560674e2de
* feat(native): report binary hardening for ELF, PE and Mach-O Documents inspect_binary_hardening and its CLI equivalent, including per-property states, supporting evidence, read budgets, and one report per Mach-O slice. Explains that missing protection imports remain unknown, signature presence does not establish validity, and hardened runtime requires inspect_signature. Adds hardening links throughout the documentation. The supplied diff also removes the advanced CodeQL workflow and configuration, along with snapshot-binding mismatch guidance. * fix(native): validate declared payloads and dynamic tables before hardening rows Run the shared range checks for ELF, read imports from the dynamic tables rather than section metadata, and keep an unresolved symbol count apart from an absent table. Check every Mach-O command before building rows and retain only the offsets the rows need. Make the verifier's readelf output wide, check the emitted format before parsing Mach-O, and place the sources before the libraries in the link. * fix(native): share Mach-O segment admission with hardening reads A segment with a section count its cmdsize cannot hold passed the hardening reader and could enable restrict_segment. Move the size, section count and file range checks to a shared admission that readMachoImage and the hardening reader both use, and pin the ELF load-size case with a regression test. * fix(hardening): reject Mach-O section payloads past the slice and empty ELF interpreters Segment admission never checked each section's payload range, so a file-backed section past the slice still produced rows. Decode sections with the section header owner and mark the slice malformed when a payload leaves it; zero-fill and empty sections own no file bytes and are exempt. admitInterp accepted a NUL first byte in a longer extent, which counted an empty interpreter as PIE evidence. It now requires a nonempty path. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01KuWHGvzJkrhCqjtEHUwqyH * fix(native): read CFG instrumentation from decoded GuardFlags Use the IMAGE_GUARD_CF_INSTRUMENTED flag that guardFlagRecord already decodes instead of masking the raw GuardFlags word a second time. * fix(native): reject ELF table spans a second PT_LOAD remaps The hardening reader mapped DT_STRTAB, DT_SYMTAB and hash tables through the one PT_LOAD containing the table's first address. A second PT_LOAD starting inside the table could map the rest of it from other file bytes and the reader still reported parsed import evidence. Cap each mapping at the next PT_LOAD that starts inside it, reject a requested range that crosses that boundary, and stop hash reads at the same limit, matching the conflicting-mapping refusal in readElfSymbols. * fix(native): dedupe ELF note tables only on shared boundaries The hardening reader dropped any note table whose bytes another table already covered. A covering SHT_NOTE can hold a non-GNU note whose descriptor is itself a complete GNU property note, while PT_NOTE names that inner note directly. Walking only the outer stream missed the GNU marker and reported CET disabled. Drop an alias only when it starts and ends on boundaries of admitted tables, which are note boundaries of the walked streams. Any other covered alias leaves the feature rows unknown, as a partial overlap already does. * fix(native): admit every Mach-O symbol record after a canary match The Mach-O stack protector scan returned as soon as it found an undefined ___stack_chk_fail, so a later undefined symbol whose n_strx lay outside the string table was never checked. The same damaged table parsed or failed as malformed depending only on record order. Keep the match and finish the bounded record walk. Records after the match are only checked against the string table bounds, so their names are not read or charged to the scan budget. The ELF reader already admits its whole symbol table before matching names. * fix(native): accept ELF load aliases with the same file translation The hardening reader treated every PT_LOAD that starts inside a table, or that also contains the table's address, as a conflicting mapping. A load with the same address-to-file translation names the same file bytes, so tables it overlaps still have one interpretation, and the canonical ElfLoadMap already merges such spans. Treat equivalent loads as one interpretation. A load with a different translation, or the zero-filled tail of an equivalent load, still ends the usable range, so a remapped table is still rejected. * fix(native): keep same-span ELF note tables with different alignments unknown A section and a program header that share endpoints were treated as one