4ef916da03
* feat(pe): inspect import and delay-load tables Add inspect_pe_imports / inspect-pe-imports to read PE32/PE32+ import and delay-load directories without executing the image. The report keeps DLL names, named and ordinal functions, ILT/IAT RVAs, and a pefile import hash of the standard import table. A missing directory is observed absence, not proof the image never imported APIs. * fix(pe): default PE import fixture options Allow peImportImage() without an argument so CLI and filesystem tests can use the KERNEL32 sample without repeating an empty options object. * test(pe): keep import path cases on the dedicated MCP contract inspect_pe_imports already rejects relative MCP paths in its own boundary test. Leave the shared absolute-path matrix to tools whose handler issue projection matches that suite's expected shape. * fix(native): index virtual-to-file mapping lookups mappedFileOffset scans every mapping twice per span, so a parser that translates one span per table entry costs sections x entries. Add fileMappingLookup, which builds an O(n log n) interval index once and answers each span in O(log n) with the same accept, reject and translation results. A differential test checks it against mappedFileOffset over randomized overlapping mappings and zero fills. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(pe): report partial import evidence and exact pefile hashes - Withhold imphash with an explicit reason whenever the standard import table is partial (unreadable names or thunks, missing tables), or when pefile 2024.8.26 would hash a different row sequence: invalid or truncated names, ordinal 0, descriptors without functions, tables its bounds or repeat/spread heuristics discard, and its 8192-thunk import symbol cap. Delay-load issues do not withhold it. - Hash ordinal imports with pefile's complete ordlookup tables and its ord<decimal> fallback instead of declining unmapped ordinals. - Report a nonterminal descriptor whose FirstThunk is zero, and a delay-load descriptor whose IAT or INT RVA is zero, as malformed_entry partial coverage instead of a complete empty inventory. - Directory evidence lists the file spans actually consumed for the descriptor array and terminator; discontiguous mappings produce separate spans and separate Evidence ranges. - Carry exhausted limits as PeImportLimitFailure.limit and derive recovery from it; the fixed 16 MiB retained-text ceiling reports a fixed allowance instead of max_file_bytes advice. - Translate RVAs through the indexed mapping lookup and yield with a cancellation check every 1024 table entries. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(pe): read only own ordinal tables for DLL names DLL names such as constructor and __proto__ pass pefile's name rule but resolved inherited object members, throwing before the ord<n> fallback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g * fix(native): preserve PE import facts and prove hash compatibility * test(native): verify PE import workflows and measured costs * refactor(native): narrow PE facts across the container union * docs(native): record integrated PE import validation * fix(native): bound every PE import RVA span * docs(native): measure RVA guard completed workflows * fix(pe): reconcile import coverage with retained rows * fix(pe): retain partial imports at descriptor mapping gaps --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
27 KiB
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu
REA: Reverse Engineer Anything
Binaries, applications aur runtime behavior ki reverse engineering ke liye ek MCP.
Koi feature pasand aaya? Samjhein ke woh kaise kaam karta hai, binary level tak.
Jaldi shuru karein · REA kaise kaam karta hai · Kya kuch analyze kar sakte hain · Amli misaalein · FAQ · Documentation
npx rea-agents setup
Important
REA morluto/rea, rea.tools ya rea-agents npm package se hasil karein. Installation aur release ke links inhi official sources se kholein. Sirf milta-julta repository naam ya copy kiya hua README kisi download ko official sabit nahi karta.
Kisi app mein aisa feature dekha jo aap apne product mein chahte hain? Apne agent se kahein ke REA ke zariye uski jaanch kare. Woh app ka source code mile baghair bhi use inspect kar sakta hai, feature kaam kaise karta hai samjha sakta hai, saboot dikha sakta hai aur aapke project ke liye uska ek version bana sakta hai.
REA aapke agent ko native binaries, JavaScript aur Electron apps, .NET assemblies aur websites inspect karne wale tools se jorta hai. Yehi tools terminal se bhi use kar sakte hain. Analysis local machine par hota hai, aur har natije ke saath uske saboot aur limitations bhi milti hain.
