Files
rea/docs/index.md
Matt Van Horn 781760a195 feat(apple): inspect IPS crash reports (#6511)
* feat(apple): inspect IPS crash reports

Add inspect_apple_ips for caller-selected Apple .ips files. Parse the
first-line metadata object and, when bug_type is the string 309, the
crash body: process identity, exception and termination facts, threads,
usedImages, lossless integer registers, and documented classification
rules. Other bug types including 288 stackshots return no crash result.
Opened Mach-O and dSYM UUID joins remain unobserved.

Related to #4297

* fix(apple): keep IPS register literals exact

Use the arm64e fixture integer that matches 0x8527000193ed4944 instead
of an IEEE-754-rounded decimal, and count the lossless JSON example
length from the source text.

* fix(apple): budget IPS parsing and keep typed presence

Parse the IPS metadata and crash body through a projection of the
documented members. Members the report does not interpret are
syntax-checked without being materialized, and thread, frame, image and
the new max_registers budgets run before each row is parsed, so a large
selected file fails with a typed resource error instead of first
expanding every row. Fixed allowances bound JSON nesting, unlisted key
names and termination reasons.

Present values whose JSON type differs from the documented one are no
longer read as absence: they are listed in coverage.type_mismatches and
coverage becomes partial, including wrong-type or missing threads and
usedImages collections. osVersion keeps the producer dictionary or the
string form. Frame roles follow physical frame depth, so the top frame
of a non-faulting thread is current_instruction and inlined rows share
the following frame's role. SIGKILL classes compare the canonical hex
once, so 0xdeadd0cc no longer matches dead10cc. Invalid UTF-8 is refused
instead of being replaced, and JSON strings are decoded by copying
unescaped spans.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ra7LM2NyQ7DumdssxbUq5g

* fix(apple): bound integer text expansion and reconcile coverage

* refactor(apple): retain image metadata at its owning row

* refactor(apple): validate row capacity through reconciled coverage

* test(apple): verify resource recovery at the public error boundary

* docs(apple): record complete IPS task and corpus measurements

* docs(apple): record integrated checks and stdio corpus evidence

* docs(apple): record PE integration and baseline cleanup controls

* fix(native): bound IPS string decoding and preserve invalid identities

* refactor(native): use exact optional IPS source evidence

* docs(native): verify IPS escape capacity and complete-task costs

* test(native): verify IPS through production stdio MCP

* style(tests): format IPS advertised schema bindings

* fix(native): preserve unresolved IPS references and recorded frame semantics

* docs(native): record IPS reference review evidence

* fix(apple-ips): enforce JSON and report consistency

* docs(apple-ips): record final consistency verification

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: gensokyo-dev <342580529+gensokyo-dev@users.noreply.github.com>
2026-10-24 16:02:59 +08:00

8.2 KiB

layout, hero, features
layout hero features
home
name text tagline actions
REA Reverse Engineer Anything Understand binaries, applications, and runtime behavior with one CLI and MCP server.
theme text link
brand Get started /installation
theme text link
alt View on GitHub https://github.com/morluto/rea
title details link
Investigate with your agent Connect REA to your coding agent, describe the app or feature you want to understand, and follow the evidence. /mcp-prompts
title details link
Inspect across formats Explore native binaries, JavaScript and Electron apps, .NET assemblies, Android packages, firmware, and websites. /installation
title details link
Keep the evidence Analysis runs locally and returns observations, limitations, and unknowns through the CLI and MCP. /mcp-contracts

Start with one command

npx rea-agents setup

Choose your agent, review the planned changes, and approve setup. Native binary analysis can use an existing Hopper, Ghidra, or IDA installation; static JavaScript analysis needs no native analysis engine.

For a first result from an extracted JavaScript application or ASAR:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

See installation and setup for requirements and configuration.

For runtime instrumentation, see the Frida guide.

Choose a guide

Task Guides
Identify a desktop installation Runtime candidates, evidence and follow-up files
Inspect native functions, references, or types Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, ELF notes, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Select a native provider or import format Ghidra semantics, Windows, DOS, raw bytes, MIPS, PSP, NativeAOT, IDA, Kuna, JEB
Analyze JavaScript or Electron artifacts Static analysis, tracing and comparisons, application graph, source recovery
Compare static JavaScript with runtime observations Runtime attribution, reconciliation, Electron observation, Electron fuses
Inspect assemblies, packages, or firmware Godot PCK, .NET, Python packages, Android, APK signatures, Apktool resources, ADB acquisition, Apple, Harmony, firmware, WASM, EVM
Observe or compare a browser scenario CDP observation, scenarios, runtime evidence, historical captures
Serve recorded behavior as an agent environment Agent environments
Trace captured website source Source locations, module traces, script export
Capture and compare a command Process capture
Use CLI/MCP and retain evidence CLI, MCP contracts, agent prompts, obligation ledgers

For development, use testing, client verification, tool design, admission limits and recovery, and releasing. Reconstruction readiness describes a development conformance verifier. The 6.2 migration records that release's compatibility changes; the roadmap tracks future work.

REA inspecting a native binary in Hopper