reverse-engineering-anything/docs/index.md at 0cb0d43e79653edfda806b95c91eca15543dc29a

0 Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-12 17:59:08 +00:00

Files

T

Matt Van Horn f183381739 feat(audit): report what a shipped app exposes to static analysis

Adds `audit_release_exposure` and `rea audit-release-exposure` to report
source maps, Electron fuse implications, extractable payloads, debug
information, build metadata, and credential markers. Checks carry stable
IDs, observations, statuses, and fixed remediation, while incomplete and
unassessed checks remain visible without implying a security verdict.
Credential findings include only rule IDs and locations. The CLI
supports `--fail_on` severity thresholds and exits 3 when an exposed
check meets the threshold.

2026-11-01 02:41:37 -08:00

10 KiB

Raw Blame History

layout, hero, features

layout

hero

features

home

name

text

tagline

actions

REA

Reverse Engineer Anything

Understand binaries, applications, and runtime behavior with one CLI and MCP server.

theme	text	link
brand	Get started	/installation

theme	text	link
alt	View on GitHub	https://github.com/morluto/rea

title	details	link
Investigate with your agent	Connect REA to your coding agent, describe the app or feature you want to understand, and follow the evidence.	/mcp-prompts

title	details	link
Inspect across formats	Explore native binaries, JavaScript and Electron apps, .NET assemblies, Android packages, firmware, and websites.	/installation

title	details	link
Keep the evidence	Analysis runs locally and returns observations, limitations, and unknowns through the CLI and MCP.	/mcp-contracts

Start with one command

npx rea-agents setup

Choose your agent, review the planned changes, and approve setup. Native binary analysis can use an existing Hopper, Ghidra, or IDA installation; static JavaScript analysis needs no native analysis engine.

For a first result from an extracted JavaScript application or ASAR:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

See installation and setup for requirements and configuration.

For runtime instrumentation, see the Frida guide.

Choose a guide

Task	Guides
Identify a desktop installation	Runtime candidates, evidence and follow-up files
Inspect native functions, references, or types	Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, PE TLS/load config, ELF notes, Linux kernel modules, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Inspect native functions, references, or types	Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, PE TLS/load config, ELF notes, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Select a native provider or import format	Ghidra semantics, Windows, DOS, raw bytes, GameCube DOL, MIPS, PSP, NativeAOT, IDA, Kuna, JEB
Analyze JavaScript or Electron artifacts	Static analysis, tracing and comparisons, application graph, source recovery
Compare static JavaScript with runtime observations	Runtime attribution, reconciliation, Electron observation, Electron fuses, Release exposure
Inspect assemblies, packages, or firmware	Godot PCK, UnityFS, U-Boot uImage, .NET, Python packages, Android, APK signatures, Apktool resources, ADB acquisition, Apple, Harmony, firmware, ESP images, ESP flash images, WASM, EVM
Observe or compare a browser scenario	CDP observation, scenarios, runtime evidence, historical captures
Serve recorded behavior as an agent environment	Agent environments
Trace captured website source	Source locations, module traces, script export
Capture and compare a command	Process capture
Use CLI/MCP and retain evidence	CLI, MCP contracts, agent prompts, obligation ledgers

For development, use testing, client verification, tool design, admission limits and recovery, and releasing. Reconstruction readiness describes a development conformance verifier. The 6.2 migration records that release's compatibility changes; the roadmap tracks future work.

10 KiB Raw Blame History

Start with one command

Choose a guide

10 KiB

Raw Blame History