morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

slots, and QML bytecode #1354

New issue

Open

opened 2026-10-16 21:04:36 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:36 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3630

Summary

The Qt framework is the premier cross-platform C++ application and UI framework across desktop operating systems (Linux, Windows, macOS), automotive infotainment (In-Vehicle Infotainment / IVI), medical devices, defense systems, and embedded IoT devices. However, applications built with Qt and Qt Quick / QML differ fundamentally from standard native C++ applications because of the Meta-Object System and the Qt Resource System (RCC).

Currently, REA analyzes Qt binaries merely as generic native executables in Ghidra or Rizin. While REA recently added C++ RTTI and class hierarchy modeling (#3624), Qt bypasses traditional C++ RTTI in favor of its own compiler-generated reflection metadata via the Meta-Object Compiler (moc). When reverse engineering a Qt application, an analyst needs to:

Unpack embedded .rcc binary resource files containing the UI definitions;
Parse QObject metadata tables to recover class signals, slots, and properties;
Trace signal-to-slot connections linking user interface triggers to backend C++ handlers;
Decompile compiled QML / QV4 bytecode (.qmlc / .jsc);
Map the boundary where QML binds to native C++ controllers (Q_INVOKABLE, setContextProperty).

This feature proposal introduces dedicated Qt and QML Reverse Engineering to REA, turning opaque Qt binaries into fully structured, event-mapped, and decompiled desktop/embedded application architectures.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: Qt Binary (ELF, PE, Mach-O) or   |
                                    |        Standalone RCC (.rcc) Archive    |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | RCC Resource Unpacker     |                                   | QObject MOC Metadata      |
           | (.rcc, qres, Zlib, Zstd)  |                                   | Parser (qt_meta_data)     |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Signal-to-Slot Connection Graph       |
                                     | (QObject::connect, UI -> C++ handler) |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | QML / QV4 Bytecode        |                                   | QML <-> C++ Native        |
           | Decompiler (.qmlc, .jsc)  |                                   | Boundary Mapping          |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence / UI & Event Dossier     |
                                     | (QML Source, C++ Slots, Connections)  |
                                     +---------------------------------------+

1. RCC Resource System Unpacker

Container Extraction: Parse standalone .rcc files and embedded resource sections in executables (detected by qInitResources_* symbols or the 0x71726573 "qres" magic header).
Format Version Support: Support RCC format versions 1, 2, and 3 (handling Zlib and Zstd compressed resource blocks).
Virtual Filesystem Reconstruction: Reconstruct the hierarchical file and directory tree (:/qml/..., :/images/..., :/translations/...), extracting QML source files, JavaScript helpers, configuration XMLs, and embedded shader programs.

2. QObject Meta-Object Data Inversion (MOC Reflection)

Metadata Table Discovery: Locate static integer arrays (qt_meta_data_<ClassName>) and corresponding string pools (qt_meta_stringdata_<ClassName>) in read-only data sections.
Structure Decoding Across Qt 4, Qt 5, and Qt 6:
- Class Metadata: Superclass name, class flags, revision number.
- Signals: Signal names, parameter counts, parameter types, and parameter names.
- Slots: Method names, parameter signatures, return types, and access specifiers (public, protected, private).
- Properties (Q_PROPERTY): Property names, types, read/write/reset methods, and change notification signals (NOTIFY).
- Enums & Class Info: Extract Q_ENUM key-value pairs and Q_CLASSINFO key-value annotations.
C++ Header Synthesis: Generate clean C++ header declarations reconstructed with standard Qt macros (Q_OBJECT, signals:, public slots:).

3. Signal-to-Slot Connection Graph (Event Routing)

Static Connect Call Tracing: Trace invocations of QObject::connect() across binary instructions:
- Legacy string-based syntax: parse SIGNAL(clicked()) and SLOT(onClicked()) strings.
- Modern PMF (Pointer-to-Member-Function) syntax: resolve function pointers passed for sender signal and receiver slot.
Event Graph Construction: Generate a directed graph mapping UI widgets (e.g. QPushButton, QAction, QLineEdit) to their target backend slots and controllers.

