Entrpiandmorluto
b43c329df7
* feat(artifacts): inventory and extract UF2 and DfuSe regions open_binary refused UF2 and DfuSe firmware containers as an unsupported format, so inspect_artifact and extract_artifact could not show which bytes a drag-and-drop or DFU update writes at which addresses. UF2 is recognized by a complete first block with all three magic numbers. Valid main-flash payloads are joined into address-contiguous regions per familyID, named family-0x<id>/0x<start>-0x<end>.bin, and known IDs are named from a small table copied from Microsoft's uf2families.json at a pinned commit. Numbering is counted per familyID and block count: absent, repeated, out-of-order and out-of-range block numbers are reported, and absent blocks leave coverage unknown. Not-main-flash blocks are excluded and reported; file-container blocks are reported and leave coverage unknown; invalid blocks and a partial final block are excluded with their position. A rewrite of one address with different bytes fails closed, naming both block spans. DfuSe is recognized only by its prefix together with a DFU 1.1a suffix. Each element becomes one region at its file range with its target's alternate setting and name. Structural faults fail closed with a byte offset; overlapping elements stay separate and are reported. A suffix CRC mismatch follows integrity_policy: fail refuses with a dfu-crc32 integrity error, and record-and-continue records a root contradiction that extraction also carries. HEX, UF2 and DfuSe share one retained-region reader and one run merger, so the HEX decoder and reader lose their private copies. * docs(artifacts): document UF2 and DfuSe images and their esptool lane Describe recognition, region names, metadata, numbering, failures, the DfuSe suffix CRC under integrity_policy, and limits, and link the page from the CLI and firmware guides and the agent skill reference. npm run verify:uf2 runs esptool merge-bin --format uf2 on generated inputs at known addresses, with and without MD5, with 256-byte payloads, and on a concatenation of two chips' outputs. Inspection and extraction through the built CLI must return every input at its address under the familyID esptool itself reports. * fix(artifacts): accept both DfuSe image size conventions UM0391 calls DFUImageSize the file length, and dfu-util's dfuse-pack.py writes that value, while ST's DfuFileMgr, MicroPython's dfu.py and pydfu leave the 16-byte suffix out. The decoder accepted only the second form, so it refused dfuse-pack.py output as malformed. Accept either value and keep the declared one in image_size; any other value still fails with the suffix offset and the file length. The tests pin both producers' output for one image, CRC included, from their build() functions transcribed and run under Python 3. * fix(artifacts): keep reused UF2 block numbers from hiding missing blocks esptool numbers every merged input from 0, so two inputs with the same block count share one numbering group. A block lost from one input left its number present in the other, and the file reported complete coverage. Each block number now records the target addresses it was seen at: equal address counts are complete copies, a resend to the same address is one block, and unequal counts make coverage unknown with a limitation and ambiguous_numbering_group_count. sequence_count becomes numbering_group_count, and region block positions become first_file_block and last_file_block. Review follow-ups in the same change: - compare_artifacts compares a DfuSe element's alternate setting and target name, so bytes moved to another device memory are changed; - the shared reader keeps no region bytes outside its map after close; - one domain type replaces four identical decoder failure types; - the UF2 decoder returns a typed limit instead of throwing on bytes beyond its admitted size, and caps retained regions, not runs; - DfuSe caps elements with bytes only, names empty elements and element-less targets, drops the constant bVersion and bcdDFU fields, and says whether the CRC matches when DFUImageSize fits neither convention; - classification evidence carries a suffix only when the probe saw the end, and root classification reads the tail only for a DfuSe prefix; - the UF2 domain region owns family_name, and the root records the family registry revision; the table's MIT notice is preserved; - docs pin the producer revisions (dfu-util ee6b393d and f9a537c9, MicroPython cb99ca98), give the MD5 structure's real meaning, and describe container contradictions in the MCP contract guide; - tests and the esptool lane add the equal-count inputs and a block lost from one of them, accepted boundaries beside each refusal, a DfuSe root larger than the classification prefix, and CLI refusals. * feat(artifacts): name the UF2 families that LibreTiny builds for LibreTiny writes UF2 for Realtek, Beken and Bouffalo Lab modules. The Microsoft registry revision REA already cites (cf3bd7f9) lists eight of those families: RTL8710A, RTL8710B, RTL8720C, RTL8720D, BK7231U, BK7231N, BK7251 and BL602. Their regions now carry those names. LN882H, which that revision omits, keeps its familyID with no name. * fix(artifacts): count DfuSe declarations without bytes instead of listing them Empty DfuSe elements have no entry, so DFUSE_MAX_ELEMENTS does not cap them, and the target walk kept a description string for each one. At 8 bytes per element, a file under the 128 MiB ceiling can declare about 16.7 million of them. The walk now counts every declaration without bytes and builds only the first NAMED_ELEMENTS descriptions, which is all that the limitation shows. The limitation text and empty_element_count do not change. The guide now says that both DfuSe limitations name the first four. On this host, decoding 4,000,000 empty elements (a 32 MB file) ran out of memory under a 128 MB V8 heap before this change, and it peaked at 1.59 GB RSS with the default heap. It now decodes in 114 ms with a 220 MB peak. --------- Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
27 KiB
Third-party notices
REA-authored code is licensed under MIT. Third-party material retains its own copyright, license, attribution, and NOTICE requirements. REA's MIT license grants no rights to proprietary analysis tools. Project and product names identify integrations; they do not imply affiliation or endorsement.