Setup REA ko aapke agent ke saath register karta hai aur uske mutabiq workflow instructions install karta hai. Native analysis ke liye pehle se installed Hopper, Ghidra ya IDA use ho sakta hai; aapki approval par setup Hopper bhi install kar sakta hai. Static JavaScript analysis ke liye native analysis engine ki zaroorat nahi.
Setup instructions, tasveeron ke saath guides aur asli case studies ke liye REA ki website dekhein.
Jaldi shuru karein
Linux par Ghidra, JADX, firmware tools shuru karne aur static JavaScript/Electron
analysis ke liye REA ke PATH par procps-compatible ps hona chahiye, taake
process ownership check ho sake. Masla hal karne ke steps docs/installation.md
ke "Linux owned-process prerequisite" section mein hain.
Apna agent setup karein
Node.js aur npm installed hon to yeh command chalayein:
npx rea-agents setup
Apne agents select karein, proposed changes dekhein aur approve karein. Setup REA ka MCP server aur matching workflow instructions add karta hai, aur existing configuration ke backups banata hai. Iske baad apna agent restart karein.
Setup Claude Code, Codex, Cursor, Gemini CLI, Grok Build aur doosre agents support karta hai. Provider configuration aur manual MCP registration ke liye installation aur setup dekhein.
Context overhead kam rakhne ke liye MCP default mein compact input schemas use
karta hai. Agar tamam advertised fields ki guidance aur nested validation details
chahiye hon to apni MCP registration mein REA_MCP_INPUT_SCHEMA_PROFILE=full
set karein. Dono profiles mein tamam tools aur canonical server validation
maujood rehte hain. MCP contracts guide ka "Compact input schema profile"
section dekhein.
Apne agent se kahein
Samjho ke Notes app mein search kaise kaam karti hai, mujhe saboot dikhao aur
mere project ke liye aisa hi feature banao.
Notes ki jagah apni target app aur jis feature ko samajhna hai uska naam likhein.
Terminal se use karein
Extract ki hui JavaScript/Electron app directory ya ASAR inspect karein:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
Natije mein modules, imports, Electron boundaries aur unke saboot milte hain.
Path ko apne target se badlein, jaise Windows par "D:/apps/example".
Rozmarra use ke liye rea command install karne ke liye:
npm install --global rea-agents
rea --help
Native analysis se pehle provider configure karein. Native commands, provider selection, snapshots aur scripting ke liye CLI aur Evidence guide dekhein.
REA update karein
REA mein tezi se changes aate hain aur naye releases mein aksar bug fixes hoti hain. Apni installation updated rakhein.
Agar CLI npm install --global ya bun add --global se install ki hai:
rea update
rea --update isi verified workflow ka alias hai aur wohi global output flags
accept karta hai. Doosre command controls ke saath use karte waqt rea update
likhein.
Updater commands stdout aur stderr mila kar zyada se zyada 4 MiB retain karti hain. Command khatam hone ke baad is had se bade metadata replies reject ho jate hain; verbose installs bounded diagnostics ke saath jari rehti hain. Insaan ke liye progress output terminal ki backpressure ka khayal rakhta hai aur bheji hui writes mukammal hone ka intezar karta hai.
Bun global updates ke liye Bun 1.2.17 ya naya version chahiye. Purana Bun ho
to rea update chalane se pehle Bun manually upgrade karein.
Agent registrations aur skill refresh karne ke liye update ke output mein di hui setup command chalayein.
Agar aap npx use karte hain to agent setup is tarah update karein:
npx rea-agents@latest setup
Setup changes review karein aur agent restart karein. Ek dafa chalane wali CLI
commands ke liye npx rea-agents@latest ke baad command likhein. Bun ke saath
npx rea-agents@latest ki jagah bunx rea-agents@latest use karein.
REA kaise kaam karta hai
Aapka agent MCP ke zariye REA ko call karta hai, taake target inspect kare aur relevant code trace kare. REA apni findings saboot ke saath wapas deta hai. Agent unki bunyaad par agle sawal poochta hai, behavior samjhata hai ya implementation likh kar test karta hai. CLI commands bhi yehi workflows use karti hain.
Puri size mein figure kholein.
