Check an Android release
Open an APK or AAB, review release risks, then check native-library alignment and signing fingerprints.
Static checks surface file-level risks; they cannot guarantee Google Play approval.
Local file analysis · build troubleshooting · reverse engineering
Understand your files. Diagnose your builds.
Free browser tools and reproducible guides for the next step.
Identify an unknown file, inspect an Android release or trace a JavaScript error. The tools parse files locally without uploading them. For deeper analysis, follow our REA tutorial series for the open-source MCP server and CLI by morluto.
Start with a task
Identify a file or architecture
Read magic bytes first. For an executable, inspect its format, architecture and headers without running it.
Identification is a starting point; check the reported evidence before choosing a parser.
Debug a JavaScript build
Match a production stack trace to its source map, or make a bundled script readable for inspection.
Missing maps, source content or original names can limit what you recover.
Practical guides & REA tutorials
Getting started getting-started
Identify a File Type Without an Extension: Magic Bytes List and Tools
Identify a file with no extension from its first bytes with file, xxd or Format-Hex, split ZIP formats like APK and NuGet, and open each in the right tool.
Is REA Safe? The Real Reverse Engineer Anything GitHub Repo vs Fakes
Confirm you install the genuine REA: the official GitHub repo and npm package, npm view checks, provenance via npm audit signatures, and where to report fakes.
REA MCP Setup: Install rea-agents for Claude Code, Cursor and Codex
Install REA with npx rea-agents setup: Node requirements, the pinned MCP registration, --client and --dry-run, updating, rea doctor, and a first analysis.
Native binaries native
Check Binary Hardening Flags: NX, PIE, RELRO, ASLR and CFG
Check whether your own ELF, PE and Mach-O builds have NX, PIE, full RELRO, stack canaries, ASLR, CFG and hardened runtime, with real tool output and flags.
Check if an EXE or DLL Is 32-bit, 64-bit or ARM64 (Incl. .NET)
Tell whether a Windows EXE or DLL is x86, x64 or ARM64 without running it, and why a .NET AnyCPU assembly looks 32-bit until you read its CLI flags.
ELF, PE and Mach-O Viewer Online: Is Your Binary Stripped?
Identify an ELF, PE or Mach-O file in the browser: architecture, sections with entropy, imports, exports and strings, and whether the binary is stripped.
Find the Go Version and Dependencies of a Binary (go version -m)
go version -m reads the Go version, modules, replace directives and VCS revision from any Go executable, even stripped or cross-compiled. Real gh and cloudflared output.
Fix "dyld: Library not loaded: @rpath" on macOS
Reproduce the dyld "Library not loaded: @rpath" crash, read the tried paths, find the rpath with otool and fix it with install_name_tool or by shipping the dylib.
Frida Hook a Native Function on Android: Spawn vs Attach
Hook a C function with Frida's Interceptor on an Android emulator: frida-server setup, the -rdynamic export trap, spawn vs attach, frida-trace, and why macOS timed out.
Ghidra MCP: Headless Decompiling from an AI Agent with REA
Drive Ghidra's headless analyzer from an AI agent or the CLI with REA: setup and doctor checks, decompile, xrefs and trace commands, plus a sample with its ground truth.
How to Reverse Engineer a Mac App: Rectangle Step by Step
Reverse engineer a macOS app without running it: bundle layout, Info.plist, Mach-O slices, signing, dylib loads, NIB menus and Swift classes, tested on Rectangle.
How to Reverse Engineer a Windows EXE or DLL: A Worked Example
Reverse engineer an EXE or DLL step by step: tell native from .NET, list exports and imports, decode version and string resources, and read the machine code.
Is This Mac App Universal? Check Apple Silicon and Intel Slices
Check if a Mac app or dylib is a universal binary, list its arm64 and x86_64 slices, and compare minimum macOS, signature and dependencies per slice, on any OS.
What Crates Are in a Rust Binary? Reading cargo-auditable Data
A Rust binary lists its crates only if built with cargo auditable. Extract and inflate the .dep-v0 section, see why a plain cargo build has nothing, with real output.
What's Inside a .mobileprovision, and How to Check It
Decode an iOS provisioning profile with security cms, openssl and plutil: entitlements, team, UDIDs, expiry and certificates, checked against the signed app.
JavaScript & Electron javascript
Electron Fuses Explained: How to Read RunAsNode, OnlyLoadAppFromAsar and the Rest
What each of the nine Electron fuses controls (RunAsNode, OnlyLoadAppFromAsar, ASAR integrity and more), which value is hardened, and how to read them from a packaged app without launching it.
