REAX — Reverse Engineer Anything, improved. One-command APK analysis: risk verdict, risky permissions, tracker SDKs, suspicious APIs, hidden payloads, version diffs. pip install, zero setup.
概览
⚠️ REAX is for learning and authorized security research — your own apps, or apps you have written permission to test. Misuse (cracking, cloning, or exploiting other people's apps) is on you, not us. Read DISCLAIMER.md. Point REAX at an APK and get a : risk score, risky permissions explained in plain English, embedded tracker SDKs, suspicious API call sites, hard-coded URLs/IPs, hidden native payloads — plus a shareable HTML report. No Node, no Ghidra install, no 153-tool treasure hunt. REAX is inspired by REA by morluto (MIT) — a deep, serious toolkit with 150+ MCP tools. REAX makes a different trade: Use REA when you need a full reverse-engineering workbench. Use REAX when you want to know "is this APK shady?" before lunch. Plus a ready-made skill at skills/reverse-engineer-apk/SKILL.md — drop it into any agent that speaks the open Agent Skills format.
README
以下为原文 README 节选，完整内容请查看原文。
⚠️ Educational use only. REAX is for learning and authorized security research — your own apps, or apps you have written permission to test. Misuse (cracking, cloning, or exploiting other people’s apps) is on you, not us. Read DISCLAIMER.md.
Point REAX at an APK and get a verdict in seconds: risk score, risky permissions explained in plain English, embedded tracker SDKs, suspicious API call sites, hard-coded URLs/IPs, hidden native payloads — plus a shareable HTML report. No Node, no Ghidra install, no 153-tool treasure hunt.
🟡 MEDIUM — risk score 27/100
• Suspicious API in use: ProcessBuilder (8 call sites)
• 65.7 MB native payload bundled in assets/ — classic hidden-payload pattern
✓ reports/app.reax.json
✓ reports/app.md
✓ reports/app.html
Quickstart
pip install reax
# full analysis → JSON + Markdown + single-file HTML report
reax analyze app.apk -o reports/
# X-ray a native binary or .so library
reax analyze lib/arm64-v8a/libnative.so -o reports/
# what changed between two versions?
reax diff app-v1.apk app-v2.apk
# is everything working?
reax doctor
What you get
| 🎯 Risk verdict | LOW / MEDIUM / HIGH / CRITICAL score with the exact findings behind it — plus an auditable 4-bucket score breakdown (how scoring works) |
| 🔑 Permissions, decoded | every risky permission with severity and a plain-English “why it matters” |
| 🛰️ Tracker detection | 50+ known tracker SDKs (AdMob, AppsFlyer, Facebook, …) |
| 🧬 Suspicious APIs | DexClassLoader, SmsManager, Runtime.exec, … with call-site counts |
| 🌐 Network indicators | URLs and IPs pulled from DEX strings |
| 📦 Hidden payloads | native .so files enumerated from the real package (with sizes), big blobs in assets/ flagged |
| 🔍 Version diff | new permissions, new trackers, new libs, risk delta between two APKs |
| 🔬 Decompile view | the actual Java code behind every flagged API call — proof, not hints |
| 📜 JS / npm analysis | dangerous APIs, exfiltration indicators, install-hook supply-chain checks, obfuscation signals — for .js files, package dirs, and tarballs |
| 🌐 Website analysis | scripts, trackers, phishing signals, TLS — one URL in, verdict out |
| ⚙️ ELF X-ray | suspicious imports, RWX segments, section entropy, packer signatures for native binaries |
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add dobewal/reax