rea
使用 AI Agent 分析应用行为与原生二进制的逆向工程工具。适合探索软件行为和辅助代码分析。
中文简介经编辑校订 · agent-skills / ai-agents / binary-analysis / claude-code / cli / codex
README / 项目原文
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română
REA: Reverse Engineer Anything
One MCP for reverse engineering across binaries, applications, and runtime behavior.
See a feature you like. Understand how it works, down to the binary level.
Quick start · How REA works · What you can analyze · Showcases · FAQ · Documentation
npx rea-agents setup
[!IMPORTANT] Get REA from morluto/rea, rea.tools, or the rea-agents npm package. Follow the installation and release links from these official sources. A similar repository name or copied README does not establish that a download is official.
See a feature in an app that you want in your own product? Ask your agent to investigate it with REA. It can inspect the app without its source code, explain how the feature works, show the evidence, and build a version for your project.
REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.
Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper, Ghidra, or IDA installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs no native analysis engine.
Visit the REA website for setup instructions, illustrated guides, and real case studies.
Quick start
On Linux, Ghidra, JADX, firmware tool launches and static JavaScript/Electron
analysis require a procps-compatible ps on REA's PATH for process ownership
checks. Recovery steps are in docs/installation.md under
"Linux owned-process prerequisite".
Set up your agent
With Node.js and npm installed, run:
npx rea-agents setup
Choose your agents, review the proposed changes, and approve them. Setup adds REA's MCP server and matching workflow instructions, with backups of existing configuration. Restart your agent afterward.
Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents. See installation and setup for provider configuration and manual MCP registration.
MCP uses compact input schemas by default to reduce context overhead. Set
REA_MCP_INPUT_SCHEMA_PROFILE=full in your MCP registration when you need the
complete advertised field guidance and nested validation details. Both profiles
keep the full tool set and canonical server validation. See
"Compact input schema profile" in the MCP contracts guide.
Ask your agent
Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.
Replace Notes with your target app and the feature you want to understand.
Use the terminal
Inspect an extracted JavaScript/Electron app directory or ASAR:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
The result includes modules, imports, Electron boundaries and their evidence.
Replace the path with your target, such as "D:/apps/example" on Windows.
To install the rea command for regular use:
npm install --global rea-agents
rea --help
For native analysis, configure a provider first. See the CLI and Evidence guide for native commands, provider selection, snapshots and scripting.
Update REA
REA changes quickly, and new releases include frequent bug fixes. Keep your installation up to date.
For a CLI installed with npm install --global or bun add --global:
rea update
rea --update is an alias for this verified workflow and accepts the same global
output flags. Use rea update when combining it with other command controls.
Updater commands retain at most 4 MiB of stdout and stderr combined. Oversized metadata replies are rejected after the command exits; verbose installs continue with bounded diagnostics. Human progress output respects terminal backpressure and waits for submitted writes to finish.
Bun global updates require Bun 1.2.17 or later. With an older Bun release,
upgrade Bun manually before running rea update.
To refresh your agent registrations and skill, run the setup command printed by the update.
If you use npx, update your agent setup with:
npx rea-agents@latest setup
Review the setup changes and restart your agent. For one-off CLI commands,
use npx rea-agents@latest followed by the command. With Bun, use
bunx rea-agents@latest in place of npx rea-agents@latest.
How REA works
Your agent calls REA through MCP to inspect the target and trace relevant code. REA returns findings with their evidence. The agent uses them to ask follow-up questions, explain the behavior, or write and test an implementation. CLI commands use the same workflows.
