feat(vm): native VM reconstruction foundations and forensic PE/dump/xref APIs

.github/workflows/vm-native.yml

@@ -0,0 +1,63 @@
+name: Native VM analysis validation
+
+on:
+  push:
+    branches:
+      - feat/themida-vm-structural-20261015
+  pull_request:
+    paths:
+      - 'crates/angryier-cfg/**'
+      - 'crates/angryier-expr/**'
+      - 'crates/angryier-ir/**'
+      - 'crates/angryier-loader/**'
+      - 'crates/angryier-models/**'
+      - 'crates/angryier-cli/**'
+      - 'crates/angryier-runtime/**'
+      - '.github/workflows/vm-native.yml'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  vm-native:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Toolchain
+        run: rustup show
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+      - name: Check VM crates
+        run: cargo check -p angryier-cfg -p angryier-expr -p angryier-ir -p angryier-loader -p angryier-models -p angryier-runtime -p angryier-cli --all-targets
+      - name: VM CFG tests
+        run: cargo test -p angryier-cfg
+      - name: VM expression tests
+        run: cargo test -p angryier-expr
+      - name: Symbolic/Concolic execution regression suite
+        run: cargo test -p angryier-execution
+      - name: AngryIR effect and trace regression suite
+        run: cargo test -p angryier-ir
+      - name: VM loader tests
+        run: cargo test -p angryier-loader
+      - name: Win32 API and synchronization tests
+        run: cargo test -p angryier-models
+      - name: Native runtime unit and fidelity tests
+        run: cargo test -p angryier-runtime --features "xed script" --lib
+      - name: VM runtime integration tests
+        run: cargo test -p angryier-runtime --features "xed script" --test lua_api
+      - name: Windows PE call-return fidelity regressions
+        run: cargo test -p angryier-runtime --features "xed script" --test pe_driver
+      - name: VM handler SSA materialization integration
+        run: cargo test -p angryier-runtime --features "xed script" --test vm_materialization
+      - name: CLI forensic command tests
+        run: cargo test -p angryier-cli
+      # Existing main has unrelated clippy warnings. Retain diagnostic output
+      # instead of hiding the compile/test result behind that baseline debt.
+      - name: Clippy analysis (baseline warnings reported)
+        run: cargo clippy -p angryier-cfg -p angryier-expr -p angryier-ir -p angryier-loader -p angryier-models -p angryier-runtime --lib
+      - name: Clippy forensic CLI
+        run: cargo clippy -p angryier-cli --bin angryier

crates/angryier-cfg/src/lib.rs

@@ -18,6 +18,8 @@ use angryier_types::Address;
 
 pub mod themida;
 pub mod vpc;
+pub mod vm;
+pub mod xrefs;
 
