---
title: "REA writeups"
url: "https://reamcp.dev/zh-tw/cases/rea-writeups-da365b"
source: "https://github.com/Gideon145/rea-writeups"
source_type: "github"
repo: "https://github.com/Gideon145/rea-writeups"
author: "Gideon145"
author_handle: "Gideon145"
stars: 0
category: "CTF 與學習"
categories: ["ctf-learning"]
tags: []
added: "2026-10-12T22:38:05.267Z"
updated: "2026-10-12T16:22:56Z"
locale: "zh-tw"
content_locale: "zh-tw"
---

# REA writeups

一系列短篇紀錄，格式一致：目標、方法，以及 REA 產出的證據。

## Original README

# REA Writeups

Reverse engineering case studies produced with
[REA](https://github.com/morluto/rea) (Reverse Engineer Anything).

Each post follows the same discipline: a target, a method, the evidence REA
produced, and the honest limitations. Every analysis runs locally and every
claim is backed by an artifact digest.

## Posts

1. [001: Pylance VS Code extension](posts/001-pylance-extension.md) — what a
   static JavaScript application graph of a real, shipped extension looks like,
   from IPC observations down to per-edge source ranges.
2. [002: Claude Code VS Code extension](posts/002-claude-code-extension.md) —
   a thin shell around a bundled CLI: import boundaries, the webview's
   localStorage persistence surface, and a zero-IPC security summary.
3. [003: notepad.exe with Ghidra](posts/003-notepad-native-ghidra.md) — the
   first native run: PE segment map, 853 procedures, and what the analysis
   profile admits about its own Windows P0 limits.

## Method

REA runs from the terminal with no cloud dependency:

    npx -y rea-agents@latest analyze-javascript-application "<target path>" --json

Native targets (binaries, APKs, firmware) additionally use Hopper, Ghidra or
IDA where available. See `posts/` for per-target commands.

## Why evidence first

Every graph edge REA returns carries a SHA-256 digest of the artifact it came
from, the source range, the extractor version, a confidence level and a
limitation note. The point of these writeups is to show that reasoning, not
just results.