How to Decode a Minified JavaScript Stack Trace with a Source Map
Decode a minified stack trace like app.js:1:68 back to the original file, line and name: keep hidden source maps, look up each frame locally, and fix map mismatches.
How to Deobfuscate javascript-obfuscator (obfuscator.io) Code: 14 Option Sets Tested
What an obfuscator.io deobfuscator can undo: string arrays, base64 and RC4, wrappers and control-flow flattening came back; renameProperties and local names did not. Tested at 14 option sets.
How to Reverse Engineer a Webpack Bundle and Recover the Source
Recover readable source from a minified webpack bundle: extract sourcesContent from a .map, split the module table with Wakaru, and map chunks and requests with REA. Real output.
How to Reverse Engineer an Electron App: ASAR, Preload and IPC
Reverse engineer a real Electron app (Joplin 3.7.22): copy and extract app.asar, read webPreferences and preloads, map IPC channels, find native add-ons and check the fuses. Real output.
How to Unpack an ASAR File: Extract app.asar on Windows, macOS and Linux
Find app.asar on Windows, macOS or Linux, unpack it in your browser or with npx @electron/asar, and read package.json, main, preload and IPC channels first.
Source Map Leaks in npm Packages: How to Check and Disable Source Maps in Production
Find a source map leak before you publish: list .map files with npm pack --dry-run, see what sourcesContent exposes, disable or hide source maps in production, and gate it in CI.
Android android
AAB to APK with bundletool, and How to Extract APK Assets
Convert an AAB to a universal APK with bundletool build-apks --mode=universal, extract device splits, then unzip the APK's assets. Real bundletool 1.18.3 output.
adb logcat Crash Logs and bugreport Tombstones: Debug Android Crashes
Read an Android crash with adb logcat -b crash -d, find the native tombstone in adb bugreport, and map frames to source with ndk-stack. Real emulator output.
Android APK Analysis with REA: Code, Resources, Device Pulls and Flutter
What REA's Android tools cover and where each one stops: JADX code search, Apktool string tables and locales, ADB split-APK pulls, and Flutter snapshot hashes.
Android Developer Verification: Get the SHA-256 Cert Fingerprint From Your APK
Android developer verification asks for your package name and signing certificate SHA-256. Read both from an APK, AAB or keystore, pick the right key, and see what applies from 2026-09-30.
App Isn't Compatible With Your Phone: targetSdk, ABI, minSdk
Fix 'App not installed as app isn't compatible with your phone' in your APK: get the real INSTALL_FAILED code, then check targetSdk, native ABIs and minSdk.
App Not Installed as Package Appears to Be Invalid: Fix Your APK
Fix 'App not installed as package appears to be invalid' in your own APK: get the real INSTALL_PARSE_FAILED code, then fix signing, resources.arsc or splits.
App Not Installed: Package Conflicts With an Existing Package
Fix 'App not installed as package conflicts with an existing package' in your app: compare signing certificate SHA-256, find the installed copy, keep your key.
Check an APK for 16 KB Page Size Compatibility (Flutter, React Native, NDK)
Check whether your APK or AAB is 16 KB page size compatible, including Flutter and React Native builds: ELF segment alignment, ZIP alignment of .so files, and 64-bit libraries, in the browser or with zipalign.
Deobfuscate Android Stack Traces with R8 mapping.txt and Retrace
Turn a crash like at a.c.b(r8-map-id-…:3) back into class, method and line: where R8 writes mapping.txt, how to read its ranges and inline groups, and retrace.
Flutter APK Reverse Engineering: Find the Flutter and Dart Version, Read libapp.so
Find which Flutter and Dart version built an APK and what is inside libapp.so: snapshot hash, bare Dart version string, engine build IDs and package URIs, checked with llvm-readelf.
Google Play App Rejection Reasons You Can Catch Before Upload
The Google Play rejection reasons hiding in your APK or AAB: target API, 64-bit and 16 KB libraries, debug signing, restricted permissions, foreground services.
How to Get the SHA-1 Fingerprint on Android: keytool -list, signingReport, apksigner
Get the SHA-1 (and SHA-256) fingerprint Firebase, Google Sign-In and assetlinks.json need: keytool -list -v on a JKS or PKCS#12, signingReport, or apksigner on an APK, plus the traps.
JADX MCP Server for Claude Code and Codex: Headless Setup and a Worked APK Example
Run JADX headless as an MCP server for Claude Code or Codex: JDK 17+, the jadx-headless-mcp 0.7.1 JAR, the env block, prompts, and a real Aegis APK walkthrough.