 /// How control leaves a basic block.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
@@ -867,7 +869,7 @@ fn interpret_block(instructions: &[DecodedInstruction]) -> BlockFacts {
                         Some(angryier_arch::MemoryBase::InstructionPointer { .. }) => {
                             insn.address
                                 .checked_add(u64::from(insn.length))
-                                .and_then(|end| end.checked_add(mem.displacement as u64))
+                                .and_then(|end| end.checked_add_signed(mem.displacement))
                                 .map(AbstractVal::Const)
                         }
                         Some(angryier_arch::MemoryBase::Register(b)) => {
@@ -876,7 +878,7 @@ fn interpret_block(instructions: &[DecodedInstruction]) -> BlockFacts {
                             // &table[idx] — an address, not a target: Unknown.
                             match (facts.values.get(&b.parent).copied(), mem.index) {
                                 (Some(AbstractVal::Const(c)), None) => {
-                                    c.checked_add(mem.displacement as u64).map(AbstractVal::Const)
+                                    c.checked_add_signed(mem.displacement).map(AbstractVal::Const)
                                 }
                                 _ => None,
                             }
@@ -900,7 +902,7 @@ fn interpret_block(instructions: &[DecodedInstruction]) -> BlockFacts {
                                 Some(angryier_arch::MemoryIndex::Register(idx)) => {
                                     insn.address
                                         .checked_add(u64::from(insn.length))
-                                        .and_then(|end| end.checked_add(mem.displacement as u64))
+                                        .and_then(|end| end.checked_add_signed(mem.displacement))
                                         .map(|table| AbstractVal::TableEntry {
                                             base: table,
                                             index: idx.parent,
@@ -914,7 +916,7 @@ fn interpret_block(instructions: &[DecodedInstruction]) -> BlockFacts {
                         Some(angryier_arch::MemoryBase::Register(b)) => {
                             match (facts.values.get(&b.parent).copied(), mem.index) {
                                 (Some(AbstractVal::Const(c)), Some(angryier_arch::MemoryIndex::Register(idx))) => {
-                                    c.checked_add(mem.displacement as u64).map(|table| AbstractVal::TableEntry {
+                                    c.checked_add_signed(mem.displacement).map(|table| AbstractVal::TableEntry {
                                         base: table,
                                         index: idx.parent,
                                         scale: mem.scale,
@@ -1058,11 +1060,11 @@ fn resolve_indirect_jump(
                 };
                 let table = match mem.base {
                     Some(angryier_arch::MemoryBase::InstructionPointer { .. }) => {
-                        insn_end.checked_add(mem.displacement as u64)?
+                        insn_end.checked_add_signed(mem.displacement)?
                     }
                     Some(angryier_arch::MemoryBase::Register(b)) => {
                         match facts.values.get(&b.parent) {
-                            Some(AbstractVal::Const(c)) => c.checked_add(mem.displacement as u64)?,
+                            Some(AbstractVal::Const(c)) => c.checked_add_signed(mem.displacement)?,
                             _ => return None,
                         }
                     }
@@ -2384,6 +2386,29 @@ mod tests {
         assert_eq!(forest.depth(3), 0);
     }
 
+    #[test]
+    fn negative_rip_relative_jump_table_displacement_resolves() -> Result<(), String> {
+        // The two qword targets sit BEFORE the dispatch, so the RIP-relative
+        // displacement is negative. A u64 cast used to reject this case.
+        let code = [
+            0x18, 0x10, 0, 0, 0, 0, 0, 0, // 0x1000 -> 0x1018
+            0x1a, 0x10, 0, 0, 0, 0, 0, 0, // 0x1008 -> 0x101a
+            0xf0, 0x02,                 // cmp eax,2  @ 0x1010
+            0xf1, 0x08, 0xe8, 0xff, 0xff, 0xff, // jmp [rip+eax*8-24], end=0x1018
+            0x90, 0xc3,                 // nop; ret @ 0x1018
+            0x90, 0xc3,                 // nop; ret @ 0x101a
+        ];
+        let cfg = recover(&TestDecoder, 0x1000, &code, 0x1010, identity_form)
+            .map_err(|error| format!("{error:?}"))?;
+        assert!(cfg.edges.iter().any(|edge| {
+            matches!(edge.kind, EdgeKind::TableDispatch { .. }) && edge.to == Some(0x1018)
+        }));
+        assert!(cfg.edges.iter().any(|edge| {
+            matches!(edge.kind, EdgeKind::TableDispatch { .. }) && edge.to == Some(0x101a)
+        }));
+        Ok(())
+    }
+
     #[test]
     fn jump_table_resolves_to_entries() -> Result<(), String> {
         // cmp eax,2; jmp [rip + eax*8 + disp] where disp points 2 entries

