Following Native Behavior Without Inventing Certainty

With a native provider explicitly bound, REA can turn a feature clue into a chain of code and data relationships. The important question is not “what did the decompiler print?” but “which typed observations connect this clue to this routine, and where does the connection stop being established?” This chapter follows that trace through reusable native primitives, then shows how dispatch metadata, value flow, Apple artifacts, and selected-window observation add evidence without turning a static route into proof of execution.

From a clue to a relationship

A native investigation usually begins with something a person can name: a menu label, an error message, a file-format term, a symbol, or a behavior-specific string. REA’s search operations turn that clue into candidate strings, names, or procedures. The result is a discovery surface, not a conclusion. A string can be shared by several paths, retained only as data, or used in a diagnostic branch unrelated to the visible feature.

The next step is to connect the candidate to the program’s structure. References and cross-references show where an address, string, or name is used. A containing-procedure lookup can identify the routine that owns an address. Callers and callees extend the route in both directions: callers explain how a candidate can be reached, while callees show the operations it delegates to. The result is a typed relationship such as “this routine refers to that string” or “this procedure has a call site associated with that target,” not merely a narrative assembled from names.

A focused function inspection can then add instructions, assembly, pseudocode, bytes, metadata, and a function dossier. Each representation answers a different question. Instructions establish decoded bytes and flow destinations at particular addresses. Assembly preserves the provider’s instruction-level view. Pseudocode makes control structure easier for a human or agent to inspect, but remains provider output. A function dossier gathers related facts so that the analyst does not have to reconstruct the same context from many isolated calls.

That order is valuable because it delays interpretation until the relevant object has been identified. A routine name may be a convenient index, but an address, procedure identity, reference kind, or file offset provides a more precise anchor. A stripped binary may offer no trustworthy human name at all, yet its instructions and references can still support a bounded trace. Conversely, a familiar name can mislead if it is imported, generated, or attached to a different implementation than the visible feature uses. REA’s primitives make the route inspectable even when labels are weak.

The route can be summarized as a progression:

sequenceDiagram participant C as Feature clue participant S as Search participant X as References participant G as Call graph participant F as Function dossier participant V as Value or decompilation trace participant U as Explicit unknown C->>S: Find strings or procedures S->>X: Locate uses and cross-references X->>G: Connect callers and callees G->>F: Inspect the relevant routine F->>V: Follow instructions, values, or pseudocode V-->>U: Preserve unresolved or ambiguous edge