<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"><channel><title>rea-reverse：文件分析与开发实操指南（中文）</title><description>免费的逆向工程与调试工具，支持 APK、签名密钥库、混淆堆栈、source map、HAR、证书和二进制文件。全部在浏览器本地运行，文件不会上传。</description><link>https://rea-reverse.com/zh/</link><language>zh-CN</language><item><title>用 REA 检查 Godot PCK 资源，并核对解出的字节</title><link>https://rea-reverse.com/zh/inspect-godot-pck-assets/</link><guid isPermaLink="true">https://rea-reverse.com/zh/inspect-godot-pck-assets/</guid><description>用 REA 盘点并提取 Godot PCK，区分资源原路径、MD5 声明与实际 SHA-256；用正常、校验不一致和全零 MD5 三个样本说明结果边界。</description><pubDate>Sun, 01 Nov 2026 00:00:00 GMT</pubDate><category>工作流</category><category>godot</category><category>pck</category><category>assets</category><category>integrity</category></item><item><title>修复 macOS 报错 dyld: Library not loaded: @rpath</title><link>https://rea-reverse.com/zh/trace-macos-dylib-resolution-rea/</link><guid isPermaLink="true">https://rea-reverse.com/zh/trace-macos-dylib-resolution-rea/</guid><description>复现 dyld 的 Library not loaded @rpath 崩溃，读懂 tried 路径，用 otool 查 rpath，再用 install_name_tool 或随包附带 dylib 修好。</description><pubDate>Wed, 28 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>macos</category><category>macho</category><category>dylib</category><category>rpath</category><category>dependencies</category><category>mcp</category></item><item><title>.mobileprovision 里装了什么？描述文件的解码与核对</title><link>https://rea-reverse.com/zh/inspect-ios-provisioning-profile/</link><guid isPermaLink="true">https://rea-reverse.com/zh/inspect-ios-provisioning-profile/</guid><description>用 security cms、openssl、plutil 解开 iOS 描述文件，读出 entitlements、团队、UDID、过期时间和证书，再和 App 的实际签名对比。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>ios</category><category>mobileprovision</category><category>provisioning-profile</category><category>codesign</category><category>entitlements</category><category>security-cms</category><category>openssl</category><category>plutil</category></item><item><title>在 Android 模拟器上用 Frida hook 原生函数：spawn 与 attach</title><link>https://rea-reverse.com/zh/frida-instrumentation-rea/</link><guid isPermaLink="true">https://rea-reverse.com/zh/frida-instrumentation-rea/</guid><description>用 Frida Interceptor 在 Android 模拟器里 hook 一个 C 函数：frida-server 部署、-rdynamic 导出坑、spawn 与 attach 区别、frida-trace，以及 macOS 上为何超时。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>frida</category><category>instrumentation</category><category>dynamic-analysis</category><category>android</category><category>emulator</category><category>mcp</category><category>interceptor</category></item><item><title>查看 Go 二进制的 Go 版本和依赖模块（go version -m）</title><link>https://rea-reverse.com/zh/analyze-go-binary-rea/</link><guid isPermaLink="true">https://rea-reverse.com/zh/analyze-go-binary-rea/</guid><description>go version -m 能从任意 Go 可执行文件读出 Go 版本、依赖模块、replace 替换和 VCS 提交，去符号、交叉编译后也一样。附 gh、cloudflared 实测。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>go</category><category>golang</category><category>buildinfo</category><category>sbom</category><category>govulncheck</category><category>elf</category><category>pe</category><category>mach-o</category><category>mcp</category></item><item><title>javascript-obfuscator（obfuscator.io）混淆代码怎么反混淆：14 组参数实测</title><link>https://rea-reverse.com/zh/deobfuscate-javascript-obfuscator-io/</link><guid isPermaLink="true">https://rea-reverse.com/zh/deobfuscate-javascript-obfuscator-io/</guid><description>obfuscator.io 反混淆能还原什么：字符串数组、base64 与 RC4、包装函数和控制流平坦化都能解开，renameProperties 和局部变量名还原不了。14 组参数实测。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>javascript</category><category>obfuscation</category><category>deobfuscation</category><category>webcrack</category><category>obfuscator-io</category><category>string-array</category></item><item><title>Android SHA-1 指纹怎么获取：keytool -list、signingReport、apksigner 实测</title><link>https://rea-reverse.com/zh/get-sha1-fingerprint-android-keystore/</link><guid isPermaLink="true">https://rea-reverse.com/zh/get-sha1-fingerprint-android-keystore/</guid><description>Firebase、Google 登录、assetlinks.json 要的 SHA-1 / SHA-256 签名指纹怎么取：keytool -list -v 查 JKS 和 PKCS#12、signingReport、apksigner 查 APK，附实测输出和常见坑。