morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

New issue

Open

opened 2026-10-16 21:05:47 +00:00 by bsakaguchi · 9 comments

bsakaguchi commented

2026-10-16 21:05:47 +00:00

Owner

Originally created by @CassieFox23 on GitHub (Oct 15, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3796

TL;DR: This lists 415 open feature requests, grouped by area, oldest first. 63 more are tracked in #4027 and #2383, so they are not repeated here. It is a map of the queue, not a to-do list. There is no rush, and nothing here asks for speed.

What's here

Feature requests are spread over many issues. Some overlap. Some have no area label. That makes the queue hard to read. This tracker lists them in one place, by area. The list is built from what is open on GitHub.

Last refreshed: 10:29 PM UTC on 2 November 2026.

Open feature requests

Each box below is an open feature request. Tick a box when it is done, closed, or answered. Nothing here asks for speed.

Items marked (our sort) had no area label, so we picked an area from the title. The maintainers' labels win.

A tag after a line means one of three things. (PR #N open) says an open pull request lists this request as closed by it. (likely same as #N) says two requests look like one ask. (roadmap: theme) uses a theme name from discussion #2039.

I judged the PR tags from titles only, so they are unverified.

area: native (112)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#288 own Windows Ghidra process trees so they end with the parent (roadmap: Windows safety) (PR #5558 open)
#318 build the Windows native add-on package
#319 ship that package in releases and test it on real Windows
#325 lock down the native add-on before it loads
#327 create and read back locked-down runtime folders
#340 test Hopper cancel, timeout, edits and shutdown
#341 run function-report tests on real Hopper
#342 real-Hopper test of caller and callee chains
#343 real-Hopper test of flow successors and assembly
#344 real-Hopper test of a two-binary workflow
#487 better AArch64 jump-table recovery in Ghidra
#1193 analyze with a dSYM the caller picks, in Ghidra (PR #2025 open)
#1389 try rsleigh as a headless analysis provider
#1416 support the official IDA MCP server as a provider
#1641 add 6502 and 65816 analysis through Ghidra
#1741 add 32-bit big-endian PowerPC, then GameCube and Wii files
#1745 confirm the 32-bit ARM lane and pin the ARM v7 language (PR #1922 open)
#2003 recover Solana sBPF program interfaces offline
#2258 a recommended list of open-source decompilers (PR #4773 open)
#2298 decompile WebAssembly functions into labeled pseudocode
#2338 admit plain MIPS32 shared libraries in Ghidra (PR #2362 open)
#2350 inspect WebAssembly components offline
#2369 inspect Linux BTF type data offline
#2408 open 16-bit Windows (NE) files in Ghidra
#2410 accept SuperH PE files (Windows CE) in Ghidra
#2417 a rule for picking an engine when Ghidra, Hopper and IDA are all there
#2711 add Radare2 (PR #3521 open)
#2734 Ghidra MIPS lane rejects mips1 and mips32
#2735 Structured decompiler-completeness signal in function dossiers (+ optional instruction fallback for dropped blocks) (PR #4237 open)
#3019 add Rizin as a native analysis provider
#3083 let users turn on Ghidra analyzers (our sort)
#3118 Xbox 360 files: big-endian PowerPC PE and XEX2 (our sort)
#3155 admit old MIPS32 ELF files with a bad section table (PR #4532 open) (our sort)
#3282 import one slice of a universal Mach-O in Ghidra (our sort)
#3483 Xtensa ELF lane (ESP32) through Ghidra (our sort)
#3532 raw SuperH-4 binaries in Ghidra (our sort)
#3716 epic: common bytecode and VM framework (our sort)
#4247 trace several goals in one trace_call_path run and report the roots (PR #4417 open) (our sort)
#4307 Inspect the dyld shared cache and resolve system library loads
#5038 IDA provider: declare read_bytes with faithful loaded-byte semantics (our sort)
#5339 Change how an address is listed in a Ghidra session: code, function, data, string, or undefined (our sort)
#5344 Resolve Objective-C __cfstring literals to the code that uses them (our sort)
#5400 Avoid repeated Ghidra startup logs in input-error replies (our sort)
#5523 inspect_native_api: report whether a function is variadic (PR #5545 open) (our sort)
#5709 Nintendo 3DS static analysis through Ghidra and a reusable verification workflow (our sort)
#5744 Analyze Thumb-only Cortex-M firmware in the raw-binary lane instead of refusing its entry point and decoding it as ARM state (our sort)
#5820 Provider-neutral V-CPU interpreter structure analysis (our sort)
#6328 C28x/C2000 support (our sort)
#6404 Ghidra: admit comment / inline_comment / set_comment / set_inline_comment at any mapped address (our sort)
#6405 Ghidra: export analyst names and comments from a session and re-apply them when the target is reopened (our sort)
#6746 Ghidra profile for PS2 Emotion Engine (R5900) executables (our sort)
#7189 Static library-function identification (FLIRT-like) for native targets (our sort)
#7265 Accept original Xbox XBE executables and route them to provider loaders (our sort)
#7381 Ghidra provider: support universal (fat) Mach-O by selecting a slice instead of refusing (our sort)
#7993 add MIPS support (our sort)
#8165 [Design] Preserve and reopen owned Ghidra analysis with a packed-program checkpoint (our sort)
#8166 [Design] Allow analyst assertions in Kuna decompilation with explicit provenance (our sort)
#8167 Recover individual Kuna decompiles that fail in a completed project export (our sort)
#8170 Investigate verified byte reads for Kuna-backed investigations (our sort)
#8173 [Design] Use independent symbol evidence to match functions when a provider omits origins (our sort)
#8175 [Design] Consider Kuna support for caller-described raw binaries (our sort)
#8176 [Design] Report verified Kuna export progress when supported (our sort)
#8177 [Design] Investigate Kuna decompilation inside a Ghidra analysis session (our sort)
#8178 [Design] Disambiguate analysis addresses from file offsets in decompilation (our sort)
#8181 [Design] Distinguish a missing batch decompilation selection from an empty batch (our sort)
#8183 [Design] Recover function references when the provider lacks a general name inventory (our sort)
#8184 [Design] Make feature-trace reference coverage explicit for agents (our sort)
#8185 [Design] Make native metadata recovery discoverable when class-label inventory is unavailable (our sort)
#8186 [Design] Make decoded Swift declarations discoverable when procedure categories are unknown (our sort)
#8190 [Design] Investigate partial outgoing data-reference evidence for Kuna functions (our sort)
#8192 [Design] Analyze analyst-selected function entries absent from provider inventories (our sort)
#8193 [Design] Analyze an explicitly selected universal Mach-O slice with Kuna (our sort)
#8194 [Design] Investigate evidence-backed algorithm-constant discovery and references (our sort)
#8195 [Design] Evaluate a bounded RISC-V ELF investigation lane for Kuna (our sort)
#8197 [Design] Trace UI actions through separately evidenced tail transfers and thunks (our sort)
#8200 [Design] Preserve call-site and indirect-call context in call-path workflows (our sort)
#8208 [Design] Make missing-function recovery aware of selected Ghidra projects (our sort)
#8209 [Design] Export a bounded explicit or graph-derived set of native functions (our sort)
#8210 [Design] Clarify ARM-state raw entry errors when Thumb may be intended (our sort)
#8212 [Design] Define Kuna cache publication when a session is cancelled (our sort)
#8218 [Design] Find short or encoded markers outside provider string inventories (our sort)
#8219 [Design] Link native API boundary types to inspectable type identities (our sort)
#8232 [Design] Compare selected Ghidra project memory with bounded original bytes (our sort)
#8236 [Design] Allow caller-bounded native call graph investigation (our sort)
#8239 [Design] Explain individual failures in compact batch naming (our sort)
#8240 [Design] Find the defined data object containing an address (our sort)
#8241 [Design] Resolve a byte-search hit to its containing instruction (our sort)
#8245 [Design] Expose loaded and metadata provenance for string matches (our sort)
#8260 [Design] Preserve per-function producer provenance across decompile export resume (our sort)
#8314 [Design] Preserve local-variable source and identity in Ghidra function observations (our sort)
#8319 [Design] Define Kuna cache identity for caller-configured launchers (our sort)
#8328 [Design] Recover procedure lookup using independent export evidence (our sort)
#8333 [Design] Preserve IFUNC resolver semantics when investigating exported APIs (our sort)
#8336 [Design] Clarify or represent direct memory varnodes in native value-flow effects (our sort)
#8344 [Design] Discover candidates before selecting an existing Ghidra program (our sort)
#8348 [Design] Make incoming reference evidence actionable with Kuna (our sort)
#8360 [Design] Investigate explicit non-mutating decode of an alternate instruction stream (our sort)
#8365 [Design] Clarify live metadata across Ghidra byte-search pages (our sort)
#8372 [Design] Correlate native addresses across provider coordinate contexts (our sort)
#8373 [Design] Bound delivery of large native feature traces and their unknowns (our sort)
#8405 [Design] Report omitted caller targets in the real Kuna verifier (PR #8406 open) (our sort)
#8408 [Design] Connect indirect call investigations to Mach-O slot bindings (our sort)
#8459 [Design] Recognize repeated Kuna observations without discarding graph provenance (our sort)
#8460 [Design] Distinguish function correspondence from analysis metadata changes (our sort)
#8471 [Design] Distinguish local value flow from call-resolution availability (our sort)
#8472 Gadget search over analyzed instruction inventories (ROPgadget-shaped, evidence-carrying) (our sort)
#8556 [Design] Preserve byte-observation limitations in function matching (our sort)
#8560 [Design] Bound Ghidra byte-read allocation before response construction (our sort)
#8563 Investigate byte signatures across adjacent Ghidra blocks (our sort)
#8569 [Design] Find references to a selected data range (our sort)
#8587 [Design] Page retained native procedure-reference observations (our sort)
#8696 [Design] Inspect explicitly selected code outside provider inventory (our sort)

area: domain (35)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#32 the top roadmap: agents run the investigation, REA gives proof (roadmap: The roadmap itself)
#39 add browser and web app reverse engineering (roadmap: Browser and web) (also an umbrella in #4027)
#48 epic: Evidence v2 and exact process capture (roadmap: Process capture)
#321 check Job Object members and limits
#324 build safe Windows file access
#724 explain content, exit and timing gaps when comparing processes
#774 plan website reverse engineering with network evidence (roadmap: Browser and web) (also an umbrella in #4027)
#1244 flag instructions that clash with guessed function types (PR #8161 open)
#1246 inspect data-region accesses and overlapping fields
#1269 make an official Codex plugin
#1947 compare functions with addresses normalized in the text (PR #6970 open)
#2017 resolve wildcard keys in package exports and imports (PR #2018 open)
#2071 add CAN bus support
#2146 help agents recover from wrong argument names (PR #2148 open) (PR #8649 open)
#2411 investigate momd and mom files from iPhone
#2444 source-bound repository context for reconstruction briefs
#2782 dsh plugin hub: the REA plugin files are incomplete
#2812 decode version and string resources in PE files (PR #2887 open)
#3034 add OpenClaw (PR #3100 open)
#3133 measure qlog summaries and retained event views (roadmap)
#3135 pick bounded efficiency pilots for real artifacts (roadmap)
#3136 research whether reusing Ghidra databases helps (roadmap)
#3137 research demand and rules for outside domain modules (roadmap)
#3719 epic: format language and extension SDK (our sort)
#4230 [Design] Opt-in agent-evaluation scenario for instructions planted in target content
#4394 Persist target-keyed investigation notes across sessions
#4396 Require a failing negative control before a reconstruction verifier closes an obligation (PR #7178 open)
#4972 Add semantic-equivalence verification for reconstructed native code (our sort)
#5062 Ship REA as a Claude Code plugin (one-step MCP + skill install) (PR #5064 closed) (our sort)
#6919 Include existing static artifact routes in feature-investigation guidance (PR #6925 open) (our sort)
#7193 Investigation-loop construct for agent-driven deep dives (loop engineering) (our sort)
#7957 Look-up of similar endavours before commencing decomp (our sort)
#8289 [Design] Surface ephemeral annotation loss when switching analysis providers (our sort)
#8317 [Design] Make unverified Kuna release guidance discoverable to MCP callers (our sort)
#8370 [Design] Expose active provider command cleanup in session status (our sort)

