[GH-ISSUE #1794] [Bug] Headless IDA reports no callees on ARM64 targets #606

New issue

Closed

opened 2026-10-15 18:26:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:33 +00:00

Owner

Originally created by @nikolay-dementiev on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1794

I'm working on this and will open a PR.

Before submitting

I searched the open and closed issues and pull requests for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

With the headless IDA profile on an arm64 Mach-O, function Evidence lists no callees and the call-graph workflows see no edges, although the function calls two others:

rea function <binary> _main --json -> normalized_result.callees: []
get_call_graph from _main (forward) -> {"0": [{"address": "0x100000460", "status": "ok", "calls": []}]}
trace_call_path from _main (forward) -> one node, no edges, no failures, no residual unknowns

The empty list is reported as an observed result, so a caller cannot tell "calls nothing" from "calls were not observed".

Reproduction

// hello.c
#include <stdio.h>
int square(int x) { return x * x; }
int main(void) { printf("%d\n", square(7)); return 0; }

clang -O0 -arch arm64 -o hello hello.c
REA_IDA_MCP_CONFIG=<dir>/ida-mcp.json REA_ANALYSIS_PROVIDER=ida rea function hello _main --json

Registration: upstream ida-pro-mcp at c133c3853faa111a9b00ee615c013b720d0c4acd (the commit named in docs/testing.md), headless idalib-mcp --stdio.

Expected behavior

callees of _main include _square and _printf, and the call-graph workflows show those edges; or, where the provider cannot observe call edges, the relationship is reported as unknown with a limitation instead of an empty observed list.

Impact and scope

Every non-x86 target analysed through the headless IDA profile (observed on ARM64). x86/x64 targets are not affected, which is presumably why the Windows x64 real workflow did not show it.

REA version

rea-agents 6.4.0 and main at ce845ba42.

Runtime and platform

macOS 26.5.2 (arm64), Node 26.3.0; IDA Professional 9.1 (9.1.250226) with idalib; ida-pro-mcp 2.0.0 at c133c3853.

Target and artifact context

The 3-line hello.c above, built with clang -O0 -arch arm64. No private target data.

Interface

CLI and MCP.

Earliest failure stage

Native analysis or reconstruction

Analysis or suspected cause

Source-derived and checked with idalib on IDA 9.1:

REA's modern profile reads callees from the upstream callees tool (IdaOperationRunner.relationships, callees with addrs: [address]).
Upstream callees (api_analysis.py:1671 at c133c385) recognises a call only when insn.itype is one of the x86 ids NN_call / NN_callfi / NN_callni. On ARM64 both calls in _main are BL with itype 4 (NN_call is 16), so the tool returns an empty list. Reported upstream: https://github.com/mrexodia/ida-pro-mcp/issues/549.
The call xrefs are there: IDA records fl_CN code xrefs from both BL instructions to _square and to the _printf stub. Upstream callgraph reads call xrefs and is processor-neutral at the same commit: on this database callees with addrs: ["_main"] returns {"addr": "_main", "callees": [], "more": false}, while callgraph with roots: ["_main"], max_depth: 1 returns the edges _main -> _square and _main -> _printf (type call).

Typed outcome or recovery expected

Callee edges on ARM64 from a processor-neutral source, or an explicit unknown with a limitation when they cannot be observed; never an empty observed list for unobserved edges.

Originally created by @nikolay-dementiev on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1794 > I'm working on this and will open a PR. ### Before submitting - [x] I searched the open and closed issues and pull requests for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior With the headless IDA profile on an arm64 Mach-O, function Evidence lists no callees and the call-graph workflows see no edges, although the function calls two others: - `rea function <binary> _main --json` -> `normalized_result.callees: []` - `get_call_graph` from `_main` (forward) -> `{"0": [{"address": "0x100000460", "status": "ok", "calls": []}]}` - `trace_call_path` from `_main` (forward) -> one node, no edges, no failures, no residual unknowns The empty list is reported as an observed result, so a caller cannot tell "calls nothing" from "calls were not observed". ### Reproduction ```c // hello.c #include <stdio.h> int square(int x) { return x * x; } int main(void) { printf("%d\n", square(7)); return 0; } ``` ```bash clang -O0 -arch arm64 -o hello hello.c REA_IDA_MCP_CONFIG=<dir>/ida-mcp.json REA_ANALYSIS_PROVIDER=ida rea function hello _main --json ``` Registration: upstream ida-pro-mcp at `c133c3853faa111a9b00ee615c013b720d0c4acd` (the commit named in docs/testing.md), headless `idalib-mcp --stdio`. ### Expected behavior `callees` of `_main` include `_square` and `_printf`, and the call-graph workflows show those edges; or, where the provider cannot observe call edges, the relationship is reported as unknown with a limitation instead of an empty observed list. ### Impact and scope Every non-x86 target analysed through the headless IDA profile (observed on ARM64). x86/x64 targets are not affected, which is presumably why the Windows x64 real workflow did not show it. ### REA version rea-agents 6.4.0 and `main` at ce845ba42. ### Runtime and platform macOS 26.5.2 (arm64), Node 26.3.0; IDA Professional 9.1 (9.1.250226) with idalib; ida-pro-mcp 2.0.0 at c133c3853. ### Target and artifact context The 3-line `hello.c` above, built with `clang -O0 -arch arm64`. No private target data. ### Interface CLI and MCP. ### Earliest failure stage Native analysis or reconstruction ### Analysis or suspected cause Source-derived and checked with idalib on IDA 9.1: - REA's modern profile reads callees from the upstream `callees` tool (`IdaOperationRunner.relationships`, `callees` with `addrs: [address]`). - Upstream `callees` (`api_analysis.py:1671` at c133c385) recognises a call only when `insn.itype` is one of the x86 ids `NN_call` / `NN_callfi` / `NN_callni`. On ARM64 both calls in `_main` are `BL` with `itype` 4 (`NN_call` is 16), so the tool returns an empty list. Reported upstream: https://github.com/mrexodia/ida-pro-mcp/issues/549. - The call xrefs are there: IDA records `fl_CN` code xrefs from both `BL` instructions to `_square` and to the `_printf` stub. Upstream `callgraph` reads call xrefs and is processor-neutral at the same commit: on this database `callees` with `addrs: ["_main"]` returns `{"addr": "_main", "callees": [], "more": false}`, while `callgraph` with `roots: ["_main"], max_depth: 1` returns the edges `_main -> _square` and `_main -> _printf` (type `call`). ### Typed outcome or recovery expected Callee edges on ARM64 from a processor-neutral source, or an explicit unknown with a limitation when they cannot be observed; never an empty observed list for unobserved edges.

bsakaguchi

2026-10-15 18:26:33 +00:00