morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7811] [Feature] `trace_android_references`: find APK callers of a framework or library method that the APK doesn't define #4647

New issue

Closed

opened 2026-10-31 00:51:48 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-31 00:51:48 +00:00

Owner

Originally created by @Rinkia on GitHub (Oct 28, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7811

Before submitting

I searched the open and closed issues (trace_android_references framework, external class, permission usage, android framework method callers) and found no related request.

Problem

A common Android question is "which code in this APK calls API X?", for example to explain why an app requests a permission: DownloadManager.Request.setNotificationVisibility(VISIBILITY_HIDDEN) for DOWNLOAD_WITHOUT_NOTIFICATION, AlarmManager.setExact* for SCHEDULE_EXACT_ALARM, AdvertisingIdClient.getAdvertisingIdInfo for AD_ID. trace-android-references only accepts classes defined in the APK:

rea trace-android-references NewPipe_v0.29.1.apk android.app.NotificationManager --method-name notify
→ invalid_request: Exact class not found: android.app.NotificationManager; use search_android_classes to discover fully qualified names.

(NewPipe_v0.29.1.apk from the GitHub release, sha256 18447bfb…ab79.)

The method references are in the DEX method_ids, and JADX resolves the call sites, but REA offers no way to ask for them. In a permission review of a real app I had to fall back to dexdump -d over all classes*.dex and grep the invoke-* lines. That works (it found the three setNotificationVisibility callers and their constant arguments), but it's outside REA, so there's no Evidence and no link to inspect-android-method.

Proposed behavior

Accept an external class and method, identified by the DEX method reference (Landroid/app/DownloadManager$Request;->setNotificationVisibility(I)Landroid/app/DownloadManager$Request;) or by class plus method name. Return the calling APK methods with the same identity inspect-android-method uses, so a caller can be decompiled next. Report the target as external (no body in the APK) rather than "not found".

Scope

Static only. Overload selection works like it does today, from the descriptor. Calls through reflection or JNI stay out of scope, and the result can say so.

Originally created by @Rinkia on GitHub (Oct 28, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7811 ### Before submitting - [x] I searched the open and closed issues (trace_android_references framework, external class, permission usage, android framework method callers) and found no related request. ### Problem A common Android question is "which code in this APK calls API X?", for example to explain why an app requests a permission: `DownloadManager.Request.setNotificationVisibility(VISIBILITY_HIDDEN)` for `DOWNLOAD_WITHOUT_NOTIFICATION`, `AlarmManager.setExact*` for `SCHEDULE_EXACT_ALARM`, `AdvertisingIdClient.getAdvertisingIdInfo` for `AD_ID`. `trace-android-references` only accepts classes defined in the APK: ``` rea trace-android-references NewPipe_v0.29.1.apk android.app.NotificationManager --method-name notify → invalid_request: Exact class not found: android.app.NotificationManager; use search_android_classes to discover fully qualified names. ``` (`NewPipe_v0.29.1.apk` from the GitHub release, sha256 `18447bfb…ab79`.) The method references are in the DEX `method_ids`, and JADX resolves the call sites, but REA offers no way to ask for them. In a permission review of a real app I had to fall back to `dexdump -d` over all `classes*.dex` and grep the `invoke-*` lines. That works (it found the three `setNotificationVisibility` callers and their constant arguments), but it's outside REA, so there's no Evidence and no link to `inspect-android-method`. ### Proposed behavior Accept an external class and method, identified by the DEX method reference (`Landroid/app/DownloadManager$Request;->setNotificationVisibility(I)Landroid/app/DownloadManager$Request;`) or by class plus method name. Return the calling APK methods with the same identity `inspect-android-method` uses, so a caller can be decompiled next. Report the target as `external` (no body in the APK) rather than "not found". ### Scope Static only. Overload selection works like it does today, from the descriptor. Calls through reflection or JNI stay out of scope, and the result can say so.

bsakaguchi closed this issue

2026-10-31 00:51:49 +00:00

bsakaguchi commented

2026-10-31 00:51:52 +00:00

Author

Owner

@xu91102 commented on GitHub (Oct 30, 2026):

I verified the requested gap on fresh main 317bf3fe235e655b2d752d3be261cc0da7d00f2b before implementation, using the real public compiled CLI, the pinned unmodified JADX headless 0.7.1 JAR (SHA-256 6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75), JDK 21 and a deterministic owned APK assembled through the bundled Smali API. No APK code was executed; its input digest stayed unchanged.

The APK defines fixture.Caller and fixture.Target, with two direct invokes of android.app.NotificationManager.notify(int, Notification) and one invoke of its (String, int, Notification) overload. Both the ordinary external query and --overload-index 0 stop at invalid_request / class_name: Exact class not found: android.app.NotificationManager. The defined fixture.Target.mark() reference control succeeds with one using node, and its caller body can be inspected successfully; an entirely absent class/method remains a correctly rejected negative control. This is a demonstrated limitation of the current APK-defined selection contract, not a claim that conservative unknown handling is a defect. An initial probe used the wrong inspect-method flag; that raw harness failure is retained and the corrected positional control passed.