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>signing</category><category>keytool</category><category>apksigner</category><category>gradle</category><category>firebase</category><category>app-links</category><category>sha-1</category><category>sha-256</category></item><item><title>Flutter APK 逆向：查出 APK 的 Flutter / Dart 版本，读懂 libapp.so</title><link>https://rea-reverse.com/zh/flutter-app-reverse-engineering-rea/</link><guid isPermaLink="true">https://rea-reverse.com/zh/flutter-app-reverse-engineering-rea/</guid><description>查出一个 APK 是哪个 Flutter / Dart 版本编译的，以及 libapp.so 里有什么：快照哈希、裸 Dart 版本字符串、引擎 Build ID 和依赖包 URI，并用 llvm-readelf 核对。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>flutter</category><category>dart</category><category>libapp</category><category>apk</category><category>aot</category><category>llvm-readelf</category></item><item><title>用 R8 mapping.txt 和 retrace 还原混淆后的 Android 崩溃堆栈</title><link>https://rea-reverse.com/zh/deobfuscate-android-stack-trace-mapping/</link><guid isPermaLink="true">https://rea-reverse.com/zh/deobfuscate-android-stack-trace-mapping/</guid><description>崩溃堆栈只剩 a.c.b(r8-map-id-…:3)？讲清 mapping.txt 在哪、行号区间和内联组怎么读、retrace 怎么用，并和浏览器工具逐行对比。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>r8</category><category>proguard</category><category>retrace</category><category>stack-trace</category><category>debugging</category></item><item><title>X.509 证书解析与 openssl verify 证书链顺序检查</title><link>https://rea-reverse.com/zh/decode-x509-certificate-pem-chain/</link><guid isPermaLink="true">https://rea-reverse.com/zh/decode-x509-certificate-pem-chain/</guid><description>读懂 PEM/DER 证书的主体、颁发者、SAN、有效期、密钥用途和指纹，再用 openssl verify 检查证书链，附 fullchain.pem 验证失败的原因。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>网站分析</category><category>x509</category><category>tls</category><category>openssl</category><category>pem</category><category>certificate-chain</category><category>san</category><category>pkcs7</category></item><item><title>没有 .proto 怎么解 protobuf：看懂 protoc --decode_raw 的输出</title><link>https://rea-reverse.com/zh/decode-protobuf-without-proto/</link><guid isPermaLink="true">https://rea-reverse.com/zh/decode-protobuf-without-proto/</guid><description>没有 schema 时，protobuf/gRPC 二进制里能读出什么：wire type、zigzag、字符串与嵌套消息和 packed 的歧义、gRPC 帧头，对照 protoc 验证。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>网站分析</category><category>web</category><category>protobuf</category><category>grpc</category><category>grpc-web</category><category>protoc</category><category>api</category></item><item><title>file 命令为什么认错文件类型：JAR、APK、DOCX 都成了 Zip archive data</title><link>https://rea-reverse.com/zh/file-command-wrong-file-type/</link><guid isPermaLink="true">https://rea-reverse.com/zh/file-command-wrong-file-type/</guid><description>为什么 file 把 APK、IPA、JAR、DOCX 报成 Zip archive data，把签名描述文件报成 data，把半个 JAR 仍报成 JAR：25 个样本和背后的魔数规则。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>工作流</category><category>file-command</category><category>magic-bytes</category><category>file-type</category><category>xxd</category><category>zip</category><category>jar</category><category>apk</category><category>ipa</category><category>docx</category><category>gzip</category><category>mime-type</category></item><item><title>Unsupported class file major version 61/65 报错怎么解决</title><link>https://rea-reverse.com/zh/unsupported-class-file-major-version/</link><guid isPermaLink="true">https://rea-reverse.com/zh/unsupported-class-file-major-version/</guid><description>亲手复现 UnsupportedClassVersionError 和 major version 61/65/69 报错，查清是哪个类、对应哪个 Java 版本，再用 --release 和 Gradle toolchain 修好。