REA Writeups

Reverse engineering case studies produced with REA (Reverse Engineer Anything).

Each post follows the same discipline: a target, a method, the evidence REA produced, and the honest limitations. Every analysis runs locally and every claim is backed by an artifact digest.

Posts

1. 001: Pylance VS Code extension — what a static JavaScript application graph of a real, shipped extension looks like, from IPC observations down to per-edge source ranges.
2. 002: Claude Code VS Code extension — a thin shell around a bundled CLI: import boundaries, the webview's localStorage persistence surface, and a zero-IPC security summary.
3. 003: notepad.exe with Ghidra — the first native run: PE segment map, 853 procedures, and what the analysis profile admits about its own Windows P0 limits.

Method

REA runs from the terminal with no cloud dependency:

npx -y rea-agents@latest analyze-javascript-application "<target path>" --json

Native targets (binaries, APKs, firmware) additionally use Hopper, Ghidra or IDA where available. See posts/ for per-target commands.

Why evidence first

Every graph edge REA returns carries a SHA-256 digest of the artifact it came from, the source range, the extractor version, a confidence level and a limitation note. The point of these writeups is to show that reasoning, not just results.