REA supported targets and backends
Targets and what each one needs
Compiled from the official README.
| Target | Output | Requirement |
|---|---|---|
| Native binaries | Pseudocode, assembly, strings, symbols, calls, references | Hopper, Ghidra or IDA |
| JavaScript / Electron apps (incl. ASAR) | Modules, imports, source maps, routes, IPC, native add-on relationships | None (static analysis) |
| .NET assemblies | Metadata, CIL instructions, native dependencies, build comparisons | None (static only) |
| Websites | Page structure, scripts, network observations, screenshots | Chrome-family browser |
| Android APKs | Decompiled app, resources | JADX and a JDK |
| Android devices | Device inspection | adb |
| Firmware | Extraction | Binwalk / Unblob (Linux) |
| Packet captures | Traffic analysis | TShark |
| Recorded Linux crashes / ELF | Crash and layout analysis | pwntools (Linux x64 for some tooling) |
| Logic-signal recordings | Signal decoding | sigrok (Linux) |
| JEB projects | JEB-backed analysis | A licensed JEB you start yourself |
The README also lists Go binaries, WASM, EVM bytecode, SQLite databases, Flutter apps, Android resources, saved network captures (HAR, Fiddler SAZ), packages and resources, and process behaviour capture. Each has its own guide in the project docs.
Ghidra vs IDA vs Hopper with REA
- Ghidra — REA uses your existing installation. Windows Ghidra support is described as experimental.
- IDA — REA uses your existing installation. IDA Pro is commercial; you must hold a valid license.
- Hopper — setup can optionally install it with your approval. On macOS a first-run dialog must be completed in your user session. Hopper is also commercial software.
REA grants no tool license or key. The README explicitly rules out cracked copies, stolen keys, unauthorized key sharing and bypassing license restrictions.
Operating system notes
- Linux x64 is needed for some crash, ELF and EVM tooling.
- Linux or macOS for native PTY process capture.
- Linux for Binwalk/Unblob and sigrok.
- Feature availability varies by host OS and provider, and features newer than the latest npm release may not be available yet.
Static vs runtime analysis
Static JavaScript and .NET inspection reads files and does not run the application. Runtime capture launches or interacts with the target using your user permissions. If you are looking at anything suspicious, know which mode you are in before you start — see legal and safety.
FAQ
Can REA analyze an Electron app without Ghidra?
Yes. Static JavaScript/Electron analysis needs no native engine.
Can REA analyze websites?
Yes — page structure, scripts, network observations and screenshots — using a Chrome-family browser.
Does REA work on Windows?
The core tool runs on Node.js, but several features are platform-specific and Windows Ghidra support is experimental. Check the README for the feature you need.
Unofficial, independent guide. Not affiliated with the REA project or its author (morluto). The official source is github.com/morluto/rea. Only analyze software you own or are authorized to examine.