[GH-ISSUE #3718] [RFC/Epic] Universal Static-to-Runtime Semantic Correlation: cross-layer mapping between code, traces, packets and UI events #1429

New issue

Open

opened 2026-10-16 21:05:22 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:22 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3718

Problem Statement & Architectural Context

Static reverse engineering reveals what a program could do (control flow graphs, strings, symbol tables, decompiled functions). Dynamic reverse engineering reveals what a program did in a specific run (API calls, syscall traces, network packets, memory reads/writes).

Currently, analysts perform the mental translation between these two worlds manually:

"Which decompiled C++ function in Ghidra was triggered by this specific incoming network packet?"
"Did this suspicious branch ever execute during the runtime observation window?"
"Which UI button click in the frontend resulted in this low-level IOCTL call to the kernel driver?"

REA's architecture is uniquely positioned to bridge this chasm. By combining static decompilation providers with live observation collectors (GDB, LLDB, Rizin, CDP, Frida, network captures), REA can establish a unified Semantic Correlation Graph linking static syntax directly to dynamic evidence.

Proposed Architecture

flowchart TD
    subgraph Static Analysis
        S1["Decompiled Functions & CFG"]
        S2["UI Event Handlers & Endpoints"]
        S3["Binary Schema & Protocol Types"]
    end

    subgraph Dynamic Observation
        D1["Call Traces (GDB / LLDB / Frida)"]
        D2["Network Capture (PCAP / WebSocket)"]
        D3["UI Clicks / Browser CDP Events"]
        D4["Memory Reads / Syscall Logs"]
    end

    S1 & S2 & S3 & D1 & D2 & D3 & D4 --> C["Static ↔ Dynamic Correlation Engine"]
    
    C --> E1["Function Coverage & Dead-Code Annotation"]
    C --> E2["Packet-to-Parser Handler Mapping"]
    C --> E3["UI-to-Kernel Driver Trace Graph"]
    C --> E4["Unified Evidence Timeline"]

Technical Capabilities & Modules

Address & Symbol Alignment Engine:
- Correlate runtime Instruction Pointers (ASLR base + slide) with static binary offsets and decompiled symbol tables.
- Map dynamically hooked functions (via Frida, eBPF, or debugger breakpoints) directly to corresponding static CFG basic blocks.
Packet-to-Code Correlation:
- Link incoming network packets (from PCAP or socket trace) to the exact function call site that read and parsed the payload.
- Correlate packet opcode fields with switch/jump tables in the static decompiler.
UI-to-Native Event Tracing:
- In hybrid apps (WebView2 #3684, CEF #3685, Tauri #3686, Electron #3608), correlate DOM click events (onClick) through the IPC channel down to the native handler function.
- Build an end-to-end trace: DOM Button -> IPC Message -> C++ / Rust Handler -> IOCTL / Syscall.
Dynamic Coverage Overlay:
- Overlay runtime basic-block execution frequency directly onto the static decompiler's control flow graph.
- Visually highlight executed branches (hot paths), unreached branches (cold paths), and dead code.
Unified Chronological Evidence Timeline:
- Synthesize a synchronized timeline correlating user actions, network events, function calls, and filesystem modifications.

Acceptance Criteria

Automated mapping of runtime dynamic execution traces to static decompiled function addresses with ASLR compensation.
Bidirectional navigation: query a decompiled function to see runtime traces, or query a trace event to jump to decompiled source.
Accurate correlation of network packet arrivals with target handler functions in static code.
End-to-end trace reconstruction bridging frontend UI interactions to backend native system calls.
Export of coverage-annotated control flow graphs.

