REA Evidence-Backed Agent-Orchestrated Reverse Engineering f...

src/network-services-pentesting/pentesting-web/electron-desktop-apps/README.md

@@ -113,6 +113,32 @@ Modify the start-main configuration and add the use of a proxy such as:
 "start-main": "electron ./dist/main/main.js --proxy-server=127.0.0.1:8080 --ignore-certificateerrors",
 ```
 
+## Static ASAR-to-native boundary tracing with REA
+
+**REA** can read an ASAR or extracted application directory without executing its JavaScript bootstrap. Its application graph records package entry points, bundled modules, `BrowserWindow` and preload settings, `contextBridge` members, IPC registrations, native add-on requests and source-map identities. This gives a starting point for tracing a renderer-exposed capability toward a privileged main-process handler.<sup>[[35]](#references)[[36]](#references)</sup>
+
+```bash
+rea analyze-javascript-application /absolute/path/to/app.asar --json > application-evidence.json
+```
+
+For a literal feature string, pass the complete Evidence record as `application` and replace the seed with one observed in the target:<sup>[[37]](#references)</sup>
+
+```bash
+node --input-type=module -e '
+import { readFileSync, writeFileSync } from "node:fs";
+const application = JSON.parse(readFileSync("application-evidence.json", "utf8"));
+writeFileSync("trace-input.json", JSON.stringify({
+  application, seed: { kind: "string", value: "search-result" }, direction: "both"
+}));'
+rea trace-application-feature ./trace-input.json --json
+```
+
+The same `trace_application_feature` workflow also accepts an observed literal API member, IPC channel or module as a seed. Check the resulting handler path, validation candidates and native handoff against the returned source locations. A renderer `invoke` pairs only with one unique `ipcMain.handle`/`handleOnce` candidate on the same exact literal channel; `send` similarly requires one unique `ipcMain.on`/`once`/`addListener` candidate. Dynamic or duplicate handlers stay unresolved. A requested `.node` member is not a verified native export; matching Hopper/Ghidra Evidence must have the same artifact digest before drawing that conclusion. Static reachability also does not prove that the path executed.<sup>[[36]](#references)[[37]](#references)</sup>
+
+For the renderer-to-main trust boundary and handler validation, see [Electron contextIsolation RCE via IPC](electron-contextisolation-rce-via-ipc.md).
+
+For provider-bound native follow-up, see [Reversing Tools & Basic Methods](../../../reversing/reversing-tools-basic-methods/#evidence-backed-native-investigation-with-rea).
+
 ## Electron auto-update attack surface
 
 Treat an updater as a remote-code-execution boundary: it retrieves executable content, decides whether that content is newer and trusted, stages it locally, and hands it to an installer. Review the complete trust graph—release index, per-version metadata, artifact, detached signatures, embedded verification key, cache, temporary path, and installer—not only whether the final `.app` is signed.<sup>[[33]](#references)[[34]](#references)</sup>
@@ -771,5 +797,8 @@ Detection and mitigations
 - [32] [Electron BrowserWindow webPreferences](https://www.electronjs.org/docs/latest/api/browser-window#new-browserwindowoptions)
 - [33] [Doyensec ElectronSafeUpdater reference implementation](https://github.com/doyensec/ElectronSafeUpdater)
 - [34] [Electron SafeUpdater: Designing a Secure Electron Auto-Update Mechanism](https://blog.doyensec.com/2026/02/16/electron-safe-updater.html)
+- [35] [REA: Reverse Engineer Anything](https://github.com/morluto/rea)
+- [36] [REA JavaScript artifact reconstruction](https://github.com/morluto/rea/blob/main/docs/javascript-artifact-reconstruction.md)
+- [37] [REA cross-layer JavaScript application workflows](https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md)
 
 {{#include ../../../banners/hacktricks-training.md}}

src/reversing/reversing-tools-basic-methods/README.md

@@ -63,6 +63,18 @@ With a comprehensive add-in model and an API that extends the tool to suit your
 [ILSpy plugin for Visual Studio Code](https://github.com/icsharpcode/ilspy-vscode): You can have it in any OS (you can install it directly from VSCode, no need to download the git. Click on **Extensions** and **search ILSpy**).\
 If you need to **decompile**, **modify** and **recompile** again you can use [**dnSpy**](https://github.com/dnSpy/dnSpy/releases) or an actively maintained fork of it, [**dnSpyEx**](https://github.com/dnSpyEx/dnSpy/releases). (**Right Click -> Modify Method** to change something inside a function).