</description><pubDate>Tue, 20 Oct 2026 00:00:00 GMT</pubDate><category>工作流</category><category>java</category><category>jvm</category><category>gradle</category><category>android</category><category>d8</category><category>class-file</category></item><item><title>没有扩展名的文件怎么识别：魔数对照表与对应工具</title><link>https://rea-reverse.com/zh/identify-file-type-magic-bytes/</link><guid isPermaLink="true">https://rea-reverse.com/zh/identify-file-type-magic-bytes/</guid><description>没有扩展名的文件，看前几个字节就能认：用 file、xxd 或 Format-Hex 读文件头，区分 APK、NuGet 等 ZIP 格式，再交给对应的工具打开。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>入门</category><category>magic-bytes</category><category>file-type</category><category>file</category><category>xxd</category><category>zip</category><category>elf</category><category>pe</category><category>mach-o</category><category>wasm</category><category>squashfs</category></item><item><title>ELF / PE / Mach-O 在线查看：识别架构、节区、导入导出，判断是否 stripped</title><link>https://rea-reverse.com/zh/elf-pe-macho-viewer-online/</link><guid isPermaLink="true">https://rea-reverse.com/zh/elf-pe-macho-viewer-online/</guid><description>在浏览器里打开 ELF、PE 或 Mach-O 文件，查看架构、带熵值的节区、导入导出和字符串，并判断二进制有没有被 strip，文件不上传。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>elf</category><category>pe</category><category>mach-o</category><category>binary</category><category>stripped</category><category>readelf</category><category>otool</category><category>sections</category><category>entropy</category></item><item><title>不运行就能判断 EXE / DLL 是 32 位、64 位还是 ARM64（含 .NET AnyCPU）</title><link>https://rea-reverse.com/zh/check-exe-dll-32-or-64-bit/</link><guid isPermaLink="true">https://rea-reverse.com/zh/check-exe-dll-32-or-64-bit/</guid><description>不运行程序，判断 Windows EXE 或 DLL 是 x86、x64 还是 ARM64；讲清 .NET AnyCPU 程序集为什么看起来像 32 位，以及怎么读 CLI 标志。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>pe</category><category>exe</category><category>dll</category><category>x86</category><category>x64</category><category>arm64</category><category>dotnet</category><category>anycpu</category><category>corflags</category><category>architecture</category></item><item><title>检查自己构建的二进制加固选项：NX、PIE、RELRO、ASLR、CFG 一次看清</title><link>https://rea-reverse.com/zh/check-binary-hardening-flags/</link><guid isPermaLink="true">https://rea-reverse.com/zh/check-binary-hardening-flags/</guid><description>发布前确认自己的 ELF、PE、Mach-O 构建开了 NX、PIE、完整 RELRO、栈保护、ASLR、CFG 和 Hardened Runtime：真实输出、参数和结果解读。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>checksec</category><category>elf</category><category>pe</category><category>mach-o</category><category>pie</category><category>relro</category><category>aslr</category><category>control-flow-guard</category><category>hardened-runtime</category><category>release-engineering</category></item><item><title>这个 Mac 应用是不是通用二进制？查看 Mach-O 里的 Apple 芯片与 Intel 切片</title><link>https://rea-reverse.com/zh/macos-universal-binary-check/</link><guid isPermaLink="true">https://rea-reverse.com/zh/macos-universal-binary-check/</guid><description>判断 Mac 应用或 dylib 是不是通用二进制，列出 arm64 和 x86_64 切片，逐个对比最低系统版本、签名和依赖库；手边没有 Mac 也能查。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>macos</category><category>mach-o</category><category>universal-binary</category><category>fat-binary</category><category>lipo</category><category>apple-silicon</category><category>arm64</category><category>x86_64</category><category>codesign</category></item><item><title>ASAR 解包教程：在 Windows、macOS、Linux 上提取 app.asar</title><link>https://rea-reverse.com/zh/unpack-asar-file/</link><guid isPermaLink="true">https://rea-reverse.com/zh/unpack-asar-file/</guid><description>找到各平台上的 app.asar，用浏览器或 npx @electron/asar 解包，再按顺序读 package.json、main、preload 和 IPC 通道。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>electron</category><category>asar</category><category>javascript</category><category>ipc</category><category>preload</category><category>extract</category></item><item><title>npm 包 source map 泄露：如何检查，以及生产环境怎么关闭 source map</title><link>https://rea-reverse.com/zh/audit-source-map-leaks-before-publish/</link><guid isPermaLink="true">https://rea-reverse.com/zh/audit-source-map-leaks-before-publish/</guid><description>发版前查出 source map 泄露：用 npm pack --dry-run 找 .map 文件，看 sourcesContent 暴露了什么，在生产环境关闭或隐藏 source map，并在 CI 里拦住。