[GH-ISSUE #1246] feat(native): inspect data-region accesses and overlapping field candidates #443

New issue

Open

opened 2026-10-15 18:25:06 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:25:06 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1246

Current limitation

Exact-address xrefs and data_type queries do not compose a view of neighboring storage, access widths, base-plus-offset fields and unclassified intervals. A procedure-seeded native value trace answers a different question. Repeated reconstruction feedback requests this region view to avoid assigning independent source globals to shared storage.

Evidence and scope

The real latest-version query xrefs(0x43f8e4) returns no exact references, while related reviewed routines use an owner pointer plus field offsets. An empty exact-reference result is correct for its examined scope; it does not prove padding or absence of use. The installed tool inventory and source have no general region-access workflow joining these observations.

Required behavior

Inspect one caller-selected data region and return observed access locations/widths, defined database types, overlapping alias candidates and untyped intervals. Distinguish decoded accesses, provider-inferred references and derived field hypotheses. Report examined procedure/reference coverage and unresolved indirect accesses.

Keep minimum reviewed field extent separate from total object size; do not infer source struct ownership, join adjacent globals automatically or invent runtime writes. Preserve shared-storage/copy coupling alongside separate function-owned/body-span boundaries. Use ordinary composable inputs, without a reconstruction-specific orchestration language.

Validate source-owned fixtures with direct and base-plus-offset accesses, overlapping widths, adjacent untyped storage and no observed references. Equivalent CLI/MCP results must include enough facts for analyst review.

src/domain/native/nativeValueTrace.ts:5 is procedure-seeded. Related typed reference work is narrower; #482 delivered native value tracing and does not establish a complete global-region index.

Verification and scope

Current exact-address behavior was reproduced; the missing composed region capability is source/catalog-confirmed. Historical reconstruction conclusions and runtime storage tests were not rerun, and this is not a provider correctness defect.

Audit date: 2026-10-09. Latest npm dist-tag verified as rea-agents@6.1.0; current main tested at f4c99ab8a53806dd57dc24b3d5a600905bcb4686. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1246 ### Current limitation Exact-address xrefs and `data_type` queries do not compose a view of neighboring storage, access widths, base-plus-offset fields and unclassified intervals. A procedure-seeded native value trace answers a different question. Repeated reconstruction feedback requests this region view to avoid assigning independent source globals to shared storage. ### Evidence and scope The real latest-version query `xrefs(0x43f8e4)` returns no exact references, while related reviewed routines use an owner pointer plus field offsets. An empty exact-reference result is correct for its examined scope; it does not prove padding or absence of use. The installed tool inventory and source have no general region-access workflow joining these observations. ### Required behavior Inspect one caller-selected data region and return observed access locations/widths, defined database types, overlapping alias candidates and untyped intervals. Distinguish decoded accesses, provider-inferred references and derived field hypotheses. Report examined procedure/reference coverage and unresolved indirect accesses. Keep minimum reviewed field extent separate from total object size; do not infer source struct ownership, join adjacent globals automatically or invent runtime writes. Preserve shared-storage/copy coupling alongside separate function-owned/body-span boundaries. Use ordinary composable inputs, without a reconstruction-specific orchestration language. Validate source-owned fixtures with direct and base-plus-offset accesses, overlapping widths, adjacent untyped storage and no observed references. Equivalent CLI/MCP results must include enough facts for analyst review. ### Related boundaries [src/domain/native/nativeValueTrace.ts:5](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/src/domain/native/nativeValueTrace.ts#L5) is procedure-seeded. Related typed reference work is narrower; #482 delivered native value tracing and does not establish a complete global-region index. ### Verification and scope Current exact-address behavior was reproduced; the missing composed region capability is source/catalog-confirmed. Historical reconstruction conclusions and runtime storage tests were not rerun, and this is not a provider correctness defect. Audit date: 2026-10-09. Latest npm dist-tag verified as `rea-agents@6.1.0`; current main tested at `f4c99ab8a53806dd57dc24b3d5a600905bcb4686`. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

bsakaguchi added the

P3: low

area: domain

enhancement

labels

2026-10-15 18:25:06 +00:00

bsakaguchi commented

2026-10-15 18:25:06 +00:00

Author

Owner

@Sravan1011 commented on GitHub (Oct 9, 2026):

@N0zoM1z0 I'll take this one