REA Guide

Reverse Engineer Anything

REA reads the artifacts you already have: JavaScript and Electron applications, .NET assemblies, native binaries, Android packages, websites and saved capture files. The static paths need no Ghidra, no IDA and no decompiler licence.

$ npx rea-agents@latest setup

Requires Node.js 22.x (22.19+), 24.x (24.11+) or 26+ — Node 23 and 25 and pre-releases are not supported.

See the 5 setup errors →Is it allowed? →

What you can analyze with REA

  1. JavaScript / Electron

    Guide coming soon

    Modules, imports, source maps, routes, IPC and native add-on relationships

    No extra tools: Node.js and npm; Linux: procps-compatible `ps`

  2. .NET assemblies

    Metadata, CIL instructions, declared native dependencies and build comparisons

    No extra tools: None (static only)

  3. Native binaries

    Guide coming soon

    Pseudocode, assembly, strings, symbols, calls and references

    Extra tools required: Hopper, Ghidra or IDA

  4. Android APKs

    Guide coming soon

    Manifest declarations, classes, decompiled methods and references

    Extra tools required: Headless JADX and a full JDK on Linux/macOS/Windows x64

  5. Websites

    Guide coming soon

    Page structure, scripts, network observations and requested screenshots

    Extra tools required: A Chrome-family browser

  6. Go binaries

    Guide coming soon

    Embedded compiler version, modules, replacements and build settings

    No extra tools: Built-in static ELF/PE/thin Mach-O inspection; no Go installation required

  7. Rust binaries

    Guide coming soon

    Embedded cargo-auditable crate names, versions, sources and dependency edges

    No extra tools: Built-in static ELF/PE/thin Mach-O inspection

  8. WASM artifact

    Guide coming soon

    Validation, sections, exact import/export WAT forms and decoded WAT

    Extra tools required: Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`

  9. EVM bytecode

    Guide coming soon

    Dispatch selectors, byte offsets, inferred arguments and mutability

    Extra tools required: Local raw/hex carrier on Linux x64

  10. SQLite databases

    Guide coming soon

    Tables, columns, indexes, views, triggers and selected ordinary-table rows

    No extra tools: Local database/WAL snapshot; Node.js 24.x >=24.15 or 26+ with native SQLite limits

  11. Saved network captures

    Guide coming soon

    Requests, responses, exposed payloads and source locations

    Extra tools required: HAR or Fiddler Everywhere SAZ; mitmdump on Linux for native mitmproxy

  12. Offline ELF layout

    Guide coming soon

    Sections, segments, original symbols/relocations and static mitigation candidates

    Extra tools required: Caller-supplied pwntools on Linux x64

  13. Recorded Linux crashes

    Guide coming soon

    Raw notes, every recorded thread's registers/signals and optional mapping candidates

    Extra tools required: Caller-supplied pwntools on Linux x64; optional GDB/pwndbg

  14. Android devices

    Guide coming soon

    Devices, packages, processes, logs, dumps, screen captures, and APK/file transfers

    Extra tools required: Caller-supplied adb (emulator or hardware)

  15. JEB projects

    Guide coming soon

    Engine-backed project units, artifact digests and type/method pseudo-code

    Extra tools required: A caller-started JEB client serving MCP, selected with REA_JEB_MCP_URL

  16. Android resources

    Guide coming soon

    Decoded manifest, string tables, locales and version facts

    Extra tools required: Caller-supplied Apktool launcher

  17. Flutter apps

    Guide coming soon

    Dart snapshot hash, per-ABI library digests and engine build provenance

    No extra tools: None (static APK parsing)

  18. Firmware

    Guide coming soon

    Regions, extraction results and native-analysis handoffs

    Extra tools required: Binwalk / Unblob on Linux

  19. Recorded packets

    Guide coming soon

    Selected fields, repeated values, filters and decode-as rules

    Extra tools required: Linux: TShark 4.x + prlimit

  20. Packet summaries

    Guide coming soon

    Endpoints, DNS, TLS SNI, protocol distribution and HTTP requests

    Extra tools required: Caller-supplied tshark and capinfos (Linux-verified)

  21. Recorded logic signals

    Guide coming soon

    Decoder annotations, sample ranges and diagnostics

    Extra tools required: Linux: sigrok-cli 0.7.2 + prlimit

  22. Packages and resources

    Guide coming soon

    File inventories, digests, plists, Apple bundle anatomy and extracted resources

    Extra tools required: Artifact and JavaScript guide + Apple applications

  23. Process behavior

    Guide coming soon

    Terminal output, interactions, exit and filesystem observations, and run comparisons

    Extra tools required: Linux/macOS with a native PTY

23 artifact types

Static — no extra install

Requires a tool

Static — no extra install

Requires a tool

What is REA, and when is it the wrong tool?

REA — Reverse Engineer Anything — is a free, open-source toolkit from morluto that gives your AI coding agent a set of analysis tools. You point it at an artifact you already have, and your agent asks REA to read it. REA returns findings with their evidence — modules, imports, IPC boundaries, metadata, strings, symbols, captured requests — instead of an unsupported guess. The agent then explains what the artifact does, traces the code that does it, or writes and tests a matching implementation.

How REA works

Run the one-time setup command above, then point your agent at a local target. For most targets the agent calls REA through MCP, REA inspects the file or capture, and the agent explains the result with the evidence attached. JavaScript and Electron also have a standalone CLI command, so you can run that analysis directly from a terminal and get JSON out. The same workflows back both paths.

What REA is not

REA is an inspection toolkit, not a licence to analyze software you do not own. Downloading a file is not the same as being authorized to inspect it, and permission to inspect is not permission to run, intercept, or modify. It is not a one-click decompiler, and it does not give you a licence for a commercial tool you do not already have. If you are unsure whether you may analyze a target, read the Authorized use guide and record your authorization before you start.

When REA is the wrong tool

The static paths — JavaScript/Electron, .NET, Go, Rust and Flutter — read the supplied files without running them and need no extra engine. Many other targets still require one: native binaries need Hopper, Ghidra or IDA; Android APKs need headless JADX and a JDK; WASM needs WABT; network and packet captures need tools such as tshark, capinfos or mitmdump. If you cannot install or run the required engine, REA cannot analyze that target for you.

Runtime capture is different from static inspection: it runs or interacts with the target using your own permissions, so only run it on a machine, device or account you control. REA does not install or update the commercial engines it can call, and it does not change what your jurisdiction permits.

This site is an independent third-party guide to REA, not a project by morluto and not affiliated with rea.tools. It covers installation, the realistic first steps for every artifact type, the common setup failures, and the authorization questions you should answer before you begin.

Is this allowed?

Authorization is not access. What you may inspect, what you may not run, and which licences are yours to buy.

It won't install

The five failures that account for nearly every setup problem, and the exact fix for each.

Pick your target

What REA actually reads from each artifact type, and what you have to install first.