[GH-ISSUE #2355] [Feature] Inspect recorded Windows minidump streams without a live target #780

New issue

Open

opened 2026-10-15 18:28:16 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-15 18:28:16 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 12, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2355

Analyst question and current scope

The current recorded-crash result declares elf-core and the guide only admits the Linux amd64 profile. A caller-selected Windows minidump needs a distinct parser/profile for its stream directory, recorded threads, modules, exception data and present memory ranges.

Acceptance criteria

Define an initial architecture/stream subset and retain original file identity plus validated RVA/size source ranges.
Report recorded thread contexts, exception facts and module/memory descriptors independently; unavailable memory and unknown streams remain explicit.
Separate historical process/thread IDs and recorded module paths from current process or filesystem identities.
Verify original valid, truncated, overlapping and incomplete dump fixtures with bounds, cancellation, cleanup and CLI/MCP parity; no attach or implicit symbol download.

https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header

This is a recorded-file feature under the crash-evidence domain. It is distinct from live native debugger adapters in #1267.

Priority: P2. The current surface was checked at upstream 1c3791430, and open/closed issues were searched before filing. Proposed file-analysis features need their own spec/plan/tasks under docs/specs/. If implementation requires a new provider or expands execution authority, obtain the maintainer scope decision required by CONTRIBUTING.md before integration; this proposal itself does not authorize that expansion.

Originally created by @matbrgz on GitHub (Oct 12, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2355 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Analyst question and current scope The current recorded-crash result declares elf-core and the guide only admits the Linux amd64 profile. A caller-selected Windows minidump needs a distinct parser/profile for its stream directory, recorded threads, modules, exception data and present memory ranges. ## Acceptance criteria - [ ] Define an initial architecture/stream subset and retain original file identity plus validated RVA/size source ranges. - [ ] Report recorded thread contexts, exception facts and module/memory descriptors independently; unavailable memory and unknown streams remain explicit. - [ ] Separate historical process/thread IDs and recorded module paths from current process or filesystem identities. - [ ] Verify original valid, truncated, overlapping and incomplete dump fixtures with bounds, cancellation, cleanup and CLI/MCP parity; no attach or implicit symbol download. ## Source and related work - https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/ns-minidumpapiset-minidump_header This is a recorded-file feature under the crash-evidence domain. It is distinct from live native debugger adapters in #1267. Priority: P2. The current surface was checked at upstream 1c3791430, and open/closed issues were searched before filing. Proposed file-analysis features need their own spec/plan/tasks under docs/specs/. If implementation requires a new provider or expands execution authority, obtain the maintainer scope decision required by CONTRIBUTING.md before integration; this proposal itself does not authorize that expansion.

bsakaguchi added the

area: runtime

enhancement

P2: medium

labels

2026-10-15 18:28:16 +00:00

bsakaguchi commented

2026-10-15 18:28:17 +00:00

Author

Owner

@matbrgz commented on GitHub (Oct 12, 2026):

Implementation & Scope Notes

Objective (ELI5):
Read Windows minidump files (.dmp) offline as static artifacts, extracting thread lists, system info, module lists, and crash exception records without requiring WinDbg.

Design Strategy:

Pure static binary stream parser reading standard Minidump stream headers (SystemInfoStream, ExceptionStream, ThreadListStream, ModuleListStream).
Retains thread context registers and stack memory ranges for downstream call unwinding.

@matbrgz commented on GitHub (Oct 12, 2026): ### Implementation & Scope Notes **Objective (ELI5):** Read Windows minidump files (`.dmp`) offline as static artifacts, extracting thread lists, system info, module lists, and crash exception records without requiring WinDbg. **Design Strategy:** - Pure static binary stream parser reading standard Minidump stream headers (`SystemInfoStream`, `ExceptionStream`, `ThreadListStream`, `ModuleListStream`). - Retains thread context registers and stack memory ranges for downstream call unwinding.

bsakaguchi referenced this issue

2026-10-16 21:16:04 +00:00

[PR #780] [CLOSED] fix(browser): resolve DOM destinations against document base URL #2237

bsakaguchi referenced this issue

2026-10-16 21:16:27 +00:00

[PR #815] [MERGED] fix: integrate 24 reviewed browser/native/semantics corrections #2262

bsakaguchi referenced this issue

2026-10-16 21:16:30 +00:00

[PR #825] [MERGED] fix(browser): preserve form destinations and satisfies mutation uncertainty #2266

bsakaguchi added

enhancement

and removed