What you can analyze
REA requires Node.js 22.x (>=22.23.4), 24.x (>=24.22.1), or 26.12.1+, plus npm. Additional tools and host support depend on the target:
| Target | What REA returns | Requirements and guide |
|---|---|---|
| Desktop installations | Runtime candidates, supporting files, component markers and next probes | Built-in bounded directory/header inspection; desktop applications |
| Native binaries | Pseudocode, assembly, strings, symbols, calls and references | Hopper, Ghidra or IDA; native analysis |
| Offline ELF layout | Sections, segments, original symbols/relocations and static mitigation candidates | Caller-supplied pwntools on Linux x64; binary diagnostics |
| Go binaries | Embedded compiler version, modules, replacements and build settings | Built-in static ELF/PE/thin Mach-O inspection; no Go installation required |
| GPU code objects | CUDA/HIP targets, selected kernel parameters and resources, retained PTX text | Built-in static ELF/PE/fatbin/CUBIN/PTX inspection; GPU code objects |
| Model artifacts | GGUF / safetensors metadata, tensor declarations and derived totals | Built-in header inspection; optional full-file hash; model files |
| IL2CPP metadata | Unity global-metadata.dat assembly images, type and method names and index ranges | Built-in static decoding of versions 24, 27, 29, 31 and 39; no Unity required |
| Godot PCK | Archive inventory and extraction, original header/directory facts and selected content identities | Built-in static formats 2, 3 and 4; no Godot required |
| Rust binaries | Embedded cargo-auditable crate names, versions, sources and dependency edges | Built-in static ELF/PE/thin Mach-O inspection; Rust binaries |
| PE certificates | Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields | Built-in static PE inspection; PE certificates |
| PE imports | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash | Built-in static PE inspection; PE imports |
| ELF notes | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields | Built-in static ELF inspection; ELF notes |
| Apple IPS crashes | .ips metadata, threads, images, registers and documented crash classes | Built-in static JSON inspection; Apple IPS |
| Linux kernel modules | .modinfo keys, __versions CRCs, this_module presence, and signature trailer | Built-in static ELF inspection; kernel modules |
| Erlang BEAM | IFF chunks, atoms, exports, imports, lambdas and the Code header | Built-in static BEAM inspection; Erlang BEAM |
| WASM artifact | Validation, sections, exact import/export WAT forms and decoded WAT | Caller-supplied WABT 1.0.42; inspect_wasm_artifact |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments and mutability | Local raw/hex carrier on Linux x64; offline EVM guide |
| SQLite databases | Tables, columns, indexes, views, triggers and selected ordinary-table rows | Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits |
| Recorded Linux crashes | Raw notes, every recorded thread's registers/signals and optional mapping candidates | Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; recorded crashes |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC and native add-on relationships | Node.js and npm; Linux: procps-compatible ps; application analysis |
| Websites | Page structure, scripts, network observations and requested screenshots | A Chrome-family browser; browser analysis |
| Saved network captures | Requests, responses, exposed payloads and source locations | HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy; capture guide |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies and build comparisons | None (static only); managed-code guide |
| Android APKs | Manifest declarations, classes, decompiled methods and references | Headless JADX and a full JDK on Linux/macOS/Windows x64; Android guide |
| APK signatures | v1/v2/v3/v3.1 signers, certificate fingerprints, key rotation and digest self-consistency | None (static only); inspect_apk_signature |
| Android devices | Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers | Caller-supplied adb (emulator or hardware); ADB guide |
| JEB projects | Engine-backed project units, artifact digests and type/method pseudo-code | A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL; JEB guide |
| Android resources | Decoded manifest, string tables, locales and version facts | Caller-supplied Apktool launcher; resource guide |
| Flutter apps | Dart snapshot hash, per-ABI library digests and engine build provenance | None (static APK parsing); Flutter guide |
| Firmware | Regions, extraction results and native-analysis handoffs | Binwalk / Unblob on Linux; firmware guide |
| Recorded packets | Selected fields, repeated values, filters and decode-as rules | Linux: TShark 4.x + prlimit; capture guide |
| Packet summaries | Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests | Caller-supplied tshark and capinfos (Linux-verified); pcap guide |
| Recorded logic signals | Decoder annotations, sample ranges and diagnostics | Linux: sigrok-cli 0.7.2 + prlimit; signal recordings |
| Packages and resources | File inventories, digests, plists, Apple bundle anatomy and extracted resources | Artifact and JavaScript guide, Apple applications |
| Process behavior | Terminal output, interactions, exit and filesystem observations, and run comparisons | Linux/macOS with a native PTY; process capture |
| PyInstaller executables | CArchive members, Python version, entry scripts and extracted bytecode | None (static only); Python packaged applications |
Static JavaScript and .NET inspection read the supplied files without running the application. Runtime capture runs or interacts with the selected target using your user permissions; each runtime guide describes its effects.