Kya kuch analyze kar sakte hain
REA ke liye Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) ya 26.12.1+, aur npm chahiye. Mazeed tools aur host support target par depend karte hain:
| Target | REA kya wapas deta hai | Zarooriyat aur guide |
|---|---|---|
| Desktop installations | Runtime candidates, supporting files, component markers aur agle probes | Built-in bounded directory/header inspection; desktop applications |
| Native binaries | Pseudocode, assembly, strings, symbols, calls aur references | Hopper, Ghidra ya IDA; native analysis |
| Offline ELF layout | Sections, segments, original symbols/relocations aur static mitigation candidates | Linux x64 par aapka diya hua pwntools; binary diagnostics |
| Go binaries | Embedded compiler version, modules, replacements aur build settings | Built-in static ELF/PE/thin Mach-O inspection; Go install karna zaroori nahi |
| GPU code objects | CUDA/HIP targets, selected kernel parameters aur resources, retained PTX text | Built-in static ELF/PE/fatbin/CUBIN/PTX inspection; GPU code objects |
| Model artifacts | GGUF / safetensors metadata, tensor declarations aur unse nikale hue totals | Built-in header inspection; optional full-file hash; model files |
| IL2CPP metadata | Unity global-metadata.dat assembly images, type aur method names aur index ranges | Versions 24, 27, 29, 31 aur 39 ki built-in static decoding; Unity zaroori nahi |
| Godot PCK | Archive inventory aur extraction, original header/directory facts aur selected content identities | Built-in static formats 2, 3 aur 4; Godot zaroori nahi |
| Rust binaries | Embedded cargo-auditable crate names, versions, sources aur dependency edges | Built-in static ELF/PE/thin Mach-O inspection; Rust binaries |
| PE certificates | Authenticode WIN_CERTIFICATE entries aur PKCS#7 signer/X.509 identity fields | Built-in static PE inspection; PE certificates |
| PE imports | Import aur delay-load DLL names, ordinals, IAT RVAs aur pefile import hash | Built-in static PE inspection; PE imports |
| ELF notes | PT_NOTE/SHT_NOTE owners, types, GNU build-id aur ABI-tag fields | Built-in static ELF inspection; ELF notes |
| Erlang BEAM | IFF chunks, atoms, exports, imports, lambdas aur Code header | Built-in static BEAM inspection; Erlang BEAM |
| WASM artifact | Validation, sections, exact import/export WAT forms aur decoded WAT | Aapka diya hua WABT 1.0.42; inspect_wasm_artifact |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments aur mutability | Linux x64 par local raw/hex carrier; offline EVM guide |
| SQLite databases | Tables, columns, indexes, views, triggers aur selected ordinary-table rows | Local database/WAL snapshot; native SQLite limits ke saath Node.js 24.x >=24.15 ya 26+ |
| Recorded Linux crashes | Raw notes, har recorded thread ke registers/signals aur optional mapping candidates | Linux x64 par aapka diya hua pwntools; optional GDB/pwndbg; recorded crashes |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC aur native add-on relationships | Node.js aur npm; Linux: procps-compatible ps; application analysis |
| Websites | Page structure, scripts, network observations aur requested screenshots | Chrome-family browser; browser analysis |
| Saved network captures | Requests, responses, exposed payloads aur source locations | HAR ya Fiddler Everywhere SAZ; native mitmproxy ke liye Linux par mitmdump; capture guide |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies aur build comparisons | Koi additional tool nahi (sirf static analysis); managed-code guide |
| Android APKs | Manifest declarations, classes, decompiled methods aur references | Linux/macOS/Windows x64 par headless JADX aur full JDK; Android guide |
| APK signatures | v1/v2/v3/v3.1 signers, certificate fingerprints, key rotation aur digest self-consistency | Koi additional tool nahi (sirf static analysis); inspect_apk_signature |
| Android devices | Devices, packages, processes, logs, dumps, screen captures aur APK/file transfers | Aapka diya hua adb (emulator ya hardware); ADB guide |