I checked the actual related production patches in #7772 (engine pin/tool schemas), merged #2439 (defined-method DEX descriptors and invoke offsets), #6968 (raw/display class selectors), #3840 (resource-id references), #7245 (JNI/JNA and structural projections), and #4473 (offline debug metadata). None of those inspected paths adds incoming external-method target selection. The specific #7811 and external-Android PR searches found no public implementation; this does not establish anything about unpublished local work. I did not run their heads.

Proposed bounded extension: keep the existing shared trace_android_references workflow, admit an external class+method only from observed exact DEX method references, select ambiguous observed prototypes explicitly, and retain caller identities/direct-invoke offsets. Mark the target as externally referenced and the coverage scope as direct DEX invokes, without pretending it has a body or an exhaustive framework class definition. Defined-class inspection and reference behavior, absent/ambiguous selectors, immutable APK identity, frame/resource bounds, cancellation and cleanup must remain intact. No new provider, target execution, network access or mutation authority is proposed. No implementation has been made yet.

Implementation update — 2026-10-30T05:54:18.909399+00:00

Upstream Draft #8096: https://github.com/morluto/rea/pull/8096

Normal fork head 6fcda30f9b1185ce470c123ec5c9ad7b7ff28d5a (parent main317bf3fe). The shared bridge observes exact external METHOD_REF invokes and preserves complete caller selectors separately from optional instruction positions; defined/class-only/inspection semantics and cleanup ownership remain. A real10,000-site caller plus10later callers now preserves all11 selectors with explicit partial sites, rather than misreporting caller-inventory exhaustion.

Final local evidence:423focused +9README =432distinct PASS/1existingWindows skip, fullcheck/docs/discovery/package and pack pass; pinned unmodified JADX0.7.1/JDK21 full real Android lane pass. New tar2661archive/current/installed bytes match;14 actual installed CLI calls and3stdio MCP sessions/24 calls pass with original APK hashes and awaited cleanup. Independent final Standards/Spec both PASS; normal hook byte gate passed before push. Original RED/FAIL/HARNESS and the pre-push normalization rejection remain preserved.

The PR is Draft with3human declarations unchecked. Upstream CI/Codex/human/maintainer review are separate and are not inferred from local runs. No target APK execution, Android device/emulator/runtime dispatch/reflection, Windows/Linux host or general performance claim.

Review-fix delivery — 2026-10-30

PR #8096 now contains normal fork commit fdfaa08171c8d9f75cf63c2f0a2e1935eeb53de9 (parent6fcda30f). Three concrete review points are fixed in the shared owner: preflight prototype lengths before descriptor/signature copies, reuse one bounded external inventory for the current exact JADX session/query, and include exact DEX prototypes in external overload ambiguity. Session replacement, typed refusal/recovery and caller/invoke freshness remain covered. A JS worker CI fixture now uses its existing framed observer and awaits the original abort event; production worker/cancellation/timeouts/retries/skips are unchanged, and the exact original CI chunk/timer cause remains unknown.

Final local accounting is22distinct files/469PASS/1existingWindows skip (overlapping tests replaced, not accumulated). Final source check/discovery PASS; retained same-product gates cover full real official-JADX lane,7 compiled CLI controls/3MCP sessions25calls,15 installed CLI/3MCP sessions25calls,233tools6prompts, package/update/lineage/awaited cleanup and2661 exact product bytes. Final independent Standards/Spec V5 both PASS. Normal hook/full byte gate passed before fork push and postpush/API readback matched. Earlier RED/FAIL/HARNESS remains preserved.

Current GitHub readback is OPEN/nonDraft; its ready event and3checked author declarations already existed before this metadata update and are preserved, without an agent ready or human-attestation action. Upstream current-head CI/Codex and maintainer scope approval are separate; no success is inferred from local runs. The earlier6fc CI failure remains historical. No issue close, foreign reply or target APK execution. Device/emulator/runtime dispatch/reflection/external bodies/other host/full agent/performance remain unverified.