note stream even when their effective note alignments differed. Walking the same bytes at 4 and 8 can frame different notes, so dropping the second table could hide a GNU property word and report CET or BTI as disabled. Require matching effective alignment at both endpoints, and no alignment change inside the covered span, before treating a table as an alias. Otherwise mark the feature rows unknown. The fixture's .note.gnu.property section now declares the class's note alignment, as toolchains emit it. * refactor(native): read LC_SYMTAB through the shared fixed-word decoder Move the Mach-O fixed uint32 command layouts out of MachoCommandNames into domain/apple/machoLoadCommands so there is one owner of those offsets. MachoCommandNames and the hardening reader now both decode through it; the hardening reader keeps its own bounds and import policy. * fix(native): skip Mach-O common definitions in canary imports A common definition sets N_UNDF|N_EXT like an import but stores its allocation size in n_value. An object holding only `int __stack_chk_fail;` therefore reported stack_protector: enabled. Require a zero n_value before an undefined external counts as an import, for both nlist widths. * refactor(native): read linkedit data commands through the shared fixed-word decoder readMachoLinkeditDataCommand reproduced the dataoff/datasize offsets that FIXED_WORD_FIELDS already owns. Take the command and decode through decodeMachoFixedWordFields, as readMachoSymtabCommand does, keeping the truncation and endianness behavior. * fix(native): skip empty SHT_NOTE sections in ELF hardening A zero-sized SHT_NOTE owns no bytes, so the section directory marks it not file-backed and the hardening reader rejected the whole image as malformed, while readElfImage accepted the same bytes. Skip empty note sections before the file-backing check; they have nothing to walk. * fix(scripts): run hardening verifier commands through the shared owner The binary hardening verifier started its probes and compiler drivers with raw spawnSync, which bypassed the src/process/ supervision that AGENTS.md requires. Every launch now goes through createVerifierCommands, and the temporary root is removed only after the owner closes cleanly. * fix(scripts): clean up hardening verifier commands on Ctrl-C SIGINT or SIGTERM ended Node before withVerifierCleanup ran, so detached compiler trees and the temporary root could outlive the verifier. The verifier now turns those signals into an abort that every owned command receives, so cleanup closes the owner and removes the root before exit. * fix(scripts): fail the hardening verifier when a signal lands outside a command Only the owned commands read the interruption signal, so a SIGINT or SIGTERM during the final cleanup or between commands was recorded and then dropped, and the verifier exited 0. After cleanup settles, the verifier now throws the interruption reason. A failure the operation or its cleanup already raised still leaves first and is not replaced. * fix(native): fail Mach-O slices with a malformed encryption command The hardening reader turned every malformed status from the shared encryption reader into an unknown `encrypted` row, so a short LC_ENCRYPTION_INFO_64 or an encrypted range past the slice still left the slice parsed with a full report. Only two conflicting encryption commands stay an unknown row now. Any other encryption defect fails the slice like other structural command failures. * fix(native): ignore STB_LOCAL undefined ELF symbols as imports A local undefined __stack_chk_fail or __memcpy_chk is never resolved against another object, so it does not establish an external import. Skip STB_LOCAL bindings when reading protector signs, and give the fixture's positive symbols STB_GLOBAL binding. --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
30 KiB
English · 简体中文 · 繁體中文 · 日本語 · 한국어 · Türkçe · Русский · Tiếng Việt · ไทย · Deutsch · Español · Français · Українська · Polski · Português (Brasil) · العربية · فارسی · Bahasa Indonesia · Italiano · Ελληνικά · മലയാളം · Roman Urdu · Română
REA: Reverse Engineer Anything
Binaries, applications aur runtime behavior ki reverse engineering ke liye ek MCP.
Koi feature pasand aaya? Samjhein ke woh kaise kaam karta hai, binary level tak.
Jaldi shuru karein · REA kaise kaam karta hai · Kya kuch analyze kar sakte hain · Amli misaalein · RL environments banayein · FAQ · Documentation
npx rea-agents setup
Important
REA morluto/rea, rea.tools ya rea-agents npm package se hasil karein. Installation aur release ke links inhi official sources se kholein. Sirf milta-julta repository naam ya copy kiya hua README kisi download ko official sabit nahi karta.