4. QML & QV4 Bytecode Decompilation (`.qmlc` / `.jsc`)

Container & Header Parsing: Parse precompiled QML files (.qmlc) and JavaScript cache files (.jsc) generated by qmlcachegen.
QV4 VM Bytecode Disassembly: Disassemble QV4 virtual machine instructions (property lookups, context resolutions, closures, math operations, and binding evaluations).
QML Component Tree Reconstruction: Invert the instruction stream into human-readable QML declarative component hierarchies (e.g. ApplicationWindow, Rectangle, Button, ListView, custom components) with associated property bindings.

5. QML-to-C++ Boundary & Native Bridge Mapping

Native Type Registrations: Identify C++ classes registered into the QML engine via qmlRegisterType<T>(), qmlRegisterSingletonType<T>(), and QML_ELEMENT.
Context Properties: Track global context properties injected via QQmlContext::setContextProperty("name", pointer).
Invokable Methods: Enumerate C++ methods decorated with Q_INVOKABLE that are directly callable from QML JavaScript.

Acceptance Criteria

Introduce analyze_qt_application in REA CLI and MCP contracts, accepting native binaries and .rcc files.
Accurately unpack .rcc archives (versions 1, 2, and 3) into regular files with verified SHA-256 digests.
Parse qt_meta_data arrays from synthetic Qt 5 and Qt 6 C++ binaries, emitting structured JSON documenting signals, slots, and properties.
Build a verifiable signal-to-slot connection graph connecting UI event sources to target slot methods.
Disassemble synthetic QV4 bytecode (.qmlc) into readable QML component structures.
Report all QML-exposed C++ types and Q_INVOKABLE methods in structured evidence.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#3624 [Feature] Native C++ semantic reconstruction: RTTI, vtables, class hierarchies
#3625 [Feature] Unreal Engine reverse engineering: Pak/IoStore, UAsset reflection

