[GH-ISSUE #3686] [Feature] Tauri reverse engineering: Rust commands, invoke/event IPC, capabilities, plugins and frontend-to-native graph reconstruction #1398

New issue

Open

opened 2026-10-16 21:05:05 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:05 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3686

Problem Statement & Context

Tauri has emerged as one of the fastest-growing modern application frameworks (>111,000 GitHub stars), combining native Rust backends with web frontend user interfaces rendered via system webviews (WebView2 on Windows, WebKitGTK on Linux, WKWebView on macOS/iOS).

In typical reverse engineering scenarios, analysts either inspect the frontend web bundle or disassemble the native Rust binary in Ghidra/IDA. However, this separates the application from its core logic:

Command Routing (invoke / #[tauri::command]): Frontend calls invoke('cmd_name', { args }) routed through internal serialization bridges into Rust functions annotated with #[tauri::command].
IPC Protocol & Serialization: Custom JSON/CBOR/IPC payload schemas passed across the webview IPC channel.
Event & Channel Streaming: Bidirectional pub/sub events (emit, listen) and streaming Channel mechanisms.
Tauri v2 Capabilities & Security Permissions: ACL rules defined in capabilities/*.json and tauri.conf.json specifying allowed commands, remote URLs, and OS permissions.
Plugin Architecture: Official and community plugins (tauri-plugin-fs, tauri-plugin-sql, tauri-plugin-http) exposing pre-configured native capabilities.

REA needs a dedicated Tauri engine capable of ingesting packaged Tauri applications, extracting frontend bundles, discovering Rust command entrypoints, and mapping the full invocation graph.

Proposed Architecture

flowchart TD
    A["Tauri Application (Native Binary + Packaged Resources)"] --> B["Tauri Application Analyzer"]
    B --> C["Frontend Asset & Invoke Extractor"]
    B --> D["Rust Binary Command Dispatcher"]
    B --> E["Tauri v2 Security & Capability Auditor"]
    
    C --> C1["Frontend JS Bundles / Webview Assets"]
    C --> C2["window.__TAURI_INTERNALS__.invoke Calls"]
    C --> C3["Event Listeners & Channel Subscribers"]
    
    D --> D1["#[tauri::command] Handler Registry"]
    D --> D2["generate_handler! Macro Resolution"]
    D --> D3["Deserialized Argument Types & Return Schemas"]
    
    E --> E1["tauri.conf.json & Embedded Capabilities ACL"]
    E --> E2["Active Plugins (FS, HTTP, Shell, Database)"]
    
    C & D & E --> F["Frontend-to-Native IPC Graph & API Specification"]

Technical Capabilities & Modules

Tauri Application Detection & Resource Extraction:
- Detect Tauri runtime signatures in PE, ELF, and Mach-O executables (embedded strings, symbols like tauri::app, tauri::ipc).
- Extract embedded frontend assets embedded via include_dir! or packaged within resources.
Frontend invoke & Event Pattern Mining:
- Scan frontend JavaScript/TypeScript bundles for invocations of @tauri-apps/api/core (invoke) or legacy window.__TAURI__.invoke.
- Extract target command names, parameter objects, and event channels (listen, emit).
Rust Command Handler Resolution:
- Identify dispatcher tables generated by the tauri::generate_handler![...] macro.
- Resolve mangled Rust symbols for functions annotated with #[tauri::command].
- Reconstruct argument structs, serde deserialization models, and return types from binary metadata or DWARF/PDB symbols when present.
Tauri v2 Permissions & ACL Auditing:
- Extract and parse embedded capability configurations (tauri.conf.json, capabilities/*.json).
- Audit permissions: identify unconstrained filesystem, shell execution (tauri-plugin-shell:open, execute), or network access scopes.
Plugin Boundary Mapping:
- Identify initialized Tauri plugins and their corresponding registered commands (e.g. plugin:fs|read_file, plugin:clipboard|write_text).
- Reconstruct the complete interaction surface exposed to the frontend.

Acceptance Criteria

Automated identification of Tauri v1 and Tauri v2 applications across Windows, Linux, and macOS.
Clean extraction and formatting of embedded frontend web assets.
Extraction of all registered #[tauri::command] functions, matching them to frontend invoke() calls.
Parsing and auditing of Tauri v2 capability ACLs and plugin permissions.
Synthesis of an interactive architecture diagram depicting frontend components, IPC commands, and native Rust handlers.

