你有没有过这种时刻：用一个软件，特别好奇某个功能是怎么做出来的——搜索为什么这么聪明、那个动效怎么算出来的、点一下导出背后发生了什么？想去查，它闭源；想问 AI，AI 没见过这个程序，只能瞎编。
10 月初，GitHub 上一个开源项目把这件事彻底改变了。它叫 REA（Reverse Engineer Anything，逆向一切），火到什么程度？
上线冲上 GitHub 趋势榜第一，我写稿时 star 数已经 11 万+，最夸张的时候一天更三个版本。
它干的事一句话说清：给你的 AI 编程助手装上一套专业逆向工具，让它真的去"拆开"你电脑上的任何软件，沿着证据链讲清楚功能是怎么实现的——而不是靠猜。
这篇文章我会带你从零装好它、跑通第一个分析，然后把 Windows 上最实用的几条分析路线各走一遍——每一步都有真实截图。
读完你能拿到：一套能跑的环境 + 看懂 REA 输出的眼睛 + 一组拿走即用的提示词模板。
先说清楚这篇文章不做什么：不带你完整复刻某个软件。复刻一个产品，难的从来不是功能而是效果——算法逻辑 REA 能给你证据链，但产品级的手感、性能、细节打磨是几千次迭代喂出来的，那是另一个话题。
这篇只解决"怎么用 REA 把软件看明白"，学会方法后你想拆什么、拿什么功能进自己的项目，就是你自己的事了。
一、REA 是个什么东西？
一）它到底火在哪
REA 是一个 MCP 服务器 + 命令行工具（npm 包名叫 rea-agents），MIT 协议完全开源。
它的思路不是自己造反编译器，而是把业界几十年的专业逆向工具——Ghidra、Hopper、IDA——还有一堆 JS/.NET/浏览器分析器，统一接到你的 AI 编程助手（Claude Code、Codex、Cursor 等）上。
AI 通过它可以去：
- 拆 Electron/JS 应用：解包 ASAR，画出模块关系图，追踪一个功能从界面点击 → 预加载脚本 → 进程通信 → 主进程的完整链路
- 拆原生二进制（exe/dylib/ELF）：反编译出伪代码和汇编，找函数、追调用关系、读内存里的数值常量
- 认 .NET 程序集：纯静态读出元数据、类型、方法、依赖，不运行一行代码
- 盯网页：连接浏览器，抓取你点击瞬间的网络请求，定位发起请求的那行脚本
- 还有安卓 APK、固件、智能合约字节码等等
社区已经玩出了花：有人在 Hacker News 上分享，把 Windows 自带的远程桌面程序喂给 AI，凭一句症状描述，半小时修好了两个多年没人修的 bug；有人逆向 Insta360 的剪辑软件，写了个垫片让自己的笔记本核显也能硬件加速；
还有人用它反编译老游戏，把童年记忆移植到现代系统上。逆向圈吵翻了天——有人欢呼"大量因为没人肯花几千小时手工逆向而烂掉的老软件，终于有救了"，也有职业逆向工程师感慨饭碗端不稳。
github仓库地址是：github.com/morluto/rea
仓库主页上的 star 数还在以肉眼可见的速度涨。它跟普通"AI 帮你逆向"最大的区别是三个字：证据链。
REA 的每一条结论都带证据编号（Evidence ID）、来源位置、甚至"哪些部分我没查清"的声明。它不会不懂装懂——这一点我们后面在输出里亲眼看。
二）它能给你什么、不能给你什么
用之前必须建立正确的预期，这决定了你用它的姿势对不对。
官方维护着一份持续更新的实测案例库：连身份验证器每 30 秒一变的动态码算法、CTF 竞赛的 flag 校验逻辑，都被完整拆解并附上验证过程。
它能给你：功能的实现原理、算法逻辑、模块关系、数据流向——全部带证据。
你看到一个好功能，可以让 AI 查明白后"照着机制写一个自己的实现"。
它不能给你：产品级的效果。一个功能"能跑"和"好用"之间隔着一整个产品的打磨功夫。
逆向能告诉你某软件的模糊搜索怎么打分，给不了它十万级文件下依然跟手的性能优化。
所以别指望"逆向一个 Photoshop"——社区里真在做这类复刻的团队，也都强调只做"净室"式的机制研究。
三）法律边界，先说清楚
REA 官方定位就是合法的逆向研究与分析。我国《计算机软件保护条例》也允许软件合法持有人研究其设计原理。但有三条线别碰：
- 别把逆向结果直接商业发布——复刻机制写自己的实现没问题，原样搬人家代码/美术/资源是找死；
- 别碰大厂核心资产的商业机密——学习研究可以，高调整活容易吃官司；
- 别拿它做坏事——找漏洞去利用、破解付费，那是另一个法律频道的事。
项目爆火后，Hacker News 上 769 分、327 条评论的大讨论里，吵得最凶的就是法律与伦理边界——工具越强，越要自己心里有秤。
记住一句：学机制、写自己的实现，安全；抄成果、碰硬骨头，危险。
二、五分钟装好它
一）先确认 Node 环境
REA 需要 Node.js 22.19+ / 24.11+ 或 26。没装的去 Node 官网（nodejs.org/zh-cn/download）下 LTS 安装包，装完打开 PowerShell（按 Win 键搜 PowerShell）验证：
node -v
能打出 v24.19.0 这样的版本号（你的是 v24.x 或 v22.x 都行），环境就绪。
二）一条命令接入你的 AI