For offline native-binary inspection, REA also supports caller-supplied GNU objdump and Rizin. See the reverse-engineering tools guide for provider setup, CLI commands, and Evidence limitations. REA does not install or update either provider.
Native formats and host support vary by provider. See
Hopper and Ghidra setup, the
IDA guide (including an optional native MCP bridge), the
Kuna decompiler guide, and
experimental Windows Ghidra support.
Ghidra also supports 16-bit DOS analysis.
For large binaries, raise the provider's startup deadline with
REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.
For provider selection, see the CLI guide.
Check release availability
for features added since the latest npm release.
Showcases
DX-Ball: reconstruct a sound-pan calculation
Follow a sound call into its position-to-pan helper, inspect the instructions, and turn incomplete pseudocode into C. The reconstruction passes 3,205 original-x86 cases and reproduces all 63 compiled function bytes.
Read the case study · Reconstruction repository
Notion: trace the Electron clipboard bridge
Find the renderer's clipboard API, follow it through preload and IPC into the main process, and inspect the rich clipboard format.
TH04: recover a DOS bullet-ring calculation
Inspect the original PC-98 game's 16-bit instructions, recover the fixed and aimed angle calculations, and compare the reconstructed C++ with the historical compiler output.
Read the case study · Reconstruction repository
If you've used REA on something interesting, we'd love to see it. Share your case in an issue or a pull request, including the target, your question, how REA helped, and what you found.
FAQ
Which agents can use REA?
Any agent that supports local MCP servers. Setup configures the supported agents; other clients can use manual MCP registration.
Do I need Hopper, Ghidra or IDA?
Deep native analysis uses one of them. Static JavaScript and .NET inspection work without a native analysis engine. Setup can install Hopper after approval; Ghidra and IDA use your existing installations. See provider setup.
Do I need to start Hopper first?
REA starts Hopper when an operation needs it. On macOS, a first-run dialog may ask you to choose demo mode or activate your license. Complete that prompt in the same user session before your first CLI/MCP operation or unattended job. Open Hopper manually if needed. See Hopper startup and troubleshooting.
What does installing the skill from skills.sh do?
The skill supplies investigation instructions for your agent. Use npx rea-agents setup
to register REA's MCP server and install the matching instructions, then restart
your agent. See skill-only installation.
What code does REA return?
Native analysis returns pseudocode and assembly. JavaScript/Electron analysis recovers modules and their relationships. Your agent uses these findings to write and test an implementation; the showcases give worked examples.
Does REA upload my app?
REA analyzes targets locally. Your agent receives the tool results, and its model provider has its own data policy.
What should I do if I hit a bug?
Update first; a recent release may already fix it.
For a CLI installed with npm install --global or bun add --global:
rea update
For agent setup through npx:
npx rea-agents@latest setup
If you're using an agent, complete the setup refresh and restart it. Retry the same task. If the problem persists, open an issue with your REA version, target type, steps to reproduce and error output.
Documentation
Start with the website's worked guides. For exact options, prerequisites and result contracts:
- Installation and setup: agent registration, provider configuration, updates and uninstall.
- Readiness and troubleshooting: diagnose one agent or analysis engine.
- CLI and Evidence: commands, provider selection, snapshots, import/export and exit statuses.
- MCP contracts and agent prompts: tool results, sessions and guided investigations.
- Tool catalog: generated inventory of tools, providers and CLI commands.
- Roadmap: planned work and capability trackers.
Report vulnerabilities through SECURITY.md.
Star history
🎉 300,000 GitHub stars — thank you!
Thanks to everyone using REA, reporting bugs, requesting features, testing builds, and contributing fixes.
Disclaimer
See DISCLAIMER.md for responsible-use guidance.