area: evidence (73)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#382 record the environment and check for contamination
#1142 Proposal: TraceBrief — evidence-gated Markdown reports from REA investigations
#2072 route NES (iNES) containers for 6502 ROMs
#3095 extract macOS DMG files (our sort)
#3153 list Windows Installer (MSI) contents read-only (PR #3404 open) (our sort)
#3154 decode .NET custom attribute arguments (our sort)
#3413 identify packers and extract UPX (PR #3775 open) (our sort)
#3431 model node:fs writes and child processes as effects (our sort) (the child-process slice is in #4027)
#3490 pick where extract_artifact writes, and extract a subset (PR #4031 open) (our sort)
#3494 inspect RSLogix 500 .RSS files (our sort)
#3570 keep file identity when inspect-artifact declines a format (our sort)
#3571 list JIMAGE runtime containers (our sort)
#3592 report request header and cookie names without values (our sort) (Part A is in #4027)
#3594 decrypt TLS in packet captures with a key log (our sort)
#3599 passive DNS extraction and security primitives (our sort)
#3621 infer unknown binary file formats (our sort)
#3636 rebuild Windows XAML UIs (BAML, XBF) (our sort)
#3714 epic: universal artifact discovery (our sort)
#3715 epic: recursive artifact graph (our sort)
#3717 epic: universal protocol inference (our sort)
#3718 epic: link static code to runtime traces and UI events (our sort)
#3766 read Procmon XML and CSV exports as capture evidence (PR #3967 open) (our sort)
#3771 better decompiling of Java 8 and obfuscated JARs (our sort)
#4091 [Design] Defer code mode and prioritize composable browser/Electron/JavaScript evidence
#4135 Cluster artifacts from retained Evidence references and summaries (PR #4133 open) (PR #4589 open)
#4297 Inspect Apple .ips crash reports as recorded-crash Evidence
#4298 Report CodeDirectory posture and the full requirement set in inspect_signature
#4299 Decode embedded launch and library constraints in inspect_signature
#4300 Decode embedded provisioning profiles and compare them with signed entitlements
#4301 Explain entitlements and derive static instrumentation constraints in inspect_signature
#4302 Interpret Info.plist entry points and capabilities per bundle
#4303 Map launchd, XPC, privileged-helper, login-item and system-extension relationships
#4304 Inspect privacy manifests and cross-check required-reason API imports per bundle
#4305 Report stapled notarization tickets and quarantine attributes without contacting Apple
#4308 Read unified log archives and correlate entries with os_log call sites
#4309 Inventory .lproj localizations and decode string tables per bundle
#4310 Open nested Apple bundle directories (appex, framework, xpc, plug-in) as targets
#4312 Report Mach-O placements that violate Apple's documented bundle layout rules
#4395 Generate unique masked byte signatures and relocate them in another build
#4398 Audit an exported Evidence bundle for secrets, local paths, and target content before sharing (PR #4482 open)
#4538 Inspect Android DEX debug metadata (lines, locals, parameter names) (PR #4473 open)
#4539 Triage PE imports: ATT&CK-tagged capabilities and a pefile-identical imphash
#5150 Expose Constant-table default values for literal fields and parameters in inspect_managed_members (our sort)
#5489 Add a dry-run plan for artifact extraction (PR #7177 open) (our sort)
#5490 Add manifest-driven batch mode for independent offline artifact inspections (our sort)
#6211 [Design] Add read-only PostgreSQL inspection (our sort)
#6332 Export supported analysis findings as SARIF 2.1.0 (PR #8572 open) (our sort)
#6333 Add auditable suppression rules for reviewed analysis findings (our sort)
#6334 Add opt-in redaction profiles for shareable analysis reports (our sort)
#6336 Define stable identities for correlating compatible findings across runs (our sort)
#6337 Add a verifiable manifest for exported analysis bundles (PR #8570 open) (our sort)
#6338 Add a focused comparison report for two compatible analysis runs (PR #8571 open) (our sort)
#6408 Inspect MFC CRuntimeClass metadata in PE binaries and link each serializable class to its Serialize(CArchive&) function (our sort)
#7038 Read Hermes bytecode bundles: header, integrity, function and string tables (our sort)
#7235 Decode FDO packaging and dlopen metadata in inspect-elf-notes (PR #7237 open) (our sort)
#7461 Evidence-backed firmware update comparison with component-level change attribution (our sort)
#7742 recover_javascript_sources on Windows x64 (our sort)
#7873 Import saved Playwright trace.zip recordings as offline Evidence (our sort)
#7874 Inspect Python wheel distributions as structured, read-only Evidence (our sort)
#8143 Import Linux perf.data recordings as read-only profiling Evidence (our sort)
#8215 [Design] Surface relevant analysis-profile differences in function comparisons (our sort)
#8234 Deterministic row paging for inspect_sqlite_database selected tables (our sort)
#8243 [Design] Reuse the refreshed annotation dossier as a function observation (our sort)
#8288 [Design] Preserve feature-trace evidence when reference ownership is unavailable (our sort)
#8292 Consider moving from binwalk to binwalk-ng (our sort)
#8364 [Design] Preserve contributing evidence for address-context handoffs (our sort)
#8375 [Design] Make Unknown history direction explicit in bundle comparisons (our sort)
#8393 [Design] Compare function observations within one selected Ghidra project (our sort)
#8427 [Design] Recover inline unretained Evidence into a new investigation (our sort)
#8448 [Design] Clarify CLI Evidence import versus MCP session retention (our sort)
#8452 [Design] Clarify authority of native matching Evidence views (our sort)
#8655 [Design] Recover historical Evidence from an incompatible analysis snapshot (our sort)
#8702 Reconstruct GraphQL schemas and operation contracts from retained artifacts (our sort)

area: runtime (22)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#289 safe Windows file access that links cannot fool (roadmap: Windows safety)
#290 private Windows runtime folders with locked permissions (roadmap: Windows safety)
#320 create Windows Job Objects and assign processes safely
#322 real-Windows test that child processes get cleaned up
#326 handle-based reads and writes, tested on real NTFS
#328 real-Windows test of private folder permissions
#333 add event-backed process-tree capture to Process Capture v4
#375 capture Electron process starts and shell events (also an umbrella in #4027 and #2383)
#381 automate a macOS test machine with snapshots and resets
#2120 copyright worries when agents read original source code
#2355 read Windows minidumps without a live target (PR #3770 open)
#2689 Windows ETW events for a chosen process
#3115 allow TShark packet inspection on Windows (our sort)
#5033 Read-only Android view hierarchy capture over adb (our sort)
#5360 Wake or classify discarded CDP page targets so restored sessions stay inspectable (our sort)
#6168 Declared permission grants and synthetic camera/microphone for capture_browser_scenario (our sort)
#8078 Accept mitmproxy 12.3.x in the native mitmproxy capture adapter (PR #8088 open) (our sort)
#8207 Flag custom credential headers in network capture inspection, and export a HAR from browser scenarios (our sort)
#8422 Inventory browser Cache Storage entries as read-only web Evidence (our sort)
#8423 Capture WebAuthn/passkey ceremony metadata without retaining credential secrets (our sort)
#8473 iOS device acquisition lane mirroring the ADB suite (BYO libimobiledevice) (our sort)
#8701 Capture WebRTC peer-connection and data-channel metadata as read-only Evidence (our sort)

area: providers (24)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#1551 add Binary Ninja as an analysis backend
#2147 existing-project launch path: wiring, docs and real tests
#2300 show one function's pseudocode from several decompilers
#2363 agent guidance for custom archives with QuickBMS
#2688 trace Linux userspace functions with eBPF
#2809 bring-your-own Dart and Flutter provider: scope check
#3289 support iOS applications (our sort)
#3489 report Android method access flags (PR #3585 open) (our sort)
#3569 analyze MQL5 (.ex5) bytecode (our sort)
#4313 Mark encrypted Mach-O ranges as unexamined in provider analysis results
#4437 Resolve class-instance method calls in JavaScript semantic call graphs (PR #4675 open)
#4487 Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE (PR #4811 open)
#4489 Harmony graph: use pkgContextInfo.json isSO declarations for N-API candidates, and report inventoried entries outside every component category
#4842 Admit SPARC V9 ELF objects (EM_SPARCV9, 43) through the header-driven Ghidra lane (PR #4843 open)
#4987 Let analyze-javascript-application select sources by folder or glob (PR #5048 open) (our sort)
#5185 Feature Request: Support Analysis of MQL5 .ex5 Expert Advisors Loaded by terminal64.exe (our sort)
#5300 Model webContents.ipc and the non-BrowserWindow window constructors in Electron static analysis (our sort)
#6191 Resolve this property accesses in constructors, prototype methods and class methods (our sort)
#6192 Model objects assigned to properties after declaration (PR #6972 open) (our sort)
#7142 Unicorn-backed function-level emulation provider (building block for #4972) (our sort)
#7740 Keep literal call arguments on call sites, such as the name in client.rpc("name") (our sort)
#8139 Consider IDASQL as an additional IDA backend (our sort)
#8402 [Design] Connect unbound tool recovery to provider selection reasons (our sort)
#8565 [Design] Guide recovery from unsupported provider operations (our sort)

area: build (12)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#25 test Hopper results across many binaries (roadmap: Process capture)
#55 stronger Hopper checks on source-built test files (roadmap: Process capture)
#287 define a trusted Windows native add-on and how it ships (roadmap: Windows safety)
#740 plan clear investigation ownership and modular add-ons (roadmap: MCP speed, internals)
#2190 audit test selection, caching and report gaps in CI
#2255 ship releases with bundled open-source tools and MCP setups
#3372 a documented Docker image for the MCP server and CLI (our sort)
#4099 Make the Windows native artifact build bit-for-bit reproducible
#6480 Track supply-chain audit follow-up: runtime, dependency and release hardening (our sort)
#6708 Require dependency security evidence for source and fresh release consumers (PR #6728 open) (our sort)
#8274 [Design] Make real Ghidra and Kuna workflow regressions a visible CI gate (our sort)
#8505 [Design] Detect publisher package drift across Hopper release formats (our sort)

area: setup (16)

#323 show Windows cleanup ownership in doctor and the capability list
#329 show private-folder support in doctor and the capability list
#1316 install without a package manager
#2187 let setup register Claude Code for one project (PR #2414 open)
#2490 support CodeBuddy in setup (PR #2492 open)
#3008 doctor checks only 2 providers while 170 tools are listed
#3016 save provider settings in a REA config file (PR #3023 open)
#3374 doctor check for the JADX provider (our sort)
#4311 Report macOS permission and Xcode tool readiness before native operations fail
#4426 Support FutureOS as a setup client (PR #4427 open)
#5485 Generate a redacted diagnostic report for support requests (our sort)
#6914 Clarify rea doctor health when optional components are unconfigured (our sort)
#7181 Discover project-scoped MCP registrations in doctor and uninstall (pi, OpenCode) (PR #7283 open) (our sort)
#7224 Gemini Desktop (our sort)
#8500 Explain skipped Hopper setup and verify container recovery on Bazzite (our sort)
#8504 Discover compatible versioned Homebrew JDKs for Ghidra (our sort)

area: mcp (9)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

#723 cut repeated text in MCP tool lists and results
#2729 add the PPEE MCP server as a light PE and .NET provider
#3005 an MCP path to the ledger "verified" step
#3446 an MCP activity dashboard (our sort)
#4248 Add a provider-neutral MCP prompt for static vulnerability review of native binaries (PR #4283 closed)
#4276 [Design] Define recovery for raw partial observations after MCP cancellation
#4718 Supported extension point for companion skills without modifying REA's SKILL.md
#5476 Support authenticated access for non-loopback MCP HTTP deployments (our sort)
#8316 [Design] Isolate invalid Ghidra project configuration from unrelated MCP tools (our sort)

area: cli (6)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#64 add Electron shell and IPC hooks (roadmap: Browser and web) (also an umbrella in #4027 and #2383)
#1932 run the agent test on Claude Code and Gemini CLI too (PR #1971 open)
#2132 an interactive terminal mode for REA
#2385 support Kiro-cli (PR #4618 open)
#2443 let the source import CLI skip chosen paths (PR #2630 open) (PR #5472 open)
#8321 [Design] Make static call-path investigation available to CLI users (our sort)

area: bridge (5)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#31 give analyze_function a full, honest report (roadmap: Process capture)
#54 give Hopper function reports real references and flow edges (likely same as #31) (roadmap: Process capture)
#968 live native hooks through a Frida adapter (roadmap: Runtime and debugging)
#4447 Link Android UniFFI/JNA bindings to their native exports (Rust libraries have no Java_* symbols)
#7244 Project expected JNI/JNA symbol names and structural attack-surface facts from Android declarations (PR #7245 open) (our sort)

area: server (1)

#59 capture process trees and the file changes they make (roadmap: Process capture)

New file formats wishlist (98)

One person filed this whole wishlist. None of it has an area label, so we grouped it by family. Each line names the format or platform asked for.

games (24)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

#3607 Unity (IL2CPP, Mono, assets)
#3625 Unreal Engine (Pak, UAsset, Blueprint)
#3631 Godot
#3632 GameMaker
#3648 Ren'Py
#3649 Clickteam Fusion
#3683 visual-novel engines
#3692 Roblox and Luau
#3700 multiplayer resource packages (fxmanifest)
#3701 RPF archives (RPF7, RPF8)
#3702 Anvil world containers and NBT
#3703 mobile world containers (.mcworld, .mcpack)
#3704 MPQ and CASC storage
#3705 VPK archives and BSP maps
#3706 ESM and ESP plugins, BSA and BA2 archives
#3707 GRF archives and sprites
#3708 2D tile-grid MMO assets (OTB, OTBM)
#3709 KPKA containers and RSZ
#3710 CAT and CAS containers, EBX
#3711 CR2W and RED4 containers
#3712 HKX packfiles
#3713 XNB content pipeline
#4794 Add basic SNES ROM support via Ghidra raw binary loading (65C816) (PR #4911 open)
#8665 IL2CPP binary_path: Unity WebGL wasm32 CodeGenModule → function index (our sort)

ML (20)

#3637 ML model graphs (ONNX, TFLite, CoreML)
#3651 LLM apps (prompts, routing, tools)
#3652 PyTorch checkpoints
#3653 LLM tokenizers
#3665 LoRA and PEFT adapters
#3666 quantized LLMs (GPTQ, AWQ, GGUF)
#3667 RAG and vector stores
#3668 local LLM runtimes (llama.cpp, Ollama)
#3669 model lineage and diffs
#3672 AI agent protocols (MCP, A2A)
#3673 ML compiler IR (MLIR, StableHLO)
#3675 diffusion models
#3679 LLM prompt packages
#3680 LLM inference traces
#3681 embedding models
#3682 AI model packages (Hugging Face)
#3721 A2A protocol
#3722 on-device AI runtimes
#4867 Add support llama.cpp (PR #4878 open)
#8097 Inspect ONNX Runtime .ort models (ORTM FlatBuffers) in inspect_model_artifact (PR #8255 open) (our sort)

blockchain (16)

#3730 Bitcoin
#3731 Move VM
#3732 Starknet
#3733 ERC-4337 account abstraction
#3734 EVM deployment lineage
#3737 wallets and dApps
#3738 Polkadot and Substrate
#3739 CosmWasm and IBC
#3740 zero-knowledge circuits
#3741 zkVM guest images
#3743 OP Stack
#3744 Arbitrum Nitro
#3745 cross-chain bridges
#3746 TON and TVM
#3747 Solana transactions
#3748 Foundry and Hardhat projects

firmware/embedded (8)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#3615 embedded hardware (ESP32 flash, NVS)
#3640 CODESYS and PLC logic
#3641 USB protocol
#3644 Bluetooth LE
#3646 FPGA bitstreams
#3725 software-defined vehicles (AUTOSAR, SOME/IP)
#3726 Matter and Thread
#4245 Propose CPU architecture and endianness candidates for headerless firmware blobs

web/JS (4)

Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have.