在 PowerShell 里执行：
npx -y rea-agents@latest setup
它会列出所有支持的 AI 助手让你选——Claude Code、Codex、Cursor、Gemini CLI、Qwen Code 等 17 个。
我机器上检测到了 Claude Code（列表第一项标了 Detected），你装了哪个就选哪个：按 ↑/↓ 移动光标，按 空格 勾选，按 回车 确认。
三）看清它要改什么，再放行
确认后它不会偷偷动手，而是先给你看一张"施工清单"：
我这次它列了两项改动：往 Claude Code 的配置文件里注册 REA 服务、往个人技能目录装一份"逆向调查工作流"说明。
注意 backup 那行——它会把你的原配置自动备份（.claude.json.rea.backup），改坏了随时能回滚。
确认无误后按回车应用，然后重启你的 AI 助手（注意是完全退出再打开，托盘图标也要退），装 配 就完成了。
三、第一个分析：官方练习题
第一次上手别直接拆大软件，先用官方提供的示例应用练手——一个只有 6 个源文件的小 Notes 应用，麻雀虽小，Electron 的三件套（界面、预加载、主进程）全有。
一）拿到示例
浏览器打开官方指南页 rea.tools/guides/javascript，页面里有「Download example ZIP」按钮：
下载后解压到一个你顺手的目录，比如 C:\Users\你的用户名\Downloads\notes-example。
二）跑第一条命令
在 PowerShell 里执行（路径换成你自己的解压目录）：
npx -y rea-agents@latest analyze-javascript-application "$HOME\Downloads\notes-example" --format json --filter-output normalized_result.summary.ipc
这条命令的意思是：静态分析这个目录里的 JS 应用（不用启动它），结果只要 IPC 通信部分的摘要。回车后它会先刷一串进度（在盘点文件、解析语法），几秒后出结果。
三）看懂输出：这是全篇最重要的一张图
输出的 ipc 字段里，重点看这几个数字：1 条明文通信通道，界面端发送 1 次，主进程接收 1 次，完美配对、零歧义。
这就是 REA 干的活：它通读了示例的全部代码，把"点导出按钮 → 数据穿过进程边界 → 落成 CSV 文件"这条看不见的链路，用数字摆在了你面前。
同时注意输出里还有一个 limitations（限制声明）字段，它会明确告诉你："这些关系是从静态语法推断的，运行时行为未经验证"。说清楚自己知道什么、不知道什么——这才是 AI 分析该有的样子。
实际使用中你几乎不会手敲这么长的命令。装好 REA 后，真正的日常用法是第四种打开方式，第八节见。
四、拆一个真实的 Electron 应用
练完习题做真题。你电脑上的很多软件——Xmind、阿里云盘、各家国产 AI 助手——都是 Electron 应用，它们的全部代码都打包在安装目录 resources 文件夹的一个 app.asar 文件里。
一）找到 asar
资源管理器地址栏输入 %LOCALAPPDATA%\Programs，进入任意一个应用文件夹里的 resources：
看到 app.asar 了吗？一个 200MB 的文件，整个应用的前端代码、界面逻辑全在里面。这就是我们的拆解目标。
二）拆 207MB 的 Xmind
我拿 Xmind（思维导图）做实测。命令和第三节一样，路径换成 asar 文件：
npx -y rea-agents@latest analyze-javascript-application "$env:LOCALAPPDATA\Programs\Xmind\resources\app.asar" --format json --filter-output normalized_result.summary.ipc,normalized_result.statistics
大文件要多等一会，我实测约 5 分钟。结果：
8919 个模块全部解析、3033 个 JS 文件、读入 58MB 源码文本、发现 39980 处结构特征，解析零失败。一个闭源商业软件的完整代码骨架，就这样被铺开在你面前。接下来你可以让 AI 顺着某条通信通道往下追——某个功能怎么调用的、数据存在哪，它都能给你指出具体文件和行号。
三）REA 也会拒绝：这个细节很加分
不是所有软件都能顺利拆。我拿阿里云盘试了一次：
npx -y rea-agents@latest analyze-javascript-application "$env:LOCALAPPDATA\Programs\aDrive\resources\app.asar" --format json --filter-output error
直接被拒：JavaScript application analysis failed。
完整错误信息里说得很清楚——包里一个原生模块文件的实际指纹和打包时的声明对不上（安装器动过它），REA 按完整性校验原则拒绝分析，并把"声明的指纹"和"实际的指纹"两个值都列给你。