The project's position on illegal or unauthorized use covers all REA versions, distribution channels, and platforms; each copy retains its applicable licenses.
REA is for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine.
Contributing
We'd love your help with REA! Open an issue to report a bug or suggest a feature, or send a pull request to improve the code or docs.
See CONTRIBUTING.md for development setup and checks, testing for verification lanes, and the architecture map for selected layers and dependency paths.
License
REA-authored code is licensed under MIT. Third-party material retains its own licenses and copyright notices; see Third-party notices for the dependency inventory, preserved license texts, and external-tool terms.
You must legally obtain and be authorized to use commercial tools, including IDA Pro / Hex-Rays decompilers, Hopper, and JEB, under their applicable licenses. REA grants no tool license, key, or activation entitlement. Trials and demos remain subject to vendor terms, including user, feature, automation, and output sharing restrictions. Cracked copies, stolen keys, unauthorized key sharing, and bypassing license restrictions are not authorized. This guidance does not amend MIT or third-party licenses.
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română
REA：逆向一切
通过一个 MCP 服务，逆向分析二进制文件、应用程序和运行时行为。
看到喜欢的功能，弄清它的工作原理，深入到二进制层面。
快速开始 · REA 的工作原理 · 可以分析什么 · 案例 · 常见问题 · GNU objdump 和 Rizin 工具 · 文档
npx rea-agents setup
[!IMPORTANT] REA 官方来源： morluto/rea, rea.tools, rea-agents (npm). 请通过这些官方来源提供的安装和发布链接获取 REA。相似的仓库名称或复制的 README 不能证明下载内容来自官方。
在应用中看到一个想加入自己产品的功能？让智能体用 REA 调查它。即使没有源代码，智能体也可以检查应用、解释功能的工作方式、展示证据，并为你的项目实现类似功能。
REA 将智能体连接到分析工具，用于检查原生二进制文件、JavaScript 和 Electron 应用、.NET 程序集以及网站。你也可以在终端中使用同样的工具。分析在本机运行，结果包含支撑各项结论的证据和相关限制。
设置流程会向智能体注册 REA，并安装匹配的工作流指引。原生分析可以使用已有的 Hopper、Ghidra 或 IDA；设置流程也可以在你批准后安装 Hopper。静态 JavaScript 分析不需要原生分析引擎。
访问 REA 网站，查看设置说明、图解指南和真实案例。
快速开始
Linux 上的 Ghidra、JADX、固件工具启动和静态 JavaScript/Electron 分析需要在 REA 的 PATH 中提供兼容 procps 的 ps，用于检查进程所有权。恢复步骤见安装指南的 Linux 进程所有权前提。
设置智能体
安装 Node.js 和 npm 后，运行：
npx rea-agents setup
选择智能体，检查计划中的变更并批准。设置流程会添加 REA 的 MCP 服务和匹配的工作流指引，并备份已有配置。完成后重启智能体。