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>javascript</category><category>source-maps</category><category>npm</category><category>security</category><category>vite</category><category>webpack</category><category>ci</category></item><item><title>如何用 source map 还原压缩后的 JS 报错堆栈</title><link>https://rea-reverse.com/zh/decode-minified-stack-trace-source-map/</link><guid isPermaLink="true">https://rea-reverse.com/zh/decode-minified-stack-trace-source-map/</guid><description>把 app.js:1:68 这样的压缩代码报错还原成原始文件、行号和名称：保留 hidden source map，在本地逐帧查询，并排查 map 与 bundle 对不上的情况。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>javascript</category><category>source-maps</category><category>debugging</category><category>stack-trace</category><category>vite</category><category>errors</category></item><item><title>adb logcat 抓崩溃日志、adb bugreport 取 tombstone：Android 崩溃排查</title><link>https://rea-reverse.com/zh/adb-logcat-bugreport-crash-debugging/</link><guid isPermaLink="true">https://rea-reverse.com/zh/adb-logcat-bugreport-crash-debugging/</guid><description>用 adb logcat -b crash -d 读出 Android 崩溃，在 adb bugreport 里找到原生 tombstone，再用 ndk-stack 对应回源码行。全部是模拟器上的真实输出。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>adb</category><category>logcat</category><category>bugreport</category><category>tombstone</category><category>crash</category><category>debugging</category></item><item><title>Android 16 KB 页面大小适配检查：APK 的 .so 对齐（含 Flutter、React Native）</title><link>https://rea-reverse.com/zh/check-apk-16kb-page-size/</link><guid isPermaLink="true">https://rea-reverse.com/zh/check-apk-16kb-page-size/</guid><description>检查 APK/AAB 是否满足 Android 16 KB 页面大小要求，Flutter、React Native 构建同样适用：ELF 段对齐、.so 在 ZIP 内的对齐和 64 位库，可在浏览器里查，也可用 zipalign 复核。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>aab</category><category>16kb</category><category>page-size</category><category>ndk</category><category>zipalign</category><category>google-play</category></item><item><title>Android 开发者验证：从 APK 读出签名证书 SHA-256 指纹和包名</title><link>https://rea-reverse.com/zh/android-developer-verification-certificate/</link><guid isPermaLink="true">https://rea-reverse.com/zh/android-developer-verification-certificate/</guid><description>Android 开发者验证要填包名和签名证书 SHA-256 指纹。从 APK、AAB 或 keystore 读出这两个值，选对要登记的密钥，并弄清 2026-09-30 起哪些安装受影响。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>developer-verification</category><category>signing</category><category>sha-256</category><category>apksigner</category><category>keytool</category><category>play-app-signing</category></item><item><title>App 被 Play Protect 拦截怎么办？原因排查、修复与申诉</title><link>https://rea-reverse.com/zh/play-protect-blocked-app-developer/</link><guid isPermaLink="true">https://rea-reverse.com/zh/play-protect-blocked-app-developer/</guid><description>Play Protect 为什么拦截线下分发的 App（短信与无障碍权限、targetSdk 过旧、调试密钥、ZIP 不规范），每一项怎么修，以及 Play Protect 申诉表要填什么。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>play-protect</category><category>sideload</category><category>signing</category><category>permissions</category><category>developer-verification</category></item><item><title>Google Play 拒审原因：上传前就能在 APK/AAB 里查出来的那些</title><link>https://rea-reverse.com/zh/google-play-app-rejection-reasons/</link><guid isPermaLink="true">https://rea-reverse.com/zh/google-play-app-rejection-reasons/</guid><description>谷歌上架被拒，很多原因就写在安装包里：targetSdk 不达标、缺 64 位和 16 KB 原生库、调试签名、敏感权限没声明、前台服务类型缺权限。上传前逐项查出并修好。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>google-play</category><category>play-console</category><category>aab</category><category>permissions</category><category>signing</category><category>target-api</category></item><item><title>安装包与现有包冲突怎么解决：排查自己 App 的签名不一致</title><link>https://rea-reverse.com/zh/app-not-installed-package-conflicts/</link><guid isPermaLink="true">https://rea-reverse.com/zh/app-not-installed-package-conflicts/</guid><description>安装时提示“安装包与现有包冲突”或签名不一致？对比两个 APK 的证书 SHA-256，找出设备上已装的那一份，用正确的密钥修复，不丢用户数据。