文件被动过手脚就明说，而不是硬着头皮给你分析一份可能不可信的结果——这个设计我很喜欢。
五、看穿一个网页：抓一次点击背后的请求
第三条路线：不装任何东西，直接观察浏览器里的网页。适合研究"某个网页操作背后发生了什么"。
一）带调试端口启动浏览器
关掉所有 Chrome 窗口，然后按 Win+R 输入以下内容启动一个带调试端口的 Chrome（可以换成任何网址）：
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir=%TEMP%\rea-chrome https://rea.tools/examples/notes-web/
我打开了官方的 Notes 网页示例，页面上有个"Export notes"按钮：
二）开观察窗，点按钮
回到 PowerShell，先问 REA 这个浏览器里有哪些页面（拿到页面 ID），再开一个 12 秒的观察窗：
npx -y rea-agents@latest list-browser-targets http://127.0.0.1:9222 --format json
npx -y rea-agents@latest inspect-web-page http://127.0.0.1:9222 页面ID --observation-ms 12000 --format json --filter-output normalized_result.network.requests
回车后立刻切到浏览器，在观察窗内点击页面上的 Export notes 按钮。12 秒后 PowerShell 交出答卷：
看这两处：你点击的瞬间，一个 GET 请求飞向 notes.json，状态 200；发起者是 export.js 脚本的第 3 行。一次点击背后的完整因果链——什么请求、发给谁、谁发起的——全被钉在证据上了。把它和第三节对脚本源码的分析连起来，一个网页导出功能的原理就完整了。
六、认出一个 .NET 程序
Windows 上大量工具软件是 C#/.NET 写的。REA 对这类程序做纯静态盘点——只读元数据，不运行、不加载：
npx -y rea-agents@latest inspect-managed-artifact "C:\Program Files\某个软件\某个.dll" --format json --filter-output normalized_result.classification,normalized_result.assembly,normalized_result.target_frameworks
我拿本机一个软件的组件实测，输出（见下图）直接给出三样东西：这是托管代码（CIL 中间语言）、程序集名字和版本、目标框架 .NET 3.1——而且每条结论都带证据编号和在文件中的偏移位置：
有意思的细节：我最初拿它去认这个软件的主程序 exe，REA 如实回答"这不是 .NET 程序集"（原生 PE）——真正的代码在同名的 .dll 里。它分得清"启动器"和"程序本体"，这种诚实在水货 AI 分析工具里很少见。
七、原生二进制：门槛与路径
最硬核的路线——反编译 exe 的机器码——需要再装一个专业反编译引擎，三选一：Ghidra（免费开源，需另装 JDK 21+）、Hopper（macOS/Linux）、IDA（商业）。
装好任何一个后跑一条体检命令，REA 会告诉你缺什么：
npx -y rea-agents@latest doctor --provider ghidra --format json --filter-output providerInspections
我机器上还没配 Ghidra，它直接说"GHIDRA_INSTALL_DIR 未设置"，连补救命令都给你写好了。配好后就能让 AI 反编译函数、追调用链、还原算法——官方展示过一个案例：从 1996 年的老游戏里还原音效的左右声道计算公式，还原出的 C 代码跟原函数 63 个编译字节全部一致。
这一条路线门槛最高（要装 Java 和 Ghidra），但也是含金量最高的。新手建议先玩熟前三条零门槛路线，需要时再回来。
八、真正的日常用法：在 AI 里说一句话
前面你手敲的每条命令，装好 REA 后都可以变成一句话。打开你的 AI 助手，直接说：
帮我用 REA 分析一下 XX 软件，看看它的 YY 功能是怎么实现的，给我看证据。
AI 会自己决定调哪个工具、传什么参数——就像下面这样，分析、读输出、追证据全程自动：
你只负责提问和看结论。这也是 REA 的正确打开方式：命令行是它的手，自然语言才是它的门。
九、提示词模板库（拿走即用）
根据目标类型，套这几个句式：
拆应用功能（Electron/JS 软件通用）：
用 REA 分析「软件名」的安装目录里的 app.asar，讲清楚「功能名」从界面操作到数据落盘的完整链路，
每一步给出源码文件和行号，最后用大白话总结它的工作机制。
看穿网页操作：
帮我用调试端口观察这个页面（地址），我手动操作「某按钮」，你抓下点击瞬间的网络请求和发起脚本，
