MMCPMarkets
DR

dobewal/reax

Developer tools

Эта страница переведена автоматически. Технические детали смотрите в оригинале. Открыть оригинал

0 stars Качество 65 Тренд 14MIT
Repository Install

REAX — Reverse Engineer Anything, improved. One-command APK analysis: risk verdict, risky permissions, tracker SDKs, suspicious APIs, hidden payloads, version diffs. pip install, zero setup.

Обзор

⚠️ REAX is for learning and authorized security research — your own apps, or apps you have written permission to test. Misuse (cracking, cloning, or exploiting other people's apps) is on you, not us. Read DISCLAIMER.md. Point REAX at an APK and get a : risk score, risky permissions explained in plain English, embedded tracker SDKs, suspicious API call sites, hard-coded URLs/IPs, hidden native payloads — plus a shareable HTML report. No Node, no Ghidra install, no 153-tool treasure hunt. REAX is inspired by REA by morluto (MIT) — a deep, serious toolkit with 150+ MCP tools. REAX makes a different trade: Use REA when you need a full reverse-engineering workbench. Use REAX when you want to know "is this APK shady?" before lunch. Plus a ready-made skill at skills/reverse-engineer-apk/SKILL.md — drop it into any agent that speaks the open Agent Skills format.

README

Показан фрагмент оригинального README. Открыть оригинал.

⚠️ Educational use only. REAX is for learning and authorized security research — your own apps, or apps you have written permission to test. Misuse (cracking, cloning, or exploiting other people’s apps) is on you, not us. Read DISCLAIMER.md.

Point REAX at an APK and get a verdict in seconds: risk score, risky permissions explained in plain English, embedded tracker SDKs, suspicious API call sites, hard-coded URLs/IPs, hidden native payloads — plus a shareable HTML report. No Node, no Ghidra install, no 153-tool treasure hunt.

🟡 MEDIUM — risk score 27/100
  • Suspicious API in use: ProcessBuilder (8 call sites)
  • 65.7 MB native payload bundled in assets/ — classic hidden-payload pattern

  ✓ reports/app.reax.json
  ✓ reports/app.md
  ✓ reports/app.html

Quickstart

pip install reax

# full analysis → JSON + Markdown + single-file HTML report
reax analyze app.apk -o reports/

# X-ray a native binary or .so library
reax analyze lib/arm64-v8a/libnative.so -o reports/

# what changed between two versions?
reax diff app-v1.apk app-v2.apk

# is everything working?
reax doctor

What you get
🎯 Risk verdict LOW / MEDIUM / HIGH / CRITICAL score with the exact findings behind it — plus an auditable 4-bucket score breakdown (how scoring works)
🔑 Permissions, decoded every risky permission with severity and a plain-English “why it matters”
🛰️ Tracker detection 50+ known tracker SDKs (AdMob, AppsFlyer, Facebook, …)
🧬 Suspicious APIs DexClassLoader, SmsManager, Runtime.exec, … with call-site counts
🌐 Network indicators URLs and IPs pulled from DEX strings
📦 Hidden payloads native .so files enumerated from the real package (with sizes), big blobs in assets/ flagged
🔍 Version diff new permissions, new trackers, new libs, risk delta between two APKs
🔬 Decompile view the actual Java code behind every flagged API call — proof, not hints
📜 JS / npm analysis dangerous APIs, exfiltration indicators, install-hook supply-chain checks, obfuscation signals — for .js files, package dirs, and tarballs
🌐 Website analysis scripts, trackers, phishing signals, TLS — one URL in, verdict out
⚙️ ELF X-ray suspicious imports, RWX segments, section entropy, packer signatures for native binaries
Открыть полный README на GitHub

Рекомендуемые инструменты

Попробуйте другой запрос или уберите фильтр.

Установка

npx skillfish add dobewal/reax
Новичок в MCP? Начните с руководства на mcpskill.org →