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>signing</category><category>install-error</category><category>adb</category><category>apksigner</category><category>play-app-signing</category></item><item><title>安装包似乎无效怎么解决：查出自己的 APK 到底哪里坏了</title><link>https://rea-reverse.com/zh/app-not-installed-package-appears-invalid/</link><guid isPermaLink="true">https://rea-reverse.com/zh/app-not-installed-package-appears-invalid/</guid><description>手机提示“应用未安装：软件包似乎无效”？先用 adb 拿到真实的 INSTALL_PARSE_FAILED 代码，再从签名、resources.arsc、拆分包逐项修好 APK。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>install-error</category><category>signing</category><category>apksigner</category><category>zipalign</category><category>bundletool</category><category>adb</category></item><item><title>应用与你的手机不兼容：检查 targetSdk、ABI 和 minSdk</title><link>https://rea-reverse.com/zh/app-isnt-compatible-with-your-phone/</link><guid isPermaLink="true">https://rea-reverse.com/zh/app-isnt-compatible-with-your-phone/</guid><description>安装提示“应用与你的手机不兼容”或“安装包无效或不兼容”？先用 adb 拿到真实的 INSTALL_FAILED 代码，再逐项检查 targetSdk、原生库 ABI 和 minSdk。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>install-error</category><category>targetsdk</category><category>abi</category><category>minsdk</category><category>adb</category></item><item><title>Android CTF 入门：逆向一道练习 APK 题，找出 flag</title><link>https://rea-reverse.com/zh/android-ctf-apk-reverse-engineering/</link><guid isPermaLink="true">https://rea-reverse.com/zh/android-ctf-apk-reverse-engineering/</guid><description>安卓逆向入门：自己编译一道 APK 练习题，先在浏览器里体检，用 DEX 类浏览器定位校验方法，再用 JADX 和 REA 读懂逻辑，写脚本解出 flag 并在模拟器上验证。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>CTF</category><category>ctf</category><category>android</category><category>apk</category><category>dex</category><category>jadx</category><category>apktool</category><category>beginners</category><category>crackme</category></item><item><title>CTF 逆向入门：新手怎么解出第一道 rev 题</title><link>https://rea-reverse.com/zh/ctf-reverse-engineering-beginners/</link><guid isPermaLink="true">https://rea-reverse.com/zh/ctf-reverse-engineering-beginners/</guid><description>第一道 CTF 逆向题怎么下手：识别文件类型、跑 strings、看导入和节区，再读懂校验逻辑写出解题脚本。全程用自己编译的练习程序演示。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>CTF</category><category>ctf</category><category>reverse-engineering</category><category>beginners</category><category>strings</category><category>file</category><category>crackme</category><category>disassembly</category><category>picoctf</category></item><item><title>HAR 文件分析与脱敏：发给别人之前怎么查看、怎么去掉敏感信息</title><link>https://rea-reverse.com/zh/har-file-analyzer-guide/</link><guid isPermaLink="true">https://rea-reverse.com/zh/har-file-analyzer-guide/</guid><description>把 HAR 发给客服之前先脱敏：Chrome 脱敏导出去掉了什么、漏掉了什么，token 藏在哪里，以及怎样在不上传文件的情况下按接口归纳 HAR。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>网站分析</category><category>web</category><category>har</category><category>devtools</category><category>privacy</category><category>redaction</category><category>api</category></item><item><title>WASM 转 WAT：在线或用 wabt 转换并查看 .wasm 文件</title><link>https://rea-reverse.com/zh/wasm-to-wat-inspect-webassembly/</link><guid isPermaLink="true">https://rea-reverse.com/zh/wasm-to-wat-inspect-webassembly/</guid><description>把 WASM 转成 WAT，并在浏览器里查看 WebAssembly 模块的导入、导出、内存、函数和自定义段，再用 wabt 命令行逐项核对。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>网站分析</category><category>webassembly</category><category>wasm</category><category>wat</category><category>wabt</category><category>wasm2wat</category><category>rust</category><category>browser</category></item><item><title>WebMCP 示例（Chrome）：给网页注册工具，并列出页面暴露的工具</title><link>https://rea-reverse.com/zh/webmcp-discover-page-tools/</link><guid isPermaLink="true">https://rea-reverse.com/zh/webmcp-discover-page-tools/</guid><description>一个能在 Chrome 里跑起来的 WebMCP 示例：打开功能开关，用 registerTool 和带属性的表单注册工具，用 document.modelContext.getTools() 列出它们，再在版本之间对比工具变化。