shifathosn
/
rea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
rea/third_party
History
Ysopwnable 7ae3c50a9d
docs: correct drift and reorganize English guides (#2207) 
Put setup, developer commands, MCP replies, and investigation recipes before
client details and implementation references. Preserve existing guide anchors,
examples, provenance, partial-result recovery, and provider restrictions.

Correct verified documentation drift, synchronize the Ghidra capability
wording, and regenerate metadata for skill version 40. Keep uncertain platform
and lifecycle findings unchanged. Refs #2156.

Validation: 56 focused tests, check:fast, docs:check, VitePress production build,
format and link/example checks. Real isolated CLI/MCP probes cover Ghidra,
NativeAOT, HAR, cancellation, Chrome, large ELF delivery, native type limits,
and the new JS/managed/process/setup recipes. Heavy work uses two CPUs;
a resource-heavy DOM probe was stopped and replaced by a smaller real CDP
payload-limit control. Windows, macOS GUI, ADB, and the full CI matrix were
not executed.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
 		2026-10-12 22:14:25 +08:00
..
binwalk@4fdab3d464 feat(firmware): integrate Binwalk and Unblob analysis 2026-10-06 14:16:04 +00:00
evmole feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
ghidra-nativeaot@effeb734fc feat(ghidra): integrate optional NativeAOT metadata recovery (#748) 2026-10-07 00:57:08 +08:00
jadx-headless-mcp@5844800a48 feat(android): integrate static APK analysis with headless JADX (#738) 2026-10-06 12:46:48 +00:00
pwndbg feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
pwntools feat(native): inspect offline ELF layout through pwntools (#1037) 2026-10-08 14:22:08 +08:00
unblob@1fcc7a0a58 feat(firmware): integrate Binwalk and Unblob analysis 2026-10-06 14:16:04 +00:00
wabt feat(wasm): inspect local artifacts with WABT (#1533) 2026-10-11 19:49:00 +08:00
wakaru@8219bf5016 fix(javascript): accept the Wakaru 1.x release line and verify 1.14.0 (#1540) 2026-10-10 23:02:15 +08:00
web-network-captures docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00
README.md docs: correct drift and reorganize English guides (#2207) 2026-10-12 22:14:25 +08:00

README.md

Upstream analysis engines

REA integrates existing tools through provider adapters. Upstream source remains unmodified and retains its own license; it is not copied into REA's domain or application code.

jadx-headless-mcp

  • Source: https://github.com/1013503897/jadx-headless-mcp
  • Submodule: third_party/jadx-headless-mcp
  • Release: v0.7.1
  • Commit: 5844800a486d2248fa949b74c9896285f5b54de2
  • License: Apache-2.0; see the submodule's LICENSE.
  • Release identity: src/android/JadxRelease.ts.
  • REA integration: src/android/; no upstream patches in this version.

Fetch source for inspection with:

git submodule update --init third_party/jadx-headless-mcp

Normal REA builds and installed npm packages do not require this submodule or a Gradle build. Supply a separately obtained JAR with REA_JADX_MCP_JAR; REA never downloads engines during an analysis operation. The audited release JAR is identified by SHA-256. A caller-supplied build reporting the supported protocol version retains its actual digest and an unknown source revision unless its bytes match the audited release.

When updating: review upstream protocol and license changes, update the gitlink and release identity together, exercise the adapter's producer regressions, and run the real APK CLI/MCP lane. Never attribute modified engine bytes to the audited source revision.

Public APK fixture

npm run fixtures:android (scripts/fixtures/android/fetch.mjs) downloads the audited engine and Appium ApiDemos v6.0.18 into ignored _reference/apk-integration/. Both downloads are checked against fixed SHA-256 values. Fixture provenance is recorded in scripts/fixtures/android-apidemos.json; the source uses Apache-2.0. This is a static analysis fixture: no emulator, device, SDK installation or app execution is needed. APKs and JARs are neither tracked nor included in npm packages.

Firmware engines

Engine Source Release Pinned commit License
Binwalk https://github.com/ReFirmLabs/binwalk v3.1.0 4fdab3d464d97b68e0af9088df3f9e2e1545b21c MIT, upstream LICENSE
Unblob https://github.com/onekey-sec/unblob 26.6.4 1fcc7a0a584a70a96c31f5a276c20944d199a089 MIT, upstream LICENSE

Source remains unmodified in third_party/binwalk and third_party/unblob. Release records live in src/firmware/FirmwareRelease.ts; REA adapters own the CLI/report interpretation and lifecycle in src/firmware/. Caller-supplied executables retain their actual launcher digest and unknown source revision; version output alone does not establish source identity. REA does not bundle extractors or download/install firmware engines during analysis.

On updates: inspect actual pinned CLI and report producers, preserve licenses, update gitlinks/release records, run report regressions and the real firmware lane. See firmware setup and coverage.