Play Protect Blocked Your App? How to Fix It and Appeal
Why Play Protect blocks a sideloaded app (SMS and accessibility permissions, old targetSdk, debug keys, bad ZIPs), how to fix each one, and what the Play Protect appeal form asks for.
CTF ctf
Android CTF for Beginners: Reverse a Practice APK, Find the Flag
Beginner Android CTF walkthrough on a practice APK you build: triage it in the browser, find the check in the DEX class browser, read it in JADX, get the flag.
CTF Reverse Engineering for Beginners: Solve Your First Rev Challenge
Your first CTF reversing challenge step by step: identify the file, try strings, read imports and sections, then solve the check on practice binaries you build.
Websites web
Decode an X.509 Certificate and Check Chain Order with openssl verify
Read a PEM or DER certificate's subject, issuer, SANs, validity, key usage and fingerprints, then check the chain order and trust with openssl verify.
Decode Protobuf Without the .proto: Reading protoc --decode_raw
Read a protobuf or gRPC body with no schema: wire types, varint vs zigzag, string vs message vs packed, the gRPC 5-byte prefix, checked against protoc --decode_raw.
HAR File Analyzer: How to Read and Sanitize a HAR File Before Sharing
Sanitize a HAR file before you send it to support: what Chrome's sanitized export removes and misses, where tokens hide, and how to summarize a HAR by endpoint without uploading it.
WASM to WAT: Convert and Inspect a .wasm File Online or with wabt
Convert WASM to WAT and read a WebAssembly module's imports, exports, memory, functions and custom sections in your browser, then confirm the result with wabt.
WebMCP Example in Chrome: Register Page Tools and List Them
A working WebMCP example for Chrome: enable the flag, register a tool with registerTool and an annotated form, list them with document.modelContext.getTools(), and diff tools between releases.
.NET dotnet
How to Check if an EXE Is .NET: Framework, Single-File, ReadyToRun or NativeAOT
Tell a .NET Framework EXE, an apphost, a single-file bundle, a ReadyToRun DLL and a NativeAOT binary apart from their bytes, with output from real builds.
How to Check Which .NET Version a DLL Targets (and Its Version and References)
Find out which .NET version a DLL targets, its assembly and file version, and the assemblies it references, without Visual Studio or the SDK. Real output from all eight Newtonsoft.Json 13.0.3 builds.
Workflow workflow
Inspect Godot PCK Assets and Verify Extracted Bytes with REA
Inspect and extract a Godot PCK with REA. Compare source paths, MD5 claims and observed SHA-256 hashes, then test a mismatch and an unknown checksum.
Patch Diffing: Compare Two Binaries Function by Function (zlib CVE-2018-25032)
Patch diffing walkthrough: build zlib 1.2.11 and 1.2.12, compare deflateInit2_ and compress_block in Ghidra through REA, and read the real diff that shows the CVE fix.
Unsupported Class File Major Version 61 or 65: Fix It in Java, Gradle, D8
Reproduce UnsupportedClassVersionError and Unsupported class file major version 61/65/69, map it to a Java release, find the class, fix it with --release.
Why the file Command Gets the Type Wrong: "Zip archive data" for JAR, APK and DOCX
Why file says "Zip archive data" for an APK, IPA, JAR or DOCX, "data" for a signed profile and "JAR" for half a JAR: 25 samples and the magic rules behind each miss.
Firmware firmware
Binwalk 3: Install the Rust Version and Fix "Not Extracting"
Install Binwalk 3.1.0 on Linux, macOS or Kali, avoid the v2 package trap, extract firmware with -e and -M, fix empty extractions, and pick Binwalk or Unblob.
Extract SquashFS from Firmware .bin: unsquashfs, Unblob, Binwalk
Find the SquashFS root filesystem inside a router firmware .bin, carve it with dd, unpack it with unsquashfs, or let Binwalk 3 or Unblob do it, on OpenWrt.
Blockchain blockchain
Etherscan Bytecode Does Not Match? Fix a Failed Hardhat or Forge Verify
Etherscan bytecode does not match, or hardhat verify failed? Read the solc version from the deployed code, then use a nine-build comparison to tell a source mismatch from a wrong compiler setting.
How to Check if a Contract Is a Proxy, Even When It's Unverified
How to check if a contract is a proxy when Etherscan shows no verified source: spot EIP-1967 proxies and EIP-1167 clones in the bytecode, find the implementation, and read a token's admin functions.
Comparisons comparison
GhidraMCP vs IDA Pro MCP vs r2mcp: Reverse Engineering MCP Servers Compared
GhidraMCP, ida-pro-mcp, r2mcp, Binary Ninja MCP and REA compared on engine, cost, install and write access, with GhidraMCP and REA run on the same binary. Partly hands-on, partly sourced; dated 2026-11.
