[GH-ISSUE #38] Add first-class Windows artifact and analysis support #27

New issue

Closed

opened 2026-10-15 18:20:07 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:07 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/38

Goal

Make REA useful on Windows hosts and for Windows targets without assuming Hopper or macOS utilities are available.

Scope

PE, COFF, PDB, MSIX, MSI, AppX, DLL, EXE, driver, and .NET assembly inventory
imports, exports, resources, manifests, signatures, debug identifiers, sections, relocations, TLS callbacks, and architecture metadata
provider discovery and capability negotiation per host operating system
deterministic adapters for native Windows tools and portable libraries
optional static providers such as Ghidra, Rizin, Binary Ninja, and IDA
approval-gated dynamic adapters such as WinDbg, x64dbg, Procmon, Process Explorer, ETW, and API Monitor
Windows process ownership, path, quoting, named-pipe, cancellation, and cleanup semantics

Requirements

Public semantic contracts must not expose a macOS-only vocabulary.
Unsupported host capabilities must be reported explicitly.
Static inspection remains usable when no commercial GUI decompiler is installed.
Dynamic providers inherit the side-effect and approval policy from #27 and #36.
Windows CI covers installation, packaging, paths, subprocesses, and portable fixture analysis.

Acceptance criteria

A target-free REA server starts and reports capabilities on Windows.
Known PE and .NET fixtures produce deterministic inventory and evidence.
CLI and MCP schemas are identical across operating systems.
Documentation provides a provider matrix by host and target format.
No Windows verifier can terminate or mutate an unrelated process.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/38 ## Goal Make REA useful on Windows hosts and for Windows targets without assuming Hopper or macOS utilities are available. ## Scope - PE, COFF, PDB, MSIX, MSI, AppX, DLL, EXE, driver, and .NET assembly inventory - imports, exports, resources, manifests, signatures, debug identifiers, sections, relocations, TLS callbacks, and architecture metadata - provider discovery and capability negotiation per host operating system - deterministic adapters for native Windows tools and portable libraries - optional static providers such as Ghidra, Rizin, Binary Ninja, and IDA - approval-gated dynamic adapters such as WinDbg, x64dbg, Procmon, Process Explorer, ETW, and API Monitor - Windows process ownership, path, quoting, named-pipe, cancellation, and cleanup semantics ## Requirements - Public semantic contracts must not expose a macOS-only vocabulary. - Unsupported host capabilities must be reported explicitly. - Static inspection remains usable when no commercial GUI decompiler is installed. - Dynamic providers inherit the side-effect and approval policy from #27 and #36. - Windows CI covers installation, packaging, paths, subprocesses, and portable fixture analysis. ## Acceptance criteria - A target-free REA server starts and reports capabilities on Windows. - Known PE and .NET fixtures produce deterministic inventory and evidence. - CLI and MCP schemas are identical across operating systems. - Documentation provides a provider matrix by host and target format. - No Windows verifier can terminate or mutate an unrelated process.

bsakaguchi

2026-10-15 18:20:07 +00:00

closed this issue
added the
P1: high

area: domain

roadmap

enhancement
labels

bsakaguchi commented

2026-10-15 18:20:10 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

Substantial Windows slices are delivered: target-free package/capability checks, managed PE static inspection, and Windows x64 Ghidra P0 with 18 operations, authenticated loopback, a source-owned PE verifier, and CI. Remaining scope is broader PE/COFF/PDB and package/resource/signature support plus Job Objects, reparse-safe handles, private DACLs, ConPTY, and dynamic providers. #287–#290 define the immediate dependency chain.

@morluto commented on GitHub (Jul 17, 2026): Substantial Windows slices are delivered: target-free package/capability checks, managed PE static inspection, and Windows x64 Ghidra P0 with 18 operations, authenticated loopback, a source-owned PE verifier, and CI. Remaining scope is broader PE/COFF/PDB and package/resource/signature support plus Job Objects, reparse-safe handles, private DACLs, ConPTY, and dynamic providers. #287–#290 define the immediate dependency chain.

bsakaguchi commented

2026-10-15 18:20:11 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#362
#363

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #362 - [ ] #363 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:20:35 +00:00

[GH-ISSUE #69] Create a resettable macOS clean-room environment #57

bsakaguchi referenced this issue

2026-10-15 18:21:02 +00:00

[GH-ISSUE #142] fix(application): continue process group ownership cleanup despite per-process read failures #90

bsakaguchi referenced this issue

2026-10-15 18:22:20 +00:00

[GH-ISSUE #354] Assign verifier and dynamic-provider run IDs with owned lineage #201

bsakaguchi referenced this issue

2026-10-15 18:22:23 +00:00

[GH-ISSUE #355] Restrict cleanup to owned processes and verify unrelated-process survival #202