 
+### Execution-free managed inspection with REA
+
+**REA** can inspect PE/CLI metadata and CIL without loading the assembly. Start with the artifact identity, then inspect members and declared native boundaries; this is useful when reviewing suspicious calls before using a decompiler or running the program.<sup>[[16]](#references)[[17]](#references)</sup>
+
+```bash
+rea inspect-managed-artifact /absolute/path/Assembly.dll --json
+rea inspect-managed-members /absolute/path/Assembly.dll --json
+rea inspect-managed-native-boundaries /absolute/path/Assembly.dll --json
+```
+
+For version diffing, `compare_managed_members` uses raw CIL/signature identity and decoded-instruction fingerprints rather than treating metadata tokens as stable across builds. A P/Invoke declaration is not proof that native code ran; `verify_managed_native_boundaries` needs matching native export or function Evidence to check that boundary. Keep the artifact digest, MVID and unresolved mappings with the result.<sup>[[17]](#references)</sup>
+
 ### DNSpy Logging
 
 In order to make **DNSpy log some information in a file**, you could use this snippet:
@@ -183,6 +195,24 @@ cheat-engine.md
 
 [**Decompiler Explorer**](https://dogbolt.org/) is a web front-end to a number of decompilers. This web service lets you compare the output of different decompilers on small executables.
 
+## Evidence-backed native investigation with REA
+
+**REA** exposes Hopper, Ghidra and IDA analysis through CLI and MCP. It requires Node.js 22.x (at least 22.19), 24.x (at least 24.11), or 26+, plus npm. Configure an existing native provider first; check `rea providers --json` and select a provider explicitly when more than one supports the target. Use an observed function name or address from the inventory in place of `0x1000` below.<sup>[[16]](#references)[[18]](#references)</sup>
+
+```bash
+npm install --global rea-agents
+rea providers --json
+rea inspect /absolute/path/to/program --provider ghidra --json
+rea search /absolute/path/to/program "search" --provider ghidra --json
+rea trace /absolute/path/to/program "search" --provider ghidra --json
+rea xrefs /absolute/path/to/program 0x1000 --provider ghidra --json
+rea function /absolute/path/to/program 0x1000 --provider ghidra --json
+```
+
+Start from a feature string or symbol, follow references and callers, then inspect the selected function dossier and pseudocode with `rea decompile`. REA binds a session to the selected provider rather than silently replacing it after a failure. For repeatable queries, `--snapshot PATH` reuses only matching artifact bytes, provider, settings, operation and parameters; a snapshot is a local cache, not a saved provider database. Preserve the returned Evidence and explicit unknowns instead of treating inferred paths or decompiler text as original source.<sup>[[16]](#references)[[18]](#references)</sup>
+
+For JavaScript/Electron entry points leading into native add-ons, see [Electron Desktop Apps](../../network-services-pentesting/pentesting-web/electron-desktop-apps/#static-asar-to-native-boundary-tracing-with-rea).
+
 ## ARM & MIPS
 
 
@@ -667,5 +697,8 @@ https://www.youtube.com/watch?v=VVbRe7wr3G4
 - [13] [GoResolver: Using Control-Flow Graph Similarity to Automatically Deobfuscate Golang Binaries](https://volexity.com/blog/2025/04/01/goresolver-using-control-flow-graph-similarity-to-deobfuscate-golang-binaries-automatically)
 - [14] [Volexity GoStringExtractor repository](https://github.com/volexity/GoStringExtractor)
 - [15] [Go Get 'Em: Updates to Volexity Golang Tooling](https://www.volexity.com/blog/2025/08/11/go-get-em-updates-to-volexity-golang-tooling/)
+- [16] [REA: Reverse Engineer Anything](https://github.com/morluto/rea)
+- [17] [REA managed-code analysis](https://github.com/morluto/rea/blob/main/docs/managed-code-analysis.md)
+- [18] [REA CLI and Evidence guide](https://github.com/morluto/rea/blob/main/docs/cli.md)
 
 {{#include ../../banners/hacktricks-training.md}}