#3614 Adobe Flash (SWF)
#3684 WebView2
#3687 VS Code extensions
#3691 Chromium LevelDB

managed (8)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#3616 Silverlight (XAP)
#3676 GraalVM Native Image
#3694 .NET MAUI and Xamarin
#3829 Expose .NET FieldRVA mappings and statically sized initializer bytes
#4627 add support for VB3 (visual basic)
#8144 Inspect NuGet .nupkg packages and dependency metadata as read-only Evidence (our sort)
#8206 Support Python 3.14 and 3.15 bytecode in inspect_python_pyc (PR #8707 open) (our sort)
#8543 Format-native inspector for V8 code cache (.jsc / bytenode artifacts) (our sort)

archives/containers (3)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#3688 Inno Setup
#3689 NSIS
#3693 InstallShield

mobile (3)

#3612 Symbian apps
#4194 [Scope] SSL unpinning support for Android TLS analysis (HTTP Toolkit/Frida composition)
#8121 Read WeChat mini-program wxapkg containers (our sort)

other (12)

The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have.

#3609 video
#3611 music and sound effects
#3620 shader and GPU bytecode
#3626 Windows kernel drivers
#3630 Qt and QML
#3674 CUDA (PTX, SASS)
#3677 LLVM bitcode and LTO
#3695 AutoIt and AutoHotkey
#3723 confidential computing (TDX, SEV-SNP)
#3724 post-quantum cryptography
#3790 IBM BOB and/or IBM Shell
#4662 by pass Oreans WinLicense / SecureEngine. / Themida

new, unsorted (2)

#4461 为 REA 增加中文名「逆天」
#6013 [Design] Upstream issue

How it's built

I checked the state of every request live on 2026-10-14. All 303 were open, so none were dropped. Areas come from the area label. Where a request has several area labels, it is listed once. The "(PR #N open)" tags come from the close list of an open pull request. I judged those from titles only, so they are unverified. 23 requests carry a PR tag. Two of the pull requests cover only part of the ask: #3153 by #3404 and #3413 by #3775. Three of the pull requests are drafts: #3404, #3770 and #3775. The "(likely same as)" tags come from titles and a few bodies. Roadmap tags come from the roadmap label. Five of them show no theme. They are not in discussion #2039.

If something's wrong

Comment on this issue and name the line. I will fix the list.

Every open tracker in the repo, so you can get to any of them from here.

Bugs and duplicates

#3537: Open bugs, by subsystem (matbrgz)
#4330: Duplicate issues, in clusters (matbrgz)
#5653: New issues by area, pointing at #4330 for duplicates (CassieFox23)

Features and roadmap

#3796: Feature requests, by area (this one, CassieFox23)
#2383: Support for the top 100 languages (matbrgz)
#2357: Static file and crash report work (matbrgz)
#3714 to #3719: six RFC epics on formats and bytecode (matbrgz)
#4027: Browser, Electron and JS work (N0zoM1z0)
#32: The main roadmap (morluto)
#48: The Evidence v2 epic (morluto)
#2039: The roadmap in plain words, a discussion (CassieFox23)

Docs

#3795: Open docs issues and PRs (CassieFox23)

Pull requests

#3582: Ready to close or merge, issues and PRs (CassieFox23)
#5654: Open PRs with conflicts or red CI (CassieFox23)

Show and tell

#1435: Linux setup notes and test queue, a discussion (CassieFox23)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