This inventory covers the locked npm dependency graph, code or assets derived from upstream projects, and separately obtained engines used by REA. A listed integration is not a statement that its executable is bundled. Upstream components and caller-selected versions may have additional terms; retain the notices supplied with the software you actually obtain or redistribute.
Distributed dependencies, derived code, and assets
| Material | Use and licensing records |
|---|---|
| npm dependencies | Complete inventory of every entry in package-lock.json, including transitive, optional platform, development, and website dependencies. Runtime notices preserve the copyright, license, and NOTICE documents from integrity-verified release archives, plus the MIT notice for Rolldown's generated runtime helpers. Development dependencies are inventoried but are not all distributed in REA's npm package. |
| pefile ordinal tables | Import-hash ordinal names are derived from pefile 2024.8.26, copyright 2004–2024 Ero Carrera. Preserve the MIT license. The Python package is not a runtime dependency. |
| UF2 family names | UF2 family IDs and short names are copied from microsoft/uf2 utils/uf2families.json, copyright Microsoft Corporation. Preserve the MIT license. |
| NativeAOT parser | REA's derived parser uses the MIT-licensed ghidra-nativeaot work of Washi and the NativeAOT layout definitions in dotnet/runtime. Preserve Washi's MIT notice and the .NET Foundation MIT notice. |
| EVM analysis | evmole@0.9.3, MIT, copyright 2023 Maxim Andreev. The published npm archive omits its license document; REA retains the original upstream license and provenance. It is also included in the runtime notices. |
| Windows native addon | The release addon is compiled with MinGW-w64 and statically links GCC runtime libraries. Preserve the MinGW-w64 runtime notices, GPLv3 text, and GCC Runtime Library Exception 3.1. The exception governs eligible compiled combinations; it does not relicense the runtime itself under MIT. The Node-API build headers are from Node 22.19.0; its original license and component notices are retained. Node itself is supplied by the user. Snapshot provenance and release-toolchain review requirements are in licenses/README.md. |
| Dinosaur website example | Selected excerpts from wayou/t-rex-runner, derived from Chromium's dinosaur game. The website retains the original BSD-3-Clause notices, including Chromium authors and wayou. This asset is not part of the npm runtime. |
Two locked runtime releases, clean-git-ref@2.0.1 (declared Apache-2.0) and
minimisted@2.0.1 (declared MIT), omit a full license/copyright document in their
published archives and inspected upstream release sources. Their runtime notice
entries preserve the declared license and author metadata and include a clearly
labeled standard license text. These are documented upstream notice gaps, not
recovered copyright notices or a claim that attribution has been fully verified.
The optional frida@17.23.2 npm archive and tagged Node binding source also
omit a standalone license/copyright document. Its declared
LGPL-2.0 WITH WxWindows-exception-3.1 license is recorded with unchanged
Frida licensing text and the
GNU Library GPL v2. These are licensing supplements,
not recovered Node binding or prebuild-component copyright notices.
Open-source engine credits and licenses
We thank the maintainers and contributors of the projects below. Their decompilers, binary-analysis engines, debuggers, parsers, and capture tools provide capabilities used through REA's integrations. Each row identifies the upstream project, its own license, and its role in REA. In particular, JADX provides the Android decompiler, while jadx-headless-mcp provides the separate headless integration used by REA; both projects deserve credit.
These acknowledgments are voluntary thanks. Required upstream copyright and NOTICE texts remain in their original form and are not replaced by this summary. Credits do not imply endorsement or change any license.
REA's adapters do not grant, replace, or waive these licenses. The upstream executables and their dependency graphs are supplied separately. Git submodules pin inspection sources; they are not included in the npm package.
