The Problem

Reverse engineering an application or binary usually requires switching between many specialized tools—Ghidra, Hopper, lldb, JavaScript static analyzers, network sniffers, etc.—and reconciling their outputs. Developers or analysts must manually set up each tool, collect evidence, and weave it into a coherent explanation. The pain is the fragmented workflow and the steep learning curve for each tool.

What This Does

rea provides a unified command‑line interface and a modular bridge architecture that orchestrates all of those tools. The core logic lives in src/cli.ts (argument parsing) and src/main.ts (orchestration). The bridge/ directory contains language‑specific adapters—bridge/ghidra/…, bridge/hopper_bridge.py, bridge/native/…—that launch and communicate with the native analysis engines. The docs in docs/ describe how each analysis type is performed and how the evidence is stored. The scripts/ folder supplies helper scripts for generating test fixtures and building the required environment.

How It Is Wired

  1. Entry point – src/cli.ts starts the process. It parses CLI flags (using commander or similar) and forwards the command to src/main.ts.
  2. Orchestration – src/main.ts imports the analysis package (src/analysis/…). The main function calls runAnalysis(), which: Loads the requested skill* from .agents/skills/…. Instantiates the corresponding bridge module (bridge/ghidra/ReaGhidraBridge.ts, bridge/hopper_bridge.py, etc.). Invokes the bridge’s analyze() method.
  3. Bridge layer – each bridge module launches its external tool (e.g., Ghidra via a local JAR, Hopper via its CLI, or lldb via rea_lldb_tracer.py) and streams the output back to the orchestrator.
  4. Evidence capture – the orchestrator writes structured evidence to the filesystem under output/ (created by src/main.ts). The evidence includes binary dumps, network captures, and JavaScript ASTs, all referenced in the generated MCP catalog (docs/mcp-contracts.md).
  5. Side effects – the process may spawn child processes (child_process.spawn in TS, subprocess.run in Python) and perform file I/O via fs or shutil. Network activity is limited to local RPC calls to the REA agents, defined in src/agents/….

The call graph is linear for a single analysis: CLI → main → bridge → external tool. There is no deep recursion or cyclic dependencies; each bridge is a thin wrapper around the tool’s CLI or API.

How To Use It

Setup

# Clone the repo
git clone https://github.com/moses-y/rea
cd rea

# Install Node dependencies
npm install            # or pnpm install if you prefer

# Register the REA MCP server with your agent
npx rea-agents setup

The setup script installs the REA server (src/agents/rea-server.ts) and writes configuration to ~/.rea/config.json.

Configuration No extra environment variables are required for the core CLI. For native analysis, place the tool’s binaries in the expected locations:

  • Hopper: ~/Applications/Hopper.app
  • Ghidra: ~/Applications/Ghidra.app
  • lldb: already part of Xcode/Command Line Tools

The bridge modules automatically detect these paths; if they differ, adjust the REANA_HOPPER_PATH or REANA_GHIDRA_PATH entries in config.json.

Running

# Run a full analysis on a binary
node dist/cli.js analyze --binary path/to/app.exe

# Or via npm script
npm run analyze -- --binary path/to/app.exe

The command starts src/cli.ts, which invokes src/main.ts. The analysis results appear under output/, including a JSON catalog (output/catalog.json) referenced in the MCP documentation.

Real‑World Use

A security team wants to understand how a third‑party Electron app encrypts its configuration. They run:

node dist/cli.js analyze \
  --binary myapp.exe \
  --scope electron \
  --output myapp-analysis

rea launches the Electron runtime in a sandbox, captures the JavaScript bundle, runs static analysis on the bundle, and stores the resulting call graph in myapp-analysis/electron-graph.json. The team can then cherry‑pick the relevant functions and reimplement them in their own codebase.

Code Health & Issues

  • Security – Low – Secret‑shaped paths detected in src/browser/BrowserScenarioSecrets.ts. The code‑health audit reports that the paths are internal and not exposed externally.
  • Tests – 962 – The repository contains comprehensive unit and integration tests (tests/), covering both TypeScript and Python modules.
  • License – MIT – The LICENSE file confirms permissive usage.
  • Documentation – 93 – The docs/ folder provides exhaustive guides and API contracts.

No missing CI, no accidental secrets, and a clear build pipeline (.github/workflows/ci.yml).

The Bottom Line

rea is a mature, TypeScript‑centric toolkit that unifies reverse‑engineering workflows across binaries, JavaScript, and native code. Its modular bridge design keeps the core lightweight while still supporting heavy tools like Ghidra and Hopper. The package is well‑tested, fully documented, and ready for integration into a developer’s existing toolchain. It suits teams that need to audit third‑party applications or reconstruct features without source code.