Originally created by @CassieFox23 on GitHub (Oct 15, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3796 [![Type: Tracker](https://img.shields.io/badge/type-tracker-purple.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Active](https://img.shields.io/badge/status-active-brightgreen.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) **TL;DR:** This lists 415 open feature requests, grouped by area, oldest first. 63 more are tracked in #4027 and #2383, so they are not repeated here. It is a map of the queue, not a to-do list. There is no rush, and nothing here asks for speed. ### What's here Feature requests are spread over many issues. Some overlap. Some have no area label. That makes the queue hard to read. This tracker lists them in one place, by area. The list is built from what is open on GitHub. Last refreshed: 10:29 PM UTC on 2 November 2026. ### Open feature requests Each box below is an open feature request. Tick a box when it is done, closed, or answered. Nothing here asks for speed. Items marked (our sort) had no area label, so we picked an area from the title. The maintainers' labels win. A tag after a line means one of three things. (PR #N open) says an open pull request lists this request as closed by it. (likely same as #N) says two requests look like one ask. (roadmap: theme) uses a theme name from discussion #2039. I judged the PR tags from titles only, so they are unverified. <details> <summary>area: native (112)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #288 own Windows Ghidra process trees so they end with the parent (roadmap: Windows safety) (PR #5558 open) - [ ] #318 build the Windows native add-on package - [ ] #319 ship that package in releases and test it on real Windows - [ ] #325 lock down the native add-on before it loads - [ ] #327 create and read back locked-down runtime folders - [ ] #340 test Hopper cancel, timeout, edits and shutdown - [ ] #341 run function-report tests on real Hopper - [ ] #342 real-Hopper test of caller and callee chains - [ ] #343 real-Hopper test of flow successors and assembly - [ ] #344 real-Hopper test of a two-binary workflow - [ ] #487 better AArch64 jump-table recovery in Ghidra - [ ] #1193 analyze with a dSYM the caller picks, in Ghidra (PR #2025 open) - [ ] #1389 try rsleigh as a headless analysis provider - [ ] #1416 support the official IDA MCP server as a provider - [ ] #1641 add 6502 and 65816 analysis through Ghidra - [ ] #1741 add 32-bit big-endian PowerPC, then GameCube and Wii files - [ ] #1745 confirm the 32-bit ARM lane and pin the ARM v7 language (PR #1922 open) - [ ] #2003 recover Solana sBPF program interfaces offline - [ ] #2258 a recommended list of open-source decompilers (PR #4773 open) - [ ] #2298 decompile WebAssembly functions into labeled pseudocode - [ ] #2338 admit plain MIPS32 shared libraries in Ghidra (PR #2362 open) - [ ] #2350 inspect WebAssembly components offline - [ ] #2369 inspect Linux BTF type data offline - [ ] #2408 open 16-bit Windows (NE) files in Ghidra - [ ] #2410 accept SuperH PE files (Windows CE) in Ghidra - [ ] #2417 a rule for picking an engine when Ghidra, Hopper and IDA are all there - [ ] #2711 add Radare2 (PR #3521 open) - [ ] #2734 Ghidra MIPS lane rejects mips1 and mips32 - [ ] #2735 Structured decompiler-completeness signal in function dossiers (+ optional instruction fallback for dropped blocks) (PR #4237 open) - [ ] #3019 add Rizin as a native analysis provider - [ ] #3083 let users turn on Ghidra analyzers (our sort) - [ ] #3118 Xbox 360 files: big-endian PowerPC PE and XEX2 (our sort) - [ ] #3155 admit old MIPS32 ELF files with a bad section table (PR #4532 open) (our sort) - [ ] #3282 import one slice of a universal Mach-O in Ghidra (our sort) - [ ] #3483 Xtensa ELF lane (ESP32) through Ghidra (our sort) - [ ] #3532 raw SuperH-4 binaries in Ghidra (our sort) - [ ] #3716 epic: common bytecode and VM framework (our sort) - [ ] #4247 trace several goals in one trace_call_path run and report the roots (PR #4417 open) (our sort) - [ ] #4307 Inspect the dyld shared cache and resolve system library loads - [ ] #5038 IDA provider: declare read_bytes with faithful loaded-byte semantics (our sort) - [ ] #5339 Change how an address is listed in a Ghidra session: code, function, data, string, or undefined (our sort) - [ ] #5344 Resolve Objective-C `__cfstring` literals to the code that uses them (our sort) - [ ] #5400 Avoid repeated Ghidra startup logs in input-error replies (our sort) - [ ] #5523 `inspect_native_api`: report whether a function is variadic (PR #5545 open) (our sort) - [ ] #5709 Nintendo 3DS static analysis through Ghidra and a reusable verification workflow (our sort) - [ ] #5744 Analyze Thumb-only Cortex-M firmware in the raw-binary lane instead of refusing its entry point and decoding it as ARM state (our sort) - [ ] #5820 Provider-neutral V-CPU interpreter structure analysis (our sort) - [ ] #6328 C28x/C2000 support (our sort) - [ ] #6404 Ghidra: admit comment / inline_comment / set_comment / set_inline_comment at any mapped address (our sort) - [ ] #6405 Ghidra: export analyst names and comments from a session and re-apply them when the target is reopened (our sort) - [ ] #6746 Ghidra profile for PS2 Emotion Engine (R5900) executables (our sort) - [ ] #7189 Static library-function identification (FLIRT-like) for native targets (our sort) - [ ] #7265 Accept original Xbox XBE executables and route them to provider loaders (our sort) - [ ] #7381 Ghidra provider: support universal (fat) Mach-O by selecting a slice instead of refusing (our sort) - [ ] #7993 add MIPS support (our sort) - [ ] #8165 [Design] Preserve and reopen owned Ghidra analysis with a packed-program checkpoint (our sort) - [ ] #8166 [Design] Allow analyst assertions in Kuna decompilation with explicit provenance (our sort) - [ ] #8167 Recover individual Kuna decompiles that fail in a completed project export (our sort) - [ ] #8170 Investigate verified byte reads for Kuna-backed investigations (our sort) - [ ] #8173 [Design] Use independent symbol evidence to match functions when a provider omits origins (our sort) - [ ] #8175 [Design] Consider Kuna support for caller-described raw binaries (our sort) - [ ] #8176 [Design] Report verified Kuna export progress when supported (our sort) - [ ] #8177 [Design] Investigate Kuna decompilation inside a Ghidra analysis session (our sort) - [ ] #8178 [Design] Disambiguate analysis addresses from file offsets in decompilation (our sort) - [ ] #8181 [Design] Distinguish a missing batch decompilation selection from an empty batch (our sort) - [ ] #8183 [Design] Recover function references when the provider lacks a general name inventory (our sort) - [ ] #8184 [Design] Make feature-trace reference coverage explicit for agents (our sort) - [ ] #8185 [Design] Make native metadata recovery discoverable when class-label inventory is unavailable (our sort) - [ ] #8186 [Design] Make decoded Swift declarations discoverable when procedure categories are unknown (our sort) - [ ] #8190 [Design] Investigate partial outgoing data-reference evidence for Kuna functions (our sort) - [ ] #8192 [Design] Analyze analyst-selected function entries absent from provider inventories (our sort) - [ ] #8193 [Design] Analyze an explicitly selected universal Mach-O slice with Kuna (our sort) - [ ] #8194 [Design] Investigate evidence-backed algorithm-constant discovery and references (our sort) - [ ] #8195 [Design] Evaluate a bounded RISC-V ELF investigation lane for Kuna (our sort) - [ ] #8197 [Design] Trace UI actions through separately evidenced tail transfers and thunks (our sort) - [ ] #8200 [Design] Preserve call-site and indirect-call context in call-path workflows (our sort) - [ ] #8208 [Design] Make missing-function recovery aware of selected Ghidra projects (our sort) - [ ] #8209 [Design] Export a bounded explicit or graph-derived set of native functions (our sort) - [ ] #8210 [Design] Clarify ARM-state raw entry errors when Thumb may be intended (our sort) - [ ] #8212 [Design] Define Kuna cache publication when a session is cancelled (our sort) - [ ] #8218 [Design] Find short or encoded markers outside provider string inventories (our sort) - [ ] #8219 [Design] Link native API boundary types to inspectable type identities (our sort) - [ ] #8232 [Design] Compare selected Ghidra project memory with bounded original bytes (our sort) - [ ] #8236 [Design] Allow caller-bounded native call graph investigation (our sort) - [ ] #8239 [Design] Explain individual failures in compact batch naming (our sort) - [ ] #8240 [Design] Find the defined data object containing an address (our sort) - [ ] #8241 [Design] Resolve a byte-search hit to its containing instruction (our sort) - [ ] #8245 [Design] Expose loaded and metadata provenance for string matches (our sort) - [ ] #8260 [Design] Preserve per-function producer provenance across decompile export resume (our sort) - [ ] #8314 [Design] Preserve local-variable source and identity in Ghidra function observations (our sort) - [ ] #8319 [Design] Define Kuna cache identity for caller-configured launchers (our sort) - [ ] #8328 [Design] Recover procedure lookup using independent export evidence (our sort) - [ ] #8333 [Design] Preserve IFUNC resolver semantics when investigating exported APIs (our sort) - [ ] #8336 [Design] Clarify or represent direct memory varnodes in native value-flow effects (our sort) - [ ] #8344 [Design] Discover candidates before selecting an existing Ghidra program (our sort) - [ ] #8348 [Design] Make incoming reference evidence actionable with Kuna (our sort) - [ ] #8360 [Design] Investigate explicit non-mutating decode of an alternate instruction stream (our sort) - [ ] #8365 [Design] Clarify live metadata across Ghidra byte-search pages (our sort) - [ ] #8372 [Design] Correlate native addresses across provider coordinate contexts (our sort) - [ ] #8373 [Design] Bound delivery of large native feature traces and their unknowns (our sort) - [ ] #8405 [Design] Report omitted caller targets in the real Kuna verifier (PR #8406 open) (our sort) - [ ] #8408 [Design] Connect indirect call investigations to Mach-O slot bindings (our sort) - [ ] #8459 [Design] Recognize repeated Kuna observations without discarding graph provenance (our sort) - [ ] #8460 [Design] Distinguish function correspondence from analysis metadata changes (our sort) - [ ] #8471 [Design] Distinguish local value flow from call-resolution availability (our sort) - [ ] #8472 Gadget search over analyzed instruction inventories (ROPgadget-shaped, evidence-carrying) (our sort) - [ ] #8556 [Design] Preserve byte-observation limitations in function matching (our sort) - [ ] #8560 [Design] Bound Ghidra byte-read allocation before response construction (our sort) - [ ] #8563 Investigate byte signatures across adjacent Ghidra blocks (our sort) - [ ] #8569 [Design] Find references to a selected data range (our sort) - [ ] #8587 [Design] Page retained native procedure-reference observations (our sort) - [ ] #8696 [Design] Inspect explicitly selected code outside provider inventory (our sort) </details> <details> <summary>area: domain (35)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #32 the top roadmap: agents run the investigation, REA gives proof (roadmap: The roadmap itself) - [ ] #39 add browser and web app reverse engineering (roadmap: Browser and web) (also an umbrella in #4027) - [ ] #48 epic: Evidence v2 and exact process capture (roadmap: Process capture) - [ ] #321 check Job Object members and limits - [ ] #324 build safe Windows file access - [ ] #724 explain content, exit and timing gaps when comparing processes - [ ] #774 plan website reverse engineering with network evidence (roadmap: Browser and web) (also an umbrella in #4027) - [ ] #1244 flag instructions that clash with guessed function types (PR #8161 open) - [ ] #1246 inspect data-region accesses and overlapping fields - [ ] #1269 make an official Codex plugin - [ ] #1947 compare functions with addresses normalized in the text (PR #6970 open) - [ ] #2017 resolve wildcard keys in package exports and imports (PR #2018 open) - [ ] #2071 add CAN bus support - [ ] #2146 help agents recover from wrong argument names (PR #2148 open) (PR #8649 open) - [ ] #2411 investigate momd and mom files from iPhone - [ ] #2444 source-bound repository context for reconstruction briefs - [ ] #2782 dsh plugin hub: the REA plugin files are incomplete - [ ] #2812 decode version and string resources in PE files (PR #2887 open) - [ ] #3034 add OpenClaw (PR #3100 open) - [ ] #3133 measure qlog summaries and retained event views (roadmap) - [ ] #3135 pick bounded efficiency pilots for real artifacts (roadmap) - [ ] #3136 research whether reusing Ghidra databases helps (roadmap) - [ ] #3137 research demand and rules for outside domain modules (roadmap) - [ ] #3719 epic: format language and extension SDK (our sort) - [ ] #4230 [Design] Opt-in agent-evaluation scenario for instructions planted in target content - [ ] #4394 Persist target-keyed investigation notes across sessions - [ ] #4396 Require a failing negative control before a reconstruction verifier closes an obligation (PR #7178 open) - [ ] #4972 Add semantic-equivalence verification for reconstructed native code (our sort) - [ ] #5062 Ship REA as a Claude Code plugin (one-step MCP + skill install) (PR #5064 closed) (our sort) - [ ] #6919 Include existing static artifact routes in feature-investigation guidance (PR #6925 open) (our sort) - [ ] #7193 Investigation-loop construct for agent-driven deep dives (loop engineering) (our sort) - [ ] #7957 Look-up of similar endavours before commencing decomp (our sort) - [ ] #8289 [Design] Surface ephemeral annotation loss when switching analysis providers (our sort) - [ ] #8317 [Design] Make unverified Kuna release guidance discoverable to MCP callers (our sort) - [ ] #8370 [Design] Expose active provider command cleanup in session status (our sort) </details> <details> <summary>area: evidence (73)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #382 record the environment and check for contamination - [ ] #1142 Proposal: TraceBrief — evidence-gated Markdown reports from REA investigations - [ ] #2072 route NES (iNES) containers for 6502 ROMs - [ ] #3095 extract macOS DMG files (our sort) - [ ] #3153 list Windows Installer (MSI) contents read-only (PR #3404 open) (our sort) - [ ] #3154 decode .NET custom attribute arguments (our sort) - [ ] #3413 identify packers and extract UPX (PR #3775 open) (our sort) - [ ] #3431 model node:fs writes and child processes as effects (our sort) (the child-process slice is in #4027) - [ ] #3490 pick where extract_artifact writes, and extract a subset (PR #4031 open) (our sort) - [ ] #3494 inspect RSLogix 500 .RSS files (our sort) - [ ] #3570 keep file identity when inspect-artifact declines a format (our sort) - [ ] #3571 list JIMAGE runtime containers (our sort) - [ ] #3592 report request header and cookie names without values (our sort) (Part A is in #4027) - [ ] #3594 decrypt TLS in packet captures with a key log (our sort) - [ ] #3599 passive DNS extraction and security primitives (our sort) - [ ] #3621 infer unknown binary file formats (our sort) - [ ] #3636 rebuild Windows XAML UIs (BAML, XBF) (our sort) - [ ] #3714 epic: universal artifact discovery (our sort) - [ ] #3715 epic: recursive artifact graph (our sort) - [ ] #3717 epic: universal protocol inference (our sort) - [ ] #3718 epic: link static code to runtime traces and UI events (our sort) - [ ] #3766 read Procmon XML and CSV exports as capture evidence (PR #3967 open) (our sort) - [ ] #3771 better decompiling of Java 8 and obfuscated JARs (our sort) - [ ] #4091 [Design] Defer code mode and prioritize composable browser/Electron/JavaScript evidence - [ ] #4135 Cluster artifacts from retained Evidence references and summaries (PR #4133 open) (PR #4589 open) - [ ] #4297 Inspect Apple .ips crash reports as recorded-crash Evidence - [ ] #4298 Report CodeDirectory posture and the full requirement set in inspect_signature - [ ] #4299 Decode embedded launch and library constraints in inspect_signature - [ ] #4300 Decode embedded provisioning profiles and compare them with signed entitlements - [ ] #4301 Explain entitlements and derive static instrumentation constraints in inspect_signature - [ ] #4302 Interpret Info.plist entry points and capabilities per bundle - [ ] #4303 Map launchd, XPC, privileged-helper, login-item and system-extension relationships - [ ] #4304 Inspect privacy manifests and cross-check required-reason API imports per bundle - [ ] #4305 Report stapled notarization tickets and quarantine attributes without contacting Apple - [ ] #4308 Read unified log archives and correlate entries with os_log call sites - [ ] #4309 Inventory .lproj localizations and decode string tables per bundle - [ ] #4310 Open nested Apple bundle directories (appex, framework, xpc, plug-in) as targets - [ ] #4312 Report Mach-O placements that violate Apple's documented bundle layout rules - [ ] #4395 Generate unique masked byte signatures and relocate them in another build - [ ] #4398 Audit an exported Evidence bundle for secrets, local paths, and target content before sharing (PR #4482 open) - [ ] #4538 Inspect Android DEX debug metadata (lines, locals, parameter names) (PR #4473 open) - [ ] #4539 Triage PE imports: ATT&CK-tagged capabilities and a pefile-identical imphash - [ ] #5150 Expose Constant-table default values for literal fields and parameters in inspect_managed_members (our sort) - [ ] #5489 Add a dry-run plan for artifact extraction (PR #7177 open) (our sort) - [ ] #5490 Add manifest-driven batch mode for independent offline artifact inspections (our sort) - [ ] #6211 [Design] Add read-only PostgreSQL inspection (our sort) - [ ] #6332 Export supported analysis findings as SARIF 2.1.0 (PR #8572 open) (our sort) - [ ] #6333 Add auditable suppression rules for reviewed analysis findings (our sort) - [ ] #6334 Add opt-in redaction profiles for shareable analysis reports (our sort) - [ ] #6336 Define stable identities for correlating compatible findings across runs (our sort) - [ ] #6337 Add a verifiable manifest for exported analysis bundles (PR #8570 open) (our sort) - [ ] #6338 Add a focused comparison report for two compatible analysis runs (PR #8571 open) (our sort) - [ ] #6408 Inspect MFC CRuntimeClass metadata in PE binaries and link each serializable class to its Serialize(CArchive&) function (our sort) - [ ] #7038 Read Hermes bytecode bundles: header, integrity, function and string tables (our sort) - [ ] #7235 Decode FDO packaging and dlopen metadata in inspect-elf-notes (PR #7237 open) (our sort) - [ ] #7461 Evidence-backed firmware update comparison with component-level change attribution (our sort) - [ ] #7742 recover_javascript_sources on Windows x64 (our sort) - [ ] #7873 Import saved Playwright `trace.zip` recordings as offline Evidence (our sort) - [ ] #7874 Inspect Python wheel distributions as structured, read-only Evidence (our sort) - [ ] #8143 Import Linux `perf.data` recordings as read-only profiling Evidence (our sort) - [ ] #8215 [Design] Surface relevant analysis-profile differences in function comparisons (our sort) - [ ] #8234 Deterministic row paging for inspect_sqlite_database selected tables (our sort) - [ ] #8243 [Design] Reuse the refreshed annotation dossier as a function observation (our sort) - [ ] #8288 [Design] Preserve feature-trace evidence when reference ownership is unavailable (our sort) - [ ] #8292 Consider moving from `binwalk` to `binwalk-ng` (our sort) - [ ] #8364 [Design] Preserve contributing evidence for address-context handoffs (our sort) - [ ] #8375 [Design] Make Unknown history direction explicit in bundle comparisons (our sort) - [ ] #8393 [Design] Compare function observations within one selected Ghidra project (our sort) - [ ] #8427 [Design] Recover inline unretained Evidence into a new investigation (our sort) - [ ] #8448 [Design] Clarify CLI Evidence import versus MCP session retention (our sort) - [ ] #8452 [Design] Clarify authority of native matching Evidence views (our sort) - [ ] #8655 [Design] Recover historical Evidence from an incompatible analysis snapshot (our sort) - [ ] #8702 Reconstruct GraphQL schemas and operation contracts from retained artifacts (our sort) </details> <details> <summary>area: runtime (22)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #289 safe Windows file access that links cannot fool (roadmap: Windows safety) - [ ] #290 private Windows runtime folders with locked permissions (roadmap: Windows safety) - [ ] #320 create Windows Job Objects and assign processes safely - [ ] #322 real-Windows test that child processes get cleaned up - [ ] #326 handle-based reads and writes, tested on real NTFS - [ ] #328 real-Windows test of private folder permissions - [ ] #333 add event-backed process-tree capture to Process Capture v4 - [ ] #375 capture Electron process starts and shell events (also an umbrella in #4027 and #2383) - [ ] #381 automate a macOS test machine with snapshots and resets - [ ] #2120 copyright worries when agents read original source code - [ ] #2355 read Windows minidumps without a live target (PR #3770 open) - [ ] #2689 Windows ETW events for a chosen process - [ ] #3115 allow TShark packet inspection on Windows (our sort) - [ ] #5033 Read-only Android view hierarchy capture over adb (our sort) - [ ] #5360 Wake or classify discarded CDP page targets so restored sessions stay inspectable (our sort) - [ ] #6168 Declared permission grants and synthetic camera/microphone for capture_browser_scenario (our sort) - [ ] #8078 Accept mitmproxy 12.3.x in the native mitmproxy capture adapter (PR #8088 open) (our sort) - [ ] #8207 Flag custom credential headers in network capture inspection, and export a HAR from browser scenarios (our sort) - [ ] #8422 Inventory browser Cache Storage entries as read-only web Evidence (our sort) - [ ] #8423 Capture WebAuthn/passkey ceremony metadata without retaining credential secrets (our sort) - [ ] #8473 iOS device acquisition lane mirroring the ADB suite (BYO libimobiledevice) (our sort) - [ ] #8701 Capture WebRTC peer-connection and data-channel metadata as read-only Evidence (our sort) </details> <details> <summary>area: providers (24)</summary> The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #1551 add Binary Ninja as an analysis backend - [ ] #2147 existing-project launch path: wiring, docs and real tests - [ ] #2300 show one function's pseudocode from several decompilers - [ ] #2363 agent guidance for custom archives with QuickBMS - [ ] #2688 trace Linux userspace functions with eBPF - [ ] #2809 bring-your-own Dart and Flutter provider: scope check - [ ] #3289 support iOS applications (our sort) - [ ] #3489 report Android method access flags (PR #3585 open) (our sort) - [ ] #3569 analyze MQL5 (.ex5) bytecode (our sort) - [ ] #4313 Mark encrypted Mach-O ranges as unexamined in provider analysis results - [ ] #4437 Resolve class-instance method calls in JavaScript semantic call graphs (PR #4675 open) - [ ] #4487 Ghidra RISC-V lane: admit position-independent executables (ET_DYN); distro riscv64 binaries are almost all PIE (PR #4811 open) - [ ] #4489 Harmony graph: use `pkgContextInfo.json` `isSO` declarations for N-API candidates, and report inventoried entries outside every component category - [ ] #4842 Admit SPARC V9 ELF objects (EM_SPARCV9, 43) through the header-driven Ghidra lane (PR #4843 open) - [ ] #4987 Let analyze-javascript-application select sources by folder or glob (PR #5048 open) (our sort) - [ ] #5185 Feature Request: Support Analysis of MQL5 `.ex5` Expert Advisors Loaded by `terminal64.exe` (our sort) - [ ] #5300 Model webContents.ipc and the non-BrowserWindow window constructors in Electron static analysis (our sort) - [ ] #6191 Resolve this property accesses in constructors, prototype methods and class methods (our sort) - [ ] #6192 Model objects assigned to properties after declaration (PR #6972 open) (our sort) - [ ] #7142 Unicorn-backed function-level emulation provider (building block for #4972) (our sort) - [ ] #7740 Keep literal call arguments on call sites, such as the name in `client.rpc("name")` (our sort) - [ ] #8139 Consider IDASQL as an additional IDA backend (our sort) - [ ] #8402 [Design] Connect unbound tool recovery to provider selection reasons (our sort) - [ ] #8565 [Design] Guide recovery from unsupported provider operations (our sort) </details> <details> <summary>area: build (12)</summary> The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #25 test Hopper results across many binaries (roadmap: Process capture) - [ ] #55 stronger Hopper checks on source-built test files (roadmap: Process capture) - [ ] #287 define a trusted Windows native add-on and how it ships (roadmap: Windows safety) - [ ] #740 plan clear investigation ownership and modular add-ons (roadmap: MCP speed, internals) - [ ] #2190 audit test selection, caching and report gaps in CI - [ ] #2255 ship releases with bundled open-source tools and MCP setups - [ ] #3372 a documented Docker image for the MCP server and CLI (our sort) - [ ] #4099 Make the Windows native artifact build bit-for-bit reproducible - [ ] #6480 Track supply-chain audit follow-up: runtime, dependency and release hardening (our sort) - [ ] #6708 Require dependency security evidence for source and fresh release consumers (PR #6728 open) (our sort) - [ ] #8274 [Design] Make real Ghidra and Kuna workflow regressions a visible CI gate (our sort) - [ ] #8505 [Design] Detect publisher package drift across Hopper release formats (our sort) </details> <details> <summary>area: setup (16)</summary> - [ ] #323 show Windows cleanup ownership in doctor and the capability list - [ ] #329 show private-folder support in doctor and the capability list - [ ] #1316 install without a package manager - [ ] #2187 let setup register Claude Code for one project (PR #2414 open) - [ ] #2490 support CodeBuddy in setup (PR #2492 open) - [ ] #3008 doctor checks only 2 providers while 170 tools are listed - [ ] #3016 save provider settings in a REA config file (PR #3023 open) - [ ] #3374 doctor check for the JADX provider (our sort) - [ ] #4311 Report macOS permission and Xcode tool readiness before native operations fail - [ ] #4426 Support FutureOS as a setup client (PR #4427 open) - [ ] #5485 Generate a redacted diagnostic report for support requests (our sort) - [ ] #6914 Clarify rea doctor health when optional components are unconfigured (our sort) - [ ] #7181 Discover project-scoped MCP registrations in doctor and uninstall (pi, OpenCode) (PR #7283 open) (our sort) - [ ] #7224 Gemini Desktop (our sort) - [ ] #8500 Explain skipped Hopper setup and verify container recovery on Bazzite (our sort) - [ ] #8504 Discover compatible versioned Homebrew JDKs for Ghidra (our sort) </details> <details> <summary>area: mcp (9)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. - [ ] #723 cut repeated text in MCP tool lists and results - [ ] #2729 add the PPEE MCP server as a light PE and .NET provider - [ ] #3005 an MCP path to the ledger "verified" step - [ ] #3446 an MCP activity dashboard (our sort) - [ ] #4248 Add a provider-neutral MCP prompt for static vulnerability review of native binaries (PR #4283 closed) - [ ] #4276 [Design] Define recovery for raw partial observations after MCP cancellation - [ ] #4718 Supported extension point for companion skills without modifying REA's SKILL.md - [ ] #5476 Support authenticated access for non-loopback MCP HTTP deployments (our sort) - [ ] #8316 [Design] Isolate invalid Ghidra project configuration from unrelated MCP tools (our sort) </details> <details> <summary>area: cli (6)</summary> Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #64 add Electron shell and IPC hooks (roadmap: Browser and web) (also an umbrella in #4027 and #2383) - [ ] #1932 run the agent test on Claude Code and Gemini CLI too (PR #1971 open) - [ ] #2132 an interactive terminal mode for REA - [ ] #2385 support Kiro-cli (PR #4618 open) - [ ] #2443 let the source import CLI skip chosen paths (PR #2630 open) (PR #5472 open) - [ ] #8321 [Design] Make static call-path investigation available to CLI users (our sort) </details> <details> <summary>area: bridge (5)</summary> The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #31 give analyze_function a full, honest report (roadmap: Process capture) - [ ] #54 give Hopper function reports real references and flow edges (likely same as #31) (roadmap: Process capture) - [ ] #968 live native hooks through a Frida adapter (roadmap: Runtime and debugging) - [ ] #4447 Link Android UniFFI/JNA bindings to their native exports (Rust libraries have no `Java_*` symbols) - [ ] #7244 Project expected JNI/JNA symbol names and structural attack-surface facts from Android declarations (PR #7245 open) (our sort) </details> <details> <summary>area: server (1)</summary> - [ ] #59 capture process trees and the file changes they make (roadmap: Process capture) </details> <details> <summary>New file formats wishlist (98)</summary> One person filed this whole wishlist. None of it has an area label, so we grouped it by family. Each line names the format or platform asked for. **games (24)** Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. - [ ] #3607 Unity (IL2CPP, Mono, assets) - [ ] #3625 Unreal Engine (Pak, UAsset, Blueprint) - [ ] #3631 Godot - [ ] #3632 GameMaker - [ ] #3648 Ren'Py - [ ] #3649 Clickteam Fusion - [ ] #3683 visual-novel engines - [ ] #3692 Roblox and Luau - [ ] #3700 multiplayer resource packages (fxmanifest) - [ ] #3701 RPF archives (RPF7, RPF8) - [ ] #3702 Anvil world containers and NBT - [ ] #3703 mobile world containers (.mcworld, .mcpack) - [ ] #3704 MPQ and CASC storage - [ ] #3705 VPK archives and BSP maps - [ ] #3706 ESM and ESP plugins, BSA and BA2 archives - [ ] #3707 GRF archives and sprites - [ ] #3708 2D tile-grid MMO assets (OTB, OTBM) - [ ] #3709 KPKA containers and RSZ - [ ] #3710 CAT and CAS containers, EBX - [ ] #3711 CR2W and RED4 containers - [ ] #3712 HKX packfiles - [ ] #3713 XNB content pipeline - [ ] #4794 Add basic SNES ROM support via Ghidra raw binary loading (65C816) (PR #4911 open) - [ ] #8665 IL2CPP binary_path: Unity WebGL wasm32 CodeGenModule → function index (our sort) **ML (20)** - [ ] #3637 ML model graphs (ONNX, TFLite, CoreML) - [ ] #3651 LLM apps (prompts, routing, tools) - [ ] #3652 PyTorch checkpoints - [ ] #3653 LLM tokenizers - [ ] #3665 LoRA and PEFT adapters - [ ] #3666 quantized LLMs (GPTQ, AWQ, GGUF) - [ ] #3667 RAG and vector stores - [ ] #3668 local LLM runtimes (llama.cpp, Ollama) - [ ] #3669 model lineage and diffs - [ ] #3672 AI agent protocols (MCP, A2A) - [ ] #3673 ML compiler IR (MLIR, StableHLO) - [ ] #3675 diffusion models - [ ] #3679 LLM prompt packages - [ ] #3680 LLM inference traces - [ ] #3681 embedding models - [ ] #3682 AI model packages (Hugging Face) - [ ] #3721 A2A protocol - [ ] #3722 on-device AI runtimes - [ ] #4867 Add support llama.cpp (PR #4878 open) - [ ] #8097 Inspect ONNX Runtime .ort models (ORTM FlatBuffers) in inspect_model_artifact (PR #8255 open) (our sort) **blockchain (16)** - [ ] #3730 Bitcoin - [ ] #3731 Move VM - [ ] #3732 Starknet - [ ] #3733 ERC-4337 account abstraction - [ ] #3734 EVM deployment lineage - [ ] #3737 wallets and dApps - [ ] #3738 Polkadot and Substrate - [ ] #3739 CosmWasm and IBC - [ ] #3740 zero-knowledge circuits - [ ] #3741 zkVM guest images - [ ] #3743 OP Stack - [ ] #3744 Arbitrum Nitro - [ ] #3745 cross-chain bridges - [ ] #3746 TON and TVM - [ ] #3747 Solana transactions - [ ] #3748 Foundry and Hardhat projects **firmware/embedded (8)** The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #3615 embedded hardware (ESP32 flash, NVS) - [ ] #3640 CODESYS and PLC logic - [ ] #3641 USB protocol - [ ] #3644 Bluetooth LE - [ ] #3646 FPGA bitstreams - [ ] #3725 software-defined vehicles (AUTOSAR, SOME/IP) - [ ] #3726 Matter and Thread - [ ] #4245 Propose CPU architecture and endianness candidates for headerless firmware blobs **web/JS (4)** Browser, Electron and JavaScript work is tracked in #4027 by N0zoM1z0. This list keeps only what #4027 doesn't have. - [ ] #3614 Adobe Flash (SWF) - [ ] #3684 WebView2 - [ ] #3687 VS Code extensions - [ ] #3691 Chromium LevelDB **managed (8)** The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #3616 Silverlight (XAP) - [ ] #3676 GraalVM Native Image - [ ] #3694 .NET MAUI and Xamarin - [ ] #3829 Expose .NET FieldRVA mappings and statically sized initializer bytes - [ ] #4627 add support for VB3 (visual basic) - [ ] #8144 Inspect NuGet `.nupkg` packages and dependency metadata as read-only Evidence (our sort) - [ ] #8206 Support Python 3.14 and 3.15 bytecode in `inspect_python_pyc` (PR #8707 open) (our sort) - [ ] #8543 Format-native inspector for V8 code cache (.jsc / bytenode artifacts) (our sort) **archives/containers (3)** The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #3688 Inno Setup - [ ] #3689 NSIS - [ ] #3693 InstallShield **mobile (3)** - [ ] #3612 Symbian apps - [ ] #4194 [Scope] SSL unpinning support for Android TLS analysis (HTTP Toolkit/Frida composition) - [ ] #8121 Read WeChat mini-program wxapkg containers (our sort) **other (12)** The language audit is tracked in #2383 by matbrgz. This list keeps only what #2383 doesn't have. - [ ] #3609 video - [ ] #3611 music and sound effects - [ ] #3620 shader and GPU bytecode - [ ] #3626 Windows kernel drivers - [ ] #3630 Qt and QML - [ ] #3674 CUDA (PTX, SASS) - [ ] #3677 LLVM bitcode and LTO - [ ] #3695 AutoIt and AutoHotkey - [ ] #3723 confidential computing (TDX, SEV-SNP) - [ ] #3724 post-quantum cryptography - [ ] #3790 IBM BOB and/or IBM Shell - [ ] #4662 by pass Oreans WinLicense / SecureEngine. / Themida </details> <details> <summary>new, unsorted (2)</summary> - [ ] #4461 为 REA 增加中文名「逆天」 - [ ] #6013 [Design] Upstream issue </details> <details> <summary>How it's built</summary> I checked the state of every request live on 2026-10-14. All 303 were open, so none were dropped. Areas come from the area label. Where a request has several area labels, it is listed once. The "(PR #N open)" tags come from the close list of an open pull request. I judged those from titles only, so they are unverified. 23 requests carry a PR tag. Two of the pull requests cover only part of the ask: #3153 by #3404 and #3413 by #3775. Three of the pull requests are drafts: #3404, #3770 and #3775. The "(likely same as)" tags come from titles and a few bodies. Roadmap tags come from the roadmap label. Five of them show no theme. They are not in discussion #2039. </details> ### If something's wrong Comment on this issue and name the line. I will fix the list. ### Related trackers Every open tracker in the repo, so you can get to any of them from here. <details> <summary>Bugs and duplicates</summary> - #3537: Open bugs, by subsystem (matbrgz) - #4330: Duplicate issues, in clusters (matbrgz) - #5653: New issues by area, pointing at #4330 for duplicates (CassieFox23) </details> <details> <summary>Features and roadmap</summary> - #3796: Feature requests, by area (this one, CassieFox23) - #2383: Support for the top 100 languages (matbrgz) - #2357: Static file and crash report work (matbrgz) - #3714 to #3719: six RFC epics on formats and bytecode (matbrgz) - #4027: Browser, Electron and JS work (N0zoM1z0) - #32: The main roadmap (morluto) - #48: The Evidence v2 epic (morluto) - #2039: The roadmap in plain words, a discussion (CassieFox23) </details> <details> <summary>Docs</summary> - #3795: Open docs issues and PRs (CassieFox23) </details> <details> <summary>Pull requests</summary> - #3582: Ready to close or merge, issues and PRs (CassieFox23) - #5654: Open PRs with conflicts or red CI (CassieFox23) </details> <details> <summary>Show and tell</summary> - #1435: Linux setup notes and test queue, a discussion (CassieFox23) </details> 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:49 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 1 of 7: native. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

