+ With Node.js and npm available, run setup, choose your coding
+ agent and review the proposed changes.
+
+
+
+ Terminal · agent setup
+
+
npx rea-agents@latest setup
+
+
+ Setup registers REA's MCP connection and installs the matching
+ investigation skill. Restart your agent when it finishes, then
+ give it a target path and a question.
+ Follow the setup guide for
+ prerequisites and your first analysis.
+
+
+
+ Which coding agents can use REA?
+
+ Any agent that supports local MCP servers. Setup includes
+ Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI,
+ Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI,
+ Command Code and VS Code.
+
+ REA releases frequently, including bug fixes. If you installed
+ the CLI with npm:
+
+
+
+ Terminal · installed CLI
+
+
rea update
+
+
+ Follow the setup refresh command printed by the update. If you
+ set up your agent through npx, run:
+
+
+
+ Terminal · refresh agent setup
+
+
npx rea-agents@latest setup
+
+
+ Review the changes and restart your agent. Its REA connection
+ pins a package version, so refreshing setup makes it use the
+ new release. For one-off CLI commands, use
+ npx -y rea-agents@latest followed by the command.
+
+
+
+
+ Is installing the skill from skills.sh enough?
+
+
+ The skill gives your agent investigation instructions. Run
+ REA setup to connect the MCP server and
+ install the matching skill, then restart your agent so it can
+ call the tools.
+
+ Browser pages: scripts,
+ requests and runtime observations.
+
+
+
+ REA also has workflows for managed assemblies, Android APKs,
+ firmware and packaged resources.
+ See the case studies for worked
+ investigations.
+
+
+
+ Do I need Hopper, Ghidra or IDA?
+
+ Deep native analysis uses one of them. Static JavaScript and
+ .NET inspection work with the supplied files and do not need a
+ native analysis engine.
+
+
+ Connect your existing Ghidra or IDA installation, or let setup
+ detect Hopper and propose an installation. Your host and
+ target determine which provider can be used.
+ Set up native analysis.
+
+
+
+ Can I use REA without a coding agent?
+
+ Yes. The CLI uses the same analysis workflows. For a local
+ JavaScript or Electron app:
+
+ Replace the path with an extracted application folder or ASAR
+ file. Use the CLI for
+ installation options.
+
+
+
+ What code does REA return?
+
+ Native analysis returns assembly and pseudocode, with calls,
+ references and relevant constants. JavaScript analysis returns
+ modules, their relationships and source locations.
+
+
+ Your agent uses these findings to explain the behavior or
+ write and test an implementation. The
+ DX-Ball calculation
+ and CTF flag checker show how
+ that process works.
+
+
+
+ What should I ask my agent?
+
+ Give it a local target and one behavior to investigate. For a
+ JavaScript or Electron app:
+
+
+
+ Your coding agent
+
+
+ ›Use REA to analyze /absolute/path/to/app and explain how
+ it exports data. Show the relevant code and source
+ locations.
+
+
+
+ Replace the path with your target. The
+ guides provide prompts for native,
+ Electron and browser examples.
+
+
+
+
+
+
+
Troubleshooting
+
+
+ Why can't my agent see the REA tools?
+
+ Restart or reconnect your agent after setup. Check its REA
+ registration with doctor; for Codex:
+
+
+
+ Terminal · check one client
+
+
npx -y rea-agents@latest doctor --client codex --json
+
+
+ Replace codex with your client ID, such as
+ claude_code or cursor. If the report
+ shows a missing or stale registration, run setup for that
+ client:
+
+
+
+ Terminal · repair one client's setup
+
+
npx rea-agents@latest setup --client codex
+
+
+ Review its plan and restart the client. If registration is
+ healthy but tools remain absent, check the client's MCP
+ connection error.
+ More setup diagnostics.
+
+
+
+ Do I need to start Hopper first?
+
+ REA starts Hopper when an operation needs it. On macOS,
+ complete the first-run choice of demo mode or license
+ activation before unattended analysis.
+ See native provider setup.
+
+
+
+ What should I do if I hit a bug?
+
+ Update REA, restart your agent and retry
+ the same task. A recent release may already fix the problem.
+
+
+ If it persists,
+ open an issue
+ with your REA version, operating system, target type, steps to
+ reproduce and error output. Include the provider name when the
+ problem involves native analysis.
+
+
+
+
+
+
+
Data and sharing
+
+
+ Does REA upload my app?
+
+ REA analyzes targets on your machine. Your agent receives the
+ results, and its model provider's data policy applies to those
+ results.
+
+
+
+ How can I share an example or contribute?
+
+ Have a useful REA example? We'd love to see it. Share the
+ target, your question, the findings and how you checked them
+ in an
+ issue
+ or
+ pull request. Short code excerpts and figures help others follow the
+ investigation.
+
+
+ Bug reports, feature requests, documentation and code
+ improvements are welcome too. You can also discuss an example
+ in the community.
+
+ Use REA to inspect an easy DownUnderCTF binary. Extract its
+ checking rules, solve for the flag and confirm that the original
+ program accepts it.
