mirror of
https://github.com/morluto/rea.git
synced 2026-11-10 08:47:00 +00:00
26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# JavaScript and Electron application artifacts
|
|
|
|
Use `analyze_javascript_application` for an operator-supplied ASAR or extracted
|
|
tree beneath an approved investigation root. Every call requires `approved:
|
|
true`; source-map contents require separate approval. Keep the default summary.
|
|
Use its counts, roots, node kinds, top findings, coverage, unknowns, and graph
|
|
page URIs before requesting more data.
|
|
|
|
BrowserWindow preferences, preload and contextBridge surfaces, IPC
|
|
registrations, utility processes, and native binding requests are static syntax
|
|
observations. Only a unique exact literal IPC channel match supports an inferred
|
|
pairing. Dynamic or ambiguous channels remain unresolved. A requested `.node`
|
|
member is not a verified native export. Never claim runtime reachability,
|
|
registration, defaults, or policy enforcement from static analysis.
|
|
|
|
Use `trace_application_feature` on existing application Evidence for one
|
|
literal node ID, route, string, API, IPC channel, module, or native export.
|
|
Choose a direction and finite bounds. Link Hopper or Ghidra Evidence only when
|
|
the exact artifact digest matches.
|
|
|
|
For version comparison, analyze each version once, then call
|
|
`compare_application_versions`. Accept only its digest, source-map, structural
|
|
fingerprint, or non-module semantic matches. Module ordinals and minified names
|
|
are not persistent identity. Report added or removed only with complete
|
|
opposite-side coverage; otherwise report unknown.
|