area: native (49)

#288 own Windows Ghidra process trees so they end with the parent (roadmap: Windows safety)
#318 build the Windows native add-on package
#319 ship that package in releases and test it on real Windows
#325 lock down the native add-on before it loads
#327 create and read back locked-down runtime folders
#340 test Hopper cancel, timeout, edits and shutdown
#341 run function-report tests on real Hopper
#342 real-Hopper test of caller and callee chains
#343 real-Hopper test of flow successors and assembly
#344 real-Hopper test of a two-binary workflow
#487 better AArch64 jump-table recovery in Ghidra
#1048 open a Ghidra project that was imported ahead of time
- PR #2150 is open for it.
#1193 analyze with a dSYM the caller picks, in Ghidra
- PR #2025 is open for it.
#1330 add PSP (Allegrex) analysis through Ghidra
#1389 try rsleigh as a headless analysis provider
#1416 support the official IDA MCP server as a provider
#1641 add 6502 and 65816 analysis through Ghidra
#1741 add 32-bit big-endian PowerPC, then GameCube and Wii files
- #3070 add PowerPC (a one-line request) (our sort) (likely the same ask)
#1745 confirm the 32-bit ARM lane and pin the ARM v7 language
- PR #1922 is open for it.
#1957 consider Kuna as another analysis tool
#2003 recover Solana sBPF program interfaces offline
#2186 allow bounded ARM and ARM64 Windows files in Ghidra
#2258 a recommended list of open-source decompilers
#2297 recover names and types from stripped Go binaries
#2298 decompile WebAssembly functions into labeled pseudocode
#2338 admit plain MIPS32 shared libraries in Ghidra
- PR #2362 is open for it.
#2350 inspect WebAssembly components offline
#2351 link Portable PDB sequence points to managed methods
- PR #2435 is open for it.
#2369 inspect Linux BTF type data offline
#2373 inspect Delphi MAP symbols with clear origin
#2382 keep LLDB source positions for observed native calls
#2408 open 16-bit Windows (NE) files in Ghidra
#2410 accept SuperH PE files (Windows CE) in Ghidra
#2417 a rule for picking an engine when Ghidra, Hopper and IDA are all there
#2711 add Radare2
- PR #3521 is open for it.
#2734 Ghidra MIPS lane rejects mips1 and mips32
#2811 recover Delphi class graphs and methods statically
#2915 derive API surfaces from mitmproxy flows
#3019 add Rizin as a native analysis provider
#3083 let users turn on Ghidra analyzers (our sort)
#3118 Xbox 360 files: big-endian PowerPC PE and XEX2 (our sort)
#3155 admit old MIPS32 ELF files with a bad section table (our sort)
#3282 import one slice of a universal Mach-O in Ghidra (our sort)
#3483 Xtensa ELF lane (ESP32) through Ghidra (our sort)
#3532 raw SuperH-4 binaries in Ghidra (our sort)
#3624 rebuild C++ classes: RTTI, vtables, virtual calls (our sort)
#3716 epic: common bytecode and VM framework (our sort)
#3736 decompile EVM to Solidity-like pseudocode (our sort)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 1 of 7: native.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### area: native (49) - [ ] #288 own Windows Ghidra process trees so they end with the parent (roadmap: Windows safety) - [ ] #318 build the Windows native add-on package - [ ] #319 ship that package in releases and test it on real Windows - [ ] #325 lock down the native add-on before it loads - [ ] #327 create and read back locked-down runtime folders - [ ] #340 test Hopper cancel, timeout, edits and shutdown - [ ] #341 run function-report tests on real Hopper - [ ] #342 real-Hopper test of caller and callee chains - [ ] #343 real-Hopper test of flow successors and assembly - [ ] #344 real-Hopper test of a two-binary workflow - [ ] #487 better AArch64 jump-table recovery in Ghidra - [ ] #1048 open a Ghidra project that was imported ahead of time - PR #2150 is open for it. - [ ] #1193 analyze with a dSYM the caller picks, in Ghidra - PR #2025 is open for it. - [ ] #1330 add PSP (Allegrex) analysis through Ghidra - [ ] #1389 try rsleigh as a headless analysis provider - [ ] #1416 support the official IDA MCP server as a provider - [ ] #1641 add 6502 and 65816 analysis through Ghidra - [ ] #1741 add 32-bit big-endian PowerPC, then GameCube and Wii files - [ ] #3070 add PowerPC (a one-line request) (our sort) (likely the same ask) - [ ] #1745 confirm the 32-bit ARM lane and pin the ARM v7 language - PR #1922 is open for it. - [ ] #1957 consider Kuna as another analysis tool - [ ] #2003 recover Solana sBPF program interfaces offline - [ ] #2186 allow bounded ARM and ARM64 Windows files in Ghidra - [ ] #2258 a recommended list of open-source decompilers - [ ] #2297 recover names and types from stripped Go binaries - [ ] #2298 decompile WebAssembly functions into labeled pseudocode - [ ] #2338 admit plain MIPS32 shared libraries in Ghidra - PR #2362 is open for it. - [ ] #2350 inspect WebAssembly components offline - [ ] #2351 link Portable PDB sequence points to managed methods - PR #2435 is open for it. - [ ] #2369 inspect Linux BTF type data offline - [ ] #2373 inspect Delphi MAP symbols with clear origin - [ ] #2382 keep LLDB source positions for observed native calls - [ ] #2408 open 16-bit Windows (NE) files in Ghidra - [ ] #2410 accept SuperH PE files (Windows CE) in Ghidra - [ ] #2417 a rule for picking an engine when Ghidra, Hopper and IDA are all there - [ ] #2711 add Radare2 - PR #3521 is open for it. - [ ] #2734 Ghidra MIPS lane rejects mips1 and mips32 - [ ] #2811 recover Delphi class graphs and methods statically - [ ] #2915 derive API surfaces from mitmproxy flows - [ ] #3019 add Rizin as a native analysis provider - [ ] #3083 let users turn on Ghidra analyzers (our sort) - [ ] #3118 Xbox 360 files: big-endian PowerPC PE and XEX2 (our sort) - [ ] #3155 admit old MIPS32 ELF files with a bad section table (our sort) - [ ] #3282 import one slice of a universal Mach-O in Ghidra (our sort) - [ ] #3483 Xtensa ELF lane (ESP32) through Ghidra (our sort) - [ ] #3532 raw SuperH-4 binaries in Ghidra (our sort) - [ ] #3624 rebuild C++ classes: RTTI, vtables, virtual calls (our sort) - [ ] #3716 epic: common bytecode and VM framework (our sort) - [ ] #3736 decompile EVM to Solidity-like pseudocode (our sort) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:49 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 2 of 7: domain. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

area: domain (42)

#32 the top roadmap: agents run the investigation, REA gives proof (roadmap: The roadmap itself)
#39 add browser and web app reverse engineering (roadmap: Browser and web)
#48 epic: Evidence v2 and exact process capture (roadmap: Process capture)
#321 check Job Object members and limits
#324 build safe Windows file access
#724 explain content, exit and timing gaps when comparing processes
#774 plan website reverse engineering with network evidence (roadmap: Browser and web)
#883 name which website workers own which sources
- PR #2068 is open for it.
#1244 flag instructions that clash with guessed function types
#1246 inspect data-region accesses and overlapping fields
#1269 make an official Codex plugin
#1431 HarmonyOS packages and Ark bytecode (roadmap: Mobile, new platforms)
#1558 add Java reverse engineering
#1947 compare functions with addresses normalized in the text
#1980 a design issue with only a bare title
#2017 resolve wildcard keys in package exports and imports
- PR #2018 is open for it.
#2071 add CAN bus support
#2146 help agents recover from wrong argument names
- PR #2148 is open for it.
#2296 decompile Python .pyc bytecode into labeled source guesses
#2352 list and extract ordinary .NET single-file bundles
- PR #3787 is open for it.
#2377 inspect JVM line and variable data for debugging
#2388 Solidity: read bytecode CBOR metadata without loss
#2389 Solidity: pick exact solc contract artifacts
- PR #3024 is open for it.
#2390 Solidity: map EVM byte positions to source
#2391 Solidity: decode ABI calls, logs and reverts
#2392 Solidity: inspect and compare storage layouts
#2395 Solidity: EVM disassembly with bounded control flow
#2396 Solidity: compare bytecode with explained compiler patches
#2411 investigate momd and mom files from iPhone
#2444 source-bound repository context for reconstruction briefs
#2743 an issue titled "rmagic" with an empty body
#2750 support WorkBuddy (asked in Chinese)
#2782 dsh plugin hub: the REA plugin files are incomplete
#2812 decode version and string resources in PE files
- PR #2887 is open for it.
#2825 recognize Delphi AnsiString text in string lists
#3034 add OpenClaw
- PR #3100 is open for it.
#3133 measure qlog summaries and retained event views (roadmap)
#3134 check paging of large retained investigations (roadmap)
#3135 pick bounded efficiency pilots for real artifacts (roadmap)
#3136 research whether reusing Ghidra databases helps (roadmap)
#3137 research demand and rules for outside domain modules (roadmap)
#3719 epic: format language and extension SDK (our sort)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 2 of 7: domain.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### area: domain (42) - [ ] #32 the top roadmap: agents run the investigation, REA gives proof (roadmap: The roadmap itself) - [ ] #39 add browser and web app reverse engineering (roadmap: Browser and web) - [ ] #48 epic: Evidence v2 and exact process capture (roadmap: Process capture) - [ ] #321 check Job Object members and limits - [ ] #324 build safe Windows file access - [ ] #724 explain content, exit and timing gaps when comparing processes - [ ] #774 plan website reverse engineering with network evidence (roadmap: Browser and web) - [ ] #883 name which website workers own which sources - PR #2068 is open for it. - [ ] #1244 flag instructions that clash with guessed function types - [ ] #1246 inspect data-region accesses and overlapping fields - [ ] #1269 make an official Codex plugin - [ ] #1431 HarmonyOS packages and Ark bytecode (roadmap: Mobile, new platforms) - [ ] #1558 add Java reverse engineering - [ ] #1947 compare functions with addresses normalized in the text - [ ] #1980 a design issue with only a bare title - [ ] #2017 resolve wildcard keys in package exports and imports - PR #2018 is open for it. - [ ] #2071 add CAN bus support - [ ] #2146 help agents recover from wrong argument names - PR #2148 is open for it. - [ ] #2296 decompile Python .pyc bytecode into labeled source guesses - [ ] #2352 list and extract ordinary .NET single-file bundles - PR #3787 is open for it. - [ ] #2377 inspect JVM line and variable data for debugging - [ ] #2388 Solidity: read bytecode CBOR metadata without loss - [ ] #2389 Solidity: pick exact solc contract artifacts - PR #3024 is open for it. - [ ] #2390 Solidity: map EVM byte positions to source - [ ] #2391 Solidity: decode ABI calls, logs and reverts - [ ] #2392 Solidity: inspect and compare storage layouts - [ ] #2395 Solidity: EVM disassembly with bounded control flow - [ ] #2396 Solidity: compare bytecode with explained compiler patches - [ ] #2411 investigate momd and mom files from iPhone - [ ] #2444 source-bound repository context for reconstruction briefs - [ ] #2743 an issue titled "rmagic" with an empty body - [ ] #2750 support WorkBuddy (asked in Chinese) - [ ] #2782 dsh plugin hub: the REA plugin files are incomplete - [ ] #2812 decode version and string resources in PE files - PR #2887 is open for it. - [ ] #2825 recognize Delphi AnsiString text in string lists - [ ] #3034 add OpenClaw - PR #3100 is open for it. - [ ] #3133 measure qlog summaries and retained event views (roadmap) - [ ] #3134 check paging of large retained investigations (roadmap) - [ ] #3135 pick bounded efficiency pilots for real artifacts (roadmap) - [ ] #3136 research whether reusing Ghidra databases helps (roadmap) - [ ] #3137 research demand and rules for outside domain modules (roadmap) - [ ] #3719 epic: format language and extension SDK (our sort) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:50 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 3 of 7: evidence. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

area: evidence (33)