| JEB projects | Engine-backed project units, artifact digests aur type/method pseudo-code | Aapka shuru kiya hua JEB client jo MCP serve kar raha ho, REA_JEB_MCP_URL se select karein; JEB guide |
| Android resources | Decoded manifest, string tables, locales aur version facts | Aapka diya hua Apktool launcher; resource guide |
| Flutter apps | Dart snapshot hash, per-ABI library digests aur engine build provenance | Koi additional tool nahi (static APK parsing); Flutter guide |
| Firmware | Regions, extraction results aur native-analysis handoffs | Linux par Binwalk / Unblob; firmware guide |
| Recorded packets | Selected fields, repeated values, filters aur decode-as rules | Linux: TShark 4.x + prlimit; capture guide |
| Packet summaries | Endpoints, DNS, TLS SNI, protocol distribution aur HTTP requests | Aapke diye hue tshark aur capinfos (Linux par verified); pcap guide |
| Recorded logic signals | Decoder annotations, sample ranges aur diagnostics | Linux: sigrok-cli 0.7.2 + prlimit; signal recordings |
| Packages aur resources | File inventories, digests, plists, Apple bundle structure aur extracted resources | Artifact aur JavaScript guide, Apple applications |
| Process behavior | Terminal output, interactions, exit aur filesystem observations aur runs ka comparison | Native PTY ke saath Linux/macOS; process capture |
| PyInstaller executables | CArchive members, Python version, entry scripts aur extracted bytecode | Koi additional tool nahi (sirf static analysis); Python packaged applications |
Static JavaScript aur .NET inspection di hui files ko application chalaye baghair parhti hai. Runtime capture aapki user permissions se selected target ko chalata hai ya uske saath interact karta hai; har runtime guide apne effects batati hai.
Offline native-binary inspection ke liye REA aapke diye hue GNU objdump aur Rizin bhi support karta hai. Provider setup, CLI commands aur Evidence ki limitations ke liye reverse-engineering tools guide dekhein. REA in dono providers ko install ya update nahi karta.
Native formats aur host support har provider ke liye alag ho sakte hain.
Hopper aur Ghidra setup,
IDA guide (optional native MCP bridge samet),
Kuna decompiler guide aur
experimental Windows Ghidra support dekhein.
Ghidra 16-bit DOS analysis bhi support karta hai.
Badi binaries ke liye REA_GHIDRA_STARTUP_TIMEOUT_MS ya
REA_HOPPER_STARTUP_TIMEOUT_MS se provider ki startup deadline barhayein.
Provider select karne ke liye CLI guide dekhein.
Latest npm release ke baad add hone wale features ki
release availability check karein.
Amli misaalein
DX-Ball: sound-pan calculation dobara banayein
Sound call se uske position-to-pan helper tak jayein, instructions inspect karein aur adhoore pseudocode ko C mein badlein. Dobara banaya gaya code 3,205 original-x86 cases pass karta hai aur compiled function ke tamam 63 bytes dobara hasil karta hai.
Case study parhein · Reconstruction repository
Notion: Electron clipboard bridge trace karein
Renderer ki clipboard API dhoondein, preload aur IPC ke raste main process tak uska flow follow karein aur rich clipboard format inspect karein.
TH04: DOS bullet-ring calculation recover karein
Original PC-98 game ki 16-bit instructions inspect karein, fixed aur aimed angle calculations recover karein aur dobara banaye gaye C++ ko purane compiler ke output se compare karein.
Case study parhein · Reconstruction repository
Agar aapne REA se koi dilchasp kaam kiya hai to hum dekhna chahenge. Apna case issue ya pull request mein share karein. Target, apna sawal, REA ne kaise madad ki aur kya mila, yeh sab batayein.
FAQ
Kaun se agents REA use kar sakte hain?
Har woh agent jo local MCP servers support karta ho. Setup supported agents configure karta hai; doosre clients manual MCP registration use kar sakte hain.
Kya mujhe Hopper, Ghidra ya IDA chahiye?
Deep native analysis in mein se ek use karta hai. Static JavaScript aur .NET inspection native analysis engine ke baghair kaam karti hai. Approval ke baad setup Hopper install kar sakta hai; Ghidra aur IDA ke liye aapki existing installations use hoti hain. Provider setup dekhein.
