REA

Tools 59 of 230

39 only read, 14 change things, 6 can delete or overwrite.

binary_session

Reports the current target, analysis provider, which tools are usable now and server identity, without starting analysis.

open_binary

Opens a local executable, app bundle, archive, JavaScript file, source map, plist or analysis database as the session target, choosing a disassembler provider.

close_binary deletes

Closes the active target and its provider processes, optionally saving an analysis snapshot first; unsaved session state is dropped.

binary_overview

Gives a native binary's metadata, segments and counts of procedures and strings.

analyze_function

Returns decompiled pseudocode, assembly, calls, references and strings for one native function.

search_procedures

Finds native procedures by name.

list_strings

Lists strings found in the open binary.

find_xrefs_to_name

Finds cross-references to a named symbol.

build_call_path

Works out call paths between functions in a native binary.

read_bytes

Reads raw bytes from mapped memory of the open binary.

annotate_native_function deletes

Renames a function and edits its comments in the analysis session, returning refreshed analysis.

set_addresses_names deletes

Names one or more addresses in the analysis session, reporting success per address.

inspect_binary_layout

Reports ELF sections, segments, symbols, relocations and mitigation candidates offline.

inspect_native_load_image

Measures how a native image maps into memory.

trace_dylib_resolution

Follows how a Mach-O binary's dynamic libraries resolve.

inspect_go_binary

Statically reads Go build and symbol data from an ELF, PE or Mach-O file without a Go install.

inspect_rust_binary

Statically reads Rust build traces from an ELF, PE or Mach-O file.

inspect_pe_imports

Lists a Windows PE file's imported and delay-loaded DLLs, ordinals and IAT addresses, with its import hash.

inspect_apple_ips

Reads an Apple .ips crash report: threads, loaded images, registers and crash class.

inspect_kernel_module

Reads a Linux kernel module's .modinfo keys, symbol version CRCs and signature trailer.

inspect_with_objdump

Runs a caller-installed GNU objdump on a file, for disassembly or DWARF, and keeps the output as evidence.

execute_rizin_command

Runs one Rizin command against a local file and records the output.

start_gdb_session changes

Starts a persistent GDB session on Linux.

gdb_console changes

Sends a command to a running GDB session, which can run and change the debugged program.

instrument_with_frida changes

Attaches Frida to a process and runs caller-written instrumentation.

load_frida_script changes

Loads a JavaScript instrumentation script into a Frida session.

observe_native_calls changes

Launches the open Mach-O under LLDB and records entries into chosen functions or Objective-C methods.

inspect_artifact

Inventories an archive or application package, with file digests and structure.

extract_artifact changes

Extracts selected files from an archive or package into a fresh temporary folder.

project_apple_application_graph

Inventories an IPA, .app, ZIP or DMG's bundles and roles without running anything.

inspect_wasm_artifact

Validates a WebAssembly file and decodes its sections and imports/exports with a caller-supplied WABT.

inspect_sqlite_database

Reads a local SQLite database or WAL snapshot.

analyze_javascript_application

Statically maps modules, imports, source maps, routes, IPC and native add-ons in a JavaScript or Electron app folder or ASAR.

trace_application_feature

Follows a literal value through every reachable part of a JavaScript application graph.

compare_application_versions

Compares two versions of an application and reports what changed.

list_electron_targets

Lists debuggable pages of a running Electron app.

capture_electron_scenario deletes

Runs a scripted scenario against an Electron app and records what happens.

inspect_web_page

Reads a live page's structure and scripts.

analyze_web_bundle

Captures a page's JavaScript and derives its chunk graph, routes, endpoints and vendor fingerprints.

observe_web_session

Records network and script activity on a page for a set time while the user operates it.

inspect_web_network_capture

Reads a saved HAR or SAZ network capture: requests, responses and payloads.

export_environment_bundle changes

Writes a replayable environment folder, built from recorded web API traffic, that an agent can practise tasks in.

discover_webmcp_tools

Lists WebMCP tools a page registers, without calling them.

inspect_managed_artifact

Reads .NET assembly metadata and CIL instructions.

inspect_android_package

Reads an APK's manifest and structure using JADX.

inspect_android_method

Returns a decompiled method from an APK.

search_android_classes

Searches the classes of an APK.

list_adb_devices

Lists Android devices and emulators visible to adb.

install_adb_package changes

Installs an APK on an attached Android device.

uninstall_adb_package deletes

Removes an app from an attached Android device.

push_adb_file changes

Copies a file onto an attached Android device.

start_adb_app changes

Starts an app on an attached Android device.

decompile_jeb_item

Gets pseudo-code for a type or method from a running JEB client.

extract_firmware changes

Extracts a firmware image with Binwalk or Unblob.

inspect_recorded_crash

Reads a recorded Linux crash: threads, registers and signals.

capture_process_scenario changes

Runs a chosen command in a terminal and records its output, interactions and file changes.

record_unknown changes

Records an open question in the session's evidence.

export_evidence_bundle deletes

Writes the session's evidence to a local file.

import_evidence_bundle changes

Loads a saved evidence bundle into the session as data.