#382 record the environment and check for contamination
#829 one URL policy for local files, live pages and source maps
#2072 route NES (iNES) containers for 6502 ROMs
#2393 Solidity: inspect proxy patterns offline
#2394 Solidity: inspect recorded EVM call traces
#3095 extract macOS DMG files (our sort)
#3153 list Windows Installer (MSI) contents read-only (our sort)
- PR #3404 is open for it.
#3154 decode .NET custom attribute arguments (our sort)
#3323 inspect GGUF and safetensors files without loading them (our sort)
#3413 identify packers and extract UPX (our sort)
- PR #3775 is open for it.
#3431 model node:fs writes and child processes as effects (our sort)
#3490 pick where extract_artifact writes, and extract a subset (our sort)
#3494 inspect RSLogix 500 .RSS files (our sort)
#3518 model the Cordova and Capacitor WebView bridge (our sort)
#3536 resolve Electron BrowserWindow options from constants (our sort)
#3539 show URL-shaped text passed to request wrappers (our sort)
#3570 keep file identity when inspect-artifact declines a format (our sort)
#3571 list JIMAGE runtime containers (our sort)
#3591 compare JavaScript endpoints with HAR API groups (our sort)
#3592 report request header and cookie names without values (our sort)
#3594 decrypt TLS in packet captures with a key log (our sort)
#3599 passive DNS extraction and security primitives (our sort)
#3608 React reconstruction and decompiler engine (RFC) (our sort)
#3621 infer unknown binary file formats (our sort)
#3633 inspect and extract Godot PCK files (our sort)
#3636 rebuild Windows XAML UIs (BAML, XBF) (our sort)
#3714 epic: universal artifact discovery (our sort)
#3715 epic: recursive artifact graph (our sort)
#3717 epic: universal protocol inference (our sort)
#3718 epic: link static code to runtime traces and UI events (our sort)
#3766 read Procmon XML and CSV exports as capture evidence (our sort)
#3771 better decompiling of Java 8 and obfuscated JARs (our sort)
#3784 read the Unity IL2CPP metadata file (first part of the Unity request) (our sort)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 3 of 7: evidence.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### area: evidence (33) - [ ] #382 record the environment and check for contamination - [ ] #829 one URL policy for local files, live pages and source maps - [ ] #2072 route NES (iNES) containers for 6502 ROMs - [ ] #2393 Solidity: inspect proxy patterns offline - [ ] #2394 Solidity: inspect recorded EVM call traces - [ ] #3095 extract macOS DMG files (our sort) - [ ] #3153 list Windows Installer (MSI) contents read-only (our sort) - PR #3404 is open for it. - [ ] #3154 decode .NET custom attribute arguments (our sort) - [ ] #3323 inspect GGUF and safetensors files without loading them (our sort) - [ ] #3413 identify packers and extract UPX (our sort) - PR #3775 is open for it. - [ ] #3431 model node:fs writes and child processes as effects (our sort) - [ ] #3490 pick where extract_artifact writes, and extract a subset (our sort) - [ ] #3494 inspect RSLogix 500 .RSS files (our sort) - [ ] #3518 model the Cordova and Capacitor WebView bridge (our sort) - [ ] #3536 resolve Electron BrowserWindow options from constants (our sort) - [ ] #3539 show URL-shaped text passed to request wrappers (our sort) - [ ] #3570 keep file identity when inspect-artifact declines a format (our sort) - [ ] #3571 list JIMAGE runtime containers (our sort) - [ ] #3591 compare JavaScript endpoints with HAR API groups (our sort) - [ ] #3592 report request header and cookie names without values (our sort) - [ ] #3594 decrypt TLS in packet captures with a key log (our sort) - [ ] #3599 passive DNS extraction and security primitives (our sort) - [ ] #3608 React reconstruction and decompiler engine (RFC) (our sort) - [ ] #3621 infer unknown binary file formats (our sort) - [ ] #3633 inspect and extract Godot PCK files (our sort) - [ ] #3636 rebuild Windows XAML UIs (BAML, XBF) (our sort) - [ ] #3714 epic: universal artifact discovery (our sort) - [ ] #3715 epic: recursive artifact graph (our sort) - [ ] #3717 epic: universal protocol inference (our sort) - [ ] #3718 epic: link static code to runtime traces and UI events (our sort) - [ ] #3766 read Procmon XML and CSV exports as capture evidence (our sort) - [ ] #3771 better decompiling of Java 8 and obfuscated JARs (our sort) - [ ] #3784 read the Unity IL2CPP metadata file (first part of the Unity request) (our sort) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:50 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 4 of 7: runtime. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

area: runtime (32)

#289 safe Windows file access that links cannot fool (roadmap: Windows safety)
#290 private Windows runtime folders with locked permissions (roadmap: Windows safety)
#320 create Windows Job Objects and assign processes safely
#322 real-Windows test that child processes get cleaned up
#326 handle-based reads and writes, tested on real NTFS
#328 real-Windows test of private folder permissions
#333 add event-backed process-tree capture to Process Capture v4
#375 capture Electron process starts and shell events
#381 automate a macOS test machine with snapshots and resets
#385 design bounded Objective-C runtime watching
- Likely the same ask as #71.
#1451 support droidasc for Android reverse engineering
#1813 Android split APK sets: record how the parts relate
#2120 copyright worries when agents read original source code
#2183 capture native window evidence tied to a target
- PR #2199 is open for it.
#2288 attach to Chromium browsers with no discovery endpoint
#2289 reuse a page element found in an earlier capture
#2355 read Windows minidumps without a live target
- PR #3770 is open for it.
#2370 inspect recorded EventPipe traces
#2372 Free Pascal source debugging with a GDB feature table
#2375 Delphi stopped-frame values, with no hidden property calls
#2376 watch chosen JVM debugger sessions through JDWP
#2378 attach to a chosen debuggable Android app
#2379 match Android Java, JNI and native debugger views
#2380 managed .NET debugger sessions with stable identity
#2381 inspect .NET dump stacks and heaps
#2483 macOS: every REA process rebuilds the ownership helper
#2689 Windows ETW events for a chosen process
#2857 derive API surfaces from Fiddler SAZ captures
#2914 compare API surfaces from old web captures
#3115 allow TShark packet inspection on Windows (our sort)
#3593 capture SSE and NDJSON stream shapes without values (our sort)
#3759 inspect an authorized browser iframe through CDP (our sort)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 4 of 7: runtime.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### area: runtime (32) - [ ] #289 safe Windows file access that links cannot fool (roadmap: Windows safety) - [ ] #290 private Windows runtime folders with locked permissions (roadmap: Windows safety) - [ ] #320 create Windows Job Objects and assign processes safely - [ ] #322 real-Windows test that child processes get cleaned up - [ ] #326 handle-based reads and writes, tested on real NTFS - [ ] #328 real-Windows test of private folder permissions - [ ] #333 add event-backed process-tree capture to Process Capture v4 - [ ] #375 capture Electron process starts and shell events - [ ] #381 automate a macOS test machine with snapshots and resets - [ ] #385 design bounded Objective-C runtime watching - Likely the same ask as #71. - [ ] #1451 support droidasc for Android reverse engineering - [ ] #1813 Android split APK sets: record how the parts relate - [ ] #2120 copyright worries when agents read original source code - [ ] #2183 capture native window evidence tied to a target - PR #2199 is open for it. - [ ] #2288 attach to Chromium browsers with no discovery endpoint - [ ] #2289 reuse a page element found in an earlier capture - [ ] #2355 read Windows minidumps without a live target - PR #3770 is open for it. - [ ] #2370 inspect recorded EventPipe traces - [ ] #2372 Free Pascal source debugging with a GDB feature table - [ ] #2375 Delphi stopped-frame values, with no hidden property calls - [ ] #2376 watch chosen JVM debugger sessions through JDWP - [ ] #2378 attach to a chosen debuggable Android app - [ ] #2379 match Android Java, JNI and native debugger views - [ ] #2380 managed .NET debugger sessions with stable identity - [ ] #2381 inspect .NET dump stacks and heaps - [ ] #2483 macOS: every REA process rebuilds the ownership helper - [ ] #2689 Windows ETW events for a chosen process - [ ] #2857 derive API surfaces from Fiddler SAZ captures - [ ] #2914 compare API surfaces from old web captures - [ ] #3115 allow TShark packet inspection on Windows (our sort) - [ ] #3593 capture SSE and NDJSON stream shapes without values (our sort) - [ ] #3759 inspect an authorized browser iframe through CDP (our sort) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:51 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 5 of 7: the smaller areas. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

area: providers (11)

#717 add Android APK tools: research and plan (roadmap: Mobile, new platforms)
#1551 add Binary Ninja as an analysis backend
#2147 existing-project launch path: wiring, docs and real tests
#2299 optional decompiled C# for chosen .NET members
#2300 show one function's pseudocode from several decompilers
#2363 agent guidance for custom archives with QuickBMS
#2688 trace Linux userspace functions with eBPF
#2809 bring-your-own Dart and Flutter provider: scope check
#3289 support iOS applications (our sort)
#3489 report Android method access flags (our sort)
- PR #3585 is open for it.
#3569 analyze MQL5 (.ex5) bytecode (our sort)

area: build (10)

#25 test Hopper results across many binaries (roadmap: Process capture)
#55 stronger Hopper checks on source-built test files (roadmap: Process capture)
#287 define a trusted Windows native add-on and how it ships (roadmap: Windows safety)
#740 plan clear investigation ownership and modular add-ons (roadmap: MCP speed, internals)
#2149 publish an npm release with dsh support
#2190 audit test selection, caching and report gaps in CI
#2255 ship releases with bundled open-source tools and MCP setups
#2810 decode Delphi form resources statically
#2908 compile the bridge Java sources as a CI check
- PR #3142 is open for it.
#3372 a documented Docker image for the MCP server and CLI (our sort)

area: setup (10)

#323 show Windows cleanup ownership in doctor and the capability list
#329 show private-folder support in doctor and the capability list
#1316 install without a package manager
#1791 support Kimi Code in setup
- PR #1804 is open for it.
#2187 let setup register Claude Code for one project
- PR #2414 is open for it.
#2490 support CodeBuddy in setup
- PR #2492 is open for it.
#3008 doctor checks only 2 providers while 170 tools are listed
#3016 save provider settings in a REA config file
- PR #3023 is open for it.
#3243 support FreeBuff in setup (our sort)
- PR #2736 is open for it.
#3374 doctor check for the JADX provider (our sort)

area: mcp (8)

#723 cut repeated text in MCP tool lists and results
#2512 an opt-in lighter tools list for small-frame clients
#2729 add the PPEE MCP server as a light PE and .NET provider
#2813 MCP input schemas nest too deep on 24 tools
- PR #2905 is open for it.
#2852 fix a Jadx schema type clash in the main compile
#3005 an MCP path to the ledger "verified" step
#3246 pick advertised MCP tools by family (our sort)
- PR #3026 is open for it.
#3446 an MCP activity dashboard (our sort)

area: cli (7)

#64 add Electron shell and IPC hooks (roadmap: Browser and web)
#71 add Objective-C runtime watching that asks first (roadmap: Runtime and debugging)
#1932 run the agent test on Claude Code and Gemini CLI too
- PR #1971 is open for it.
#2132 an interactive terminal mode for REA
#2385 support Kiro-cli
#2443 let the source import CLI skip chosen paths
- PR #2630 is open for it.
#2927 CLI batch mode: many tool calls in one session
- PR #3028 is open for it.

area: bridge (4)

#31 give analyze_function a full, honest report (roadmap: Process capture)
- #54 give Hopper function reports real references and flow edges (roadmap: Process capture) (likely the same ask)
#968 live native hooks through a Frida adapter (roadmap: Runtime and debugging)
#1267 live native debugging through x64dbg, GDB and LLDB (roadmap: Runtime and debugging)

area: server (1)

