[GH-ISSUE #1846] [Bug] Android method inspection loses executable static initializer evidence #624

New issue

Closed

opened 2026-10-15 18:26:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:43 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1846

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction; provider or capability discovery.

Observed behavior

inspect_android_class lists <clinit> and a field initialized by it, but inspect_android_method returns unavailable source with a native/abstract explanation. Original DEX method flags and a nonempty code item establish executable initialization. The initialization is present in the decompiled whole-class field representation.

Reproduction

Inspect an APK class with a static collection field initialized in <clinit>.
Select the listed <clinit> using its exact class name and overload index.
Compare the returned method source/status with the original method flags/code item and the whole-class initialization representation.

Expected behavior

Retrieve the exact initialization evidence or an accurate original-bytecode fallback. Distinguish source folded into a field from native/abstract methods and genuinely unavailable source.

Impact and scope

An analyst cannot retrieve policy-defining initialization through the selected method workflow. Other ordinary method bodies remain available.

REA version

Observed at source revision 97c0348e6bef62bb7183d52bcebea8299c5b3afe; current-main reproduction is part of the investigation.

Runtime and platform

Linux x86_64, Node.js 24.18.0. Heavy operations used a one-CPU, 3-GiB process-tree limit.

Interface

MCP; the shared CLI workflow should be verified where applicable.

Earliest failure stage

Native analysis or reconstruction; provider result interpretation.

Relevant output or evidence

body_status=not_available, representation=java, fell_back=false; source text: // method exists but has no decompiled body (native/abstract). The original observed method has flags 0x10008 and 40 instruction units.

Analysis or suspected cause

src/android/JadxAnalysis.ts recognizes this provider stub. The producing provider/source representation must be investigated before selecting a fallback. Preserve exact method identity and source provenance; do not infer native/abstract from missing Java text alone.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1846 ### Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction; provider or capability discovery. ### Observed behavior `inspect_android_class` lists `<clinit>` and a field initialized by it, but `inspect_android_method` returns unavailable source with a native/abstract explanation. Original DEX method flags and a nonempty code item establish executable initialization. The initialization is present in the decompiled whole-class field representation. ### Reproduction 1. Inspect an APK class with a static collection field initialized in `<clinit>`. 2. Select the listed `<clinit>` using its exact class name and overload index. 3. Compare the returned method source/status with the original method flags/code item and the whole-class initialization representation. ### Expected behavior Retrieve the exact initialization evidence or an accurate original-bytecode fallback. Distinguish source folded into a field from native/abstract methods and genuinely unavailable source. ### Impact and scope An analyst cannot retrieve policy-defining initialization through the selected method workflow. Other ordinary method bodies remain available. ### REA version Observed at source revision `97c0348e6bef62bb7183d52bcebea8299c5b3afe`; current-main reproduction is part of the investigation. ### Runtime and platform Linux x86_64, Node.js 24.18.0. Heavy operations used a one-CPU, 3-GiB process-tree limit. ### Interface MCP; the shared CLI workflow should be verified where applicable. ### Earliest failure stage Native analysis or reconstruction; provider result interpretation. ### Relevant output or evidence `body_status=not_available`, `representation=java`, `fell_back=false`; source text: `// method exists but has no decompiled body (native/abstract)`. The original observed method has flags `0x10008` and 40 instruction units. ### Analysis or suspected cause `src/android/JadxAnalysis.ts` recognizes this provider stub. The producing provider/source representation must be investigated before selecting a fallback. Preserve exact method identity and source provenance; do not infer native/abstract from missing Java text alone.

bsakaguchi

2026-10-15 18:26:43 +00:00