REA 开源 MCP 服务：集成 Ghidra 与 Hopper 实现无源码软件自动化逆向，重塑 AI 智能体安全分析范式Hacker News AIT2开发与工程

Hacker News AI · 2026/10/13 00:31:55

REA 开源智能体逆向工程套件：集成 Ghidra 与 Hopper 实现无源码应用行为分析与本地化重构

原标题：Reverse engineer anything with agents, from app behavior down to native binaries

68AI 研判分

核心综述

REA 推出了一套专为 AI 智能体设计的逆向工程工具链，允许开发者通过自然语言指令分析闭源应用、原生二进制及 Web 前端代码。该工具集成了 Hopper、Ghidra 等主流反编译引擎，支持在本地环境中执行静态 JavaScript 分析和网络流量捕获，并能基于分析证据自动生成功能复刻方案，显著降低了黑盒测试与竞品功能复现的技术门槛。

报道全文原始报道全文

本文目录7 个章节

See a feature in an app that you want in your own product? Ask your agent to investigate it with REA. It can inspect the app without its source code, explain how the feature works, show the evidence, and build a version for your project.

REA connects your agent to tools for inspecting native binaries, JavaScript and Electron apps, .NET assemblies, and websites. You can also use the same tools from your terminal. Analysis runs locally, and results include the evidence and limitations behind each conclusion.

Setup registers REA with your agent and installs matching workflow instructions. Native analysis can use an existing Hopper, Ghidra, or IDA installation; setup can optionally install Hopper with approval. Static JavaScript analysis needs no native analysis engine.

Visit the REA website for setup instructions, illustrated guides, and real case studies.

Quick start

Set up your agent

With Node.js and npm installed, run:

BASH

npx rea-agents setup

Choose your agents, review the proposed changes, and approve them. Setup adds REA's MCP server and matching workflow instructions, with backups of existing configuration. Restart your agent afterward.

Setup supports Claude Code, Codex, Cursor, Gemini CLI, Grok Build and other agents. See installation and setup for provider configuration and manual MCP registration.

Ask your agent

TEXT

Understand how search works in the Notes app, show me the evidence, and build a
similar feature for my project.

Replace Notes with your target app and the feature you want to understand.

Use the terminal

Inspect an extracted JavaScript/Electron app directory or ASAR:

BASH

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

The result includes modules, imports, Electron boundaries and their evidence. Replace the path with your target, such as "D:/apps/example" on Windows.

To install the rea command for regular use:

BASH

npm install --global rea-agents
rea --help

For native analysis, configure a provider first. See the CLI and Evidence guide for native commands, provider selection, snapshots and scripting.

Update REA

REA changes quickly, and new releases include frequent bug fixes. Keep your installation up to date.

For a CLI installed with npm install --global or bun add --global:

BASH

rea update

Bun global updates require Bun 1.2.17 or later. With an older Bun release, upgrade Bun manually before running rea update.

To refresh your agent registrations and skill, run the setup command printed by the update.

If you use npx, update your agent setup with:

BASH

npx rea-agents@latest setup

Review the setup changes and restart your agent. For one-off CLI commands, use npx rea-agents@latest followed by the command. With Bun, use bunx rea-agents@latest in place of npx rea-agents@latest.

How REA works

Your agent calls REA through MCP to inspect the target and trace relevant code. REA returns findings with their evidence. The agent uses them to ask follow-up questions, explain the behavior, or write and test an implementation. CLI commands use the same workflows.

REA investigation flow: your agent asks about a local target, REA inspects and traces it using analysis tools, and the agent uses the returned code, references and unknowns to explain, implement and test.

Open the full-size figure.

What you can analyze

REA requires Node.js 22.x (>=22.19), 24.x (>=24.11), or 26+, plus npm. Additional tools and host support depend on the target:

Target	What REA returns	Requirements and guide
Native binaries	Pseudocode, assembly, strings, symbols, calls and references	Hopper, Ghidra or IDA; native analysis
Offline ELF layout	Sections, segments, original symbols/relocations and static mitigation candidates	Caller-supplied pwntools on Linux x64; binary diagnostics
Go binaries	Embedded compiler version, modules, replacements and build settings	Built-in static ELF/PE/thin Mach-O inspection; no Go installation required
WASM artifact	Validation, sections, exact import/export WAT forms and decoded WAT	Caller-supplied WABT 1.0.42; `inspect_wasm_artifact`
EVM bytecode	Dispatch selectors, byte offsets, inferred arguments and mutability	Local raw/hex carrier on Linux x64; offline EVM guide
Recorded Linux crashes	Raw notes, every recorded thread's registers/signals and optional mapping candidates	Caller-supplied pwntools on Linux x64; optional GDB/pwndbg; recorded crashes
JavaScript / Electron	Modules, imports, source maps, routes, IPC and native add-on relationships	Node.js and npm; application analysis
Websites	Page structure, scripts, network observations and requested screenshots	A Chrome-family browser; browser analysis
Saved network captures	Requests, responses, exposed payloads and source locations	HAR; mitmdump on Linux for native mitmproxy captures; [capture

（注：更多技术实现细节与完整 API 文档请查阅原项目 README）