Kisi app mein aisa feature dekha jo aap apne product mein chahte hain? Apne agent se kahein ke REA ke zariye uski jaanch kare. Woh app ka source code mile baghair bhi use inspect kar sakta hai, feature kaam kaise karta hai samjha sakta hai, saboot dikha sakta hai aur aapke project ke liye uska ek version bana sakta hai.
REA aapke agent ko native binaries, JavaScript aur Electron apps, .NET assemblies aur websites inspect karne wale tools se jorta hai. Yehi tools terminal se bhi use kar sakte hain. Analysis local machine par hota hai, aur har natije ke saath uske saboot aur limitations bhi milti hain.
Setup REA ko aapke agent ke saath register karta hai aur uske mutabiq workflow instructions install karta hai. Native analysis ke liye pehle se installed Hopper, Ghidra, IDA ya Kuna use ho sakta hai; aapki approval par setup Hopper bhi install kar sakta hai. Static JavaScript analysis ke liye native analysis engine ki zaroorat nahi.
Setup instructions, tasveeron ke saath guides aur asli case studies ke liye REA ki website dekhein.
Jaldi shuru karein
Linux par Ghidra, JADX, firmware tools shuru karne aur static JavaScript/Electron
analysis ke liye REA ke PATH par procps-compatible ps hona chahiye, taake
process ownership check ho sake. Masla hal karne ke steps docs/installation.md
ke "Linux owned-process prerequisite" section mein hain.
Apna agent setup karein
Node.js aur npm installed hon to yeh command chalayein:
npx rea-agents setup
Apne agents select karein, proposed changes dekhein aur approve karein. Setup REA ka MCP server aur matching workflow instructions add karta hai, aur existing configuration ke backups banata hai. Iske baad apna agent restart karein.
Setup Claude Code, Codex, Cursor, Gemini CLI, Grok Build aur doosre agents support karta hai. Provider configuration aur manual MCP registration ke liye installation aur setup dekhein.
Context overhead kam rakhne ke liye MCP default mein compact input schemas use
karta hai. Agar tamam advertised fields ki guidance aur nested validation details
chahiye hon to apni MCP registration mein REA_MCP_INPUT_SCHEMA_PROFILE=full
set karein. Dono profiles mein tamam tools aur canonical server validation
maujood rehte hain. MCP contracts guide ka "Compact input schema profile"
section dekhein.
Apne agent se kahein
Samjho ke Notes app mein search kaise kaam karti hai, mujhe saboot dikhao aur
mere project ke liye aisa hi feature banao.
Notes ki jagah apni target app aur jis feature ko samajhna hai uska naam likhein.
Terminal se use karein
Extract ki hui JavaScript/Electron app directory ya ASAR inspect karein:
npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json
Natije mein modules, imports, Electron boundaries aur unke saboot milte hain.
Path ko apne target se badlein, jaise Windows par "D:/apps/example".
Rozmarra use ke liye rea command install karne ke liye:
npm install --global rea-agents
rea --help
Native analysis se pehle provider configure karein. Native commands, provider selection, snapshots aur scripting ke liye CLI aur Evidence guide dekhein.
REA update karein
REA mein tezi se changes aate hain aur naye releases mein aksar bug fixes hoti hain. Apni installation updated rakhein.
Agar CLI npm install --global ya bun add --global se install ki hai:
rea update
rea --update isi verified workflow ka alias hai aur wohi global output flags
accept karta hai. Doosre command controls ke saath use karte waqt rea update
likhein.
Updater commands stdout aur stderr mila kar zyada se zyada 4 MiB retain karti hain. Command khatam hone ke baad is had se bade metadata replies reject ho jate hain; verbose installs bounded diagnostics ke saath jari rehti hain. Insaan ke liye progress output terminal ki backpressure ka khayal rakhta hai aur bheji hui writes mukammal hone ka intezar karta hai.
