morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5130] [Bug] Native UI traces discard Hopper partial CallReference sites and classification #3155

New issue

Closed

opened 2026-10-31 00:37:17 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:37:17 +00:00

Owner

Originally created by @morluto on GitHub (Oct 18, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5130

Before submitting

I searched open and closed issues for a related report.
I removed credentials and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

A controlled provider supplied a canonical-valid reference at 0x1004 -> 0x2000, with unavailable detailed reference flags and Hopper-shaped call classification/provenance. Through the official SDK, trace_native_ui_action ({"action":"0x1000","max_depth":1}) discarded the observed call site and classification. When fallback enumeration failed, only an unresolved enumeration failure remained; successful fallback replaced the site with the procedure entry and marked the relationship inferred.

Reproduction

Ran eight controlled cases: none/unknown/direct/objective_c (raw types 0/1/2/3), each with failing or successful callee fallback. All eight passed the canonical reference parser and lost the exact site in the public MCP trace. This is a simulated production-boundary reproduction; no real Hopper analysis was run.

Expected behavior

Preserve provider-reported endpoints and partial classification/provenance independently of generic flags and fallback success. Keep provider-scoped observations distinct from target-only inferred routes; do not manufacture generic call flags or Objective-C dispatch joins.

Impact and scope

Confirmed loss in the shared trace reader and public MCP workflow under controlled inputs. Actual Hopper runtime frequency and cross-version behavior: NOT_ENOUGH_INFO; real-provider verification was not performed.

REA version

65884350ff

Runtime and platform

Node 24.18.0; macOS arm64; installed Hopper 6.6.0-demo API documentation inspected, engine not invoked.

Target and artifact context

Controlled Mach-O arm64 subject; no executable was analyzed.

Interface

MCP

Earliest failure stage

Transport or result projection

Relevant output or evidence

Source: NativeCallRoutes.ts omits call in its projection schema and selects only complete kind.call records. The canonical referenceEdgeSchema and bridge producer retain partial CallReference facts. Controlled probe: all eight canonical parses succeeded; zero public traces retained 0x1004 as reference location.

Analysis

The consumer requires richer classification than the producer can supply, then silently strips the available partial record. This is separate from #5073 (retention of complete typed calls), already fixed. A shared classification contract and evidence projection can retain facts while leaving detailed flags unknown.

Originally created by @morluto on GitHub (Oct 18, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5130 ### Before submitting - [x] I searched open and closed issues for a related report. - [x] I removed credentials and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior A controlled provider supplied a canonical-valid reference at `0x1004 -> 0x2000`, with unavailable detailed reference flags and Hopper-shaped `call` classification/provenance. Through the official SDK, `trace_native_ui_action` (`{"action":"0x1000","max_depth":1}`) discarded the observed call site and classification. When fallback enumeration failed, only an unresolved enumeration failure remained; successful fallback replaced the site with the procedure entry and marked the relationship inferred. ### Reproduction Ran eight controlled cases: `none/unknown/direct/objective_c` (raw types 0/1/2/3), each with failing or successful callee fallback. All eight passed the canonical reference parser and lost the exact site in the public MCP trace. This is a simulated production-boundary reproduction; no real Hopper analysis was run. ### Expected behavior Preserve provider-reported endpoints and partial classification/provenance independently of generic flags and fallback success. Keep provider-scoped observations distinct from target-only inferred routes; do not manufacture generic call flags or Objective-C dispatch joins. ### Impact and scope Confirmed loss in the shared trace reader and public MCP workflow under controlled inputs. Actual Hopper runtime frequency and cross-version behavior: NOT_ENOUGH_INFO; real-provider verification was not performed. ### REA version 65884350ff3373f2adc7337c1945eeb54334693f ### Runtime and platform Node 24.18.0; macOS arm64; installed Hopper 6.6.0-demo API documentation inspected, engine not invoked. ### Target and artifact context Controlled Mach-O arm64 subject; no executable was analyzed. ### Interface MCP ### Earliest failure stage Transport or result projection ### Relevant output or evidence Source: [NativeCallRoutes.ts](https://github.com/morluto/rea/blob/65884350ff3373f2adc7337c1945eeb54334693f/src/application/native/NativeCallRoutes.ts) omits `call` in its projection schema and selects only complete `kind.call` records. The canonical [referenceEdgeSchema](https://github.com/morluto/rea/blob/65884350ff3373f2adc7337c1945eeb54334693f/src/domain/hopperValues.ts) and [bridge producer](https://github.com/morluto/rea/blob/65884350ff3373f2adc7337c1945eeb54334693f/bridge/hopper_bridge.py) retain partial `CallReference` facts. Controlled probe: all eight canonical parses succeeded; zero public traces retained `0x1004` as reference location. ### Analysis The consumer requires richer classification than the producer can supply, then silently strips the available partial record. This is separate from #5073 (retention of complete typed calls), already fixed. A shared classification contract and evidence projection can retain facts while leaving detailed flags unknown.

bsakaguchi

2026-10-31 00:37:17 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-31 00:37:18 +00:00

Author

Owner

@morluto commented on GitHub (Oct 18, 2026):

Fixed on main in a80575c736.

