lkimuk/ReArk

ReArk – AI‑assisted reverse‑engineering workstation

What it is

• A desktop application for inspecting and analysing mobile and native binaries. It works with HarmonyOS NEXT packages (.hap, .app, .abc), Android APK/AAB files, iOS IPA files, and raw Windows PE, Linux ELF, or macOS Mach‑O binaries.
• The tool combines classic static reverse‑engineering (disassembly, decompilation, resource browsing) with an optional ReArk Agent that can answer natural‑language questions about the loaded package using LLMs (OpenAI‑compatible endpoints or local Ollama models).

Key capabilities

Area	What you can do
Package inspection	View file hierarchy, resources, signatures, manifests, permissions, and metadata.
Static code analysis	Disassemble ABC bytecode, view decompiled Java‑like output for Android, and explore strings, cross‑references and call‑argument flows.
Native binary view	Parse PE/ELF/Mach‑O headers, sections, imports/exports, relocations and security mitigations (ASLR, DEP, PIE, etc.).
Signing & re‑packaging (HarmonyOS)	Examine certificates, verify signing status, replace signing material and rebuild the package.
Device interaction	Connect to HarmonyOS devices via HDC or Android devices via ADB, install packages, capture screenshots, mirror the screen, record audio, and run commands on the device.
AI‑assisted analysis	Ask contextual questions to the ReArk Agent, retrieve specific artefacts (e.g., strings, decompiled code), and attach your own reference documents.
Cross‑format navigation	Switch between structured listings, hex view with field‑level annotations, and formatted JSON/XML/text representations.

Supported platforms

• Windows 10+ (x64) – installer provided as a .exe setup.
• macOS 14+ (Apple Silicon) – distributed as a signed .dmg.
• Linux – planned for a future release (currently listed as “coming”).

How the AI part works

• The ReArk Agent talks to any OpenAI‑compatible API or to a locally‑run Ollama model.
• It can retrieve data from the currently opened package (metadata, strings, disassembly, etc.) and present it in natural language, helping users formulate queries without digging through raw output.
• Users can also attach their own documents (e.g., design specs) to enrich the context the model sees.

Typical use cases

• Security researchers analysing suspicious apps or malware on Android, iOS, or HarmonyOS.
• CTF participants needing quick insight into package contents and binary protections.
• Developers verifying that their app’s signing chain and permissions are correct.
• Reverse‑engineers who want a visual workspace that can also answer “What does this method do?” via an LLM.

Safety & privacy notes

• The README stresses legal use (authorized reverse engineering, interoperability, security research).
• When the Agent contacts remote model providers, users should avoid sending secrets, certificates, or proprietary code.

License

• Apache 2.0 – permissive open‑source licence.

Where to get it

• Pre‑built installers are on the GitHub releases page. The Windows x64 installer and macOS Apple‑Silicon DMG are linked directly in the README.

---

All information above is taken directly from the project's README; no additional features have been inferred.