shifathosn
/
rea
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
rea/third_party
History
Ysopwnable 163ee09a74
feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 
* feat(native): inspect recorded crashes through pwntools and pwndbg

* fix(native): bind core note semantics to raw owner bytes

* fix(native): validate recorded core ABI and evidence scalars

* fix(native): require complete recorded note interpretations

* fix(native): bind physical core notes to original headers
 		2026-10-08 16:50:31 +08:00
..
binwalk@4fdab3d464 feat(firmware): integrate Binwalk and Unblob analysis 2026-10-06 14:16:04 +00:00
evmole feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
ghidra-nativeaot@effeb734fc feat(ghidra): integrate optional NativeAOT metadata recovery (#748) 2026-10-07 00:57:08 +08:00
jadx-headless-mcp@5844800a48 feat(android): integrate static APK analysis with headless JADX (#738) 2026-10-06 12:46:48 +00:00
pwndbg feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
pwntools feat(native): inspect offline ELF layout through pwntools (#1037) 2026-10-08 14:22:08 +08:00
unblob@1fcc7a0a58 feat(firmware): integrate Binwalk and Unblob analysis 2026-10-06 14:16:04 +00:00
wakaru@6070266d24 feat(javascript): recover readable modules with Wakaru (#848) 2026-10-07 12:46:13 +08:00
web-network-captures feat(browser): inspect historical web network captures (#992) 2026-10-08 07:53:41 +08:00
README.md feat(firmware): integrate Binwalk and Unblob analysis 2026-10-06 14:16:04 +00:00

README.md

Upstream analysis engines

REA integrates existing tools through provider adapters. Upstream source remains unmodified and retains its own license; it is not copied into REA's domain or application code.

jadx-headless-mcp

  • Source: https://github.com/1013503897/jadx-headless-mcp
  • Submodule: third_party/jadx-headless-mcp
  • Release: v0.7.1
  • Commit: 5844800a486d2248fa949b74c9896285f5b54de2
  • License: Apache-2.0; see the submodule's LICENSE.
  • Release identity: src/android/JadxRelease.ts.
  • REA integration: src/android/; no upstream patches in this version.

Fetch source for inspection with:

git submodule update --init third_party/jadx-headless-mcp

Normal REA builds and installed npm packages do not require this submodule or a Gradle build. Supply a separately obtained JAR with REA_JADX_MCP_JAR; REA never downloads engines during an analysis operation. The audited release JAR is identified by SHA-256. A caller-supplied build reporting the supported protocol version retains its actual digest and an unknown source revision unless its bytes match the audited release.

When updating: review upstream protocol and license changes, update the gitlink and release identity together, exercise the adapter's producer regressions, and run the real APK CLI/MCP lane. Never attribute modified engine bytes to the audited source revision.

Public APK fixture

scripts/fetch-android-fixtures.mjs explicitly downloads the audited engine and Appium ApiDemos v6.0.18 into ignored _reference/apk-integration/. Both downloads are checked against fixed SHA-256 values. Fixture provenance is recorded in scripts/fixtures/android-apidemos.json; the source uses Apache-2.0. This is a static analysis fixture: no emulator, device, SDK installation or app execution is needed. APKs and JARs are neither tracked nor included in npm packages.

Firmware engines

Engine Source Release Pinned commit License
Binwalk https://github.com/ReFirmLabs/binwalk v3.1.0 4fdab3d464d97b68e0af9088df3f9e2e1545b21c MIT, upstream LICENSE
Unblob https://github.com/onekey-sec/unblob 26.6.4 1fcc7a0a584a70a96c31f5a276c20944d199a089 MIT, upstream LICENSE

Source remains unmodified in third_party/binwalk and third_party/unblob. Release records live in src/firmware/FirmwareRelease.ts; REA adapters own the CLI/report interpretation and lifecycle in src/firmware/. Caller-supplied executables retain their actual launcher digest and unknown source revision; version output alone does not establish source identity. REA does not bundle extractors or download/install firmware engines during analysis.

On updates: inspect actual pinned CLI and report producers, preserve licenses, update gitlinks/release records, run report regressions and the real firmware lane. See firmware setup and coverage.