From aa9461b6267c0aa08f448de56d95c3a22f3d76d4 Mon Sep 17 00:00:00 2001
From: Church of Malware <3+ek0ms@noreply.git.churchofmalware.org>
Date: Mon, 29 Jun 2026 16:44:55 +0000
Subject: [PATCH] Upload files to "ghidra-12.1.2-rce-ace-calc-poc/evidence"

---
 .../evidence/source-evidence.md               | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 ghidra-12.1.2-rce-ace-calc-poc/evidence/source-evidence.md

diff --git a/ghidra-12.1.2-rce-ace-calc-poc/evidence/source-evidence.md b/ghidra-12.1.2-rce-ace-calc-poc/evidence/source-evidence.md
new file mode 100644
index 0000000..5e69fa3
--- /dev/null
+++ b/ghidra-12.1.2-rce-ace-calc-poc/evidence/source-evidence.md
@@ -0,0 +1,40 @@
+# Source Evidence Summary
+
+## Swift Demangler ACE
+
+- `SwiftDemanglerAnalyzer.java` restores a Swift binary directory analyzer
+  option.
+- `SwiftNativeDemangler.java` builds the native demangler path from the
+  configured Swift directory.
+- `SwiftNativeDemangler.java` executes the native demangler with `--version`.
+- `SwiftNativeDemangler.java` executes the native demangler during symbol
+  demangling.
+
+## TraceRMI Conditional RCE
+
+- GDB agent `methods.py` exposes `execute(cmd)`.
+- The GDB implementation calls `gdb.execute(cmd, to_string=...)`.
+- LLDB agent `methods.py` exposes `execute(cmd)`.
+- The LLDB implementation routes the command string to the LLDB command
+  interpreter.
+- LLDB agent `methods.py` exposes `pyeval(expr)`.
+- The LLDB implementation calls Python `eval(expr)`.
+
+These are execution-capable sinks once a TraceRMI agent channel is exposed or
+connected to an untrusted controller.
+
+## SevenZipJBinding Reachability
+
+- `Ghidra/Features/FileFormats/build.gradle` declares
+  `sevenzipjbinding:16.02-2.01`.
+- `Ghidra/Features/FileFormats/build.gradle` declares
+  `sevenzipjbinding-all-platforms:16.02-2.01`.
+- `SevenZipFileSystemFactory.probeStartBytes(...)` recognizes archive
+  signatures.
+- `SevenZipFileSystemFactory.create(...)` constructs `SevenZipFileSystem`.
+- `SevenZipFileSystem.mount(...)` calls `SevenZip.openInArchive(...)`.
+- `SevenZipCustomInitializer.initSevenZip()` loads native libraries with
+  `System.load(...)`.
+- `ZipFileSystemFactory.create(...)` tries the SevenZip path for ZIP handling
+  unless built-in ZIP handling is forced.
+