bbylw/rea-cn

What is REA?

REA (Reverse‑Engineered Anything) is a Node‑JS‑based platform that lets large‑language‑model agents talk to traditional reverse‑engineering tools (Hopper, Ghidra, IDA, etc.) and to a suite of static‑analysis utilities for JavaScript/Electron, .NET, Android, firmware, web captures and more. The idea is to let an AI assistant ask the tool “how does this feature work?” and receive concrete evidence – decompiled code, call‑graphs, strings, resource listings, screenshots – that the agent can then reason about, explain, or even re‑implement.

---

How it works

1. MCP service – REA runs a local Micro‑Component‑Protocol server that exposes a catalog of analysis commands.
2. Agent registration – Using npx rea‑agents setup you register the service with a supported LLM‑powered agent (Claude, Gemini‑CLI, Cursor, Grok, etc.). The setup also installs a skill (prompt guide) that tells the agent how to formulate queries.
3. Ask a question – You type a natural‑language request, e.g. “Explain how Notion’s search works and give me evidence.”
4. Tool execution – REA calls the appropriate backend (Hopper, Ghidra, a JavaScript parser, a browser scraper, etc.) and returns structured evidence (pseudo‑code, assembly, module graph, screenshots, network logs).
5. Agent response – The LLM consumes the evidence, answers the question, and can even generate new code that you can test.

The same workflow is available from the command line, so you can script analyses without an LLM.

---

What can be analyzed?

Target	Evidence returned	Required tools
Native binaries (x86/ARM)	Pseudo‑code, assembly, strings, symbols, call refs	Hopper, Ghidra or IDA
ELF layouts	Sections, symbols, relocations, static protections	pwntools on Linux
EVM bytecode	Dispatch selectors, inferred parameters, state mutability	Raw byte/hex input on Linux
Recorded Linux crashes	Registers, signals, optional memory maps	pwntools, optional GDB
JavaScript / Electron apps	Modules, imports, source‑maps, IPC bridges, native extensions	Node.js/npm
Websites	DOM structure, scripts, network traces, screenshots	Chrome‑based browser
HAR captures	Requests, responses, payloads	HAR files, optional mitmdump
.NET assemblies	Metadata, CIL, native deps, build diff	Static analysis only
Android APKs	Manifest, classes, decompiled methods	JADX + JDK
Android devices	Packages, processes, logs, dumps, screenshots	adb
JEB projects	Project units, artifact summaries, pseudo‑code	JEB client via MCP
Android resources	Decoded manifest, string tables, locales	Apktool
Firmware images	Partitions, extracted files, hand‑off to binwalk	Binwalk/Unblob
Packages & resources (Apple bundles, JS artifacts)	File lists, plists, resource extraction	Various helpers
Process behavior	Terminal output, file‑system changes, runtime diff	PTY‑enabled Linux/macOS

Static JavaScript/.NET checks read files only; runtime captures run the target under your user permissions.

---

Getting started (quick‑start)

# 1. Install Node 22/24/26 and npm
npx rea-agents setup          # registers the MCP service & installs a skill
# 2. Ask an agent (via your chosen LLM client)
#    e.g. "Explain the search feature of the Notes app and show evidence."
# 3. Or run a CLI analysis directly
npx -y rea-agents@latest analyze-javascript-application /path/to/app --json

You can also install the CLI globally:

npm install -g rea-agents
rea --help

Updates are done with rea update (npm install) or npx rea-agents@latest setup for the skill.

---

Example showcase

• DX‑Ball – REA traced the sound‑panning routine in a classic PC‑98 game, turned incomplete pseudo‑code into C, and passed 3,205 original x86 test cases.
• Notion – Followed the Electron clipboard bridge from the renderer process through preload scripts to the main process, exposing the rich‑format clipboard API.
• TH04 – De‑compiled 16‑bit DOS bullet‑trajectory code, reconstructed the C++ logic, and matched it against the original compiler output.

Full case studies are on the REA website with links to the reconstructed repositories.

---

Who is it for?

• LLM‑powered agents that need concrete, verifiable evidence when reverse‑engineering closed‑source software.
• Security researchers who want to automate binary, firmware, or web‑app analysis and keep the results local.
• Developers looking to replicate a feature from a competitor’s app without source code.

---

Limitations & safety

• REA never uploads your binaries; all analysis runs locally. The LLM provider may log the evidence you send it.
• Deep native analysis requires a licensed disassembler (Hopper, Ghidra, IDA). Static JavaScript/.NET analysis works out‑of‑the‑box.
• You are responsible for having the legal right to reverse‑engineer the target.

---

Where to learn more

• Website & docs – https://rea.tools/ (guides, architecture, roadmap)
• Discord community – real‑time Q&A and showcase sharing.
• GitHub – source, CI, issue tracker, contribution guide.

---

TL;DR

REA is a Node.js toolkit that bridges LLM agents with traditional reverse‑engineering tools, letting you ask an AI to investigate binaries, Electron apps, Android packages, firmware, web captures, etc., and get back concrete evidence (pseudo‑code, graphs, screenshots) that the AI can explain or re‑implement. Install with npx rea‑agents setup, register your LLM, and start asking questions or run the CLI commands directly.