Bun global updates ke liye Bun 1.2.17 ya naya version chahiye. Purana Bun ho
to rea update chalane se pehle Bun manually upgrade karein.
Agent registrations aur skill refresh karne ke liye update ke output mein di hui setup command chalayein.
Agar aap npx use karte hain to agent setup is tarah update karein:
npx rea-agents@latest setup
Setup changes review karein aur agent restart karein. Ek dafa chalane wali CLI
commands ke liye npx rea-agents@latest ke baad command likhein. Bun ke saath
npx rea-agents@latest ki jagah bunx rea-agents@latest use karein.
REA kaise kaam karta hai
Aapka agent MCP ke zariye REA ko call karta hai, taake target inspect kare aur relevant code trace kare. REA apni findings saboot ke saath wapas deta hai. Agent unki bunyaad par agle sawal poochta hai, behavior samjhata hai ya implementation likh kar test karta hai. CLI commands bhi yehi workflows use karti hain.
Puri size mein figure kholein.
Kya kuch analyze kar sakte hain
REA ke liye Node.js 22.x (>=22.23.4), 24.x (>=24.22.1) ya 26.12.1+, aur npm chahiye. Mazeed tools aur host support target par depend karte hain:
| Target | REA kya wapas deta hai | Zarooriyat aur guide |
|---|---|---|
| Desktop installations | Runtime candidates, supporting files, component markers aur agle probes | Built-in bounded directory/header inspection; desktop applications |
| Native binaries | Pseudocode, assembly, strings, symbols, calls aur references | Hopper, Ghidra, IDA ya Kuna; native analysis |
| Offline ELF layout | Sections, segments, original symbols/relocations aur static mitigation candidates | Linux x64 par aapka diya hua pwntools; binary diagnostics |
| Go binaries | Embedded compiler version, modules, replacements aur build settings | Built-in static ELF/PE/thin Mach-O inspection; Go install karna zaroori nahi |
| GPU code objects | CUDA/HIP targets, selected kernel parameters aur resources, retained PTX text | Built-in static ELF/PE/fatbin/CUBIN/PTX inspection; GPU code objects |
| Model artifacts | GGUF / safetensors metadata, tensor declarations aur unse nikale hue totals | Built-in header inspection; optional full-file hash; model files |
| IL2CPP metadata | Unity global-metadata.dat assembly images, type aur method names aur index ranges | Versions 24, 27, 29, 31 aur 39 ki built-in static decoding; Unity zaroori nahi |
| Godot PCK | Archive inventory aur extraction, original header/directory facts aur selected content identities | Built-in static formats 2, 3 aur 4; Godot zaroori nahi |
| Rust binaries | Embedded cargo-auditable crate names, versions, sources aur dependency edges | Built-in static ELF/PE/thin Mach-O inspection; Rust binaries |
| PE certificates | Authenticode WIN_CERTIFICATE entries aur PKCS#7 signer/X.509 identity fields | Built-in static PE inspection; PE certificates |
| PE imports | Import aur delay-load DLL names, ordinals, IAT RVAs aur pefile import hash | Built-in static PE inspection; PE imports |
| ELF notes | PT_NOTE/SHT_NOTE owners, types, GNU build-id aur ABI-tag fields | Built-in static ELF inspection; ELF notes |
| Binary hardening | PIE, NX, RELRO, CFG and related header flags for ELF, PE and Mach-O | Built-in static header inspection; binary hardening |
| Linux kernel modules | .modinfo keys, __versions CRCs, this_module presence, and signature trailer | Built-in static ELF inspection; kernel modules |
| Erlang BEAM | IFF chunks, atoms, exports, imports, lambdas aur Code header | Built-in static BEAM inspection; Erlang BEAM |
| WASM artifact | Validation, sections, exact import/export WAT forms aur decoded WAT | Aapka diya hua WABT 1.0.42; inspect_wasm_artifact |
| EVM bytecode | Dispatch selectors, byte offsets, inferred arguments aur mutability | Linux x64 par local raw/hex carrier; offline EVM guide |
| SQLite databases | Tables, columns, indexes, views, triggers aur selected ordinary-table rows | Local database/WAL snapshot; native SQLite limits ke saath Node.js 24.x >=24.15 ya 26+ |