ILSpy vs dnSpy vs dotPeek: Which .NET Decompiler, and What to Use on a Mac
ILSpy 11.2, dnSpyEx 6.6.0 and dotPeek 2026.2.4 compared on platforms, licences and debugging, with real decompiler output for one DLL and a clear note on what was run on macOS.
JADX vs JEB vs Apktool: Which Android Decompiler for Which Job
JADX 1.5.6, Apktool 3.0.3 and JEB 5.48 compared as of October 2026: what each outputs, a timed run on the F-Droid APK, pricing, licences and REA integration.
Online toolsRuns in your browser, no upload
Android
APK & AAB analyzer
Reads the manifest, native libraries and signing certificates of an APK or AAB and checks 16 KB alignment, targetSdk and the other Google Play rules that most often block a release.
Blockchain
EVM function selector extractor
Paste deployed contract bytecode to list its 4-byte function selectors with inferred argument types and state mutability, using EVMole compiled to WebAssembly. No ABI or verified source needed.
Blockchain
EVM bytecode disassembler
Paste EVM bytecode to get an address-annotated opcode listing, with the Solidity CBOR metadata trailer (solc version, IPFS/bzzr hash) decoded separately and the dispatcher function selectors listed. Runs entirely in your browser.
WebAssembly
WebAssembly module analyzer and WASM to WAT
Open a .wasm file to see its imports, exports, functions, memory and custom sections, and convert it to readable WAT text with wabt.
.NET
.NET assembly metadata and IL viewer
Inspect a .NET DLL or EXE without running it: PE/CLI headers, type and member tables, referenced assemblies and the IL of each method.
HAR / SAZ
HAR and Fiddler SAZ API summarizer
Load a HAR or Fiddler SAZ capture to group requests by host and endpoint, with the methods, status codes and query and body parameters seen for each API.
Electron
ASAR unpacker and Electron IPC analyzer
Unpack an Electron app.asar in the browser, browse its files, and list the IPC channels and preload bridges exposed between the main and renderer processes.
Source maps
JS bundle and source map restorer
Rebuild the original source tree from a source map's sourcesContent and download it as a .zip, and map minified bundle positions or a stack trace back to original files, lines and names.
ELF / PE / Mach-O
Native binary overview (ELF, PE, Mach-O)
Identify an ELF, PE or Mach-O file without running it: architecture, headers, sections with entropy, imports and exports, hardening flags such as NX, PIE, RELRO and ASLR, and printable strings.
Java / JAR
Java class and JAR version checker
See which Java version a .class, JAR, WAR, EAR or AAR needs: the class file version of every class including nested jars, multi-release layers, module-info and the build JDK, plus an explainer for UnsupportedClassVersionError messages.
Protobuf / gRPC
Protobuf decoder (no .proto needed)
Decode a binary protobuf, gRPC or gRPC-Web body pasted as hex or base64, or opened as a file, into field numbers and values, with output identical to protoc --decode_raw and a tree of alternative readings.
Keystore / SHA-1
Signing certificate fingerprints (keystore, APK)
Get the SHA-1, SHA-256 and MD5 of the certificates in a .jks, .keystore, .p12 or .pfx file, an APK or AAB, or a certificate file, in the colon, plain and Base64 forms Firebase, Google Sign-In and Facebook ask for, without installing keytool.
X.509
X.509 certificate decoder
Paste a PEM certificate or chain, or drop a DER, CRT or CER file, to read every field and extension (SAN, key usage, EKU, basic constraints, AKI/SKI, AIA, CRL, SCTs), check the chain order and see whether each certificate is valid today.
Magic bytes / hex
File type identifier and hex viewer
Find out what an unknown file is from its magic bytes, with the evidence offset and a confidence level, then scan it for embedded signatures, plot its entropy, extract strings and inspect any byte in a hex view. Works on multi-gigabyte files.
R8 / ProGuard
R8 / ProGuard stack trace retrace
Paste an obfuscated Android or Java stack trace and choose the build's mapping.txt to get the original classes, methods and line numbers back, inlined frames included. Same output as Google's retrace.
Deobfuscate
JavaScript deobfuscator and unminifier
Turn minified or obfuscator.io-style JavaScript back into readable code: string arrays decoded, control-flow and dead-code tricks undone, _0x names renamed, and webpack or browserify bundles split into modules.
iOS / IPA
iOS provisioning profile and IPA viewer
Read a .mobileprovision or an .ipa in the browser: profile type, expiry, team, devices and certificates, Info.plist and privacy manifest, and the entitlements the executable is signed with, checked against the profile.