设置流程支持 Claude Code、Codex、Cursor、Gemini CLI、Grok Build 和其他智能体。提供方配置和手动注册 MCP 的方法见安装与设置。
MCP 默认使用紧凑输入 Schema 来减少上下文开销。需要完整字段说明和嵌套验证细节时，在 MCP 注册中设置 REA_MCP_INPUT_SCHEMA_PROFILE=full。两种配置都保留完整工具集和规范的服务端验证；见 MCP 合约指南。
询问智能体
弄清 Notes 应用的搜索功能如何工作，展示证据，并为我的项目实现类似功能。
把 Notes 替换为目标应用，并描述你想了解的功能。
使用终端
检查已解包的 JavaScript/Electron 应用目录或 ASAR 文件：
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
结果包含模块、导入、Electron 边界及相关证据。将路径替换为你的目标路径，例如 Windows 上的 "D:/apps/example"。
如果需要经常使用，可以安装 rea 命令：
npm install --global rea-agents
rea --help
原生分析需要先配置分析提供方。原生命令、提供方选择、快照和脚本用法见 CLI 与 Evidence 指南。
更新 REA
REA 更新较快，新版本经常包含错误修复。请保持安装的版本为最新。
通过 npm install --global 或 bun add --global 安装的 CLI 使用：
rea update
rea --update 是 rea update 的别名，接受相同的全局输出选项。更新命令合计最多保留 4 MiB 的 stdout/stderr；命令退出后会拒绝过大的元数据响应，详细安装日志采用有界诊断。进度输出遵守终端背压并等待已提交的写入完成。
Bun 全局更新需要 Bun 1.2.17 或更高版本。如果使用较旧的 Bun 版本，请先手动升级 Bun，再运行 rea update。
要更新智能体注册和 skill，请运行更新命令输出的设置命令。
如果使用 npx，通过以下命令更新智能体设置：
npx rea-agents@latest setup
检查设置变更并重启智能体。单次 CLI 操作可使用 npx rea-agents@latest，后接所需命令。使用 Bun 时，用 bunx rea-agents@latest 代替 npx rea-agents@latest。
REA 的工作原理
智能体通过 MCP 调用 REA，检查目标并追踪相关代码。REA 返回发现及对应证据。智能体据此提出后续问题、解释行为，或编写并测试实现。CLI 命令使用同样的工作流。
可以分析什么
REA 需要 Node.js 22.x（>=22.23.4）、24.x（>=24.22.1）或 26+ (>=26.12.1)，以及 npm。额外工具和主机支持取决于分析目标：
| 目标 | REA 返回的内容 | 要求与指南 |
|---|---|---|
| 原生二进制文件 | 伪代码、汇编、字符串、符号、调用和引用 | Hopper、Ghidra 或 IDA；原生分析 |
| 离线 ELF 布局 | 节、段、原始符号/重定位信息及静态防护机制候选项 | Linux x64 上由调用方提供的 pwntools；二进制诊断 |
| Go 二进制文件 | 内嵌编译器版本、模块、替换项和构建设置 | 内置静态 ELF/PE/thin Mach-O 检查；无需安装 Go |
| WASM 工件 | 验证、节、精确的导入/导出 WAT 形式及解码后的 WAT | 调用方提供的 WABT 1.0.42；inspect_wasm_artifact |
| EVM 字节码 | 分派选择器、字节偏移、推断的参数和状态可变性 | Linux x64 上的本地原始字节/十六进制输入载体；离线 EVM 指南 |
| Rust binaries | Embedded cargo-auditable dependency list | Rust binaries |
| Erlang BEAM | IFF chunks, atoms, exports, and tables | Built-in static BEAM inspection; Erlang BEAM |
| PE certificates | Authenticode WIN_CERTIFICATE entries and PKCS#7 signer/X.509 identity fields | Built-in static PE inspection; PE certificates |
| PE imports | Import and delay-load DLL names, ordinals, IAT RVAs and pefile import hash | Built-in static PE inspection; PE imports |