| Apple IPS crash reports | Apple .ips metadata, threads, images aur crash classification | Built-in static JSON inspection; Apple IPS |
| Recorded Linux crashes | Raw notes, har recorded thread ke registers/signals aur optional mapping candidates | Linux x64 par aapka diya hua pwntools; optional GDB/pwndbg; recorded crashes |
| JavaScript / Electron | Modules, imports, source maps, routes, IPC aur native add-on relationships | Node.js aur npm; Linux: procps-compatible ps; application analysis |
| Websites | Page structure, scripts, network observations aur requested screenshots | Chrome-family browser; browser analysis |
| Saved network captures | Requests, responses, exposed payloads aur source locations | HAR ya Fiddler Everywhere SAZ; native mitmproxy ke liye Linux par mitmdump; capture guide |
| .NET assemblies | Metadata, CIL instructions, declared native dependencies aur build comparisons | Koi additional tool nahi (sirf static analysis); managed-code guide |
| Android APKs | Manifest declarations, classes, decompiled methods aur references | Linux/macOS/Windows x64 par headless JADX aur full JDK; Android guide |
| APK signatures | v1/v2/v3/v3.1 signers, certificate fingerprints, key rotation aur digest self-consistency | Koi additional tool nahi (sirf static analysis); inspect_apk_signature |
| Android devices | Devices, packages, processes, logs, dumps, screen captures aur APK/file transfers | Aapka diya hua adb (emulator ya hardware); ADB guide |
| JEB projects | Engine-backed project units, artifact digests aur type/method pseudo-code | Aapka shuru kiya hua JEB client jo MCP serve kar raha ho, REA_JEB_MCP_URL se select karein; JEB guide |
| Android resources | Decoded manifest, string tables, locales aur version facts | Aapka diya hua Apktool launcher; resource guide |
| Flutter apps | Dart snapshot hash, per-ABI library digests aur engine build provenance | Koi additional tool nahi (static APK parsing); Flutter guide |
| Firmware | Regions, extraction results aur native-analysis handoffs | Linux par Binwalk / Unblob; firmware guide |
| Recorded packets | Selected fields, repeated values, filters aur decode-as rules | Linux: TShark 4.x + prlimit; capture guide |
| Packet summaries | Endpoints, DNS, TLS SNI, protocol distribution aur HTTP requests | Aapke diye hue tshark aur capinfos (Linux par verified); pcap guide |
| Recorded logic signals | Decoder annotations, sample ranges aur diagnostics | Linux: sigrok-cli 0.7.2 + prlimit; signal recordings |
| Packages aur resources | File inventories, digests, plists, Apple bundle structure aur extracted resources | Artifact aur JavaScript guide, Apple applications |
| Process behavior | Terminal output, interactions, exit aur filesystem observations aur runs ka comparison | Native PTY ke saath Linux/macOS; process capture |
| PyInstaller executables | CArchive members, Python version, entry scripts aur extracted bytecode | Koi additional tool nahi (sirf static analysis); Python packaged applications |
Static JavaScript aur .NET inspection di hui files ko application chalaye baghair parhti hai. Runtime capture aapki user permissions se selected target ko chalata hai ya uske saath interact karta hai; har runtime guide apne effects batati hai.
Offline native-binary inspection ke liye REA aapke diye hue GNU objdump aur Rizin bhi support karta hai. Provider setup, CLI commands aur Evidence ki limitations ke liye reverse-engineering tools guide dekhein. REA in dono providers ko install ya update nahi karta.
Native formats aur host support har provider ke liye alag ho sakte hain.
Hopper aur Ghidra setup,
IDA guide (optional native MCP bridge samet),
Kuna decompiler guide aur
experimental Windows Ghidra support dekhein.
Ghidra 16-bit DOS analysis bhi support karta hai.