再读一下相关脚本源码，解释这个功能在前端是怎么实现的。
认程序身份（任何 exe/dll）：
用 REA 看一下这个文件是什么类型的项目：是什么语言/框架写的、版本多少、依赖哪些库，
把判断依据一并列出来。
从机制到实现（合规复刻的正确姿势）：
基于你刚才查明的机制（不要引用原程序的任何代码），帮我从零写一个最小可用的同类实现，
只实现核心逻辑，代码要完全原创。
最后一条就是"复刻"的安全姿势：让 AI 凭"机制理解"写全新代码，而不是搬运原程序的字节。
我按模板④把第五节分析的网页导出功能重写了一遍——30 行原创代码，机制同源、字字原创：
十、什么时候该用、什么时候别用
一张判断清单收尾：
- 有源码的项目 → 别用 REA，直接看代码
- 闭源软件、想知道某功能原理 → 正中本项目的靶心
- 网页交互背后的逻辑 → 正中项目的靶心
- 老软件修复、老游戏复刻 → 社区已验证的最佳场景
- 想整段搬人家的代码和素材 → 别，法律风险
- 大厂核心产品的高调逆向 → 慎重，学习研究别声张
工具是中性的，REA 把过去专业团队才玩得起的逆向能力塞进了每个人的终端里。怎么用，考验的是拿工具的人。
装好它，从拆你电脑里第一个让你好奇的软件开始吧。拆出什么有意思的东西，欢迎评论区聊聊。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Have you ever been at a moment when you're using a software, and you're particularly curious about how a function is made — why a search is so smart, how does that action come out, what happens behind it? I'd like to check it out, it's closed; I'd like to ask AI, AI has never seen this program, it's just a fabrication.
In early October, GitHub's last open source project completely changed this. It's called Reverse Engineer Anything. What's the fire?
The first step on the GitHub trend list, when I wrote the article, the number of Stars was 110,000 plus, and at the most exaggerated time, three more editions a day.
What it's doing is clear: a professional reverse tool for your AI programming assistant so that it can actually "discrete" any software on your computer and tell you how it works along the chain of evidence - not by guess.
I'll take you through the first analysis from scratch, and I'll go through the most practical analysis routes on Windows — there's a real screenshot of every step.
Read it and you can get it: a running environment + read the eyes of the REA output + take the prompt template.
Let's make it clear that this article doesn't do anything: it doesn't take you to reset some software. Recapturing a product is never a function, but an effect -- algorithmic logic REA can give you a chain of evidence, but the sense, performance, detail of the product grade is fed thousands of times, that's another topic.
It's only about "How to read the software with REA," and it's your business to learn what you want to break down and put in your project.
- What is it?
Where is it?
