[GH-ISSUE #490] [Feature] Resolve indirect call targets as a provider-neutral primitive #264

New issue

Closed

opened 2026-10-15 18:23:10 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:23:10 +00:00

Owner

Originally created by @morluto on GitHub (Oct 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/490

Current limitation

REA exposes direct caller/callee relationships and raw references, but unresolved indirect calls may be omitted. Callers then have to inspect instructions, metadata, and provider-specific decompiler output manually. The broader native state/value tracing proposal in #482 depends on such relationships, but this capability is useful on its own for many static analysis tasks.

Desired outcome

Add a read-only operation for one explicit call site that reports the target-resolution result and its supporting evidence. Where available, return:

the call-site address and containing procedure;
direct, resolved indirect, candidate, ambiguous, unresolved, or unavailable status;
target procedure addresses and the evidence basis for each target, such as relocation/reference facts, type or dispatch metadata, or a documented provider analysis result;
the dispatch mechanism when directly identified, with inference labeled separately;
provider coverage and reasons resolution could not be completed.

Keep the operation composable: it should answer target resolution for one call site, without also traversing a whole call graph or inferring the higher-level behavior of a feature. Do not claim complete dynamic call-graph recovery. Static analysis only; no target execution or runtime hooks.

Acceptance criteria

Input identifies one reproducible call site and active analysis document/program.
Results preserve artifact/provider identity, addresses, Evidence, and per-target status.
Multiple possible targets remain candidates or ambiguous rather than being presented as confirmed calls.
Unsupported providers and incomplete analysis are explicit, not empty success.
Fixtures cover direct, indirect-resolved, indirect-ambiguous, and unresolved sites for at least one provider; provider support is reported precisely.
The operation can be composed by #482 or direct callers without forcing either workflow on other users.

#482 Trace native state and value dependencies across functions
#54 Complete Hopper function dossiers with real references and CFG edges

Originally created by @morluto on GitHub (Oct 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/490 ## Current limitation REA exposes direct caller/callee relationships and raw references, but unresolved indirect calls may be omitted. Callers then have to inspect instructions, metadata, and provider-specific decompiler output manually. The broader native state/value tracing proposal in #482 depends on such relationships, but this capability is useful on its own for many static analysis tasks. ## Desired outcome Add a read-only operation for one explicit call site that reports the target-resolution result and its supporting evidence. Where available, return: - the call-site address and containing procedure; - direct, resolved indirect, candidate, ambiguous, unresolved, or unavailable status; - target procedure addresses and the evidence basis for each target, such as relocation/reference facts, type or dispatch metadata, or a documented provider analysis result; - the dispatch mechanism when directly identified, with inference labeled separately; - provider coverage and reasons resolution could not be completed. Keep the operation composable: it should answer target resolution for one call site, without also traversing a whole call graph or inferring the higher-level behavior of a feature. Do not claim complete dynamic call-graph recovery. Static analysis only; no target execution or runtime hooks. ## Acceptance criteria - Input identifies one reproducible call site and active analysis document/program. - Results preserve artifact/provider identity, addresses, Evidence, and per-target status. - Multiple possible targets remain candidates or ambiguous rather than being presented as confirmed calls. - Unsupported providers and incomplete analysis are explicit, not empty success. - Fixtures cover direct, indirect-resolved, indirect-ambiguous, and unresolved sites for at least one provider; provider support is reported precisely. - The operation can be composed by #482 or direct callers without forcing either workflow on other users. ## Related - #482 Trace native state and value dependencies across functions - #54 Complete Hopper function dossiers with real references and CFG edges

bsakaguchi

2026-10-15 18:23:10 +00:00

closed this issue
added the
area: providers

enhancement
labels

bsakaguchi commented

2026-10-15 18:23:12 +00:00

Author

Owner

@morluto commented on GitHub (Oct 8, 2026):

Verified fixed on main (7a7460f0). Tool is in OFFICIAL_TOOL_CONTRACTS with schemas and Ghidra bridge dispatch (ReaGhidraBridge.java), satisfying the at-least-one-provider acceptance. contractSnapshot.test.ts passes. Closing per audit.

@morluto commented on GitHub (Oct 8, 2026): Verified fixed on main (7a7460f0). Tool is in OFFICIAL_TOOL_CONTRACTS with schemas and Ghidra bridge dispatch (ReaGhidraBridge.java), satisfying the at-least-one-provider acceptance. contractSnapshot.test.ts passes. Closing per audit.

bsakaguchi referenced this issue

2026-10-15 18:24:29 +00:00

[GH-ISSUE #1050] [Feature] Add caller-selected views for large analysis results over MCP #384

bsakaguchi referenced this issue

2026-10-16 21:12:29 +00:00

[PR #274] [MERGED] feat(mcp)!: harden contracts and Evidence references #1918

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:57 +00:00