[GH-ISSUE #8472] [Feature] Gadget search over analyzed instruction inventories (ROPgadget-shaped, evidence-carrying) #6617

New issue

Open

opened 2026-11-01 21:12:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:12:43 +00:00

Owner

Originally created by @lostsock1 on GitHub (Nov 1, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/8472

Context

Community resource maps for agent-assisted reverse engineering (e.g. the October 2026 "AI reverse-engineering toolkit" roundup on r/SATNA_PROJECT, mirrored at reamcp.dev) consistently list ROPgadget and Keystone alongside the core native toolkit. REA currently has no gadget-search lane: an investigator wanting ROP gadgets or an assembly check has to leave the evidence-carrying workflow and run external tools whose output loses provenance.

Suggested direction

A provider-neutral gadget search projected over deep-provider instruction inventories: enumerate instructions/sequences ending in control flow (ret, jmp, call, syscall) within analyzed procedures, filtered by caller pattern, returned as Evidence with procedure/offset provenance.
This composes with existing lanes: rea_read_function_instructions / provider instruction listings already hold the data; a gadget view is a projection over them, not a new producer.
Keystone-style assembly is a different question (input crafting, not analysis) — probably out of scope unless a concrete workflow demonstrates it.

Open questions

Provider operation (per-engine bridge call) vs application-layer projection over already-listed instructions?
Whole-program enumeration cost on large binaries — page or budget?
Should results carry the instruction bytes so downstream tooling can consume them without re-querying?

Happy to prototype once a scope decision lands.

Originally created by @lostsock1 on GitHub (Nov 1, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/8472 ## Context Community resource maps for agent-assisted reverse engineering (e.g. the October 2026 "AI reverse-engineering toolkit" roundup on r/SATNA_PROJECT, mirrored at reamcp.dev) consistently list ROPgadget and Keystone alongside the core native toolkit. REA currently has no gadget-search lane: an investigator wanting ROP gadgets or an assembly check has to leave the evidence-carrying workflow and run external tools whose output loses provenance. ## Suggested direction - A provider-neutral gadget search projected over deep-provider instruction inventories: enumerate instructions/sequences ending in control flow (`ret`, `jmp`, `call`, `syscall`) within analyzed procedures, filtered by caller pattern, returned as Evidence with procedure/offset provenance. - This composes with existing lanes: `rea_read_function_instructions` / provider instruction listings already hold the data; a gadget view is a projection over them, not a new producer. - Keystone-style assembly is a different question (input crafting, not analysis) — probably out of scope unless a concrete workflow demonstrates it. ## Open questions 1. Provider operation (per-engine bridge call) vs application-layer projection over already-listed instructions? 2. Whole-program enumeration cost on large binaries — page or budget? 3. Should results carry the instruction bytes so downstream tooling can consume them without re-querying? Happy to prototype once a scope decision lands.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6617

No description provided.

Rows
Columns