REA is an MCP server + command line tool (npm package called rea-agents), and the MIT protocol is fully open.
The idea is not to create an anti-circulator itself, but rather to put industry's decades of professional reverse tools — Ghidra, Hopper, IDA — together with a bunch of JS/.NET/Grower Analyzers, on your AI programming assistant (Claude Code, Codex, Cursor, etc.).
AI through which it can go:
- Dismantling Electron/JS Application: Unpacking ASAR, drawing a modular relationship chart, tracking a function clicking from the interface → preloading scripts → process communication → complete link to the main process
- Dismantling of primary binary (exe/dylib/ELF): Inverse compilation of pseudocodes and compilations, search functions, call relationships, reading numerical constants in memory
- Recognition.NET program set: pure static reading metadata, type, method, dependency, not running a line code
- On the web page: connect the browser, grab your instant web request, locate the script that initiated the request
- And Andre, APK, solid, smart contract, Q113 Z, etc.
The community has played flowers: someone shared it on Hacker News, fed the Windows own remote desktop program to AI, fixed two bugs in half an hour with a description of the symptoms, which have been unrepaired for over two years; and someone reverses Instal360's editing software, writing a pad that allows his laptop to see it faster;
It is also used to codify old games and transfer childhood memories to modern systems. The backsliding – some cheered at "A lot of old software that's rotting because no one's willing to spend thousands of hours on manual reverses, finally saves itself", and some professional reverse engineers feel unstable.
github warehouse address: github.com/morluto/rea
The number of Stars on the warehouse home page is still rising at a visible rate. The difference between it and normal "AI to help you reverse" is three words: the chain of evidence.
Each conclusion of the REA is accompanied by a statement of evidence number (Evidence ID), location of origin, or even "I don't know what." It doesn't get to pretend -- we look back in the output.
ii) What can it give you? What can it give you?
You have to build the right expectations before you use it, which determines your position.
Officially, a continuously updated database of empirical case studies is maintained: even dynamic code algorithms for identification machines per 30 seconds, and flag logic for CTF competitions, which are fully dismantled and accompanied by a validation process.
It gives you the principle of functionality, algorithmic logic, modular relationships, data flow — all with evidence.
You see a good function that allows AI to "write one of its own by the mechanism" once it's clear.
It doesn't give you product-level effects. A function that runs between "run" and "good use" is a whole product.
The reverse tells you how a vague search of a software can be rated, and it does not optimize the performance of a 100,000-grade file.
So don't count on a "reverse to a Photoshop" -- the real team in the community doing these kinds of retracings, and the emphasis is on a "clean room" mechanism.
(iii) Legal boundaries.
REA official positioning is a legitimate reverse research and analysis. Our Regulation on Protection of Computer Software also allows legitimate holders of software to study their design principles. But there are three lines:
- Do not write the reverse results directly to the commercial publish - Recapturing the mechanism does not have a problem of achieving it.
- Do not touch the commercial confidentiality of the core assets of the large plant — studies can be done and high-adjustment work can be easily prosecuted;
- Don't do anything wrong with it - find a loophole to exploit and crack paid, that's another legal channel.
After the project broke fire, in the 769 points, 327 comments on Hacker News, the most noisy was the legal and ethical boundary — the stronger the instrument, the greater the balance in the mind.
Remember: learn mechanisms, write your own achievements, be safe; copy results, touch hard bones, and be dangerous.
Two, five minutes to load it.
(i) Confirmation of Node Environment
REA needs Node.js 22.19+/ 24.11+ or 26. Unmounted LTS installation package under Nodejs.org/zh-cn/download, completes the opening of PowerShell (press Win search PowerShell):
node -v
V24.19.0 is ready for version number.
ii) an order to access your AI
In PowerShell:
npx -y rea-agents@latest setup
It lists all supporting AI assistants - Claude Code, Codex, Cursor, Gemini CLI, Qwen Code, and so on - 17.
I've detected Claude Code on the machine, and you have to choose which one you have: press the ↑/ ↓ move cursor, press the space tick, press the car back.
iii) See what it changes, then let it go.
When it's confirmed, it doesn't sneak up, but first, it shows you the construction list:
This time I've listed two changes: registration of REA services in Claude Code's configuration file and a "reverse investigation workflow" note in the Personal Skills Directory.
