[PR #7472] [MERGED] feat(android): link native declarations to static JNI candidates #7860

New issue

Closed

opened 2026-11-05 01:48:12 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-05 01:48:12 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/7472
Author: @gensokyo-dev
Created: 10/27/2026
Status: ✅ Merged
Merged: 10/27/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/android-jni-bindings

📝 Commits (5)

4a1839d feat(android): link native declarations to static JNI candidates
e8a8a50 chore: merge latest main for JNI verification
106b67f docs(android): record JNI correctness and completed-task costs
967b4b6 perf(android): default JNI MCP delivery to retained summary
69beb18 fix(android): bound JNI parsing and preserve IL2CPP capacity

📊 Changes

60 files changed (+8413 additions, -329 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/references/android-applications.md (+11 -0)
📝 bridge/android/ReaJadxBridge.java (+217 -1)
📝 docs/android-analysis.md (+105 -0)
➕ docs/verification/android-jni-bindings-2026-10-27.md (+320 -0)
📝 scripts/verify/android/metadata.mjs (+8 -0)
➕ src/android/AndroidJniLibraries.ts (+309 -0)
➕ src/android/AndroidNativeInventory.test.ts (+99 -0)
➕ src/android/AndroidNativeInventory.ts (+42 -0)
📝 src/android/JadxAnalysis.ts (+57 -2)
📝 src/android/JadxProtocol.ts (+4 -0)
📝 src/android/JadxProvider.ts (+2 -0)
📝 src/android/JadxRelease.ts (+2 -2)
📝 src/android/JadxSession.ts (+122 -13)
📝 src/application/android/AndroidAnalysisService.ts (+4 -1)
➕ src/application/android/AndroidJniInspection.ts (+42 -0)
📝 src/cli/androidCommands.ts (+79 -0)
📝 src/cliCommandNames.ts (+1 -0)
📝 src/contracts/android/androidToolContracts.ts (+30 -0)
📝 src/contracts/toolEffects.test.ts (+2 -0)
📝 src/contracts/toolEffects.ts (+5 -0)

...and 40 more files

📄 Description

Summary

Fixes #6403. Find static JNI implementation candidates for original DEX native declarations, per ABI and exact APK library occurrence, including libraries that expose only JNI_OnLoad. Class selection preserves global registration-pair ambiguity. Compact replies retain full Evidence and explain unsupported or incomplete scans.

Contract and scope

Adds named inspect_android_jni_bindings (MCP defaults to retained summary) and matching inspect-android-jni-bindings CLI through the existing Android workflow. Exact class/method/descriptor/ABI/library selection, stable IDs, batch ID lookup, fields and retained pages share one implementation.
The existing JAR's raw DEX reader preserves declarations before JADX deduplication; JNI queries skip APK loading into the decompiler. One shared sparse ELF relocation owner supports REL/RELA/RELR; the existing IL2CPP consumer now uses it. Table candidates retain all three slots, relocation sources, function/code addresses and file offsets.
matched means observed candidate presence. Separate coverage prevents partial scans from claiming uniqueness or absence; table classes remain ambiguous/unknown unless the complete global inventory establishes attribution. Summary includes no-edge library failure reasons and selected native declarations even without ABI rows. Parsed checkpoints survive final cleanup failure/cancellation; exact resource leases gate retry.
The immutable APK session reuses complete declarations and one selected library scan. Fresh admission validates caller bytes; idle/close releases caches. Bounds cover preallocation, scan work, retained facts and serialized delivery.
Static read-only contribution within the existing provider; maintainer scope decision: not applicable. Launches only the owned analysis JVM and writes private snapshots/explicit Evidence outputs. No target execution, injection, mutation or protection recovery. Bridge 9 uses the unchanged supplied JADX 0.7.1 JAR. No dependency/installer changes or committed binaries/generated outputs.

