morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #71] Add approval-gated Objective-C runtime observation #58

New issue

Open

opened 2026-10-15 18:20:37 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:20:37 +00:00

Owner

Originally created by @morluto on GitHub (Jul 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/71

Problem

Static analysis cannot establish actual Objective-C receivers, arguments, callbacks, errors, lifetimes, or permission-dependent paths.

Outcome

Add bounded LLDB and/or Frida capabilities correlated with static function evidence.

Contract

Trace specs declare an owned target, class/selector/symbol/module filters, entry/return capture, decode limits, duration/event/recursion/memory bounds, hook failure policy, redaction, and optional static evidence IDs.

Return calls with thread/image/symbol/class/selector/receiver where observed, bounded arguments/results/errors, backtrace locations, native-addon boundaries, correlations, missed/decode/unsupported metadata.

Safety

Require approval and owned-process validation. No arbitrary expression evaluation or unrelated attachment. Bound reads/descriptions, redact secrets/content, restore hooks and detach cleanly, and report entitlement/SIP/TCC/debugger limits.

Acceptance criteria

Signed fixtures prove entry/return, callbacks, errors, lifetimes, static/runtime correlation, native-addon arguments, typed denial/unavailability, and clean detach/crash/timeout behavior.

Dependencies

Parent #36. Requires clean-room macOS, provider SDK, ownership, and bundles.

Non-goals

Anti-debug bypass, arbitrary attachment, kernel tracing, or general interactive debugger exposure.

Originally created by @morluto on GitHub (Jul 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/71 ## Problem Static analysis cannot establish actual Objective-C receivers, arguments, callbacks, errors, lifetimes, or permission-dependent paths. ## Outcome Add bounded LLDB and/or Frida capabilities correlated with static function evidence. ## Contract Trace specs declare an owned target, class/selector/symbol/module filters, entry/return capture, decode limits, duration/event/recursion/memory bounds, hook failure policy, redaction, and optional static evidence IDs. Return calls with thread/image/symbol/class/selector/receiver where observed, bounded arguments/results/errors, backtrace locations, native-addon boundaries, correlations, missed/decode/unsupported metadata. ## Safety Require approval and owned-process validation. No arbitrary expression evaluation or unrelated attachment. Bound reads/descriptions, redact secrets/content, restore hooks and detach cleanly, and report entitlement/SIP/TCC/debugger limits. ## Acceptance criteria Signed fixtures prove entry/return, callbacks, errors, lifetimes, static/runtime correlation, native-addon arguments, typed denial/unavailability, and clean detach/crash/timeout behavior. ## Dependencies Parent #36. Requires clean-room macOS, provider SDK, ownership, and bundles. ## Non-goals Anti-debug bypass, arbitrary attachment, kernel tracing, or general interactive debugger exposure.

bsakaguchi added the

labels

2026-10-15 18:20:37 +00:00

bsakaguchi commented

2026-10-15 18:20:38 +00:00

Author

Owner

@morluto commented on GitHub (Jul 20, 2026):

Split into focused child issues:

#385

These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

@morluto commented on GitHub (Jul 20, 2026): Split into focused child issues: - [ ] #385 These replace the broad remaining scope in this issue. Closing this parent can happen once all children are closed.

bsakaguchi added

enhancement

and removed

enhancement

labels

2026-10-31 00:28:41 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#58

No description provided.

Rows
Columns