[GH-ISSUE #484] [Feature] Expose typed Swift and Objective-C dispatch metadata across providers #260

New issue

Closed

opened 2026-10-15 18:23:07 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:23:07 +00:00

Owner

Originally created by @morluto on GitHub (Sep 29, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/484

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Current limitation

REA has typed models and provider operations for some Objective-C and Swift declarations, while native providers expose different subsets of runtime and ABI information. Raw bytes, strings, symbols, and ordinary cross-references leave analysts to decode relative pointers and connect metadata structures by hand. A provider-specific query contract would make equivalent findings difficult to compare and compose with UI and semantic traces.

Desired outcome and success criteria

Define a bounded, read-only, provider-neutral result contract for recoverable Swift and Objective-C dispatch metadata. Provider adapters may use Ghidra, Hopper, or dedicated artifact readers; they report only fields they can substantiate. The normalized result should represent:

Objective-C classes, metaclasses, superclass links, instance layout/ivars, protocols, selectors, method implementations, and target/action references where encoded;
Swift declarations and protocol conformances, witness tables, class vtables, method slots, thunks, and relative pointer targets where recoverable;
exact virtual addresses and file offsets for each structure, entry, and decoded relationship;
per-field or per-record decode status distinguishing observed fields, derived links, inferred candidates, malformed or unsupported encodings, and unresolved pointers;
target SHA-256, provider identity/version, provider-specific analysis version when available, and evidence links so results remain tied to the analyzed artifact and toolchain.

Provide typed result schemas and deterministic fixtures for supported encodings across symbol-rich and stripped binaries. Bound records and bytes inspected, paginate large results, and preserve unknown/unavailable outcomes rather than treating empty results as proof of absence. Compose these results with UI-to-handler route tracing (#483) and native state/value tracing (#482).

Authority boundaries and non-goals

Static inspection only; no target execution, runtime attachment, database mutation, or arbitrary provider scripting.
Keep provider-specific structure reading and decoding in provider adapters; keep normalized metadata interpretation and cross-provider composition in REA layers.
Do not require every provider to support every metadata family. Advertise exact coverage and limitations per provider.
Support only encodings validated by fixtures; report other ABI variants as unavailable or unknown.

#480 Decode compiled Apple storyboard and nib archives into UI graphs
#481 Add a read-only Ghidra provider for macOS
#482 Trace native state and value dependencies across functions
#483 Trace native UI controls through dispatch to handlers
#353 Add deeper Objective-C/Swift metadata and database save/licensing support

Originally created by @morluto on GitHub (Sep 29, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/484 ## Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Native analysis or decompilation ## Current limitation REA has typed models and provider operations for some Objective-C and Swift declarations, while native providers expose different subsets of runtime and ABI information. Raw bytes, strings, symbols, and ordinary cross-references leave analysts to decode relative pointers and connect metadata structures by hand. A provider-specific query contract would make equivalent findings difficult to compare and compose with UI and semantic traces. ## Desired outcome and success criteria Define a bounded, read-only, provider-neutral result contract for recoverable Swift and Objective-C dispatch metadata. Provider adapters may use Ghidra, Hopper, or dedicated artifact readers; they report only fields they can substantiate. The normalized result should represent: - Objective-C classes, metaclasses, superclass links, instance layout/ivars, protocols, selectors, method implementations, and target/action references where encoded; - Swift declarations and protocol conformances, witness tables, class vtables, method slots, thunks, and relative pointer targets where recoverable; - exact virtual addresses and file offsets for each structure, entry, and decoded relationship; - per-field or per-record decode status distinguishing observed fields, derived links, inferred candidates, malformed or unsupported encodings, and unresolved pointers; - target SHA-256, provider identity/version, provider-specific analysis version when available, and evidence links so results remain tied to the analyzed artifact and toolchain. Provide typed result schemas and deterministic fixtures for supported encodings across symbol-rich and stripped binaries. Bound records and bytes inspected, paginate large results, and preserve unknown/unavailable outcomes rather than treating empty results as proof of absence. Compose these results with UI-to-handler route tracing (#483) and native state/value tracing (#482). ## Authority boundaries and non-goals - Static inspection only; no target execution, runtime attachment, database mutation, or arbitrary provider scripting. - Keep provider-specific structure reading and decoding in provider adapters; keep normalized metadata interpretation and cross-provider composition in REA layers. - Do not require every provider to support every metadata family. Advertise exact coverage and limitations per provider. - Support only encodings validated by fixtures; report other ABI variants as unavailable or unknown. ## Related work - #480 Decode compiled Apple storyboard and nib archives into UI graphs - #481 Add a read-only Ghidra provider for macOS - #482 Trace native state and value dependencies across functions - #483 Trace native UI controls through dispatch to handlers - #353 Add deeper Objective-C/Swift metadata and database save/licensing support

bsakaguchi

2026-10-15 18:23:07 +00:00

closed this issue
added the
triage

enhancement
labels

bsakaguchi commented

2026-10-15 18:23:09 +00:00

Author

Owner

@morluto commented on GitHub (Oct 8, 2026):

Verified fixed on main (7a7460f0). inspect_native_dispatch_metadata ships via enhancedToolContracts with AppleDispatchMetadata + objcSwiftMetadata modules and passing tests (18+1). Closing per audit.

@morluto commented on GitHub (Oct 8, 2026): Verified fixed on main (7a7460f0). inspect_native_dispatch_metadata ships via enhancedToolContracts with AppleDispatchMetadata + objcSwiftMetadata modules and passing tests (18+1). Closing per audit.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:12:24 +00:00

[PR #260] [MERGED] feat(dotnet): add managed artifact triage #1909

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:57 +00:00