REA Guide

Reverse Engineer Anything

REA reads the artifacts you already have: JavaScript and Electron applications, .NET assemblies, native binaries, Android packages, websites and saved capture files. The static paths need no Ghidra, no IDA and no decompiler licence.

$ npx rea-agents@latest setup

Requires Node.js 22.x (22.19+), 24.x (24.11+) or 26+ — Node 23 and 25 and pre-releases are not supported.

See the 5 setup errors →Is it allowed? →

What do you want to analyze?

  1. JavaScript / Electron

    Modules, imports, source maps, routes, IPC and native add-on relationships

    No extra tools: Node.js and npm; Linux: procps-compatible `ps`

  2. .NET assemblies

    Metadata, CIL instructions, declared native dependencies and build comparisons

    No extra tools: None (static only)

  3. Native binaries

    Pseudocode, assembly, strings, symbols, calls and references

    Extra tools required: Hopper, Ghidra or IDA

  4. Android APKs

    Manifest declarations, classes, decompiled methods and references

    Extra tools required: Headless JADX and a full JDK on Linux/macOS/Windows x64

  5. Websites

    Page structure, scripts, network observations and requested screenshots

    Extra tools required: A Chrome-family browser

  6. Go binaries

    Embedded compiler version, modules, replacements and build settings

    No extra tools: Built-in static ELF/PE/thin Mach-O inspection; no Go installation required

  7. Rust binaries

    Embedded cargo-auditable crate names, versions, sources and dependency edges

    No extra tools: Built-in static ELF/PE/thin Mach-O inspection

  8. WASM artifact

    Validation, sections, exact import/export WAT forms and decoded WAT

    Extra tools required: Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`

  9. EVM bytecode

    Dispatch selectors, byte offsets, inferred arguments and mutability

    Extra tools required: Local raw/hex carrier on Linux x64

  10. SQLite databases

    Tables, columns, indexes, views, triggers and selected ordinary-table rows

    No extra tools: Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits

  11. Saved network captures

    Requests, responses, exposed payloads and source locations

    Extra tools required: HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy

  12. Offline ELF layout

    Sections, segments, original symbols/relocations and static mitigation candidates

    Extra tools required: Caller-supplied pwntools on Linux x64

  13. Recorded Linux crashes

    Raw notes, every recorded thread's registers/signals and optional mapping candidates

    Extra tools required: Caller-supplied pwntools on Linux x64; optional GDB/pwndbg

  14. Android devices

    Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers

    Extra tools required: Caller-supplied adb (emulator or hardware)

  15. JEB projects

    Engine-backed project units, artifact digests and type/method pseudo-code

    Extra tools required: A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL

  16. Android resources

    Decoded manifest, string tables, locales and version facts

    Extra tools required: Caller-supplied Apktool launcher

  17. Flutter apps

    Dart snapshot hash, per-ABI library digests and engine build provenance

    No extra tools: None (static APK parsing)

  18. Firmware

    Regions, extraction results and native-analysis handoffs

    Extra tools required: Binwalk / Unblob on Linux

  19. Recorded packets

    Selected fields, repeated values, filters and decode-as rules

    Extra tools required: Linux: TShark 4.x + prlimit

  20. Packet summaries

    Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests

    Extra tools required: Caller-supplied tshark and capinfos (Linux-verified)

  21. Recorded logic signals

    Decoder annotations, sample ranges and diagnostics

    Extra tools required: Linux: sigrok-cli 0.7.2 + prlimit

  22. Packages and resources

    File inventories, digests, plists, Apple bundle anatomy and extracted resources

    Extra tools required: Artifact and JavaScript guide + Apple applications

  23. Process behavior

    Terminal output, interactions, exit and filesystem observations, and run comparisons

    Extra tools required: Linux/macOS with a native PTY

23 artifact types

Static — no extra install

Requires a tool

Static — no extra install

Requires a tool

Is this allowed?

Authorization is not access. What you may inspect, what you may not run, and which licences are yours to buy.

It won't install

The five failures that account for nearly every setup problem, and the exact fix for each.

Pick your target

What REA actually reads from each artifact type, and what you have to install first.

Reverse Engineer Anything: Install REA in One Command