Root cause: the trace reader stripped the canonical partial call record and required complete generic reference flags. Fallback could therefore erase observed sites and classification. The graph also overwrote evidence when multiple raw endpoints resolved to one containing procedure, and overwrote relation labels in enumeration order.

The shared leaf classification contract now feeds both the source parser and structured call_reference evidence. Provider-reported endpoint pairs remain provider_call/observed; target-only fallback remains inferred. Raw endpoints, label, numeric type and provenance survive fallback failures and node bounds. Shared graph edges accumulate their endpoint evidence, and relation participates in edge identity. No generic direct/indirect flags or Objective-C dispatch joins are inferred from Hopper enum ordinals.

Validation: corrected producer-shaped public regression on committed baseline658 was 10 fail/9 pass; final 72 focused tests across six files passed, including official SDK calls and converted/generated JSON Schema validation. The final 25-case public suite also passed with shared-edge evidence at the edge limit. Additional regressions demonstrated endpoint overwrite (2 fail/19 pass) and relation order dependence (4 fail/21 pass) before their fixes. Full typecheck/lint/architecture, docs checks (5 tests), discovery (1596 files), commit hooks and pre-push checks passed. An independent read-only review found no remaining blocker in this slice.

Costs: six completed equivalent controlled SDK workflows against baseline291059adb, with edge IDs excluded from semantic equivalence because identity now includes relation. Catalog estimate 806805 -> 807197 cl100k tokens, control trace 2299 -> 2301. Two repeated-process samples per variant had descriptive medians: elapsed 2.244 -> 2.469 s; CPU 2.981 -> 3.212 s; sampled process-family peak RSS 742522880 -> 726515712 bytes. These are small local samples, not an optimization claim or model-context measurement; complete serialized replies include the full catalog and duplicate text/structured content. True cold-cache, actual model delivery, partial/fault workload costs and cross-host behavior were not measured.

Limits: controlled providers only; bundled Hopper API documentation was inspected but the real engine was not run. Targetless CallReferences retain the existing site/reason representation; richer upstream targetless classification and duplicate identical endpoint reports were not changed or verified as separate runtime defects. The nearby function-comparison mixed-known/unknown-kind case is separately reproduced and remains under review with #4210. CI remains background; this comment does not claim the latest remote run is green.

@morluto commented on GitHub (Oct 18, 2026): Fixed on main in a80575c73652d8b43d7340654a48bd20a4eb966d. Root cause: the trace reader stripped the canonical partial `call` record and required complete generic reference flags. Fallback could therefore erase observed sites and classification. The graph also overwrote evidence when multiple raw endpoints resolved to one containing procedure, and overwrote relation labels in enumeration order. The shared leaf classification contract now feeds both the source parser and structured `call_reference` evidence. Provider-reported endpoint pairs remain `provider_call/observed`; target-only fallback remains inferred. Raw endpoints, label, numeric type and provenance survive fallback failures and node bounds. Shared graph edges accumulate their endpoint evidence, and relation participates in edge identity. No generic direct/indirect flags or Objective-C dispatch joins are inferred from Hopper enum ordinals. Validation: corrected producer-shaped public regression on committed baseline658 was 10 fail/9 pass; final 72 focused tests across six files passed, including official SDK calls and converted/generated JSON Schema validation. The final 25-case public suite also passed with shared-edge evidence at the edge limit. Additional regressions demonstrated endpoint overwrite (2 fail/19 pass) and relation order dependence (4 fail/21 pass) before their fixes. Full typecheck/lint/architecture, docs checks (5 tests), discovery (1596 files), commit hooks and pre-push checks passed. An independent read-only review found no remaining blocker in this slice. Costs: six completed equivalent controlled SDK workflows against baseline291059adb, with edge IDs excluded from semantic equivalence because identity now includes relation. Catalog estimate 806805 -> 807197 cl100k tokens, control trace 2299 -> 2301. Two repeated-process samples per variant had descriptive medians: elapsed 2.244 -> 2.469 s; CPU 2.981 -> 3.212 s; sampled process-family peak RSS 742522880 -> 726515712 bytes. These are small local samples, not an optimization claim or model-context measurement; complete serialized replies include the full catalog and duplicate text/structured content. True cold-cache, actual model delivery, partial/fault workload costs and cross-host behavior were not measured. Limits: controlled providers only; bundled Hopper API documentation was inspected but the real engine was not run. Targetless CallReferences retain the existing site/reason representation; richer upstream targetless classification and duplicate identical endpoint reports were not changed or verified as separate runtime defects. The nearby function-comparison mixed-known/unknown-kind case is separately reproduced and remains under review with #4210. CI remains background; this comment does not claim the latest remote run is green.

bsakaguchi referenced this issue

2026-10-31 01:13:20 +00:00

[PR #4532] fix(ghidra): admit recordless legacy MIPS32 carves missing section tables #6291

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471