[GH-ISSUE #3676] [Feature] GraalVM Native Image reverse engineering: image heap, Java metadata, reflection config and Java-to-native reconstruction #1388

New issue

Open

opened 2026-10-16 21:04:59 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:59 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3676

Summary

GraalVM Native Image (SubstrateVM) compiles ahead-of-time (AOT) Java and JVM applications (Quarkus, Micronaut, Spring Boot 3, serverless microservices) directly into standalone native executables (PE/COFF on Windows, ELF on Linux, Mach-O on macOS). Unlike traditional JVM applications distributed as .jar bytecode files, Native Image executables contain compiled native machine code alongside an embedded Image Heap and specialized runtime data structures.

When an analyst reverses a GraalVM native binary in Ghidra or Rizin, the original Java class hierarchy, method names, and reflection targets are obscured. Standard JVM decompilers cannot open the file, and native disassemblers see thousands of unannotated native subroutines.

While REA has proposed .NET NativeAOT recovery (#743) and C++ RTTI reconstruction (#3624), it currently has no parser for GraalVM SubstrateVM structures.

This feature proposal introduces dedicated GraalVM Native Image Reverse Engineering to REA, enabling automated extraction of the image heap, reconstruction of Java classes and methods, recovery of reflection configurations, and mapping of native entrypoints back to Java source semantics.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: GraalVM Native Binary (ELF/PE)   |
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | SubstrateVM Signature &   |                                   | Image Heap Section Parser |
           | Metadata Discovery        |                                   | (svm_heap, Initial State) |
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Java Class Hierarchy & Method Table   |
                                     | Reconstructor (DynamicHub, vtables)   |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Reflection & JNI Metadata |                                   | Native Function to Java   |
           | Carving (reflect-config)  |                                   | Symbol Re-Hydration       |
           +-------------+-------------+                                   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | REA Evidence: Java Class Dossier,     |
                                     | Ghidra Symbol Map & Method Signatures |
                                     +---------------------------------------+

1. SubstrateVM Signature & Layout Ingestion

Binary Signature Detection: Detect GraalVM Native Image markers across ELF, PE, and Mach-O files:
- SubstrateVM runtime constants, thread-local storage (TLS) patterns, and memory isolate handlers (graal_create_isolate).
- Distinguish GraalVM AOT binaries from Go, Rust, or C++ executables.
Section Layout Extraction: Identify the read-only image heap, writable heap partition, and native code text boundaries.

2. Image Heap & DynamicHub Parsing

Object Header Inversion: Parse object headers in the frozen image heap:
- Hub pointers linking frozen objects to their DynamicHub runtime class representations.
- Array length fields and identity hash code fields.
DynamicHub Class Structures: Decode DynamicHub metadata records:
- Fully qualified Java class name (e.g. com.example.service.AuthenticationController).
- Superclass and implemented interface references.
- Vtable slots: virtual method pointers and interface method dispatch tables.

3. Reflection, JNI & Resource Configuration Carving

Reflection Metadata: Extract pre-compiled reflection metadata tables registering classes, methods, and fields accessible via reflection (reflect-config.json artifacts compiled into the heap).
JNI & C Entrypoints: Locate native entrypoints exposed to C via @CEntryPoint and JNI bindings.
Embedded Resources: Carve embedded classpath resources stored within the image heap.

4. Headless Ghidra & Rizin Symbol Hydration

Method Renaming: Map compiled native subroutines back to their Java signatures (e.g. renaming FUN_140023400 to com.example.service.UserService::validatePassword(String)).
Type Injection: Inject recovered Java class structures and vtables directly into Ghidra and Rizin program databases.

Acceptance Criteria

Introduce analyze_graalvm_binary in REA CLI and MCP contracts, accepting ELF, PE, and Mach-O native binaries.
Reliably distinguish GraalVM Native Image binaries from standard C/C++ and Go executables.
Parse the image heap and extract fully qualified Java class names from DynamicHub records.
Recover registered reflection methods and JNI entrypoints.
Annotate virtual function tables and native subroutine names in headless Ghidra analysis.

