REA 逆向分析工作流

在授权前提下对原生二进制、JavaScript/Electron、APK、固件等做取证、反编译、版本比对与证据化分析的工作流手册；是 REA MCP 服务器的配套指令（需另装工具本体），仅限合法安全研究。

github最新版本 0.1.1更新于 2026-10-19下载 0 次2 个版本

references/android-applications.md

1	# Android application artifacts
2
3	Use the connected server's advertised Android tools. Repository main and npm
4	4.1.0 include this family. A skill installation alone cannot add it to an
5	older server.
6
7	Start with `inspect_android_package` on the caller's APK path for package
8	identity, manifest declarations, coverage, and inline Evidence. Use
9	`search_android_classes` to find candidates, `inspect_android_class` for one
10	class's members, `inspect_android_method` for decompilation, and
11	`trace_android_references` for incoming static references. Each call takes its
12	own APK path and explicit selectors; do not open a native session first.
13	Choose an `overload_index` from the class inventory when methods are ambiguous
14	instead of guessing.
15
16	The provider requires a separately supplied headless JADX MCP JAR 0.7.1 and
17	Java 17 or newer. `REA_JADX_MCP_JAR` selects the absolute JAR path; `JAVA_HOME`
18	can select Java. REA setup does not install or configure that JAR, and doctor
19	provider scopes cover Hopper/Ghidra rather than JADX. Use existing tools and
20	report missing prerequisites for the Android task specifically.
21
22	Linux and macOS use the POSIX owned-process boundary. Windows x64 requires the
23	matching bundled native controls and uses an owned Job Object with bidirectional
24	stdio. A full JDK, including `jdk.compiler`, is required on every host; Windows
25	`JAVA_HOME` selects `bin\java.exe`. Consult the Android guide for actual host
26	verification coverage. Calls use one worker and provider deadlines; optional
27	`REA_JADX_HEAP_MIB` selects the JVM heap and `REA_JADX_OPERATION_TIMEOUT_MS`
28	the per-operation deadline (default 120000 ms; the MCP client's tool timeout
29	must also allow it). The APK is never launched,
30	and no emulator is required.
31
32	Manifest entries and decompiled text are static observations, not execution or
33	policy enforcement. Incoming references are recovered static relationships;
34	reflection, dynamic loading, and unresolved calls remain unknown. Preserve
35	artifact digests, locations, diagnostics, and incomplete coverage. For archive
36	members rather than code analysis, use `open_binary` and `inspect_artifact`.

文件内容是平台检查时读出的文本，只供查看。平台不会运行包里的任何脚本或程序。