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>网站分析</category><category>web</category><category>webmcp</category><category>mcp</category><category>chrome</category><category>cdp</category><category>ai-agents</category><category>security-review</category></item><item><title>怎么判断 EXE 是不是 .NET 程序：Framework、单文件、ReadyToRun 还是 NativeAOT</title><link>https://rea-reverse.com/zh/is-exe-dotnet-or-native/</link><guid isPermaLink="true">https://rea-reverse.com/zh/is-exe-dotnet-or-native/</guid><description>从文件字节分辨 .NET Framework EXE、apphost、单文件发布、ReadyToRun 和 NativeAOT，五种构建全部实测，附真实输出和可直接用的解析脚本。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>.NET</category><category>dotnet</category><category>pe</category><category>apphost</category><category>single-file</category><category>readytorun</category><category>nativeaot</category><category>ilspy</category></item><item><title>怎么查看 DLL 是哪个 .NET 版本：目标框架、版本号和依赖</title><link>https://rea-reverse.com/zh/check-dotnet-dll-target-framework/</link><guid isPermaLink="true">https://rea-reverse.com/zh/check-dotnet-dll-target-framework/</guid><description>不装 Visual Studio，也能查出 DLL 面向哪个 .NET 版本、程序集版本和文件版本、引用了哪些程序集：附 Newtonsoft.Json 13.0.3 八份构建的真实输出。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>.NET</category><category>dotnet</category><category>dll</category><category>target-framework</category><category>assembly-version</category><category>il</category><category>metadata</category><category>nuget</category></item><item><title>Binwalk 3 安装与“提取不出东西”排查：Rust 重写版和 v2 的区别</title><link>https://rea-reverse.com/zh/binwalk-3-install-extract/</link><guid isPermaLink="true">https://rea-reverse.com/zh/binwalk-3-install-extract/</guid><description>在 Linux、macOS、Kali 上安装 Binwalk 3.1.0，避开 v2 软件包的坑，用 -e、-M 提取固件，排查“什么都没解出来”，并说明何时改用 Unblob。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>固件</category><category>binwalk</category><category>binwalk3</category><category>unblob</category><category>firmware</category><category>sasquatch</category><category>rust</category><category>kali</category><category>extraction</category></item><item><title>从固件 .bin 里提取 SquashFS 根文件系统：unsquashfs、Unblob 与 Binwalk 实操</title><link>https://rea-reverse.com/zh/extract-squashfs-from-firmware/</link><guid isPermaLink="true">https://rea-reverse.com/zh/extract-squashfs-from-firmware/</guid><description>在路由器固件 .bin 中定位 SquashFS 根文件系统，用 dd 切出、unsquashfs 解包，或交给 Binwalk 3、Unblob 一步完成，全程用 OpenWrt 官方镜像实测。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>固件</category><category>firmware</category><category>squashfs</category><category>unsquashfs</category><category>binwalk</category><category>unblob</category><category>sasquatch</category><category>openwrt</category><category>dd</category></item><item><title>Etherscan 合约验证失败、字节码不匹配？找出不一致的源码或编译设置</title><link>https://rea-reverse.com/zh/etherscan-verification-bytecode-mismatch/</link><guid isPermaLink="true">https://rea-reverse.com/zh/etherscan-verification-bytecode-mismatch/</guid><description>Etherscan 报 bytecode does not match、hardhat verify 失败？从链上代码读出 solc 版本，再用九组编译对照判断是源码不一致还是编译设置不对。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>区块链</category><category>etherscan</category><category>solidity</category><category>solc</category><category>bytecode</category><category>metadata</category><category>cbor</category><category>verification</category><category>hardhat</category><category>foundry</category></item><item><title>怎么判断一个合约是不是代理合约？未验证源码也能从字节码看出来</title><link>https://rea-reverse.com/zh/unverified-contract-proxy-token-check/</link><guid isPermaLink="true">https://rea-reverse.com/zh/unverified-contract-proxy-token-check/</guid><description>Etherscan 上合约没有验证源码，怎么判断是不是代理？从字节码识别 EIP-1967 代理和 EIP-1167 克隆，找到实现合约，并读出代币有哪些管理权限函数。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>区块链</category><category>evm</category><category>proxy</category><category>eip-1967</category><category>eip-1167</category><category>erc-20</category><category>bytecode</category><category>etherscan</category><category>openzeppelin</category><category>storage-layout</category></item><item><title>ILSpy、dnSpy、dotPeek 怎么选：.NET 反编译器对比，Mac 上用什么</title><link>https://rea-reverse.com/zh/ilspy-vs-dnspy-vs-dotpeek/</link><guid isPermaLink="true">https://rea-reverse.com/zh/ilspy-vs-dnspy-vs-dotpeek/</guid><description>对比 ILSpy 11.2、dnSpyEx 6.6.0 和 dotPeek 2026.2.4 的平台、许可证和调试能力，附同一个 DLL 的真实反编译输出，并写清楚在 macOS 上哪些实测了、哪些没有。