rea/docs/index.md at main

mirror/rea

mirror of https://github.com/morluto/rea synced 2026-10-26 06:16:17 -04:00

Files

T

Matt Van Horn dba8a31978 feat(elf): inspect Linux kernel module metadata (#7010 )

* feat(elf): inspect Linux kernel module metadata

Adds inspect-kernel-module and inspect_kernel_module for ELF32/ELF64
ET_REL Linux kernel modules, read statically without executing them.
Reports ordered .modinfo entries with duplicates preserved, __versions
symbol CRCs, the presence of .gnu.linkonce.this_module and __ksymtab,
.init.text and .exit.text sizes, and an appended module signature
trailer with its PKCS#7 byte range and SHA-256. gzip, xz and zstd
containers are reported unsupported with external decompression as the
next probe. Malformed headers and exhausted entry budgets return no
partial success.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe

* fix(elf): bound kernel module ksymtab listing and tighten contracts

Charge listed __ksymtab* sections against max_entries, omit section names
longer than 256 bytes with ksymtab_name_exceeds_limit, and aggregate the
non-file-backed limitation so repeated huge names cannot inflate Evidence.
Use fixedTupleSchema for the signature pad bytes with projection parity
tests, and assert the late-cancellation reason and retained observation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016y53PdpyMAp9RSW65fatHe

* fix: resolve merge integration errors

---------

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>

2026-10-24 22:35:20 +08:00

9.2 KiB

Raw Permalink Blame History

layout, hero, features

layout

hero

features

home

name

text

tagline

actions

REA

Reverse Engineer Anything

Understand binaries, applications, and runtime behavior with one CLI and MCP server.

theme	text	link
brand	Get started	/installation

theme	text	link
alt	View on GitHub	https://github.com/morluto/rea

title	details	link
Investigate with your agent	Connect REA to your coding agent, describe the app or feature you want to understand, and follow the evidence.	/mcp-prompts

title	details	link
Inspect across formats	Explore native binaries, JavaScript and Electron apps, .NET assemblies, Android packages, firmware, and websites.	/installation

title	details	link
Keep the evidence	Analysis runs locally and returns observations, limitations, and unknowns through the CLI and MCP.	/mcp-contracts

Start with one command

npx rea-agents setup

Choose your agent, review the planned changes, and approve setup. Native binary analysis can use an existing Hopper, Ghidra, or IDA installation; static JavaScript analysis needs no native analysis engine.

For a first result from an extracted JavaScript application or ASAR:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

See installation and setup for requirements and configuration.

For runtime instrumentation, see the Frida guide.

Choose a guide

Task	Guides
Identify a desktop installation	Runtime candidates, evidence and follow-up files
Inspect native functions, references, or types	Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, PE TLS/load config, ELF notes, Linux kernel modules, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Inspect native functions, references, or types	Native binaries, Go metadata, Rust dependencies, CPython pyc files, PE certificates, PE imports, PE TLS/load config, ELF notes, Apple IPS, Erlang BEAM, offline ELF layout, recorded crashes
Select a native provider or import format	Ghidra semantics, Windows, DOS, raw bytes, GameCube DOL, MIPS, PSP, NativeAOT, IDA, Kuna, JEB
Analyze JavaScript or Electron artifacts	Static analysis, tracing and comparisons, application graph, source recovery
Compare static JavaScript with runtime observations	Runtime attribution, reconciliation, Electron observation, Electron fuses
Inspect assemblies, packages, or firmware	Godot PCK, .NET, Python packages, Android, APK signatures, Apktool resources, ADB acquisition, Apple, Harmony, firmware, WASM, EVM
Observe or compare a browser scenario	CDP observation, scenarios, runtime evidence, historical captures
Serve recorded behavior as an agent environment	Agent environments
Trace captured website source	Source locations, module traces, script export
Capture and compare a command	Process capture
Use CLI/MCP and retain evidence	CLI, MCP contracts, agent prompts, obligation ledgers

For development, use testing, client verification, tool design, admission limits and recovery, and releasing. Reconstruction readiness describes a development conformance verifier. The 6.2 migration records that release's compatibility changes; the roadmap tracks future work.

9.2 KiB Raw Permalink Blame History

Start with one command

Choose a guide

9.2 KiB

Raw Permalink Blame History