Badi binaries ke liye REA_GHIDRA_STARTUP_TIMEOUT_MS ya
REA_HOPPER_STARTUP_TIMEOUT_MS se provider ki startup deadline barhayein.
Provider select karne ke liye CLI guide dekhein.
Latest npm release ke baad add hone wale features ki
release availability check karein.
Amli misaalein
DX-Ball: sound-pan calculation dobara banayein
Sound call se uske position-to-pan helper tak jayein, instructions inspect karein aur adhoore pseudocode ko C mein badlein. Dobara banaya gaya code 3,205 original-x86 cases pass karta hai aur compiled function ke tamam 63 bytes dobara hasil karta hai.
Case study parhein · Reconstruction repository
Notion: Electron clipboard bridge trace karein
Renderer ki clipboard API dhoondein, preload aur IPC ke raste main process tak uska flow follow karein aur rich clipboard format inspect karein.
TH04: DOS bullet-ring calculation recover karein
Original PC-98 game ki 16-bit instructions inspect karein, fixed aur aimed angle calculations recover karein aur dobara banaye gaye C++ ko purane compiler ke output se compare karein.
Case study parhein · Reconstruction repository
REA se RL environments banayein
Web app session record karein, us ki API ko tools mein badlein aur AI agent ke liye environment export karein. AgentEnv ke saath chalayein, phir RL training ya evaluation ke liye tasks aur reward checks shamil karein.
Environment banane ki rehnumai · X par demo dekhein
Agar aapne REA se koi dilchasp kaam kiya hai to hum dekhna chahenge. Apna case issue ya pull request mein share karein. Target, apna sawal, REA ne kaise madad ki aur kya mila, yeh sab batayein.
RL environments banayein
AI agent ke liye local environment banayein jahan woh asal app chalaye baghair issue dhoondhne ya folder banane jaise kaam ki mashq kar sake. Ise reinforcement learning (RL) ya agent ke kaam poore karne ki salahiyat jaanchne ke liye istemal karein.
REA record kiye hue API requests aur responses ko aise tools mein badalta hai jinhein agent call kar sakta hai. Environment recorded data istemal karta hai aur sirf woh tabdeeliyan support karta hai jin ke asraat recording tasdeeq karti hai.
Agent mein REA setup karne ke baad neeche example URL aur folder tasks ko apne app ke mutabiq badlein:
Meri test web app se REA ke zariye RL environment banao:
http://127.0.0.1:3000
Folders ki list, creation, rename aur deletion cover karo. Test folders bana
aur hata sakte ho, lekin mojooda data tabdeel na karo.
my-env naam ke folder mein save karo, kaam karne wale operations check karo aur chalane ka tareeqa batao.
Command line istemal karein
Yeh commands tab istemal karein jab app ke browser requests aur responses ki recording pehle se file mein ho. Result chalane ke liye AgentEnv aur Docker bhi chahiye.
rea environment-build ./session.har ./my-env --name my-env --json
agent-env run ./my-env
REA chalne ke liye tayyar environment aur aik bunyadi test export karta hai jo us ka shuru hona aur jawab dena check karta hai. Apne RL framework ke saath task goals aur reward checks tay karein aur training chalayein.
Environment banane ki rehnumai · Environment reference · X par demo dekhein
FAQ
Kaun se agents REA use kar sakte hain?
Har woh agent jo local MCP servers support karta ho. Setup supported agents configure karta hai; doosre clients manual MCP registration use kar sakte hain.
Kya mujhe Hopper, Ghidra, IDA ya Kuna chahiye?
Deep native analysis in mein se ek use karta hai. Static JavaScript aur .NET inspection native analysis engine ke baghair kaam karti hai. Approval ke baad setup Hopper install kar sakta hai; Ghidra, IDA aur Kuna ke liye aapki existing installations use hoti hain. Provider setup dekhein.
Kya pehle Hopper shuru karna hoga?