Kya pehle Hopper shuru karna hoga?
Jab kisi operation ko Hopper chahiye hota hai to REA use shuru karta hai. macOS par pehli dafa khulne wala dialog demo mode select karne ya license activate karne ko keh sakta hai. Pehle CLI/MCP operation ya unattended job se pehle usi user session mein yeh prompt complete karein. Zaroorat ho to Hopper manually kholein. Hopper startup aur troubleshooting dekhein.
skills.sh se skill install karne se kya hota hai?
Skill aapke agent ko jaanch karne ki instructions deti hai. REA ka MCP server
register karne aur matching instructions install karne ke liye
npx rea-agents setup use karein, phir agent restart karein.
Sirf skill ki installation dekhein.
REA kis tarah ka code wapas deta hai?
Native analysis pseudocode aur assembly wapas deta hai. JavaScript/Electron analysis modules aur unke relationships recover karta hai. Aapka agent in findings se implementation likhta aur test karta hai; amli misaalein iska tareeqa dikhati hain.
Kya REA meri app upload karta hai?
REA targets ko local machine par analyze karta hai. Aapke agent ko tool results milte hain, aur uske model provider ki apni data policy hoti hai.
Bug mile to kya karun?
Pehle update karein; ho sakta hai recent release mein masla hal ho chuka ho.
Agar CLI npm install --global ya bun add --global se install ki hai:
rea update
npx se agent setup ke liye:
npx rea-agents@latest setup
Agar agent use kar rahe hain to setup refresh complete karke agent restart karein. Wohi task dobara try karein. Masla phir bhi ho to REA version, target type, reproduce karne ke steps aur error output ke saath issue kholein.
Documentation
Website ki amli guides se shuru karein. Exact options, prerequisites aur result contracts ke liye:
- Installation aur setup: agent registration, provider configuration, updates aur uninstall.
- Readiness aur troubleshooting: ek agent ya analysis engine ka masla diagnose karein.
- CLI aur Evidence: commands, provider selection, snapshots, import/export aur exit statuses.
- MCP contracts aur agent prompts: tool results, sessions aur guided investigations.
- Tool catalog: tools, providers aur CLI commands ki generated inventory.
- Roadmap: planned work aur capability trackers.
Security vulnerabilities SECURITY.md ke zariye report karein.
Stars ki history
🎉 300,000 GitHub stars — shukriya!
REA use karne, bugs report karne, features suggest karne, builds test karne aur fixes contribute karne wale sab logon ka shukriya.
Zimmedarana istemal
Responsible-use guidance ke liye DISCLAIMER.md dekhein.
Ghair qanooni ya ghair ijazati istemal ke bare mein project ki position REA ke tamam versions, distribution channels aur platforms par lagu hoti hai; har copy par uske applicable licenses barqarar rehte hain.
REA qanooni research, taleem, interoperability, software preservation aur aise software ke analysis ke liye hai jo aapka apna ho ya jise examine karne ki aapko ijazat ho.
Hissa dalein
REA mein aapki madad ka khairmaqdam hai! Bug report karne ya feature suggest karne ke liye issue kholein, ya code aur docs behtar karne ke liye pull request bhejein.
Development setup aur checks ke liye CONTRIBUTING.md, verification lanes ke liye testing aur project structure ke liye architecture map dekhein.
License
REA ka apna likha hua code MIT ke tehat licensed hai. Third-party material ke apne licenses aur copyright notices barqarar rehte hain. Dependency inventory, preserved license texts aur external tools ki terms ke liye Third-party notices dekhein.
IDA Pro / Hex-Rays decompilers, Hopper aur JEB samet commercial tools qanooni tareeqe se hasil karna aur unke applicable licenses ke mutabiq use karne ki ijazat rakhna zaroori hai. REA koi tool license, key ya activation ka haq nahi deta. Trials aur demos vendor ki terms ke tehat rehte hain, jin mein user, feature, automation aur output sharing ki pabandiyan bhi shamil hain. Cracked copies, chori ki hui keys, ghair ijazati key sharing aur license restrictions bypass karne ki ijazat nahi. Yeh guidance MIT ya third-party licenses ko tabdeel nahi karti.