mytechnotalent/rea 发布 2.0.0：离线逆向工程助手 REA

FREE Reverse Engineering Self-Study Course HERE

Point it at a binary. Get an answer.

Reverse Engineering Assistant (REA) explains native binaries and JavaScript or Electron trees in plain language. One command, no API key, fully offline by default. It pairs static analysis with retrieval augmented generation and a multi-agent harness, and it speaks both a command line and the Model Context Protocol.

2.0.0

The 2.0.0 release is the simple front door. Instead of learning a dozen flags, run one command:

rea scan ./suspect.exe

and get back a short, readable report: what the file is, whether it looks packed or encrypted, and the strings worth a first look.

- PE file, 215161 bytes
- no obvious packing
- strings worth a look: http://example.test, flag.txt, api_key

Everything underneath, the providers, the retrieval engine, the multi-agent harness and the Model Context Protocol server, stays available for power users.

What it does

• scan: one command triage of any native binary or JavaScript tree, fully offline.
• native_inventory, native_strings, native_symbols: static inventory of ELF, Mach-O, and PE binaries through the host readelf, objdump, nm, and strings tools, with explicit limitations when a tool is missing.
• javascript_inventory: static inventory of a JavaScript or Electron tree, reporting modules, import specifiers, package metadata, and Electron boundaries without executing code.
• rag_index, rag_query: retrieval augmented generation over local documents, using an idf weighted lexical index and, when GROQ_API_KEY is set, a hosted generator with an offline extractive fallback.
• harness_run: a multi-agent propose, review, gate, adjudicate loop that records every artifact.

Every provider returns evidence that names its kind, its source, its structured detail, and its limitations. The CLI and the MCP server dispatch through one shared tool catalog, so behavior cannot drift between adapters.

Install

python3 -m venv .venv
.venv/bin/python -m pip install pycodestyle pytest

Run

python -m gateway scan ./suspect.exe
python -m gateway scan ./suspect.exe --json
python -m gateway capabilities
python -m gateway native-inventory /bin/ls --json
python -m gateway javascript-inventory /path/to/app --json
python -m gateway rag-index files README.md
python -m gateway rag-query "What is reverse engineering?"
python -m gateway serve

python -m gateway serve starts the Model Context Protocol server over standard input and output, so any MCP capable client can drive the same tools.

Verify

python scripts/run_tests.py
python3 .opencode/skill/embedded-python-standard/audit_python_standard.py

Origin of the RAG Architecture

Retrieval-Augmented Generation (RAG) is a powerful technique in natural language processing (NLP) that combines retrieval-based methods with generative models to produce more accurate and contextually relevant outputs.

Overview of the RAG Architecture

The RAG model consists of three main components:

1. Indexer: This component creates an index of the corpus to facilitate efficient retrieval of relevant documents.
2. Retriever: This component retrieves relevant documents from the indexed corpus based on the input query.
3. Generator: This component generates responses conditioned on the retrieved documents.

Mathematical Formulation

Indexer

The indexer preprocesses the corpus $\mathcal{D}$ to create an index that maps queries to relevant documents. This index is used by the retriever for efficient document retrieval.

Retriever

The retriever selects the top $k$ documents from the indexed corpus $\mathcal{D}$ based on their relevance to a query $q$. The relevance of a document $d_i$ to a query $q$ is denoted as $s(q, d_i)$.

Generator

The generator produces a response $r$ based on the input query $q$ and the retrieved documents ${d_1, d_2, \ldots, d_k}$. The probability of generating a response $r$ given an input query $q$ and a document $d_i$ is denoted as $P(r \mid q, d_i)$.

Combining Indexer, Retriever, and Generator

The final probability of generating a response $r$ given a query $q$ is obtained by marginalizing over the top $k$ retrieved documents: $$ P(r \mid q) = \sum_{i=1}^{k} P(d_i \mid q) P(r \mid q, d_i) $$ Here, $P(d_i \mid q)$ is the normalized relevance score of document $d_i$ given the query $q$, and $P(r \mid q, d_i)$ is the probability of generating response $r$ given the query $q$ and the document $d_i$.

Implementation Details

Training

The RAG model is trained in three stages:

1. Indexer Training: The indexer is trained to create an efficient and accurate mapping of queries to documents.
2. Retriever Training: The retriever is trained to maximize the relevance score $s(q, d_i)$ for relevant documents.
3. Generator Training: The generator is trained to maximize the probability of the ground-truth responses given the retrieved documents.

Inference

During inference, the RAG model follows these steps:

1. Indexing: The corpus is indexed to facilitate efficient retrieval.
2. Retrieval: The top $k$ documents are retrieved for a given query based on their relevance scores.
3. Generation: A response is generated conditioned on the retrieved documents. The final response is obtained by marginalizing over the top $k$ retrieved documents as described above.

Conclusion

RAG leverages the strengths of indexing, retrieval-based, and generation-based models to produce accurate and informative responses. By conditioning the generation on retrieved documents, the model can incorporate external knowledge from large corpora, leading to better responses on a wide range of tasks.

The combination of indexer, retriever, and generator makes RAG a powerful approach for tasks that require access to external knowledge and the ability to generate coherent and contextually appropriate responses.