Executed validation

Type/lint/build and 396 exact tests pass, including actual ZIP cleanup/retry/cancellation, native projection/parsing, existing session behavior, public contracts and IL2CPP regressions. Latest-main input/contract cases and 16 artifact-aware SDK schema tests pass without relaxing assertions.
Full actual JDK21/JADX metadata and downstream CLI/MCP parity pass, including native reads before any APK load, CRC/duplicate/malformed DEX, raw identities and cross-DEX direct invokes.
Genuine NDK r27d fixtures: ordinary REL/RELA, RELR and APS2 across four ABIs, overloads, UTF-16/MUTF-8, duplicate classes/libraries and partial coverage. Independent source/javac-header/readelf/byte oracles validate 25 built libraries and 33 golden table entries.
371 real SDK calls and eleven CLI parity checks pass. Conscrypt 2.8.0 original library bytes resolve EVP_PKEY_new_RSA to arm64 0xfa11c with the exact three relocated slots. Complete/summary facts match. Owned-copy removal leaves retained summaries, selected slots, pages and full parent exports readable; originals remain unchanged.
Review corrections pass type/lint/build and 330 cases in 13 related files, plus all 38 JNI cases after adding cancellation during GNU version decoding. The shared decoder streams IL2CPP writes without lowering file-backed capacity; GNU version traversal/cache work is bounded and cooperative; JNI string-limit exhaustion remains partial/unknown. Optional Conscrypt qualification stays optional and rejects missing advertised artifacts. Final built 25-library oracles and fresh real SDK/CLI qualification pass. These test counts overlap earlier gates; documentation/check/render results are recorded in the report.

Reproduction, artifact/revision pins, all costs and failed attempts. Equivalent Conscrypt complete/summary tasks include catalog, arguments, 12 pages and proof export: warm text estimates fall from ~225k to ~32k (about 86%), with the same fact digest. Cold/warm, startup, qualification, CLI, CPU and family-RSS costs are reported separately. No equivalent pre-feature table workflow, actual model-billing result or general latency/memory speedup is claimed.

Limits: Linux/JDK21/JADX0.7.1 qualified. Cross-ABI static ELF fixtures do not establish Windows/macOS lifecycle or runtime Android behavior. The Conscrypt APK is a static derivative, not an installed vendor app. Runtime-built tables, obfuscated strings and unavailable split/runtime code remain unknown. Empty-ABI coverage is a domain regression, not a separate real SDK artifact claim. The shared IL2CPP path has existing regressions, without a new real IL2CPP-app qualification.