Complements #3626 (Windows kernel driver reverse engineering: IOCTL correlation)
Complements #3684 (Microsoft WebView2 reverse engineering)
Complements #3686 (Tauri reverse engineering)
Complements #740 (Roadmap: static and runtime correlation)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3718 [![Type: Architecture / RFC](https://img.shields.io/badge/type-architecture_%2F_RFC-darkred.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Architectural Context Static reverse engineering reveals what a program *could* do (control flow graphs, strings, symbol tables, decompiled functions). Dynamic reverse engineering reveals what a program *did* in a specific run (API calls, syscall traces, network packets, memory reads/writes). Currently, analysts perform the mental translation between these two worlds manually: - *"Which decompiled C++ function in Ghidra was triggered by this specific incoming network packet?"* - *"Did this suspicious branch ever execute during the runtime observation window?"* - *"Which UI button click in the frontend resulted in this low-level IOCTL call to the kernel driver?"* REA's architecture is uniquely positioned to bridge this chasm. By combining static decompilation providers with live observation collectors (GDB, LLDB, Rizin, CDP, Frida, network captures), REA can establish a unified **Semantic Correlation Graph** linking static syntax directly to dynamic evidence. ### Proposed Architecture ```mermaid flowchart TD subgraph Static Analysis S1["Decompiled Functions & CFG"] S2["UI Event Handlers & Endpoints"] S3["Binary Schema & Protocol Types"] end subgraph Dynamic Observation D1["Call Traces (GDB / LLDB / Frida)"] D2["Network Capture (PCAP / WebSocket)"] D3["UI Clicks / Browser CDP Events"] D4["Memory Reads / Syscall Logs"] end S1 & S2 & S3 & D1 & D2 & D3 & D4 --> C["Static ↔ Dynamic Correlation Engine"] C --> E1["Function Coverage & Dead-Code Annotation"] C --> E2["Packet-to-Parser Handler Mapping"] C --> E3["UI-to-Kernel Driver Trace Graph"] C --> E4["Unified Evidence Timeline"] ``` ### Technical Capabilities & Modules 1. **Address & Symbol Alignment Engine:** - Correlate runtime Instruction Pointers (ASLR base + slide) with static binary offsets and decompiled symbol tables. - Map dynamically hooked functions (via Frida, eBPF, or debugger breakpoints) directly to corresponding static CFG basic blocks. 2. **Packet-to-Code Correlation:** - Link incoming network packets (from PCAP or socket trace) to the exact function call site that read and parsed the payload. - Correlate packet opcode fields with switch/jump tables in the static decompiler. 3. **UI-to-Native Event Tracing:** - In hybrid apps (WebView2 #3684, CEF #3685, Tauri #3686, Electron #3608), correlate DOM click events (`onClick`) through the IPC channel down to the native handler function. - Build an end-to-end trace: `DOM Button -> IPC Message -> C++ / Rust Handler -> IOCTL / Syscall`. 4. **Dynamic Coverage Overlay:** - Overlay runtime basic-block execution frequency directly onto the static decompiler's control flow graph. - Visually highlight executed branches (hot paths), unreached branches (cold paths), and dead code. 5. **Unified Chronological Evidence Timeline:** - Synthesize a synchronized timeline correlating user actions, network events, function calls, and filesystem modifications. ### Acceptance Criteria - [ ] Automated mapping of runtime dynamic execution traces to static decompiled function addresses with ASLR compensation. - [ ] Bidirectional navigation: query a decompiled function to see runtime traces, or query a trace event to jump to decompiled source. - [ ] Accurate correlation of network packet arrivals with target handler functions in static code. - [ ] End-to-end trace reconstruction bridging frontend UI interactions to backend native system calls. - [ ] Export of coverage-annotated control flow graphs. ### Related Issues & Dependencies - Complements #3626 (Windows kernel driver reverse engineering: IOCTL correlation) - Complements #3684 (Microsoft WebView2 reverse engineering) - Complements #3686 (Tauri reverse engineering) - Complements #740 (Roadmap: static and runtime correlation)

bsakaguchi referenced this issue

2026-10-17 21:11:22 +00:00

[PR #1429] [MERGED] docs(skill): save CLI application Evidence and read a summary view #2880

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1429

No description provided.

Rows
Columns