Complements #3608 (React Semantic Reconstruction & Decompiler Engine)
Complements #117 (Full-stack reconstruction)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3686 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context Tauri has emerged as one of the fastest-growing modern application frameworks (>111,000 GitHub stars), combining native Rust backends with web frontend user interfaces rendered via system webviews (WebView2 on Windows, WebKitGTK on Linux, WKWebView on macOS/iOS). In typical reverse engineering scenarios, analysts either inspect the frontend web bundle or disassemble the native Rust binary in Ghidra/IDA. However, this separates the application from its core logic: 1. **Command Routing (`invoke` / `#[tauri::command]`)**: Frontend calls `invoke('cmd_name', { args })` routed through internal serialization bridges into Rust functions annotated with `#[tauri::command]`. 2. **IPC Protocol & Serialization**: Custom JSON/CBOR/IPC payload schemas passed across the webview IPC channel. 3. **Event & Channel Streaming**: Bidirectional pub/sub events (`emit`, `listen`) and streaming `Channel` mechanisms. 4. **Tauri v2 Capabilities & Security Permissions**: ACL rules defined in `capabilities/*.json` and `tauri.conf.json` specifying allowed commands, remote URLs, and OS permissions. 5. **Plugin Architecture**: Official and community plugins (`tauri-plugin-fs`, `tauri-plugin-sql`, `tauri-plugin-http`) exposing pre-configured native capabilities. REA needs a dedicated Tauri engine capable of ingesting packaged Tauri applications, extracting frontend bundles, discovering Rust command entrypoints, and mapping the full invocation graph. ### Proposed Architecture ```mermaid flowchart TD A["Tauri Application (Native Binary + Packaged Resources)"] --> B["Tauri Application Analyzer"] B --> C["Frontend Asset & Invoke Extractor"] B --> D["Rust Binary Command Dispatcher"] B --> E["Tauri v2 Security & Capability Auditor"] C --> C1["Frontend JS Bundles / Webview Assets"] C --> C2["window.__TAURI_INTERNALS__.invoke Calls"] C --> C3["Event Listeners & Channel Subscribers"] D --> D1["#[tauri::command] Handler Registry"] D --> D2["generate_handler! Macro Resolution"] D --> D3["Deserialized Argument Types & Return Schemas"] E --> E1["tauri.conf.json & Embedded Capabilities ACL"] E --> E2["Active Plugins (FS, HTTP, Shell, Database)"] C & D & E --> F["Frontend-to-Native IPC Graph & API Specification"] ``` ### Technical Capabilities & Modules 1. **Tauri Application Detection & Resource Extraction:** - Detect Tauri runtime signatures in PE, ELF, and Mach-O executables (embedded strings, symbols like `tauri::app`, `tauri::ipc`). - Extract embedded frontend assets embedded via `include_dir!` or packaged within resources. 2. **Frontend `invoke` & Event Pattern Mining:** - Scan frontend JavaScript/TypeScript bundles for invocations of `@tauri-apps/api/core` (`invoke`) or legacy `window.__TAURI__.invoke`. - Extract target command names, parameter objects, and event channels (`listen`, `emit`). 3. **Rust Command Handler Resolution:** - Identify dispatcher tables generated by the `tauri::generate_handler![...]` macro. - Resolve mangled Rust symbols for functions annotated with `#[tauri::command]`. - Reconstruct argument structs, serde deserialization models, and return types from binary metadata or DWARF/PDB symbols when present. 4. **Tauri v2 Permissions & ACL Auditing:** - Extract and parse embedded capability configurations (`tauri.conf.json`, `capabilities/*.json`). - Audit permissions: identify unconstrained filesystem, shell execution (`tauri-plugin-shell:open`, `execute`), or network access scopes. 5. **Plugin Boundary Mapping:** - Identify initialized Tauri plugins and their corresponding registered commands (e.g. `plugin:fs|read_file`, `plugin:clipboard|write_text`). - Reconstruct the complete interaction surface exposed to the frontend. ### Acceptance Criteria - [ ] Automated identification of Tauri v1 and Tauri v2 applications across Windows, Linux, and macOS. - [ ] Clean extraction and formatting of embedded frontend web assets. - [ ] Extraction of all registered `#[tauri::command]` functions, matching them to frontend `invoke()` calls. - [ ] Parsing and auditing of Tauri v2 capability ACLs and plugin permissions. - [ ] Synthesis of an interactive architecture diagram depicting frontend components, IPC commands, and native Rust handlers. ### Related Issues & Dependencies - Complements #3608 (React Semantic Reconstruction & Decompiler Engine) - Complements #117 (Full-stack reconstruction)

bsakaguchi referenced this issue

2026-10-17 21:11:05 +00:00

[PR #1398] [CLOSED] fix(browser): recover masked Chromium frame URLs #2856

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1398

No description provided.

Rows
Columns