Author readiness

Human owner: @gensokyo-dev

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/7472 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/27/2026 **Status:** ✅ Merged **Merged:** 10/27/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/android-jni-bindings` --- ### 📝 Commits (5) - [`4a1839d`](https://github.com/morluto/rea/commit/4a1839de6f091ade19e82557874c358ed34b8e36) feat(android): link native declarations to static JNI candidates - [`e8a8a50`](https://github.com/morluto/rea/commit/e8a8a50725cd384ae38ce66a94bafdaba1138108) chore: merge latest main for JNI verification - [`106b67f`](https://github.com/morluto/rea/commit/106b67fdee2dfa74e90f0088339aac60da205e1f) docs(android): record JNI correctness and completed-task costs - [`967b4b6`](https://github.com/morluto/rea/commit/967b4b62bfe4b315bfde67ed815125c31119243a) perf(android): default JNI MCP delivery to retained summary - [`69beb18`](https://github.com/morluto/rea/commit/69beb1891670f8c79b2846465187d0a3a4e11796) fix(android): bound JNI parsing and preserve IL2CPP capacity ### 📊 Changes **60 files changed** (+8413 additions, -329 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/references/android-applications.md` (+11 -0) 📝 `bridge/android/ReaJadxBridge.java` (+217 -1) 📝 `docs/android-analysis.md` (+105 -0) ➕ `docs/verification/android-jni-bindings-2026-10-27.md` (+320 -0) 📝 `scripts/verify/android/metadata.mjs` (+8 -0) ➕ `src/android/AndroidJniLibraries.ts` (+309 -0) ➕ `src/android/AndroidNativeInventory.test.ts` (+99 -0) ➕ `src/android/AndroidNativeInventory.ts` (+42 -0) 📝 `src/android/JadxAnalysis.ts` (+57 -2) 📝 `src/android/JadxProtocol.ts` (+4 -0) 📝 `src/android/JadxProvider.ts` (+2 -0) 📝 `src/android/JadxRelease.ts` (+2 -2) 📝 `src/android/JadxSession.ts` (+122 -13) 📝 `src/application/android/AndroidAnalysisService.ts` (+4 -1) ➕ `src/application/android/AndroidJniInspection.ts` (+42 -0) 📝 `src/cli/androidCommands.ts` (+79 -0) 📝 `src/cliCommandNames.ts` (+1 -0) 📝 `src/contracts/android/androidToolContracts.ts` (+30 -0) 📝 `src/contracts/toolEffects.test.ts` (+2 -0) 📝 `src/contracts/toolEffects.ts` (+5 -0) _...and 40 more files_ </details> ### 📄 Description ## Summary Fixes #6403. Find static JNI implementation candidates for original DEX native declarations, per ABI and exact APK library occurrence, including libraries that expose only `JNI_OnLoad`. Class selection preserves global registration-pair ambiguity. Compact replies retain full Evidence and explain unsupported or incomplete scans. ## Contract and scope - Adds named `inspect_android_jni_bindings` (MCP defaults to retained summary) and matching `inspect-android-jni-bindings` CLI through the existing Android workflow. Exact class/method/descriptor/ABI/library selection, stable IDs, batch ID lookup, fields and retained pages share one implementation. - The existing JAR's raw DEX reader preserves declarations before JADX deduplication; JNI queries skip APK loading into the decompiler. One shared sparse ELF relocation owner supports REL/RELA/RELR; the existing IL2CPP consumer now uses it. Table candidates retain all three slots, relocation sources, function/code addresses and file offsets. - `matched` means observed candidate presence. Separate coverage prevents partial scans from claiming uniqueness or absence; table classes remain ambiguous/unknown unless the complete global inventory establishes attribution. Summary includes no-edge library failure reasons and selected native declarations even without ABI rows. Parsed checkpoints survive final cleanup failure/cancellation; exact resource leases gate retry. - The immutable APK session reuses complete declarations and one selected library scan. Fresh admission validates caller bytes; idle/close releases caches. Bounds cover preallocation, scan work, retained facts and serialized delivery. - Static read-only contribution within the existing provider; maintainer scope decision: not applicable. Launches only the owned analysis JVM and writes private snapshots/explicit Evidence outputs. No target execution, injection, mutation or protection recovery. Bridge 9 uses the unchanged supplied JADX 0.7.1 JAR. No dependency/installer changes or committed binaries/generated outputs. ## Executed validation - Type/lint/build and **396 exact tests pass**, including actual ZIP cleanup/retry/cancellation, native projection/parsing, existing session behavior, public contracts and IL2CPP regressions. Latest-main input/contract cases and **16 artifact-aware SDK schema tests pass** without relaxing assertions. - Full actual JDK21/JADX metadata and downstream CLI/MCP parity pass, including native reads before any APK load, CRC/duplicate/malformed DEX, raw identities and cross-DEX direct invokes. - Genuine NDK r27d fixtures: ordinary REL/RELA, RELR and APS2 across four ABIs, overloads, UTF-16/MUTF-8, duplicate classes/libraries and partial coverage. Independent source/javac-header/readelf/byte oracles validate **25 built libraries and 33 golden table entries**. - **371 real SDK calls and eleven CLI parity checks pass**. Conscrypt 2.8.0 original library bytes resolve `EVP_PKEY_new_RSA` to arm64 `0xfa11c` with the exact three relocated slots. Complete/summary facts match. Owned-copy removal leaves retained summaries, selected slots, pages and full parent exports readable; originals remain unchanged. - Review corrections pass type/lint/build and **330 cases in 13 related files**, plus all **38 JNI cases** after adding cancellation during GNU version decoding. The shared decoder streams IL2CPP writes without lowering file-backed capacity; GNU version traversal/cache work is bounded and cooperative; JNI string-limit exhaustion remains partial/unknown. Optional Conscrypt qualification stays optional and rejects missing advertised artifacts. Final built 25-library oracles and fresh real SDK/CLI qualification pass. These test counts overlap earlier gates; documentation/check/render results are recorded in the report. [Reproduction, artifact/revision pins, all costs and failed attempts](https://github.com/morluto/rea/blob/69beb1891670f8c79b2846465187d0a3a4e11796/docs/verification/android-jni-bindings-2026-10-27.md). Equivalent Conscrypt complete/summary tasks include catalog, arguments, 12 pages and proof export: warm text estimates fall from ~225k to ~32k (about **86%**), with the same fact digest. Cold/warm, startup, qualification, CLI, CPU and family-RSS costs are reported separately. No equivalent pre-feature table workflow, actual model-billing result or general latency/memory speedup is claimed. Limits: Linux/JDK21/JADX0.7.1 qualified. Cross-ABI static ELF fixtures do not establish Windows/macOS lifecycle or runtime Android behavior. The Conscrypt APK is a static derivative, not an installed vendor app. Runtime-built tables, obfuscated strings and unavailable split/runtime code remain unknown. Empty-ABI coverage is a domain regression, not a separate real SDK artifact claim. The shared IL2CPP path has existing regressions, without a new real IL2CPP-app qualification. ## Author readiness Human owner: @gensokyo-dev - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-05 01:48:12 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7860

No description provided.

Rows
Columns