#743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows
#3624 [Feature] Native C++ semantic reconstruction: RTTI, vtables, class hierarchies
#3617 [Feature] Java Applets & JNLP reverse engineering

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3676 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary GraalVM Native Image (SubstrateVM) compiles ahead-of-time (AOT) Java and JVM applications (Quarkus, Micronaut, Spring Boot 3, serverless microservices) directly into standalone native executables (PE/COFF on Windows, ELF on Linux, Mach-O on macOS). Unlike traditional JVM applications distributed as `.jar` bytecode files, Native Image executables contain compiled native machine code alongside an embedded **Image Heap** and specialized runtime data structures. When an analyst reverses a GraalVM native binary in Ghidra or Rizin, the original Java class hierarchy, method names, and reflection targets are obscured. Standard JVM decompilers cannot open the file, and native disassemblers see thousands of unannotated native subroutines. While REA has proposed .NET NativeAOT recovery (#743) and C++ RTTI reconstruction (#3624), it currently has no parser for GraalVM SubstrateVM structures. This feature proposal introduces dedicated **GraalVM Native Image Reverse Engineering** to REA, enabling automated extraction of the image heap, reconstruction of Java classes and methods, recovery of reflection configurations, and mapping of native entrypoints back to Java source semantics. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: GraalVM Native Binary (ELF/PE) | +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | SubstrateVM Signature & | | Image Heap Section Parser | | Metadata Discovery | | (svm_heap, Initial State) | +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Java Class Hierarchy & Method Table | | Reconstructor (DynamicHub, vtables) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Reflection & JNI Metadata | | Native Function to Java | | Carving (reflect-config) | | Symbol Re-Hydration | +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | REA Evidence: Java Class Dossier, | | Ghidra Symbol Map & Method Signatures | +---------------------------------------+ ``` ### 1. SubstrateVM Signature & Layout Ingestion - **Binary Signature Detection:** Detect GraalVM Native Image markers across ELF, PE, and Mach-O files: - SubstrateVM runtime constants, thread-local storage (TLS) patterns, and memory isolate handlers (`graal_create_isolate`). - Distinguish GraalVM AOT binaries from Go, Rust, or C++ executables. - **Section Layout Extraction:** Identify the read-only image heap, writable heap partition, and native code text boundaries. ### 2. Image Heap & DynamicHub Parsing - **Object Header Inversion:** Parse object headers in the frozen image heap: - Hub pointers linking frozen objects to their `DynamicHub` runtime class representations. - Array length fields and identity hash code fields. - **DynamicHub Class Structures:** Decode `DynamicHub` metadata records: - Fully qualified Java class name (e.g. `com.example.service.AuthenticationController`). - Superclass and implemented interface references. - Vtable slots: virtual method pointers and interface method dispatch tables. ### 3. Reflection, JNI & Resource Configuration Carving - **Reflection Metadata:** Extract pre-compiled reflection metadata tables registering classes, methods, and fields accessible via reflection (`reflect-config.json` artifacts compiled into the heap). - **JNI & C Entrypoints:** Locate native entrypoints exposed to C via `@CEntryPoint` and JNI bindings. - **Embedded Resources:** Carve embedded classpath resources stored within the image heap. ### 4. Headless Ghidra & Rizin Symbol Hydration - **Method Renaming:** Map compiled native subroutines back to their Java signatures (e.g. renaming `FUN_140023400` to `com.example.service.UserService::validatePassword(String)`). - **Type Injection:** Inject recovered Java class structures and vtables directly into Ghidra and Rizin program databases. --- ## Acceptance Criteria 1. Introduce `analyze_graalvm_binary` in REA CLI and MCP contracts, accepting ELF, PE, and Mach-O native binaries. 2. Reliably distinguish GraalVM Native Image binaries from standard C/C++ and Go executables. 3. Parse the image heap and extract fully qualified Java class names from `DynamicHub` records. 4. Recover registered reflection methods and JNI entrypoints. 5. Annotate virtual function tables and native subroutine names in headless Ghidra analysis. --- ## Related - #743 [Feature] Recover .NET NativeAOT metadata in Ghidra workflows - #3624 [Feature] Native C++ semantic reconstruction: RTTI, vtables, class hierarchies - #3617 [Feature] Java Applets & JNLP reverse engineering

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:58 +00:00

[PR #1388] [CLOSED] fix(javascript): avoid regex overflow for large source maps #2846