[GH-ISSUE #492] [Feature] Inspect recovered native data types and layouts #262

New issue

Closed

opened 2026-10-15 18:23:09 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:23:09 +00:00

Owner

Originally created by @morluto on GitHub (Oct 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/492

Current limitation

The analysis surface exposes procedure signatures and locals, raw bytes, references, and function dossiers, but no standalone operation for inspecting a recovered native data type or aggregate layout. Analysts must infer field boundaries and offsets from pseudocode, raw memory, or provider-specific UI state. This makes useful type information hard to reuse in data-reference analysis and cross-function state tracing.

Desired outcome

Add a read-only primitive to inspect one explicitly identified data type or typed data object. Where the active provider or artifact metadata can substantiate it, return:

stable type identity, display name, kind, and source/provenance;
total size and alignment when known;
ordered fields or enum members with offsets/values, sizes, names, and nested types;
packing, bitfield, union, pointer, array, and flexible-tail details when represented;
decode status for each field and explicit unknown/unavailable reasons.

Keep it focused on one type object. Do not infer a layout from field-like decompiler variable names, and do not include a cross-function read/write trace. Report the exact provider and metadata source because debug info, analysis databases, and ABI metadata have different authority.

Acceptance criteria

Input identifies one type or typed data object unambiguously in the active artifact/session.
Output is evidence-linked, deterministic, and provider-neutral, with source locations or addresses where available.
Unknown, conflicting, recursive, malformed, or partially decoded layouts remain explicit; no guessed offsets or sizes.
Providers advertise exact supported type families and return typed unavailability for unsupported queries.
Fixtures cover structures, nested fields, unions, enums, and unavailable/partial type information for at least one real provider.
The primitive composes with reference and value-flow analysis without imposing a domain-specific workflow.

#482 Trace native state and value dependencies across functions
#484 Expose typed Swift and Objective-C dispatch metadata across providers
#54 Complete Hopper function dossiers with real references and CFG edges

Originally created by @morluto on GitHub (Oct 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/492 ## Current limitation The analysis surface exposes procedure signatures and locals, raw bytes, references, and function dossiers, but no standalone operation for inspecting a recovered native data type or aggregate layout. Analysts must infer field boundaries and offsets from pseudocode, raw memory, or provider-specific UI state. This makes useful type information hard to reuse in data-reference analysis and cross-function state tracing. ## Desired outcome Add a read-only primitive to inspect one explicitly identified data type or typed data object. Where the active provider or artifact metadata can substantiate it, return: - stable type identity, display name, kind, and source/provenance; - total size and alignment when known; - ordered fields or enum members with offsets/values, sizes, names, and nested types; - packing, bitfield, union, pointer, array, and flexible-tail details when represented; - decode status for each field and explicit unknown/unavailable reasons. Keep it focused on one type object. Do not infer a layout from field-like decompiler variable names, and do not include a cross-function read/write trace. Report the exact provider and metadata source because debug info, analysis databases, and ABI metadata have different authority. ## Acceptance criteria - Input identifies one type or typed data object unambiguously in the active artifact/session. - Output is evidence-linked, deterministic, and provider-neutral, with source locations or addresses where available. - Unknown, conflicting, recursive, malformed, or partially decoded layouts remain explicit; no guessed offsets or sizes. - Providers advertise exact supported type families and return typed unavailability for unsupported queries. - Fixtures cover structures, nested fields, unions, enums, and unavailable/partial type information for at least one real provider. - The primitive composes with reference and value-flow analysis without imposing a domain-specific workflow. ## Related - #482 Trace native state and value dependencies across functions - #484 Expose typed Swift and Objective-C dispatch metadata across providers - #54 Complete Hopper function dossiers with real references and CFG edges

bsakaguchi

2026-10-15 18:23:09 +00:00

closed this issue
added the
area: native

enhancement
labels

bsakaguchi commented

2026-10-15 18:23:12 +00:00

Author

Owner

@morluto commented on GitHub (Oct 8, 2026):

Verified fixed on main (7a7460f0). Tool is in OFFICIAL_TOOL_CONTRACTS with schemas and Ghidra bridge dispatch (ReaGhidraBridge.java), satisfying the at-least-one-provider acceptance. contractSnapshot.test.ts passes. Closing per audit.

@morluto commented on GitHub (Oct 8, 2026): Verified fixed on main (7a7460f0). Tool is in OFFICIAL_TOOL_CONTRACTS with schemas and Ghidra bridge dispatch (ReaGhidraBridge.java), satisfying the at-least-one-provider acceptance. contractSnapshot.test.ts passes. Closing per audit.

bsakaguchi referenced this issue

2026-10-16 21:12:34 +00:00

[PR #285] [MERGED] feat: add managed characterization and reconstruction coverage #1927

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:57 +00:00