REAReverse Engineer Anything

Understand binaries, applications, and runtime behavior with one CLI and MCP server.

Get started

View on GitHub

Investigate with your agent

Connect REA to your coding agent, describe the app or feature you want to understand, and follow the evidence.

Inspect across formats

Explore native binaries, JavaScript and Electron apps, .NET assemblies, Android packages, firmware, and websites.

Keep the evidence

Analysis runs locally and returns observations, limitations, and unknowns through the CLI and MCP.

Start with one command

bash

npx rea-agents setup

Choose your agent, review the planned changes, and approve setup. Native binary analysis can use an existing Hopper, Ghidra, or IDA installation; static JavaScript analysis needs no native analysis engine.

For a first result from an extracted JavaScript application or ASAR:

bash

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

See installation and setup for requirements and configuration.

For runtime instrumentation, see the Frida guide.

Choose a guide

Task	Guides
Identify a desktop installation	Runtime candidates, evidence and follow-up files
Inspect native functions, references, or types	Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, PE TLS/load config, ELF notes, Binary hardening, Linux kernel modules, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Select a native provider or import format	Ghidra semantics, Windows, DOS, raw bytes, GameCube DOL, MIPS, PSP, NativeAOT, IDA, Kuna, JEB
Analyze JavaScript or Electron artifacts	Static analysis, tracing and comparisons, application graph, source recovery
Compare static JavaScript with runtime observations	Runtime attribution, reconciliation, Electron observation, Electron fuses
Inspect assemblies, packages, or firmware	Godot PCK, UnityFS, wxapkg, U-Boot uImage, .NET, Python packages, Android, APK signatures, Apktool resources, ADB acquisition, Apple, Harmony, firmware, ESP images, ESP flash images, WASM, EVM
Observe or compare a browser scenario	CDP observation, scenarios, runtime evidence, historical captures
Serve recorded behavior as an agent environment	Agent environments
Trace captured website source	Source locations, module traces, script export
Capture and compare a command	Process capture
Capture a Linux desktop application in use	Desktop application capture
Read a captured application's state	Desktop application state
Export a captured application as an environment	Desktop application export
Write and validate a task for an exported app	Desktop application tasks
Drive a computer while building an environment	Desktop build computer
Use CLI/MCP and retain evidence	CLI, MCP contracts, agent prompts, obligation ledgers

For development, use testing, client verification, tool design, admission limits and recovery, and releasing. Reconstruction readiness describes a development conformance verifier. The 6.2 migration records that release's compatibility changes; the roadmap tracks future work.

REA inspecting a native binary in Hopper