Watch the backup line -- it'll turn your original configuration back-up (.claude.json.rea.backup) into a rollback.
Press back the application and restart your AI assistant.
III. The first analysis: the official exercise topic
First time, don't take down the software, first with the officially available examples. - A small Notes application with only 6 source files, with a small sparrow, all three sets (interface, preload, main process).
(i) Get examples
Browser opens the official guide page rea.tools/guides/javascript with the "Download external ZIP" button:
Download to decompress to a directory that you can easily access, like C:\Users\ your username\Downloads\notes-example.
(ii) Run the first order
In PowerShell:
npx -y rea-agents@latest analyze-javascript-application "$HOME\Downloads\notes-example" --format json --filter-output normalized_result.summary.ipc
This command means that a static analysis of the JS application in this directory (does not need to start it) will result in only summary in the IPC communications section. When you get back to the car, it brushes a sequence of progresses (e.g. inventory files, solvency syntax) and results in a few seconds.
(iii) Read the output: This is the most important picture of the whole story.
Output ipc Z109Z, focussing on these numbers: 1 explicit communication channel, 1 sent at the interface end, 1 received by the main process, perfect pair, zero ambiguity.
That's what the REA did: it read the entire code of the example, and it put the "point-out button" data through the process boundary into the CSV file, an invisible link, with numbers in front of you.
At the same time, note that the output also contains a statement of limitation (field), which clearly tells you: "These relationships are extrapolated from static syntax and run without verification." Tell me what you know, what you don't know -- that's what AI analyzes.
In practice, you hardly know how to knock on orders so long. When the REA is installed, the real daily usage is the fourth way to open it, see section VIII.
iv. Undo a real Electron application
After practice, do the real thing. Many of the software you have on your computer -- Xmind, Alibaba Cloud disks, and all the national AI assistants -- are Electron applications, and all of their codes are packed in an app.asar file in the installation directory directories folder.
I) Find Asar
Resource manager address bar entered %LOCALAPDA%\Programs into any application folder
See app.asar? A 200MB file, front-end code, interface logic for the whole application. That's our dismantling target.
(ii) Xmind of 207MB
I'm using Xmind to make a reality. The command is the same as section III. The path is changed to the asar file:
npx -y rea-agents@latest analyze-javascript-application "$env:LOCALAPPDATA\Programs\Xmind\resources\app.asar" --format json --filter-output normalized_result.summary.ipc,normalized_result.statistics
Big papers wait a little longer. I've been measuring about five minutes. Results:
8919 modules were fully parsed, 3033 JS files, 58MB source text read, 39980 structural features found, and zero parse failed. A complete coded skeleton of closed-source commercial software, so it was spread out in front of you. Then you can get AI to follow a certain channel of communication -- how a certain function is called, where the data is, it can give you a specific file and line number.
iii) REA would also refuse: this is a good point.
Not all the software can be dismantled. I tried Alibaba Cloud once:
npx -y rea-agents@latest analyze-javascript-application "$env:LOCALAPPDATA\Programs\aDrive\resources\app.asar" --format json --filter-output error
Directly rejected: JavaScript application anallysis failed.
The complete error information is clear: the actual fingerprints of a raw module file in the bag and the statements made when packing it were not matched (the installer moved it), the REA refused to analyse it in accordance with the principle of completeness and gave you both the "declaration fingerprints" and "actual fingerprints".
It's not hard to analyse a result that may not be credible — a design that I like very much.
V. Read through a web page: a request for a click
The third route: to observe the web page in the browser directly, without loading anything. It's appropriate to study what happened behind a web operation.
i) Launch browser with debug port
Turn off all Chrome windows and then press Win+R to start a Chrome with a debug port (can be replaced with any address):
"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir=%TEMP%\rea-chrome https://rea.tools/examples/notes-web/
I opened the official Notes page example, and there's an "Export notes" button on the page:
(ii) Open the observation window, click the button
Go back to PowerShell and ask REA, which pages are in this browser (get the page ID) and open a 12-second observation window:
npx -y rea-agents@latest list-browser-targets http://127.0.0.1:9222 --format json
npx-y rea-ages@latest effect-web-page http://127.0.0.1:9222pageID --observation-ms12000 --format json --filter-output recently result.network.requests
Click the Export notes button on the page in the observation window. In 12 seconds, PowerShell will hand over the responses:
Look at both: The moment you click, a GET requests to fly to notes.json, status 200; the sponsor is row 3 of the report.js script. The complete chain of causality behind a single click — what request, to whom, who initiated it — was nailed to the evidence. Linking it to section III's analysis of script source code completes the rationale for a web page export function.