| ELF notes | PT_NOTE/SHT_NOTE owners, types, GNU build-id and ABI-tag fields | Built-in static ELF inspection; ELF notes |
| Apple IPS crashes | .ips metadata, threads, images, registers and crash classes | Built-in static JSON inspection; Apple IPS |
| Linux kernel modules | .modinfo keys, __versions CRCs, this_module presence, and signature trailer | Built-in static ELF inspection; kernel modules |
| 已记录的 Linux 崩溃 | 原始 note 记录、每个已记录线程的寄存器/信号及可选的映射候选项 | Linux x64 上由调用方提供的 pwntools；可选的 GDB/pwndbg；已记录崩溃 |
| 桌面安装目录 | 运行时候选、支持文件、组件标记和后续操作 | 有界的目录与文件头检查；桌面应用 |
| JavaScript / Electron | 模块、导入、source map、路由、IPC 和原生扩展关系 | Node.js 和 npm；应用分析; Linux: procps ps |
| 网站 | 页面结构、脚本、网络观察结果和按请求获取的截图 | Chrome 系浏览器；浏览器分析 |
| 已保存的网络捕获 | 请求、响应、可访问的载荷和来源位置 | HAR / Fiddler Everywhere SAZ；原生 mitmproxy 捕获需要 Linux 上的 mitmdump；捕获指南 |
| 数据包捕获 | 端点、DNS、TLS SNI、协议分布和 HTTP 请求 | 调用方提供的 tshark 和 capinfos；pcap 指南 |
| .NET 程序集 | 元数据、CIL 指令、声明的原生依赖和构建对比 | 静态检查；托管代码指南 |
| PyInstaller | CArchive, PYZ, Python bytecode | Static inspection; Python packaged applications |
| Android APK | 清单声明、类、反编译的方法和引用 | Linux/macOS/Windows x64 上的无界面 JADX 和完整 JDK；Android 指南 |
| Android 设备 | 设备、软件包、进程、日志、转储、屏幕截图以及 APK/文件传输 | 调用方提供的 adb（模拟器或实体设备）；ADB 指南 |
| JEB 项目 | 引擎支持的项目单元、工件摘要和类型/方法的伪代码 | 由调用方启动、提供 MCP 的 JEB 客户端，通过 REA_JEB_MCP_URL 选择；JEB 指南 |
| Android 资源 | 解码后的清单、字符串表、语言区域和版本信息 | 调用方提供的 Apktool 启动器；资源指南 |
| Flutter 应用 | Dart 快照哈希、按 ABI 的库摘要及引擎构建溯源 | 无（静态 APK 解析）；Flutter 指南 |
| 固件 | 区域、提取结果和转交原生分析的内容 | Linux 上的 Binwalk / Unblob；固件指南 |
| 抓包文件 | 指定字段、重复值、过滤条件与解码规则 | Linux: TShark 4.x + prlimit; 抓包分析指南 |
| 录制的逻辑信号 | 解码注释、样本范围和诊断信息 | Linux: sigrok-cli 0.7.2 + prlimit; 信号记录指南 |
| 软件包与资源 | 文件清单、摘要、plist、Apple bundle 结构和提取的资源 | 制品与 JavaScript 指南、Apple 应用 |
| 进程行为 | 终端输出、交互、退出和文件系统观察结果，以及运行对比 | 支持原生 PTY 的 Linux/macOS；进程捕获 |
| SQLite 数据库 | 表、列、索引、视图、触发器和选定普通表的行 | 本地数据库/WAL 快照；Node.js 24.x >=24.15 或 26+，具有原生 SQLite 限制 API |
| GPU 代码对象 | CUDA/HIP 目标、选定内核参数和资源、保留的 PTX 文本 | 内置静态检查 ELF/PE/fatbin/CUBIN/PTX; GPU |
| 模型文件 | GGUF / safetensors 元数据、张量声明和派生总量 | 头部检查；可选完整文件哈希; GGUF / safetensors |
| IL2CPP 元数据 | Unity global-metadata.dat 程序集映像、类型和方法名、索引范围 | 静态解码版本 24、27、29、31 和 39；无需 Unity |
| Godot PCK | 归档目录与提取、原始头部和目录信息、选定内容身份 | 静态格式 2、3 和 4；无需 Godot |
