Choose a target and follow source-linked tools, learning paths, REA workflows, case studies and research.
Choose the software or artifact you want to understand before choosing a tool. A Windows executable, Android package, managed assembly, website and network capture expose different kinds of evidence. Each task path below starts with a concrete question, explains the likely prerequisites and links to tools and learning material. Unknown costs, platforms and release compatibility stay labelled Unknown until a source supports them.
This hub combines original guidance with source-linked records. Begin with read-only inspection of an authorized sample, preserve its version and hash, and test important conclusions against raw evidence or a controlled run. AI-assisted analysis can organize observations, but generated prose and decompiled strings need independent verification. Use the comparison pages to choose by task fit rather than a universal ranking.
56 resources · Page 4 of 5
REA coordinates evidence-focused investigations through a local CLI and MCP interface. Choose a target and check its particular provider requirements before starting: native pseudocode, Android methods, browser observations and firmware extraction use different underlying tools. Its structured output can help an analyst or agent stay on a question, but it does not independently verify a model's interpretation.
View evidence & requirementsREA documents a path from a retained web network capture to an agent environment for evaluation or reinforcement learning. The exported environment answers from recorded evidence and can model confirmed state changes; it does not reproduce every behavior of the original application. Review capture coverage, generated tools and framework requirements before calling a task representative.
View evidence & requirementsREA's guided MCP prompts give an agent an investigation starting point, but a prompt is not a connection or a provider. Configure the local server in a compatible client, inspect the tools that register, and ask one bounded question about an authorized target. Preserve tool observations separately from the agent's interpretation and verify its conclusions.
View evidence & requirementsREA documents native programs, managed code, Android packages and devices, web and Electron applications, firmware and other artifacts. Support is operation-specific: identifying file metadata differs from decompiling a function or observing runtime behavior. Choose the target and exact question first, then check the provider requirement and installed release rather than treating the broad list as a universal capability guarantee.
View evidence & requirementsGhidra is an analysis environment for inspecting native programs, functions and decompiler output. REA can direct a documented workflow through a configured native provider and return structured evidence to a CLI or agent. For a question about a function, the useful choice is often whether to work directly in Ghidra or coordinate selected reads through REA.
View evidence & requirementsA useful reverse-engineering project begins with permission and a legitimate purpose: understanding software you own, authorized testing, interoperability, education, security research or preservation. Legal rules depend on location, license and circumstances, so check the rules relevant to your target. Keep the investigation bounded, preserve evidence and avoid publishing secrets or instructions that enable harm.
View evidence & requirementsRetDec decompiles machine code into a higher-level representation for inspection. It can provide another perspective on a native function when one decompiler's output is unclear. Keep the exact binary and architecture context, then compare important control flow with assembly. Different pseudocode does not by itself prove which interpretation matches the original program behavior.
View evidence & requirementsReversing: Secrets of Reverse Engineering is a historical software reversing text from 2005. It can help an intermediate reader understand how analysts reason about compiled code and software internals. Use it for concepts and historical perspective, then verify every platform-specific technique against modern operating systems, architectures, legal permissions and tools before attempting a contemporary workflow.
View evidence & requirementsA REA call may read a file, add analysis state, launch a foreign program or change a connected device, depending on the operation. MCP annotations describe effects but are not permission controls. Keep agent access narrow, treat target content as untrusted and verify consequential conclusions from raw evidence before acting on a result.
View evidence & requirementsREA setup starts with the target and the agent or CLI interface you intend to use. Confirm the current Node runtime requirement, install the official package, run its setup checks and inspect the reported tool list. A successful installation does not prove that a native provider, Android engine or browser capture path is ready for your investigation.
View evidence & requirementsThe Android Malware Handbook offers a book-length view of Android malware investigation and detection. It is suitable after the reader understands APK structure, app components and permissions, and wants a more focused defensive workflow. Android platform rules and attacker techniques evolve quickly, so validate any operational instruction against the device and OS versions in the actual investigation.
View evidence & requirementsThe second edition of The Ghidra Book is a current book-length route into Ghidra's analysis workflow. Choose it when a structured explanation of projects, functions, decompilation and extensions would help more than a short tool reference. Confirm the examples against the Ghidra release you install, because menus, processors and extension interfaces can change after publication.
View evidence & requirements