crates/angryier-cfg/src/themida.rs

@@ -214,7 +214,26 @@ impl DispatchWindow<'_> {
         }
         use angryier_semantics_intel64::forms;
         match insn.form_id {
-            forms::MOV_R64_IMM64 | forms::MOV_R32_IMM32 | forms::LEA_R64_MEM => Def::Constant,
+            forms::MOV_R64_IMM64 | forms::MOV_R32_IMM32 => Def::Constant,
+            // LEA is a constant only with RIP/absolute addressing. A context-
+            // relative LEA is NOT a constant, even if its displacement is.
+            forms::LEA_R64_MEM => {
+                let mem = insn.operands.iter().find_map(|op| match op.kind {
+                    OperandKind::AddressGeneration(mem) | OperandKind::Memory(mem) => Some(mem),
+                    _ => None,
+                });
+                match mem.map(|m| (m.base, m.index)) {
+                    Some((Some(MemoryBase::InstructionPointer { .. }), None))
+                    | Some((None, None)) => Def::Constant,
+                    Some((Some(MemoryBase::Register(base)), None)) => Def::Derived(base.parent),
+                    Some((None, Some(MemoryIndex::Register(index)))) => {
+                        Def::Derived(index.parent)
+                    }
+                    // Two register inputs cannot be represented by the single-
+                    // source provenance relation. Retain uncertainty.
+                    _ => Def::ClobberedByUnmodeled,
+                }
+            },
             forms::MOV_R64_R64 | forms::MOV_R32_R32 | forms::MOVZX_R64_R32 | forms::MOVSX_R64_R32 => {
                 match register_source(insn) {
                     Some(src) => Def::From(src),
@@ -430,6 +449,58 @@ mod tests {
         assert_eq!(site.chain_register, Some(RegisterId(0)));
     }
 
+    #[test]
+    fn lea_context_relative_is_not_a_constant() -> Result<(), &'static str> {
+        // lea rbx,[r14+0x28]; jmp [rbx+0x38]
+        let block = [
+            insn(
+                0x80,
+                forms::LEA_R64_MEM,
+                vec![
+                    reg_op(0, 2, AccessKind::Write),
+                    mem_op(1, Some(0xe), None, 1, 0x28),
+                ],
+            ),
+            insn(0x83, forms::JMP_INDIRECT_MEM64, vec![mem_op(0, Some(2), None, 1, 0x38)]),
+        ];
+        let site = (DispatchWindow { instructions: &block }).classify().ok_or("site unavailable")?;
+        let (_, provenance) = site.base.ok_or("base unavailable")?;
+        assert!(matches!(
+            provenance,
+            BaseProvenance::DerivedFrom { source } if source == RegisterId(0xe)
+        ));
+        Ok(())
+    }
+
+    #[test]
+    fn lea_rip_relative_is_constant_but_two_registers_are_not() -> Result<(), &'static str> {
+        let rip = [
+            insn(
+                0x90,
+                forms::LEA_R64_MEM,
+                vec![reg_op(0, 2, AccessKind::Write), rip_mem_op(-0x20)],
+            ),
+            insn(0x93, forms::JMP_INDIRECT_MEM64, vec![mem_op(0, Some(2), None, 1, 0x38)]),
+        ];
+        let site = (DispatchWindow { instructions: &rip }).classify().ok_or("RIP site unavailable")?;
+        assert!(matches!(site.base.ok_or("RIP base unavailable")?.1, BaseProvenance::Constant));
+
+        let ambiguous = [
+            insn(
+                0xa0,
+                forms::LEA_R64_MEM,
+                vec![
+                    reg_op(0, 2, AccessKind::Write),
+                    mem_op(1, Some(0xe), Some(0xd), 4, 0x28),
+                ],
+            ),
+            insn(0xa3, forms::JMP_INDIRECT_MEM64, vec![mem_op(0, Some(2), None, 1, 0x38)]),
+        ];
+        let site = (DispatchWindow { instructions: &ambiguous }).classify().ok_or("ambiguous site unavailable")?;
+        assert!(matches!(site.base.ok_or("ambiguous base unavailable")?.1, BaseProvenance::Clobbered));
+        Ok(())
+    }
+
     #[test]
     fn derived_base_keeps_source() {
         // add rbx, 0x20 ; jmp [rbx+0x38] — context member pointer.