VI. Recognition of a.NET procedure
Many of the Windows tools are written by C#/.NET. REA makes a pure static inventory of this program - read-only metadata, not run, not loaded:
{\cHFFFFFF}{\cH00FFFF} npx-y rea-agents@latest effect-managed-artifice "C: \programmefiles \specific.dll" --format json-output {\cHFFFFFF}result.classifization, nonmaliz result.assembly, nonmalized result.target framewors
I'm going to give three things directly from a component of one of my software: hosting code (CIL intermediate language), program set names and versions, target frame.NET 3.1 -- Each conclusion is accompanied by an evidence number and a deviation from the document:
Interesting details: I started using it to identify the main program of the software, exe, REA answered correctly, "It's not the.NET program set," the real code in the same name.dll. It distinguishes between "starter" and "procedure body", which is rarely found in the water cargo AI analysis tool.
Original binary: threshold and path
The most hard-core route — the counter-compilation machine code for exe — requires the installation of an additional specialized back-compilation engine, with three options: Ghidra (free open source, additional JDK 21+), Hopper (macOS/Linux), IDA (commercial).
If you put any of them in there and run a medical check-up order, REA will tell you what's missing:
npx -y rea-agents@latest doctor --provider ghidra --format json --filter-output providerInspections
I'm not on the machine yet, Ghidra, and it says, "Ghidra INSTALL DIR has not set it up," and even wrote you the remedial order. When it's done, it'll allow AI to reverse the translation function, call chain, restore the algorithm - an official case: Reverting the left- and right-channel calculation formula from the old 1996 game. Reverting the C code corresponds to all 63 original functions.
This route has the highest threshold (for Java and Ghidra) but also the highest gold content. beginner suggested that the first three zero threshold routes should be used before coming back if needed.
VIII. REAL DIRECT USE: Say a word in AI
Every order you knock on your hand in front of you can be turned into a sentence. Open your AI assistant and say:
Help me analyze the XX software with REA, see how it works, show me the evidence.
AI will decide for itself which instrument to adjust and which parameters to pass - as follows, analyze, read out, and follow the evidence automatically:
You only ask questions and see conclusions. It's the right way to open the REA: command line is its hand, and natural language is its door.
ix. prompt Template Library (take away or use)
Based on the target type, these phrases:
Dismantling applications (Electron/JS software generic):
Using app.asar in the installation directory of REA analysis of "softnames", it is clear that "functional names" are the complete link between the interface operation and the data landing disk.
Each step gives the source document and line numbers and concludes with a summary of its working mechanisms in white.
Web access operation:
Help me use the debug port to look at this page (the address), I manually operate a "button" and you grab click-on web requests and launch scripts.
Read the relevant script source code and explain how this function is achieved at the front end.
Procedural identification (any exe/dll):
If you look at the type of project that this document is: what language/framework is written, how many versions are available, and what libraries you rely on, then you can look at the type of document you want.
The basis of the judgement is presented together.
From mechanism to achievement (the correct posture of the redacting of compliance):
Based on the mechanism you just identified (do not quote any code from the original program), help me write one of the lowest available of its kind,
Only core logic is achieved, the code is fully original.
The last one is the "repeated" security posture: to allow AI to "understand" the whole new code, not to move the original program byte.
I rewrited the section 5 analysis page with template 4 -- 30 lines of original code, mechanism homogeneity, original text:
When to use it, when not.
End of a judgement list:
- There's a source code.
- Closed-source software, want to know how it works.
- The logic behind web interaction.
- Old software fixes, old game resets, community-tested best scenes.
- The whole move code and asset.
- The core product of the big plant is highly retroverted.
The tools are neutral, and the REA places the reverse ability that professional teams used to play on everyone's terminals. And the test is those who take the tools.
Let's start with the first software you're curious about on your computer. Take out something interesting and welcome to the comment section.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.