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>对比</category><category>dotnet</category><category>decompiler</category><category>ilspy</category><category>dnspyex</category><category>dotpeek</category><category>ilspycmd</category><category>comparison</category></item><item><title>JADX、JEB、Apktool 怎么选：三款 Android 反编译工具对比</title><link>https://rea-reverse.com/zh/jadx-vs-jeb-vs-apktool/</link><guid isPermaLink="true">https://rea-reverse.com/zh/jadx-vs-jeb-vs-apktool/</guid><description>截至 2026 年 10 月对比 JADX 1.5.6、Apktool 3.0.3 和 JEB 5.48：各自输出什么、F-Droid APK 实测耗时、价格与许可证，以及 REA 如何接入。</description><pubDate>Wed, 14 Oct 2026 00:00:00 GMT</pubDate><category>对比</category><category>android</category><category>apk</category><category>jadx</category><category>apktool</category><category>jeb</category><category>decompiler</category><category>comparison</category></item><item><title>REA MCP 安装：用 rea-agents 接入 Claude Code、Cursor 与 Codex</title><link>https://rea-reverse.com/zh/getting-started-rea-mcp/</link><guid isPermaLink="true">https://rea-reverse.com/zh/getting-started-rea-mcp/</guid><description>用 npx rea-agents setup 安装 REA：Node 版本要求、锁定版本的 MCP 注册、--client 与 --dry-run、更新、rea doctor 排错和第一次分析。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>入门</category><category>rea</category><category>mcp</category><category>setup</category><category>claude-code</category><category>cursor</category><category>codex</category><category>cli</category></item><item><title>REA 安全吗？认准真正的 Reverse Engineer Anything 仓库与 npm 包</title><link>https://rea-reverse.com/zh/verify-real-rea-install/</link><guid isPermaLink="true">https://rea-reverse.com/zh/verify-real-rea-install/</guid><description>确认装的是正版 REA：核对官方仓库和 npm 包名，用 npm view 查元数据，用 npm audit signatures 验证 provenance，发现假冒去哪举报。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>入门</category><category>rea</category><category>security</category><category>npm</category><category>provenance</category><category>supply-chain</category><category>installation</category></item><item><title>Ghidra MCP：用 REA 让 AI agent 无界面调用 Ghidra 反编译</title><link>https://rea-reverse.com/zh/rea-ghidra-native-binary/</link><guid isPermaLink="true">https://rea-reverse.com/zh/rea-ghidra-native-binary/</guid><description>用 REA 在 CLI 或 AI agent 里驱动 Ghidra 无头分析：配置与 doctor 检查，decompile、xrefs、trace 命令，附一个带标准答案的样本。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>rea</category><category>ghidra</category><category>native</category><category>decompile</category><category>xrefs</category><category>mcp</category><category>cli</category></item><item><title>macOS 应用怎么逆向：以 Rectangle 为例一步步拆解</title><link>https://rea-reverse.com/zh/reverse-engineer-macos-app/</link><guid isPermaLink="true">https://rea-reverse.com/zh/reverse-engineer-macos-app/</guid><description>不运行程序也能逆向 macOS 应用：bundle 结构、Info.plist、Mach-O 切片、签名、dylib 加载、NIB 菜单和 Swift 类，全部在 Rectangle 上实测。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>macos</category><category>mach-o</category><category>swift</category><category>objective-c</category><category>nib</category><category>plist</category><category>dyld</category><category>ghidra</category><category>hopper</category></item><item><title>如何逆向 Windows EXE/DLL：一个完整实测示例</title><link>https://rea-reverse.com/zh/reverse-engineer-windows-exe-dll-ai/</link><guid isPermaLink="true">https://rea-reverse.com/zh/reverse-engineer-windows-exe-dll-ai/</guid><description>一步步逆向 EXE 或 DLL：先判断原生还是 .NET，再看导出表和导入表、解码版本与字符串资源，最后读导出函数背后的机器码。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>原生二进制</category><category>rea</category><category>ghidra</category><category>windows</category><category>pe</category><category>dll</category><category>exe</category><category>mcp</category><category>ai-agent</category></item><item><title>Electron 应用逆向分析实战：ASAR、preload 与 IPC（以 Joplin 为例）</title><link>https://rea-reverse.com/zh/reverse-engineer-electron-app/</link><guid isPermaLink="true">https://rea-reverse.com/zh/reverse-engineer-electron-app/</guid><description>在真实的 Electron 应用 Joplin 3.7.22 上逆向分析：复制并解开 app.asar，读 webPreferences 和 preload，梳理 IPC 通道，找出原生 addon，检查 fuses。