re_behaviour: the emulator check for given functions of a worktree

harbor/cli.py

@@ -255,7 +255,7 @@ def build_parser():
     p = sub.add_parser("who", help="who has worked on a scope (notes, reviews, claims, messages)")
     p.add_argument("scope")
     p = sub.add_parser("re", help="reverse-engineering lookups from the project's image and annotations")
-    p.add_argument("action", choices=["disasm", "xrefs", "bytes", "lookup", "ghidra", "ghidra-tools", "debugger-tools", "match", "similar", "struct-audit"])
+    p.add_argument("action", choices=["disasm", "xrefs", "bytes", "lookup", "ghidra", "ghidra-tools", "debugger-tools", "match", "similar", "struct-audit", "behaviour"])
     p.add_argument("target", nargs="?", default="", help="an address (0x4AD850) or a name; for ghidra, the tool")
     p.add_argument("arguments", nargs="?", default="{}", help="ghidra: the tool's arguments as JSON")
     p.add_argument("--decomp", help="match: the checkout or worktree to compile from")
@@ -690,8 +690,12 @@ def main(argv=None):
         out(r, f"summary #{r['id']} pinned to {r['thread']}")
     elif cmd == "re":
         from .reverse import Ghidra, Reverse
-        r = None if args.action.startswith(("ghidra", "debugger", "match")) else Reverse(harbor.project.reverse)
-        if args.action in ("similar", "struct-audit"):
+        r = None if args.action.startswith(("ghidra", "debugger", "match", "behaviour")) else Reverse(harbor.project.reverse)
+        if args.action == "behaviour":
+            from .reverse import behaviour_check
+            res = behaviour_check(harbor.project.reverse, args.target, args.decomp)
+            out(res, "\n".join(f"{r['address']} {r.get('verdict', ''):<8} {r.get('name', '')} {r.get('reason') or ''}" for r in res))
+        elif args.action in ("similar", "struct-audit"):
             from .reverse import run_toolkit
             res = (run_toolkit(harbor.project.reverse, "similar", [args.target]) if args.action == "similar" else
                    run_toolkit(harbor.project.reverse, "struct_audit", ["--struct", args.target], json_to_file=True))