+
+ The first loop copies 36 character codes. The checking loop
+ decodes a mask, sums the selected codes and compares the
+ result with a stored number. Its 0x18-byte steps
+ across 0x270 bytes give 26 masks.
+
+
+
+
+ These are selected results from a fresh REA analysis. The local
+ target path is shortened for display; addresses refer to REA's
+ imported image.
+
+
+
+
+
One check reveals one character
+
+ The checker arranges the input in a 6×6 grid. A mask chooses which
+ cells contribute to a sum. Its compact encoding uses negative
+ numbers to skip cells and positive numbers to select them.
+
+
+
+
+
+
+ The seventh check selects just one position.
+ Open figure.
+
+
+
+ The instruction MOVSX reads mask bytes as signed
+ values. This is why eb means −21. The target is a
+ little-endian integer. Together, these bytes tell the agent that
+ code[21] = 55, so that character is 7.
+
+
+
+
+
From instructions to a readable check
+
+ Select a step to connect the summing helper and its caller to the
+ same rule in C.
+
int check_one_mask(const int codes[36],
+ const int mask[36],
+ int target) {
+ int total = 0;
+ for (int i = 0; i < 36; ++i) {
+ if (mask[i]) {
+ total += codes[i];
+ }
+ }
+ return total == target;
+}
+
+
+
+
+ 01 · Start at zero.ECX holds
+ the running sum.
+
+
+ 02 · Check the mask cell. A zero value skips
+ the character; a nonzero value includes it.
+
+
+ 03 · Add a character code. The input's
+ integer at the same offset is added to the sum.
+
+
+ 04 · Move to the next cell. The original loop
+ advances four bytes per integer and visits six rows of six
+ cells.
+
+
+ 05 · Compare with the stored target. The
+ caller receives the sum in EAX. A mismatch jumps
+ to Incorrect!.
+
+
+
+
+ The instructions come from the summing helper and its caller. The
+ C is an explanatory summary with descriptive names and a flattened
+ 36-cell loop.
+
+
+
+
+
Solve the 26 equations
+
+ Most masks select several cells. For example, the first check adds
+ 16 character codes and requires a total of 1441. The overlapping
+ selections give equations that a small Python script can solve
+ together.
+
+
+
+ Python · solver excerpt
+
+
from z3 import Int, Or, Solver, Sum, sat
+
+codes = [Int(f"code_{i}") for i in range(36)]
+solver = Solver()
+alphabet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_{}"
+for code in codes:
+ solver.add(Or(*[code == ord(c) for c in alphabet]))
+for code, char in zip(codes, "DUCTF{"):
+ solver.add(code == ord(char))
+solver.add(codes[-1] == ord("}"))
+
+for selected, target in checks:
+ solver.add(Sum([codes[i] for i in selected]) == target)
+
+assert solver.check() == sat
+model = solver.model()
+print("".join(chr(model.eval(code).as_long()) for code in codes))
+
+
+ Z3 is a solver that finds values satisfying these equations. This
+ excerpt uses the extracted checks and assumes a
+ DUCTF{…} flag with letters, digits, underscores and
+ braces. The complete download includes all 26 masks and targets.
+
+ REA's process capture records the original executable accepting
+ the solved flag. Changing one selected character from
+ z to y makes the first sum 1440 instead
+ of 1441, and the program rejects it.
+
+
+
+
+
+
Input
+
Observed output
+
Exit code
+
+
+
+
+
Solver's flag
+
Correct!
+
0
+
+
+
One character changed
+
Incorrect!
+
255
+
+
+
+
+
+ Show the recovered flag and captured output
+
+
+ REA · original program output
+
+
What is the flag? DUCTF{ezzzpzzz_07bcda7bfe81faf43caa}
+Correct!
+
+
+ The recovered value also matches the flag in the organizers'
+ published challenge metadata, checked after solving the binary.
+
+
+
+ Source, target identity and analysis details
+
+ Fresh analysis and two process captures on 8 October 2026, using
+ REA 4.1.0 with Ghidra 12.1.4 on Linux x64. The binary is a
+ stripped x86-64 ELF, 15,248 bytes.
+
+ The string references, functions and constants were inspected
+ before reading the organizers' source or solution. The Python
+ solver and the diagram were built from those REA results.
+
+ Download the original challenge and the solver into one folder.
+ Use the prompt above to investigate with your agent, or run the
+ included script.
+
+ The script prints a candidate flag; paste it at the program's
+ prompt. Solving needs Python and z3-solver. Running
+ the original executable needs Linux x86-64.
+
- Game reconstruction and Electron analysis, with examples from DX-Ball,
- Notion and TH04.
+ Game reconstruction, Electron analysis and a CTF challenge, with code,
+ figures and checked results.
+
+
CTF · Native analysis
+
+
Solve a CTF flag checker
+
+ Inspect an easy DownUnderCTF challenge with REA. Find its checking
+ functions, turn masks and sums into equations, then verify the
+ solved flag with the original program.
+
+