rea-rust is a Rust port of REA that inspects binaries, decompiles functions via a JVM-free Ghidra worker, and exposes the same tools through a CLI and MCP server for authorized analysts.
| Tool | nanashili/rea-rust — Rust port of REA, a local-only reverse-engineering toolkit with CLI/MCP workflows and a native Ghidra decompiler worker |
| Category | binary analysis / reverse engineering tooling |
| Primary Use | Local binary inspection, decompilation via ghidra-rust, Go/Electron/managed-artifact analysis, and driving the same capabilities from an MCP client in a lab environment |
| Safe Use | Intended for authorized reverse engineering: analyzing software you own or are licensed to assess, CTF and lab work, and defensive malware/vulnerability research on private infrastructure |
| Telemetry Note | Purely local: the runtime has no network service dependency, leaves no external callbacks, and its activity is observable only as ordinary local process and filesystem access (rea, rea-ghidra-rust-worker) on the analyst's machine |
rea-rust is a ground-up Rust port of the original REA project by morluto, aimed at analysts who want to do serious binary analysis from the terminal — or from an AI-assisted MCP client — without dragging a Node.js runtime along for the ride. The README is unusually forthright about scope: the tool inspects binaries, decompiles functions, analyzes JavaScript and Electron applications, reads managed and mobile artifacts, and works with process and browser captures. Crucially, the CLI and the MCP server share the same underlying tool implementations, so there is no behavioral divergence between what you script and what your agent-driven workflow invokes. At 64 stars, MIT-licensed, and written in Rust, it is a young project but one engineered with visible discipline.
Installation is deliberately frictionless. Prebuilt releases ship rea itself, the MCP server, and the Ghidra worker for macOS, Linux, and Windows on both ARM64 and x86-64, with no Node.js, no Rust toolchain, and no administrator account required. The shell route is the standard pattern: fetch install.sh from the latest GitHub release, run it, and add $HOME/.local/bin to your PATH. Windows users get an equivalent PowerShell installer via irm and install-rea.ps1. The installers verify release checksums, store versioned files in a per-user directory, and — a detail experienced operators will appreciate — deliberately refuse to edit shell profiles, PATH, or MCP settings. Rerunning updates; REA_VERSION pins a specific release.
Building from source is a legitimate first-class path, not an afterthought. You need a pinned Rust toolchain (1.93.1), Python 3.11+ for release scripts, and a C/C++20 compiler (GCC 12+ on Linux), after which cargo build --locked --release -p rea produces the binary. The --locked flag matters here: the project is reproducible-first, and the repository embeds all helper sources rather than fetching them ad hoc. That self-containment is a meaningful supply-chain property for a tool that will be parsing untrusted binaries — the classic reverse-engineering bootstrap problem of trusting your analyzer is at least partially mitigated.
The Ghidra integration deserves its own paragraph because it is the architectural centerpiece. Instead of the usual JVM-headed Ghidra harness, rea-rust ships a separate ghidra-rust-worker — built with cargo build --manifest-path ghidra-rust-worker/Cargo.toml --locked --release — that wraps the native Ghidra decompiler with no JVM in the process tree. Place it beside the rea binary or point REA_GHIDRA_RUST_WORKER at its absolute path. For an analysis tool this is a substantial operational win: startup cost, memory footprint, and process-tree complexity all shrink, and automation becomes far more predictable. Frida support exists as an optional build feature, documented separately in docs/development.md.
The CLI surface shown in the README is compact and compositional: rea inspect /path/to/program, rea decompile /path/to/program main --provider ghidra-rust, rea inspect-go-binary /path/to/go-program --format json, and rea doctor for environment sanity checks. The --format json flag hints at the intended automation posture — structured output for pipelines and tooling rather than pretty-printed terminal text. The decompile command's --provider flag formalizes the pluggable analysis-provider model, with ghidra-rust as the shipped native option and the README noting that other providers and external tools require their own installations.
The MCP story is where rea-rust aligns with where analyst workflows are visibly heading. rea mcp starts a stdio server, registered in a client's mcpServers configuration with the executable's absolute path — the README explicitly warns that MCP clients may have a different PATH from your shell, a small detail that saves real debugging time. rea setup previews client registrations and skill installation, then asks before applying changes; that consent-before-mutation behavior is consistent with the installer philosophy and suggests the author has thought about agents modifying user configuration. Because the CLI and MCP layers share implementations, an authorized analyst can prototype a workflow interactively and then hand the identical capability to an MCP-driven assistant.
What separates this README from most hobby-port projects is the benchmarking rigor. A local application benchmark covers 11 installed macOS applications plus Go, running 125 samples across 25 workflows with elapsed time, CPU, memory, per-call results, and documented failures — followed by a separate failure-verification rerun recording fixes and repeated measurements. The headline TypeScript-versus-native comparison, measured on an Apple M1 Pro with warm caches and frozen builds, is striking: start-and-inspect of Go build metadata drops from 570 ms to 64 ms, and first-function decompilation of a small C program drops from 9.43 s to 0.39 s with peak process-family memory falling from 1,022 MiB to 214 MiB.
The project is also honest about where the native port loses. In the decompilation comparison, the Rust Ghidra worker failed on the larger Go test because of an import-name collision, while Java Ghidra returned all three requested functions. Interestingly, the warm repeated-request row shows the TypeScript build slightly faster (7.3 ms versus 16.2 ms), which suggests the Rust advantage concentrates in startup and memory rather than steady-state IPC. Raw measurements, inputs, output differences, and reproduction steps are published under experiments/analysis-efficiency/, and a migration verification report documents known behavior differences and test coverage. This level of self-reporting is rare and materially raises trust in the claimed numbers.
Release engineering is handled through GitHub Actions, which builds and smoke-tests macOS and Linux archives on both architectures plus Windows ARM64 and x64 before publishing a tagged release. The caveats are clearly stated: Musl Linux and Frida-enabled binaries are not provided prebuilt, and external analysis tools must be installed by the user. The development workflow enforces cargo fmt --all -- --check, cargo clippy --workspace --locked, and targeted tests across rea-core, rea-rust-analysis, and rea-mcp — the crate names themselves reveal the layering: a core library, an analysis layer, and the MCP transport, with MIGRATION_GUIDE.md and architecture notes governing behavior changes and crate ownership.
For the working analyst, the positioning question is where this fits against incumbents. It is not an IDA replacement or a disassembler IDE; it is a fast, scriptable, agent-friendly inspection and decompilation layer that happens to expose Ghidra's decompiler without the JVM tax. The Go-binary inspection, Electron/JavaScript analysis, managed and mobile artifact reading, and process/browser capture handling make it a broad triage surface rather than a deep single-format specialist. In an authorized engagement or lab context, that triage role — quick structured answers about what a sample is and what its main looks like — is exactly where a 64 ms cold start beats a heavyweight GUI.
Caveats worth holding onto: the project is young with a modest community, the larger-Go-binary decompilation gap versus Java Ghidra is real, and Musl users must build from source. But the checksum-verified installer, the no-surprises configuration policy, the embedded helper sources, the published benchmarks with reproduction steps, and the honest failure documentation collectively signal engineering maturity beyond the star count. For authorized professionals who want local-only reverse engineering that speaks both sh and MCP, rea-rust earns a close look.
nanashili/rea-rust.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.