| APK 签名 | v1/v2/v3/v3.1 签名者、证书指纹、密钥轮换和摘要自洽性 | 内置静态检查; inspect_apk_signature |
静态 JavaScript 和 .NET 检查读取提供的文件，不运行应用。运行时捕获会以你的用户权限运行目标或与之交互；各运行时指南说明了具体影响。
大型二进制文件可通过 REA_GHIDRA_STARTUP_TIMEOUT_MS 或 REA_HOPPER_STARTUP_TIMEOUT_MS 延长提供方启动期限。
不同提供方支持的原生格式和主机系统有所不同。请参阅 Hopper 与 Ghidra 设置、IDA 指南、Kuna和实验性 Windows Ghidra 支持。Ghidra 也支持 16 位 DOS 分析。提供方选择见 CLI 指南。对于最新 npm 版本发布后新增的功能，请查看发布可用性。
案例
DX-Ball：重建声像计算
沿声音调用追踪到根据位置计算声像的辅助函数，检查指令，将不完整的伪代码转为 C。重建结果通过了 3,205 个原始 x86 测试用例，并复现了编译后函数的全部 63 个字节。
Notion：追踪 Electron 剪贴板桥
找到渲染进程的剪贴板 API，沿 preload 和 IPC 追踪到主进程，并检查富格式剪贴板数据。
TH04：恢复 DOS 环形子弹的计算
检查原始 PC-98 游戏的 16 位指令，恢复固定角度和瞄准角度的计算，并将重建的 C++ 与当年的编译器输出进行对比。
如果你用 REA 分析了有趣的目标，我们很想了解。欢迎通过 issue 或 pull request 分享案例，说明目标、你的问题、REA 如何提供帮助，以及你的发现。
常见问题
需要 Hopper、Ghidra 或 IDA 吗？
深入的原生分析需要其中一个引擎。静态 JavaScript 和 .NET 检查不需要原生分析引擎。设置流程可以在你批准后安装 Hopper；Ghidra 和 IDA 则使用已有安装。见提供方设置。
需要先启动 Hopper 吗？
REA 会在操作需要时启动 Hopper。在 macOS 上，首次运行时可能会出现对话框，让你选择演示模式或激活许可证。见 Hopper 启动与故障排查。
从 skills.sh 安装 skill 有什么作用？
skill 为智能体提供调查指引。使用 npx rea-agents setup 注册 REA 的 MCP 服务并安装匹配的指引，然后重启智能体。见仅安装 skill。
REA 返回什么代码？
原生分析返回伪代码和汇编。JavaScript/Electron 分析恢复模块及其关系。智能体利用这些发现编写并测试实现；案例提供了完整示例。
REA 会上传我的应用吗？
REA 在本机分析目标。智能体会接收工具结果，其模型提供商有自己的数据政策。
遇到错误时该怎么办？
先更新；最近的版本可能已经修复了问题。
通过 npm 安装的 CLI 使用：
rea update
通过 npx 设置智能体时使用：
npx rea-agents@latest setup
如果正在使用智能体，请完成设置更新并重启智能体。重试同一任务。如果问题仍然存在，请提交 issue，附上 REA 版本、目标类型、复现步骤和错误输出。
文档
可以先阅读网站上的实操指南。具体选项、前提条件和结果契约见：
- 安装与设置：智能体注册、提供方配置、更新和卸载。
- 就绪检查与故障排查：诊断特定智能体或分析引擎。
- CLI 与 Evidence：命令、提供方选择、快照、导入/导出和退出状态。
- MCP 契约和智能体提示词：工具结果、会话和引导式调查。
- 工具目录：构建时生成的工具、提供方和 CLI 命令清单。
- 路线图：计划中的工作和能力跟踪。
请按照 SECURITY.md 报告漏洞。
Star 历史
🎉 GitHub Star 达到 300,000 个，感谢大家！
感谢每一位使用 REA、报告错误、提出功能需求、测试构建和贡献修复的朋友。
免责声明
负责任使用的相关指引请见 DISCLAIMER.md。
REA 用于合法的研究、教育、互操作性、软件保存，以及分析你拥有或获准检查的软件。
本项目对非法或未经授权使用的立场涵盖所有 REA 版本、分发渠道和运行平台； 每份副本仍适用其随附的许可。
参与贡献
欢迎帮助改进 REA！你可以提交 issue 报告错误或建议功能，也可以提交 pull request 改进代码或文档。
开发设置和检查见 CONTRIBUTING.md，验证流程见测试指南，项目结构见架构图。
许可证
REA 自行编写的代码采用 MIT 许可；第三方内容保留各自的许可和著作权声明。 依赖清单、许可原文及外部工具条款见第三方声明。
用户须自行合法取得商用工具及所需使用权，包括 IDA Pro / Hex-Rays 反编译器、 Hopper 和 JEB，并遵守各自许可。REA 不提供工具许可、密钥或激活权利；试用版和 演示版也须遵守厂商对用户、功能、自动化及输出分享的限制。不得使用破解副本、 窃取或违规共用密钥，也不得绕过许可限制。本指引不变更 MIT 或第三方许可。