@xu91102 commented on GitHub (Oct 30, 2026): I verified the requested gap on fresh main `317bf3fe235e655b2d752d3be261cc0da7d00f2b` before implementation, using the real public compiled CLI, the pinned unmodified JADX headless 0.7.1 JAR (SHA-256 `6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75`), JDK 21 and a deterministic owned APK assembled through the bundled Smali API. No APK code was executed; its input digest stayed unchanged. The APK defines `fixture.Caller` and `fixture.Target`, with two direct invokes of `android.app.NotificationManager.notify(int, Notification)` and one invoke of its `(String, int, Notification)` overload. Both the ordinary external query and `--overload-index 0` stop at `invalid_request` / `class_name`: `Exact class not found: android.app.NotificationManager`. The defined `fixture.Target.mark()` reference control succeeds with one using node, and its caller body can be inspected successfully; an entirely absent class/method remains a correctly rejected negative control. This is a demonstrated limitation of the current APK-defined selection contract, not a claim that conservative unknown handling is a defect. An initial probe used the wrong inspect-method flag; that raw harness failure is retained and the corrected positional control passed. I checked the actual related production patches in #7772 (engine pin/tool schemas), merged #2439 (defined-method DEX descriptors and invoke offsets), #6968 (raw/display class selectors), #3840 (resource-id references), #7245 (JNI/JNA and structural projections), and #4473 (offline debug metadata). None of those inspected paths adds incoming external-method target selection. The specific #7811 and external-Android PR searches found no public implementation; this does not establish anything about unpublished local work. I did not run their heads. Proposed bounded extension: keep the existing shared `trace_android_references` workflow, admit an external class+method only from observed exact DEX method references, select ambiguous observed prototypes explicitly, and retain caller identities/direct-invoke offsets. Mark the target as externally referenced and the coverage scope as direct DEX invokes, without pretending it has a body or an exhaustive framework class definition. Defined-class inspection and reference behavior, absent/ambiguous selectors, immutable APK identity, frame/resource bounds, cancellation and cleanup must remain intact. No new provider, target execution, network access or mutation authority is proposed. No implementation has been made yet. ### Implementation update — 2026-10-30T05:54:18.909399+00:00 Upstream Draft #8096: https://github.com/morluto/rea/pull/8096 Normal fork head `6fcda30f9b1185ce470c123ec5c9ad7b7ff28d5a` (parent main317bf3fe). The shared bridge observes exact external METHOD_REF invokes and preserves complete caller selectors separately from optional instruction positions; defined/class-only/inspection semantics and cleanup ownership remain. A real10,000-site caller plus10later callers now preserves all11 selectors with explicit partial sites, rather than misreporting caller-inventory exhaustion. Final local evidence:423focused +9README =432distinct PASS/1existingWindows skip, fullcheck/docs/discovery/package and pack pass; pinned unmodified JADX0.7.1/JDK21 full real Android lane pass. New tar2661archive/current/installed bytes match;14 actual installed CLI calls and3stdio MCP sessions/24 calls pass with original APK hashes and awaited cleanup. Independent final Standards/Spec both PASS; normal hook byte gate passed before push. Original RED/FAIL/HARNESS and the pre-push normalization rejection remain preserved. The PR is Draft with3human declarations unchecked. Upstream CI/Codex/human/maintainer review are separate and are not inferred from local runs. No target APK execution, Android device/emulator/runtime dispatch/reflection, Windows/Linux host or general performance claim. ### Review-fix delivery — 2026-10-30 PR #8096 now contains normal fork commit `fdfaa08171c8d9f75cf63c2f0a2e1935eeb53de9` (parent6fcda30f). Three concrete review points are fixed in the shared owner: preflight prototype lengths before descriptor/signature copies, reuse one bounded external inventory for the current exact JADX session/query, and include exact DEX prototypes in external overload ambiguity. Session replacement, typed refusal/recovery and caller/invoke freshness remain covered. A JS worker CI fixture now uses its existing framed observer and awaits the original abort event; production worker/cancellation/timeouts/retries/skips are unchanged, and the exact original CI chunk/timer cause remains unknown. Final local accounting is22distinct files/469PASS/1existingWindows skip (overlapping tests replaced, not accumulated). Final source check/discovery PASS; retained same-product gates cover full real official-JADX lane,7 compiled CLI controls/3MCP sessions25calls,15 installed CLI/3MCP sessions25calls,233tools6prompts, package/update/lineage/awaited cleanup and2661 exact product bytes. Final independent Standards/Spec V5 both PASS. Normal hook/full byte gate passed before fork push and postpush/API readback matched. Earlier RED/FAIL/HARNESS remains preserved. Current GitHub readback is OPEN/nonDraft; its ready event and3checked author declarations already existed before this metadata update and are preserved, without an agent ready or human-attestation action. Upstream current-head CI/Codex and maintainer scope approval are separate; no success is inferred from local runs. The earlier6fc CI failure remains historical. No issue close, foreign reply or target APK execution. Device/emulator/runtime dispatch/reflection/external bodies/other host/full agent/performance remain unverified.

bsakaguchi referenced this issue

2026-10-31 01:13:41 +00:00

[PR #4647] [CLOSED] fix(cli): return canonical Frida device identifiers #6340

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4647

No description provided.

Rows
Columns

[GH-ISSUE #7811] [Feature] trace_android_references: find APK callers of a framework or library method that the APK doesn't define #4647