What you will find here
We organize the first steps: selecting a target, installing the tooling, connecting an agent, tracing a behavior, and checking what the evidence actually supports. The guides combine original explanations with links to primary documentation.
Our relationship to REA
This site is not affiliated with, sponsored by, or endorsed by the REA project or the authors of the software discussed here. REA’s official repository is morluto/rea; its official website is rea.tools. Project and product names belong to their respective owners.
How to read our examples
Command examples and prompts are templates. Replace illustrative paths and names before using them. The case-study directory points to work published by the REA project; it does not claim those investigations were reproduced by this site. We do not offer a hosted binary-analysis service.
Sources and corrections
Technical pages link to the upstream documentation used in their preparation and show a review date. Commands and capabilities may change. If you find a discrepancy, use the linked official documentation for your installed release; software bugs belong in the official issue tracker.
Use the method thoughtfully
Choose software you own or are authorized to study. Keep a record of the target version and the evidence. Learn from a behavior, write your own specification, and check your implementation against meaningful examples.