[GH-ISSUE #483] [Feature] Trace native UI controls through dispatch to handlers #259

New issue

Closed

opened 2026-10-15 18:23:07 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:23:07 +00:00

Owner

Originally created by @morluto on GitHub (Sep 29, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/483

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native application analysis and UI reconstruction

Current limitation

REA can inventory native code and is adding a decoded graph for compiled Apple storyboard and nib resources (#480). Native function and value-flow analysis is tracked separately in #482. There is not yet one bounded operation that starts at a UI control or action and follows the control-flow route through Objective-C target/action, Swift protocol witnesses, virtual dispatch, and closure/thunk edges to candidate handler implementations.

Desired outcome and success criteria

Provide a read-only, bounded route trace that accepts a UI resource object/action, selector, symbol, or exact function address and returns the connected UI-to-code route. Where evidence supports it, include:

UI control, outlet, action, and segue nodes supplied by the compiled UI graph, with links to #480;
direct call edges and resolved Objective-C target/action, Swift witness-table, vtable, closure, and thunk edges;
exact source and destination addresses, function identities, and dispatch mechanism for each edge;
edge status distinguishing directly observed, statically resolved, inferred, ambiguous, and unresolved relationships;
alternate candidate handlers and explicit unknown reasons when stripped symbols, dynamic registration, or unsupported metadata prevents resolution.

Bound depth, nodes, edges, decompilation work, and output size. Preserve evidence IDs and locations per edge. Do not report a UI object or selector match as proof that the handler is reachable.

Authority boundaries and non-goals

Static analysis only; do not launch the target or instantiate UI components.
Keep provider-specific extraction in providers and route composition in REA application/domain layers.
This is a control-flow route, not a value/state slice; the latter remains tracked in #482.
Reuse the read-only Ghidra provider boundary in #481 where available; do not expose arbitrary Ghidra scripts.

#480 Decode compiled Apple storyboard and nib archives into UI graphs
#481 Add a read-only Ghidra provider for macOS
#482 Trace native state and value dependencies across functions

Originally created by @morluto on GitHub (Sep 29, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/483 ## Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native application analysis and UI reconstruction ## Current limitation REA can inventory native code and is adding a decoded graph for compiled Apple storyboard and nib resources (#480). Native function and value-flow analysis is tracked separately in #482. There is not yet one bounded operation that starts at a UI control or action and follows the control-flow route through Objective-C target/action, Swift protocol witnesses, virtual dispatch, and closure/thunk edges to candidate handler implementations. ## Desired outcome and success criteria Provide a read-only, bounded route trace that accepts a UI resource object/action, selector, symbol, or exact function address and returns the connected UI-to-code route. Where evidence supports it, include: - UI control, outlet, action, and segue nodes supplied by the compiled UI graph, with links to #480; - direct call edges and resolved Objective-C target/action, Swift witness-table, vtable, closure, and thunk edges; - exact source and destination addresses, function identities, and dispatch mechanism for each edge; - edge status distinguishing directly observed, statically resolved, inferred, ambiguous, and unresolved relationships; - alternate candidate handlers and explicit unknown reasons when stripped symbols, dynamic registration, or unsupported metadata prevents resolution. Bound depth, nodes, edges, decompilation work, and output size. Preserve evidence IDs and locations per edge. Do not report a UI object or selector match as proof that the handler is reachable. ## Authority boundaries and non-goals - Static analysis only; do not launch the target or instantiate UI components. - Keep provider-specific extraction in providers and route composition in REA application/domain layers. - This is a control-flow route, not a value/state slice; the latter remains tracked in #482. - Reuse the read-only Ghidra provider boundary in #481 where available; do not expose arbitrary Ghidra scripts. ## Related work - #480 Decode compiled Apple storyboard and nib archives into UI graphs - #481 Add a read-only Ghidra provider for macOS - #482 Trace native state and value dependencies across functions

bsakaguchi

2026-10-15 18:23:07 +00:00

closed this issue
added the
triage

enhancement
labels

bsakaguchi commented

2026-10-15 18:23:09 +00:00

Author

Owner

@morluto commented on GitHub (Oct 8, 2026):

Verified fixed on main (7a7460f0). trace_native_ui_action is wired through enhancedToolContracts + CLI with NativeUiActionTrace service and native-investigation docs. Closing per audit.

@morluto commented on GitHub (Oct 8, 2026): Verified fixed on main (7a7460f0). trace_native_ui_action is wired through enhancedToolContracts + CLI with NativeUiActionTrace service and native-investigation docs. Closing per audit.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:12:23 +00:00

[PR #259] [MERGED] docs(analysis): define managed-code evidence boundary #1908

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:57 +00:00