Jab kisi operation ko Hopper chahiye hota hai to REA use shuru karta hai. macOS par pehli dafa khulne wala dialog demo mode select karne ya license activate karne ko keh sakta hai. Pehle CLI/MCP operation ya unattended job se pehle usi user session mein yeh prompt complete karein. Zaroorat ho to Hopper manually kholein. Hopper startup aur troubleshooting dekhein.
skills.sh se skill install karne se kya hota hai?
Skill aapke agent ko jaanch karne ki instructions deti hai. REA ka MCP server
register karne aur matching instructions install karne ke liye
npx rea-agents setup use karein, phir agent restart karein.
Sirf skill ki installation dekhein.
REA kis tarah ka code wapas deta hai?
Native analysis pseudocode aur assembly wapas deta hai. JavaScript/Electron analysis modules aur unke relationships recover karta hai. Aapka agent in findings se implementation likhta aur test karta hai; amli misaalein iska tareeqa dikhati hain.
Kya REA meri app upload karta hai?
REA targets ko local machine par analyze karta hai. Aapke agent ko tool results milte hain, aur uske model provider ki apni data policy hoti hai.
Bug mile to kya karun?
Pehle update karein; ho sakta hai recent release mein masla hal ho chuka ho.
Agar CLI npm install --global ya bun add --global se install ki hai:
rea update
npx se agent setup ke liye:
npx rea-agents@latest setup
Agar agent use kar rahe hain to setup refresh complete karke agent restart karein. Wohi task dobara try karein. Masla phir bhi ho to REA version, target type, reproduce karne ke steps aur error output ke saath issue kholein.
Documentation
Website ki amli guides se shuru karein. Exact options, prerequisites aur result contracts ke liye:
- Installation aur setup: agent registration, provider configuration, updates aur uninstall.
- Readiness aur troubleshooting: ek agent ya analysis engine ka masla diagnose karein.
- CLI aur Evidence: commands, provider selection, snapshots, import/export aur exit statuses.
- MCP contracts aur agent prompts: tool results, sessions aur guided investigations.
- Tool catalog: tools, providers aur CLI commands ki generated inventory.
- Roadmap: planned work aur capability trackers.
Security vulnerabilities SECURITY.md ke zariye report karein.
Stars ki history
🎉 400,000 GitHub stars — shukriya!
REA use karne, bugs report karne, features suggest karne, builds test karne aur fixes contribute karne wale sab logon ka shukriya.
Zimmedarana istemal
Responsible-use guidance ke liye DISCLAIMER.md dekhein.
Ghair qanooni ya ghair ijazati istemal ke bare mein project ki position REA ke tamam versions, distribution channels aur platforms par lagu hoti hai; har copy par uske applicable licenses barqarar rehte hain.
REA qanooni research, taleem, interoperability, software preservation aur aise software ke analysis ke liye hai jo aapka apna ho ya jise examine karne ki aapko ijazat ho.
Hissa dalein
REA mein aapki madad ka khairmaqdam hai! Bug report karne ya feature suggest karne ke liye issue kholein, ya code aur docs behtar karne ke liye pull request bhejein.
Development setup aur checks ke liye CONTRIBUTING.md, verification lanes ke liye testing aur project structure ke liye architecture map dekhein.
License
REA ka apna likha hua code MIT ke tehat licensed hai. Third-party material ke apne licenses aur copyright notices barqarar rehte hain. Dependency inventory, preserved license texts aur external tools ki terms ke liye Third-party notices dekhein.
IDA Pro / Hex-Rays decompilers, Hopper aur JEB samet commercial tools qanooni tareeqe se hasil karna aur unke applicable licenses ke mutabiq use karne ki ijazat rakhna zaroori hai. REA koi tool license, key ya activation ka haq nahi deta. Trials aur demos vendor ki terms ke tehat rehte hain, jin mein user, feature, automation aur output sharing ki pabandiyan bhi shamil hain. Cracked copies, chori ki hui keys, ghair ijazati key sharing aur license restrictions bypass karne ki ijazat nahi. Yeh guidance MIT ya third-party licenses ko tabdeel nahi karti.