全部是真实输出。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>electron</category><category>asar</category><category>ipc</category><category>preload</category><category>javascript</category><category>source-maps</category><category>native-addons</category><category>fuses</category></item><item><title>JS 逆向实战：如何还原 webpack 打包后的源码（附 MCP 用法）</title><link>https://rea-reverse.com/zh/recover-javascript-source-from-bundle/</link><guid isPermaLink="true">https://rea-reverse.com/zh/recover-javascript-source-from-bundle/</guid><description>还原压缩过的 webpack bundle：从 .map 的 sourcesContent 直接取回源码，用 Wakaru 拆开模块表，再用 REA 梳理 chunk、模块和请求。全部是真实输出。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>JavaScript 与 Electron</category><category>javascript</category><category>webpack</category><category>source-maps</category><category>wakaru</category><category>unminify</category><category>bundles</category><category>mcp</category></item><item><title>AAB 转 APK（bundletool）与 APK 资源提取</title><link>https://rea-reverse.com/zh/apk-aab-unpack-extract-assets/</link><guid isPermaLink="true">https://rea-reverse.com/zh/apk-aab-unpack-extract-assets/</guid><description>用 bundletool build-apks --mode=universal 把 AAB 转成通用 APK，按设备提取拆分包，再用 unzip 取出 APK 里的 assets。附 bundletool 1.18.3 真实输出。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>aab</category><category>bundletool</category><category>apktool</category><category>assets</category><category>unpack</category></item><item><title>JADX MCP Server 配置教程：让 Claude Code / Codex 读 APK 反编译代码（含实例）</title><link>https://rea-reverse.com/zh/jadx-mcp-server-claude-code/</link><guid isPermaLink="true">https://rea-reverse.com/zh/jadx-mcp-server-claude-code/</guid><description>把 JADX 以无头方式挂成 MCP Server，接入 Claude Code 或 Codex：JDK 17+、jadx-headless-mcp 0.7.1、env 配置、提问方式，以及一次真实的 Aegis APK 分析。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>jadx</category><category>mcp</category><category>claude-code</category><category>codex</category><category>java</category></item><item><title>用 REA 分析 Android APK：代码、资源、设备拉包与 Flutter</title><link>https://rea-reverse.com/zh/android-apk-analysis-rea/</link><guid isPermaLink="true">https://rea-reverse.com/zh/android-apk-analysis-rea/</guid><description>REA 的 Android 工具各管什么、在哪里止步：JADX 搜类读代码、Apktool 字符串表与语言区域、ADB 拉取 split APK、Flutter 快照哈希。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>Android</category><category>android</category><category>apk</category><category>jadx</category><category>apktool</category><category>adb</category><category>flutter</category><category>dart</category></item><item><title>二进制补丁对比：逐函数比较两个版本（zlib CVE-2018-25032 实例）</title><link>https://rea-reverse.com/zh/binary-patch-diffing-ai-agent/</link><guid isPermaLink="true">https://rea-reverse.com/zh/binary-patch-diffing-ai-agent/</guid><description>补丁对比实操：自己编译 zlib 1.2.11 和 1.2.12，用 REA 调 Ghidra 比较 deflateInit2_ 与 compress_block，从真实 diff 里看到 CVE 修复。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>工作流</category><category>patch-diffing</category><category>binary-diffing</category><category>ghidra</category><category>mcp</category><category>version-diff</category><category>evidence</category></item><item><title>GhidraMCP、IDA Pro MCP、r2mcp 怎么选：逆向工程 MCP 服务器对比</title><link>https://rea-reverse.com/zh/rea-vs-ghidramcp-ida-pro-mcp/</link><guid isPermaLink="true">https://rea-reverse.com/zh/rea-vs-ghidramcp-ida-pro-mcp/</guid><description>从引擎、费用、安装和写入能力对比 GhidraMCP、ida-pro-mcp、r2mcp、Binary Ninja MCP 和 REA，并在同一个二进制上实测了 GhidraMCP 与 REA。部分实测、部分资料整理，日期 2026-11。</description><pubDate>Tue, 13 Oct 2026 00:00:00 GMT</pubDate><category>对比</category><category>mcp</category><category>comparison</category><category>ghidra</category><category>ida-pro</category><category>radare2</category><category>binary-ninja</category></item></channel></rss>