#59 capture process trees and the file changes they make (roadmap: Process capture)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 5 of 7: the smaller areas.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### area: providers (11) - [ ] #717 add Android APK tools: research and plan (roadmap: Mobile, new platforms) - [ ] #1551 add Binary Ninja as an analysis backend - [ ] #2147 existing-project launch path: wiring, docs and real tests - [ ] #2299 optional decompiled C# for chosen .NET members - [ ] #2300 show one function's pseudocode from several decompilers - [ ] #2363 agent guidance for custom archives with QuickBMS - [ ] #2688 trace Linux userspace functions with eBPF - [ ] #2809 bring-your-own Dart and Flutter provider: scope check - [ ] #3289 support iOS applications (our sort) - [ ] #3489 report Android method access flags (our sort) - PR #3585 is open for it. - [ ] #3569 analyze MQL5 (.ex5) bytecode (our sort) ### area: build (10) - [ ] #25 test Hopper results across many binaries (roadmap: Process capture) - [ ] #55 stronger Hopper checks on source-built test files (roadmap: Process capture) - [ ] #287 define a trusted Windows native add-on and how it ships (roadmap: Windows safety) - [ ] #740 plan clear investigation ownership and modular add-ons (roadmap: MCP speed, internals) - [ ] #2149 publish an npm release with dsh support - [ ] #2190 audit test selection, caching and report gaps in CI - [ ] #2255 ship releases with bundled open-source tools and MCP setups - [ ] #2810 decode Delphi form resources statically - [ ] #2908 compile the bridge Java sources as a CI check - PR #3142 is open for it. - [ ] #3372 a documented Docker image for the MCP server and CLI (our sort) ### area: setup (10) - [ ] #323 show Windows cleanup ownership in doctor and the capability list - [ ] #329 show private-folder support in doctor and the capability list - [ ] #1316 install without a package manager - [ ] #1791 support Kimi Code in setup - PR #1804 is open for it. - [ ] #2187 let setup register Claude Code for one project - PR #2414 is open for it. - [ ] #2490 support CodeBuddy in setup - PR #2492 is open for it. - [ ] #3008 doctor checks only 2 providers while 170 tools are listed - [ ] #3016 save provider settings in a REA config file - PR #3023 is open for it. - [ ] #3243 support FreeBuff in setup (our sort) - PR #2736 is open for it. - [ ] #3374 doctor check for the JADX provider (our sort) ### area: mcp (8) - [ ] #723 cut repeated text in MCP tool lists and results - [ ] #2512 an opt-in lighter tools list for small-frame clients - [ ] #2729 add the PPEE MCP server as a light PE and .NET provider - [ ] #2813 MCP input schemas nest too deep on 24 tools - PR #2905 is open for it. - [ ] #2852 fix a Jadx schema type clash in the main compile - [ ] #3005 an MCP path to the ledger "verified" step - [ ] #3246 pick advertised MCP tools by family (our sort) - PR #3026 is open for it. - [ ] #3446 an MCP activity dashboard (our sort) ### area: cli (7) - [ ] #64 add Electron shell and IPC hooks (roadmap: Browser and web) - [ ] #71 add Objective-C runtime watching that asks first (roadmap: Runtime and debugging) - [ ] #1932 run the agent test on Claude Code and Gemini CLI too - PR #1971 is open for it. - [ ] #2132 an interactive terminal mode for REA - [ ] #2385 support Kiro-cli - [ ] #2443 let the source import CLI skip chosen paths - PR #2630 is open for it. - [ ] #2927 CLI batch mode: many tool calls in one session - PR #3028 is open for it. ### area: bridge (4) - [ ] #31 give analyze_function a full, honest report (roadmap: Process capture) - [ ] #54 give Hopper function reports real references and flow edges (roadmap: Process capture) (likely the same ask) - [ ] #968 live native hooks through a Frida adapter (roadmap: Runtime and debugging) - [ ] #1267 live native debugging through x64dbg, GDB and LLDB (roadmap: Runtime and debugging) ### area: server (1) - [ ] #59 capture process trees and the file changes they make (roadmap: Process capture) 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:52 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 6 of 7: new file formats, games, ML and blockchain. The lists above, unfolded so they are easy to scan. A line under another line belongs with it. One person filed the formats list. Each is a separate ask.

games (24)

#3607 Unity (IL2CPP, Mono, assets)
#3625 Unreal Engine (Pak, UAsset, Blueprint)
#3631 Godot
#3632 GameMaker
#3647 RPG Maker
#3648 Ren'Py
#3649 Clickteam Fusion
#3650 Construct 2 and 3
#3683 visual-novel engines
#3692 Roblox and Luau
#3700 multiplayer resource packages (fxmanifest)
#3701 RPF archives (RPF7, RPF8)
#3702 Anvil world containers and NBT
#3703 mobile world containers (.mcworld, .mcpack)
#3704 MPQ and CASC storage
#3705 VPK archives and BSP maps
#3706 ESM and ESP plugins, BSA and BA2 archives
#3707 GRF archives and sprites
#3708 2D tile-grid MMO assets (OTB, OTBM)
#3709 KPKA containers and RSZ
#3710 CAT and CAS containers, EBX
#3711 CR2W and RED4 containers
#3712 HKX packfiles
#3713 XNB content pipeline

ML (18)

#3637 ML model graphs (ONNX, TFLite, CoreML)
#3651 LLM apps (prompts, routing, tools)
#3652 PyTorch checkpoints
#3653 LLM tokenizers
#3665 LoRA and PEFT adapters
#3666 quantized LLMs (GPTQ, AWQ, GGUF)
#3667 RAG and vector stores
#3668 local LLM runtimes (llama.cpp, Ollama)
#3669 model lineage and diffs
#3672 AI agent protocols (MCP, A2A)
#3673 ML compiler IR (MLIR, StableHLO)
#3675 diffusion models
#3679 LLM prompt packages
#3680 LLM inference traces
#3681 embedding models
#3682 AI model packages (Hugging Face)
#3721 A2A protocol
#3722 on-device AI runtimes

blockchain (16)

#3730 Bitcoin
#3731 Move VM
#3732 Starknet
#3733 ERC-4337 account abstraction
#3734 EVM deployment lineage
#3737 wallets and dApps
#3738 Polkadot and Substrate
#3739 CosmWasm and IBC
#3740 zero-knowledge circuits
#3741 zkVM guest images
#3743 OP Stack
#3744 Arbitrum Nitro
#3745 cross-chain bridges
#3746 TON and TVM
#3747 Solana transactions
#3748 Foundry and Hardhat projects

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 6 of 7: new file formats, games, ML and blockchain.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. One person filed the formats list. Each is a separate ask. ### games (24) - [ ] #3607 Unity (IL2CPP, Mono, assets) - [ ] #3625 Unreal Engine (Pak, UAsset, Blueprint) - [ ] #3631 Godot - [ ] #3632 GameMaker - [ ] #3647 RPG Maker - [ ] #3648 Ren'Py - [ ] #3649 Clickteam Fusion - [ ] #3650 Construct 2 and 3 - [ ] #3683 visual-novel engines - [ ] #3692 Roblox and Luau - [ ] #3700 multiplayer resource packages (fxmanifest) - [ ] #3701 RPF archives (RPF7, RPF8) - [ ] #3702 Anvil world containers and NBT - [ ] #3703 mobile world containers (.mcworld, .mcpack) - [ ] #3704 MPQ and CASC storage - [ ] #3705 VPK archives and BSP maps - [ ] #3706 ESM and ESP plugins, BSA and BA2 archives - [ ] #3707 GRF archives and sprites - [ ] #3708 2D tile-grid MMO assets (OTB, OTBM) - [ ] #3709 KPKA containers and RSZ - [ ] #3710 CAT and CAS containers, EBX - [ ] #3711 CR2W and RED4 containers - [ ] #3712 HKX packfiles - [ ] #3713 XNB content pipeline ### ML (18) - [ ] #3637 ML model graphs (ONNX, TFLite, CoreML) - [ ] #3651 LLM apps (prompts, routing, tools) - [ ] #3652 PyTorch checkpoints - [ ] #3653 LLM tokenizers - [ ] #3665 LoRA and PEFT adapters - [ ] #3666 quantized LLMs (GPTQ, AWQ, GGUF) - [ ] #3667 RAG and vector stores - [ ] #3668 local LLM runtimes (llama.cpp, Ollama) - [ ] #3669 model lineage and diffs - [ ] #3672 AI agent protocols (MCP, A2A) - [ ] #3673 ML compiler IR (MLIR, StableHLO) - [ ] #3675 diffusion models - [ ] #3679 LLM prompt packages - [ ] #3680 LLM inference traces - [ ] #3681 embedding models - [ ] #3682 AI model packages (Hugging Face) - [ ] #3721 A2A protocol - [ ] #3722 on-device AI runtimes ### blockchain (16) - [ ] #3730 Bitcoin - [ ] #3731 Move VM - [ ] #3732 Starknet - [ ] #3733 ERC-4337 account abstraction - [ ] #3734 EVM deployment lineage - [ ] #3737 wallets and dApps - [ ] #3738 Polkadot and Substrate - [ ] #3739 CosmWasm and IBC - [ ] #3740 zero-knowledge circuits - [ ] #3741 zkVM guest images - [ ] #3743 OP Stack - [ ] #3744 Arbitrum Nitro - [ ] #3745 cross-chain bridges - [ ] #3746 TON and TVM - [ ] #3747 Solana transactions - [ ] #3748 Foundry and Hardhat projects 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi commented

2026-10-16 21:05:52 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 15, 2026):

Part 7 of 7: new file formats, the other families. The lists above, unfolded so they are easy to scan. A line under another line belongs with it.

firmware/embedded (8)

#3615 embedded hardware (ESP32 flash, NVS)
#3640 CODESYS and PLC logic
#3641 USB protocol
#3644 Bluetooth LE
#3645 Java Card
#3646 FPGA bitstreams
#3725 software-defined vehicles (AUTOSAR, SOME/IP)
#3726 Matter and Thread

web/JS (7)

#3614 Adobe Flash (SWF)
#3684 WebView2
#3685 Chromium Embedded Framework
#3686 Tauri
#3687 VS Code extensions
#3691 Chromium LevelDB
#3727 WebGPU apps

managed (5)

#3616 Silverlight (XAP)
#3617 Java applets (JNLP)
#3676 GraalVM Native Image
#3694 .NET MAUI and Xamarin
#3696 Java serialization

archives/containers (4)

#3678 Python packaged apps (PyInstaller)
#3688 Inno Setup
#3689 NSIS
#3693 InstallShield

mobile (1)

#3612 Symbian apps

other (13)

#3609 video
#3611 music and sound effects
#3618 ActiveX, COM and OCX
#3620 shader and GPU bytecode
#3626 Windows kernel drivers
#3628 Microsoft Office (OLE, VBA, macros)
#3630 Qt and QML
#3674 CUDA (PTX, SASS)
#3677 LLVM bitcode and LTO
#3695 AutoIt and AutoHotkey
#3699 Lua and LuaJIT bytecode
#3723 confidential computing (TDX, SEV-SNP)
#3724 post-quantum cryptography

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 15, 2026): **Part 7 of 7: new file formats, the other families.** The lists above, unfolded so they are easy to scan. A line under another line belongs with it. ### firmware/embedded (8) - [ ] #3615 embedded hardware (ESP32 flash, NVS) - [ ] #3640 CODESYS and PLC logic - [ ] #3641 USB protocol - [ ] #3644 Bluetooth LE - [ ] #3645 Java Card - [ ] #3646 FPGA bitstreams - [ ] #3725 software-defined vehicles (AUTOSAR, SOME/IP) - [ ] #3726 Matter and Thread ### web/JS (7) - [ ] #3614 Adobe Flash (SWF) - [ ] #3684 WebView2 - [ ] #3685 Chromium Embedded Framework - [ ] #3686 Tauri - [ ] #3687 VS Code extensions - [ ] #3691 Chromium LevelDB - [ ] #3727 WebGPU apps ### managed (5) - [ ] #3616 Silverlight (XAP) - [ ] #3617 Java applets (JNLP) - [ ] #3676 GraalVM Native Image - [ ] #3694 .NET MAUI and Xamarin - [ ] #3696 Java serialization ### archives/containers (4) - [ ] #3678 Python packaged apps (PyInstaller) - [ ] #3688 Inno Setup - [ ] #3689 NSIS - [ ] #3693 InstallShield ### mobile (1) - [ ] #3612 Symbian apps ### other (13) - [ ] #3609 video - [ ] #3611 music and sound effects - [ ] #3618 ActiveX, COM and OCX - [ ] #3620 shader and GPU bytecode - [ ] #3626 Windows kernel drivers - [ ] #3628 Microsoft Office (OLE, VBA, macros) - [ ] #3630 Qt and QML - [ ] #3674 CUDA (PTX, SASS) - [ ] #3677 LLVM bitcode and LTO - [ ] #3695 AutoIt and AutoHotkey - [ ] #3699 Lua and LuaJIT bytecode - [ ] #3723 confidential computing (TDX, SEV-SNP) - [ ] #3724 post-quantum cryptography 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi commented

2026-10-17 21:02:00 +00:00

Author

Owner

@ogutdgn commented on GitHub (Oct 16, 2026):

Feature request #4247 (multiple goals in one trace_call_path traversal and reporting backward roots) also has an open PR: #4417. It is ready for review and remains unmerged. The request falls under native analysis or decompilation and is not currently listed in this tracker.

@ogutdgn commented on GitHub (Oct 16, 2026): Feature request #4247 (multiple goals in one `trace_call_path` traversal and reporting backward roots) also has an open PR: #4417. It is ready for review and remains unmerged. The request falls under native analysis or decompilation and is not currently listed in this tracker.

bsakaguchi referenced this issue

2026-10-17 21:11:41 +00:00

[PR #1471] [MERGED] fix(javascript): retain returned-reference mutation uncertainty #2909

bsakaguchi referenced this issue

2026-10-17 21:12:01 +00:00

[PR #1517] [MERGED] fix(javascript): expand an escaped receiver's methods once (#1495) #2937

bsakaguchi commented

2026-10-31 00:30:56 +00:00

Author

Owner

@CassieFox23 commented on GitHub (Oct 18, 2026):

Thanks, ogutdgn. I added #4247 with its PR #4417 under native analysis.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

@CassieFox23 commented on GitHub (Oct 18, 2026): Thanks, ogutdgn. I added #4247 with its PR #4417 under native analysis. 🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1471

No description provided.

Rows
Columns