| Project | License and source | REA relationship |
|---|---|---|
| Ghidra | Apache-2.0, with the government-work and component qualifications in its NOTICE | Bring your own Ghidra; see supported versions. Copies of the 12.1.4 LICENSE, NOTICE, and DISCLAIMER are retained for reference. |
| ghidra-nativeaot | MIT | Pinned inspection source; derived parser attribution above. |
| JADX | Apache-2.0 | The audited jadx-headless-mcp source uses JADX 1.5.6 for Android decompilation; the engine JAR is separately supplied. |
| jadx-headless-mcp | Apache-2.0 | v0.7.1; pinned submodule and user-supplied JAR. |
| Kuna | Apache-2.0, with its NOTICE | Bring your own kuna; REA verified 1.986 and never downloads, installs or bundles it. REA invokes it as a separate process. |
| Apktool | Apache-2.0 | User-supplied Android resource decoder. |
| Binwalk | MIT | v3.1.0; pinned submodule and user-supplied firmware engine. |
| Unblob | MIT | 26.6.4; pinned submodule and user-supplied firmware engine. |
| Wakaru | Apache-2.0 | v1.14.0; pinned source and separately obtained JavaScript reconstruction tooling. |
| WABT | Apache-2.0 | v1.0.42; external WebAssembly tools; integration provenance. |
| pwntools | MIT, with GPL/BSD component qualifications | 4.15.0; caller-supplied offline ELF analysis package. |
| pyelftools | Public-domain dedication and component notices | 0.33; includes separately licensed bundled material, including Construct. |
| Unicorn | GPL-2.0 and component notices | 2.1.2; used by the caller-supplied ELF analysis profile for instruction emulation. |
| pwndbg | MIT | 2026.09.15, commit 55596aa676a2756efb8d67034f31675170eabe48; separately obtained debugger extension. |
| GNU GDB | GPL-3.0-or-later | Caller-supplied debugger for the optional pwndbg core-file workflow. |
| LLDB / LLVM | Apache-2.0 with LLVM exceptions | Caller-supplied debugger; the installed distribution's component and historical notices also apply. |
| mitmproxy | MIT | 12.2.3; separately supplied network capture proxy. |
| Android Debug Bridge (adb) | Apache-2.0 | User-supplied Android device tool. A complete Android SDK download has its own SDK license terms; adb's source license does not replace them. |
| ILSpy / ICSharpCode.Decompiler | MIT | Optional separately installed .NET decompiler; not a redistributed REA dependency. |
Ghidra's original notice credits software developed at the National Security
Agency. It explains that US-government-created portions are not subject to US
copyright protection, while other portions retain their authors' rights. Its
modules include additional third-party licenses, and standalone programs under
GPL/ have GPLv3 terms. The three retained top-level documents do not replace
the module notices and license directories in a complete Ghidra distribution.
REA is not affiliated with or endorsed by the NSA.
Commercial tools and bridges
You must legally obtain the tools and the rights needed for your use. REA does not include an IDA Pro, Hex-Rays decompiler, Hopper, or JEB license, license key, or activation entitlement. A permitted trial/demo may be used only within its official terms. Cracked copies, stolen keys, unauthorized sharing, and bypassing activation or license limits are not authorized by REA.
| Project / product | Applicable terms and distinction |
|---|---|
| IDA Pro and Hex-Rays decompilers | Proprietary Hex-Rays software governed by the EULA, purchase agreement, and applicable license scheme. Obtain rights for the required product, user, machine, decompiler, and automation interfaces. Availability of an API or a bridge does not grant hosting, service, or additional-user rights. |
| ida-pro-mcp | The bridge's MIT license belongs to Duncan Ogilvie. It licenses the bridge code, not IDA or Hex-Rays products. Its README requires IDA Pro and explicitly states that IDA Free is unsupported. Follow the prerequisites for the version you actually install. The bridge is separately supplied, not bundled by REA. |
| Hopper Disassembler | Proprietary Cryptic Apps software under its license agreement. Personal and computer licenses have different permitted-user and installation rules; an official evaluation trial is available. REA setup may obtain the official installer after approval, but this grants no paid license or activation entitlement. |
| JEB | Proprietary PNF Software product under its EULA and edition-specific agreement. Check user/seat/server rights and whether your edition permits automation, backend/service integration, and disclosure of generated output. The published EULA restricts public or third-party disclosure of decompiled code, reconstructed artifacts, and analysis reports unless expressly permitted by the license type. |
The vendor's applicable agreement controls. These summaries do not interpret your individual contract or expand the rights it grants. Verify permissions before publishing analysis output, sharing tool access, or operating a service. Vendor terms above were checked on 2026-10-12.
Runtimes, development tooling, and fixtures
REA uses a caller-supplied Node.js runtime (MIT and component notices). Optional workflows may also use Python (PSF and component licenses), OpenJDK (GPLv2 with Classpath Exception and component notices), Electron (MIT and component notices), or a Chromium-based browser (BSD-3-Clause and third-party licenses). These external installations are not licensed or bundled by REA's MIT license.
Development, test, and website npm packages are included in the locked inventory.
GitHub Actions, operating-system utilities, downloaded verification fixtures,
and their runtimes retain the terms supplied by their publishers. Fixture
identities and provenance are recorded under scripts/fixtures/ and the
existing third_party/ records; downloaded executable fixtures are not tracked
or included in the npm package. This notice does not claim to inventory every
dependency of a caller's operating system, agent, or separately installed tool.
Maintaining and redistributing notices
Refresh the dependency inventory and runtime notice collection when the lockfile changes. Review the actual versions and distributed contents, retain the upstream license and copyright texts, and account for optional platform packages. See licenses/README.md for source provenance, collection scope, and known upstream notice gaps.
The npm package includes this document, the licenses/ directory, and the
existing redistributed license records under third_party/. If you additionally
bundle an external engine or modify upstream code, review that actual
distribution and retain its full applicable licenses, copyright notices,
NOTICE files, modification notices, and source obligations. REA's inventory is
not a substitute for those obligations.