIR and pin the verified manifest. Use --analysis-cache DIR on cards/slices for complete decoded/SSA snapshot reuse.",
    "Inspect SMT verdict and filter_reasons: NotReachable can come from a static filter before Z3 runs even when confidence is proved.",
    "Select one SSA root by --return (with --at for ambiguity), --call-site ADDR --arg INDEX (zero-based ABI slots), --condition ADDR, or snapshot-local --var ID. Unknown dependencies and unsupported MIPS/RISC-V argument/frame-memory conventions remain explicit boundaries, not reachability claims.",
    "Preserve raw-pcode/v1 instruction origins and per-function snapshot identities; slice node identity is (context_id, var_id). Check status, diagnostics, limits, and cache/work metrics before making claims."
  ],
  "previousVersions": [
    {
      "tag": "v0.4.3"
    },
    {
      "tag": "v0.4.2"
    },
    {
      "tag": "v0.4.1"
    },
    {
      "tag": "v0.4.0"
    }
  ]
}