feat(xref): objdump-based string-literal cross-reference tool

New CLI (openfut-bridge-xref) that finds every code site referencing chosen
.rdata string literals and prints the guarding-branch context. Shells out to
system objdump only (no disassembler crate) and exploits objdump's resolved
'# <hex>' RIP-relative target comments. Phases: discovery (ImageBase + section
table via -p/-h), harvest (-s -j .rdata → NUL-terminated ASCII matching anchors,
with VAs), streaming xref (-d, ring-buffer context, int3-boundary function
synthesis for this stripped PE), grouped report flagging control-flow lines.

Self-test (anchor nucleusConnectREST) PASSES: harvests VA 0x1480db550 and finds
the load site 0x142861942 in fn 0x142861910 (which calls the map-lookup at
0x145057670). First payoff: gosredirector hostnames have ZERO code refs — they
sit in a 4-entry env→URL data table at 0x1483fc858, so env selection is
table-indexed, not a direct code lea.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

This commit is contained in:

funman300

2026-07-02 19:10:12 -07:00

parent 8f5b6b1d59

commit e4108fcff8

2 changed files with 739 additions and 0 deletions

									
										Cargo.toml
									
		+4
		
												View File
												
				@@ -19,6 +19,10 @@ path = "src/main.rs"

				name = "openfut-bridge-replay"

				path = "src/bin/replay.rs"

				[[bin]]

				name = "openfut-bridge-xref"

				path = "src/bin/xref.rs"

				[dependencies]

				axum = { version = "0.7", features = ["macros"] }

				tokio = { version = "1", features = ["full"] }