[GH-ISSUE #41] Add mobile application investigation providers and workflows #30

New issue

Closed

opened 2026-10-15 18:20:12 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-15 18:20:12 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/41

Goal

Support Android and Apple mobile application artifacts through a common investigation model.

Scope

APK, AAB, DEX, OAT, native libraries, resources, manifests, signing, and decompilation metadata
IPA, Mach-O, frameworks, entitlements, provisioning, assets, Swift and Objective-C metadata
Java, Kotlin, Swift, Objective-C, JavaScript, Flutter, React Native, Unity, and native bridge identification
optional adapters for jadx, apktool, smali/baksmali, class-dump alternatives, Frida, LLDB, and platform simulators
app-to-service protocol correlation

Requirements

Inventory and extraction must satisfy the artifact containment rules in #35.
Static workflows must work without a connected physical device.
Simulator, emulator, or device actions require explicit capability and side-effect declarations.
Signing material, device identifiers, and application secrets are redacted.
Provider output normalizes concepts without discarding platform-specific evidence.

Acceptance criteria

Known Android and Apple fixtures produce deterministic artifact graphs.
Cross-language bridge calls and bundled native libraries are discoverable.
Runtime observation is approval-gated and tied to an owned app process.
Reports cite artifact hashes, package locations, and provider limitations.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/41 ## Goal Support Android and Apple mobile application artifacts through a common investigation model. ## Scope - APK, AAB, DEX, OAT, native libraries, resources, manifests, signing, and decompilation metadata - IPA, Mach-O, frameworks, entitlements, provisioning, assets, Swift and Objective-C metadata - Java, Kotlin, Swift, Objective-C, JavaScript, Flutter, React Native, Unity, and native bridge identification - optional adapters for jadx, apktool, smali/baksmali, class-dump alternatives, Frida, LLDB, and platform simulators - app-to-service protocol correlation ## Requirements - Inventory and extraction must satisfy the artifact containment rules in #35. - Static workflows must work without a connected physical device. - Simulator, emulator, or device actions require explicit capability and side-effect declarations. - Signing material, device identifiers, and application secrets are redacted. - Provider output normalizes concepts without discarding platform-specific evidence. ## Acceptance criteria - Known Android and Apple fixtures produce deterministic artifact graphs. - Cross-language bridge calls and bundled native libraries are discoverable. - Runtime observation is approval-gated and tied to an owned app process. - Reports cite artifact hashes, package locations, and provider limitations.

bsakaguchi

2026-10-15 18:20:12 +00:00

closed this issue
added the
area: domain

roadmap

enhancement

P2: medium
labels

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 17, 2026):

This remains a genuine gap. Existing Mach-O, artifact-graph, JavaScript, and managed primitives are useful foundations, but there is no APK/AAB/DEX or IPA provider, mobile graph, or owned emulator/device workflow.

@morluto commented on GitHub (Jul 17, 2026): This remains a genuine gap. Existing Mach-O, artifact-graph, JavaScript, and managed primitives are useful foundations, but there is no APK/AAB/DEX or IPA provider, mobile graph, or owned emulator/device workflow.

bsakaguchi commented

2026-10-15 18:20:13 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#366

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #366 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi referenced this issue

2026-10-15 18:28:29 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-16 21:11:25 +00:00

[PR #85] [MERGED] feat(analysis): harden agent workflows and evidence boundaries #1823

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:38 +00:00