leanrea

leanrea: fast path

You already know these tools. This file only lists the fastest command for each target, and the traps.

Rules

• Work on a copy (cp -c on APFS is instant). Put each extraction in a new dir under $TMPDIR/re/<name>. Reuse an extraction if one exists.
• Route by file -b T and the magic bytes first. Run the cheapest inventory next. Only then decompile or read code.
• rg skips hidden and ignored files, and bundlers hide code (Electron: .webpack/, .vite/). Always search extracted trees with rg -uu.
• Never cat a big or minified file. Slice it: rg -o '.{0,200}NEEDLE.{0,200}' F | head. Dump a disassembly once to a file, then grep that file.
• Batch independent probes into ONE shell call with ; and echo '--- name' markers (quoted: zsh expands a bare ==x). Cap every output with head or -m.
• Answer from evidence. In the answer, mark each claim as seen (cite file:offset, or a symbol/string) or inferred. A fact you did not find is unknown, not "absent". Static reading is not observed execution.
• A missing tool is not a blocker. Use the fallback in the same row, or brew install <x> if the user allows it.
• Turns cost more than bytes. Aim for 2–4 tool calls: one batched recon call, one or two targeted slices, then answer. Stop when every item you were asked has evidence. Do not re-verify what you already saw.

First move: one call each, paste and run

Native (Mach-O):

T=./bin; D=$TMPDIR/re/$(basename $T); mkdir -p $D; file $T; lipo -info $T; otool -L $T; echo '--- EXPORTS'; nm -gU $T | head -150; echo '--- IMPORTS'; nm -u $T | rg -v '^__Z|napi_' | tr '\n' ' '; echo; echo '--- STRINGS'; strings -a -n 6 $T | rg -v '^[_$.]' | head -400; otool -tV $T > $D/dis.txt; echo '--- FUNCS'; rg '^[_a-zA-Z].*:$' $D/dis.txt | rg -v '^_?_?Z?N?St3' | head -150

Then read one function: awk '/^FUNC_LABEL:$/{p=1;next} p&&/^[_a-zA-Z].*:$/{exit} p' $D/dis.txt | rg 'bl|b\.|cmp|literal|mov\s+w2'.

Electron:

A=./app.asar; X=$TMPDIR/re/asar; rm -rf $X; npx -y @electron/asar extract $A $X && jq '{name,version,main}' $X/package.json; find $X -path '*/node_modules' -prune -o -type f \( -name '*.js' -o -name '*.node' \) -print | head -60; ls ${A}.unpacked/node_modules 2>/dev/null; rg -uu -l --glob '!node_modules' 'exposeInMainWorld' $X

Then slice the needle across the bundle: rg -uu -o --glob '!node_modules' '.{0,250}NEEDLE.{0,250}' $X | head -20.

Go: go version -m T alone usually answers the question.

Router

Speed patterns

• Strings and imports first. On a small binary, nm -u + strings + the export list usually answer "what does it do" with no disassembly.
• To find who uses a string: get its address from otool -tV "literal pool for" comments, or rg -n 'literal pool for: "X'. Then find the enclosing function label above that line.
• A C++ name in a bl target already tells you the protocol (for example getpeereid, write, std::hash). Read the call sequence, not every instruction.
• For JS, go from the native/JS boundary inward: find the native call, then its caller class, then the IPC registration, then the renderer/preload.
• Comparing versions: diff the inventories (nm, the module list, go version -m) before you diff any code.
• Rebuilding: write the minimal reimplementation, then test it against the original (same inputs, same outputs).

Install (only on request)

brew install jadx apktool radare2 binwalk wabt wireshark ghidra · npm i -g @electron/asar · dotnet tool install -g ilspycmd · cargo install cargo-audit.