[GH-ISSUE #17] Add an evidence-driven native API reconstruction workflow #18

New issue

Closed

opened 2026-10-15 18:19:58 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:19:58 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/17

Goal

Compose Hopper with native metadata and runtime evidence so agents can reconstruct a small native API without treating pseudocode as compilable source.

Workflow

Inventory segments, procedures, labels, imports, exports, selectors, and strings.
Identify registration and entry routines.
Select decompilation targets using symbols, strings, references, and call-graph reachability.
Recover boundary types from imports, selectors, conventions, metadata, and flow.
Mark register variables, compiler blocks, pointer arithmetic, and signatures as decompiler artifacts.
Cross-check jump tables against section data, strings, enum documentation, and assembly.
Correlate static conclusions with optional runtime traces and ABI probes.
Export evidence and residual unknowns.

Acceptance criteria

Anonymous reachable helpers are included.
Inferred types carry evidence and confidence.
Jump-table mappings cite data addresses and targets.
Pseudocode is labeled non-source/non-compilable.
Resource retention and delegate cleanup can be explained.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/17 ## Goal Compose Hopper with native metadata and runtime evidence so agents can reconstruct a small native API without treating pseudocode as compilable source. ## Workflow 1. Inventory segments, procedures, labels, imports, exports, selectors, and strings. 2. Identify registration and entry routines. 3. Select decompilation targets using symbols, strings, references, and call-graph reachability. 4. Recover boundary types from imports, selectors, conventions, metadata, and flow. 5. Mark register variables, compiler blocks, pointer arithmetic, and signatures as decompiler artifacts. 6. Cross-check jump tables against section data, strings, enum documentation, and assembly. 7. Correlate static conclusions with optional runtime traces and ABI probes. 8. Export evidence and residual unknowns. ## Acceptance criteria - Anonymous reachable helpers are included. - Inferred types carry evidence and confidence. - Jump-table mappings cite data addresses and targets. - Pseudocode is labeled non-source/non-compilable. - Resource retention and delegate cleanup can be explained.

bsakaguchi

2026-10-15 18:19:58 +00:00

closed this issue
added the
area: server

P1: high

area: bridge

enhancement
labels

bsakaguchi commented

2026-10-15 18:20:00 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Current main already supplies analyze_function, trace_feature, function comparison, call paths, evidence, and residual-unknown tooling. The remaining scope is first-class native API reconstruction orchestration: inferred boundary types with confidence, ABI/jump-table fixture proof, and resource/delegate lifecycle explanation. Keeping this open only for that focused outcome avoids duplicating the delivered generic investigation workflow.

@morluto commented on GitHub (Jul 17, 2026): Current main already supplies analyze_function, trace_feature, function comparison, call paths, evidence, and residual-unknown tooling. The remaining scope is first-class native API reconstruction orchestration: inferred boundary types with confidence, ABI/jump-table fixture proof, and resource/delegate lifecycle explanation. Keeping this open only for that focused outcome avoids duplicating the delivered generic investigation workflow.

bsakaguchi commented

2026-10-15 18:20:00 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#345
#346

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #345 - [ ] #346 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:20:03 +00:00

[GH-ISSUE #32] Roadmap: evolve REA into an agent-first multi-tool reverse-engineering platform #20

bsakaguchi referenced this issue

2026-10-15 18:20:37 +00:00

[GH-ISSUE #73] Create an evidence-linked residual-unknowns registry #60

bsakaguchi referenced this issue

2026-10-15 18:22:16 +00:00

[GH-ISSUE #347] Add inspect_artifact provider-neutral inspection tool #193

bsakaguchi referenced this issue

2026-10-15 18:22:16 +00:00

[GH-ISSUE #348] Add find_code_for_string and trace_call_path bounded tracing tools #195