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3630 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary The Qt framework is the premier cross-platform C++ application and UI framework across desktop operating systems (Linux, Windows, macOS), automotive infotainment (In-Vehicle Infotainment / IVI), medical devices, defense systems, and embedded IoT devices. However, applications built with Qt and Qt Quick / QML differ fundamentally from standard native C++ applications because of the **Meta-Object System** and the **Qt Resource System (RCC)**. Currently, REA analyzes Qt binaries merely as generic native executables in Ghidra or Rizin. While REA recently added C++ RTTI and class hierarchy modeling (#3624), Qt bypasses traditional C++ RTTI in favor of its own compiler-generated reflection metadata via the Meta-Object Compiler (`moc`). When reverse engineering a Qt application, an analyst needs to: - Unpack embedded `.rcc` binary resource files containing the UI definitions; - Parse `QObject` metadata tables to recover class signals, slots, and properties; - Trace signal-to-slot connections linking user interface triggers to backend C++ handlers; - Decompile compiled QML / QV4 bytecode (`.qmlc` / `.jsc`); - Map the boundary where QML binds to native C++ controllers (`Q_INVOKABLE`, `setContextProperty`). This feature proposal introduces dedicated **Qt and QML Reverse Engineering** to REA, turning opaque Qt binaries into fully structured, event-mapped, and decompiled desktop/embedded application architectures. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: Qt Binary (ELF, PE, Mach-O) or | | Standalone RCC (.rcc) Archive | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | RCC Resource Unpacker | | QObject MOC Metadata | | (.rcc, qres, Zlib, Zstd) | | Parser (qt_meta_data) | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Signal-to-Slot Connection Graph | | (QObject::connect, UI -> C++ handler) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | QML / QV4 Bytecode | | QML <-> C++ Native | | Decompiler (.qmlc, .jsc) | | Boundary Mapping | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence / UI & Event Dossier | | (QML Source, C++ Slots, Connections) | +---------------------------------------+ ``` ### 1. RCC Resource System Unpacker - **Container Extraction:** Parse standalone `.rcc` files and embedded resource sections in executables (detected by `qInitResources_*` symbols or the `0x71726573` `"qres"` magic header). - **Format Version Support:** Support RCC format versions 1, 2, and 3 (handling Zlib and Zstd compressed resource blocks). - **Virtual Filesystem Reconstruction:** Reconstruct the hierarchical file and directory tree (`:/qml/...`, `:/images/...`, `:/translations/...`), extracting QML source files, JavaScript helpers, configuration XMLs, and embedded shader programs. ### 2. QObject Meta-Object Data Inversion (MOC Reflection) - **Metadata Table Discovery:** Locate static integer arrays (`qt_meta_data_<ClassName>`) and corresponding string pools (`qt_meta_stringdata_<ClassName>`) in read-only data sections. - **Structure Decoding Across Qt 4, Qt 5, and Qt 6:** - **Class Metadata:** Superclass name, class flags, revision number. - **Signals:** Signal names, parameter counts, parameter types, and parameter names. - **Slots:** Method names, parameter signatures, return types, and access specifiers (`public`, `protected`, `private`). - **Properties (`Q_PROPERTY`):** Property names, types, read/write/reset methods, and change notification signals (`NOTIFY`). - **Enums & Class Info:** Extract `Q_ENUM` key-value pairs and `Q_CLASSINFO` key-value annotations. - **C++ Header Synthesis:** Generate clean C++ header declarations reconstructed with standard Qt macros (`Q_OBJECT`, `signals:`, `public slots:`). ### 3. Signal-to-Slot Connection Graph (Event Routing) - **Static Connect Call Tracing:** Trace invocations of `QObject::connect()` across binary instructions: - Legacy string-based syntax: parse `SIGNAL(clicked())` and `SLOT(onClicked())` strings. - Modern PMF (Pointer-to-Member-Function) syntax: resolve function pointers passed for sender signal and receiver slot. - **Event Graph Construction:** Generate a directed graph mapping UI widgets (e.g. `QPushButton`, `QAction`, `QLineEdit`) to their target backend slots and controllers. ### 4. QML & QV4 Bytecode Decompilation (`.qmlc` / `.jsc`) - **Container & Header Parsing:** Parse precompiled QML files (`.qmlc`) and JavaScript cache files (`.jsc`) generated by `qmlcachegen`. - **QV4 VM Bytecode Disassembly:** Disassemble QV4 virtual machine instructions (property lookups, context resolutions, closures, math operations, and binding evaluations). - **QML Component Tree Reconstruction:** Invert the instruction stream into human-readable QML declarative component hierarchies (e.g. `ApplicationWindow`, `Rectangle`, `Button`, `ListView`, custom components) with associated property bindings. ### 5. QML-to-C++ Boundary & Native Bridge Mapping - **Native Type Registrations:** Identify C++ classes registered into the QML engine via `qmlRegisterType<T>()`, `qmlRegisterSingletonType<T>()`, and `QML_ELEMENT`. - **Context Properties:** Track global context properties injected via `QQmlContext::setContextProperty("name", pointer)`. - **Invokable Methods:** Enumerate C++ methods decorated with `Q_INVOKABLE` that are directly callable from QML JavaScript. --- ## Acceptance Criteria 1. Introduce `analyze_qt_application` in REA CLI and MCP contracts, accepting native binaries and `.rcc` files. 2. Accurately unpack `.rcc` archives (versions 1, 2, and 3) into regular files with verified SHA-256 digests. 3. Parse `qt_meta_data` arrays from synthetic Qt 5 and Qt 6 C++ binaries, emitting structured JSON documenting signals, slots, and properties. 4. Build a verifiable signal-to-slot connection graph connecting UI event sources to target slot methods. 5. Disassemble synthetic QV4 bytecode (`.qmlc`) into readable QML component structures. 6. Report all QML-exposed C++ types and `Q_INVOKABLE` methods in structured evidence. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #3624 [Feature] Native C++ semantic reconstruction: RTTI, vtables, class hierarchies - #3625 [Feature] Unreal Engine reverse engineering: Pak/IoStore, UAsset reflection

bsakaguchi referenced this issue

2026-10-17 21:10:41 +00:00

[PR #1354] [MERGED] fix(snapshot): preserve complete investigation revision histories #2820

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1354

No description provided.

Rows
Columns