gensokyo-dev
23f984b1a8
Supply a real retained resource owner to every Android verifier prerequisite check, sharing the existing Ghidra verifier cleanup scope. Match recovery checks to typed Java or archive failures and applicable remediation, preserving exact close retry authority and primary failures. Assisted-by: Reimu (gensokyo-skills:reimu-incident-triage)
22 KiB
Static Android APK analysis
REA wraps an existing headless JADX engine through src/android/. Its source is
kept as an unmodified, commit-pinned Git submodule; see
upstream provenance. CLI and MCP use the same
application workflow and return artifact-bound Evidence inline.
This family is present on repository main and in npm 4.1.0. Check the released package boundary and the connected server's tool list before selecting it.
On Linux, JADX launches an REA-owned process and requires a procps-compatible
ps on REA's PATH; see the shared
Linux process prerequisite.
Optional package delivery
The MCP inspect_android_package request keeps complete output when detail is
omitted or "complete". Select detail: "summary" explicitly to receive all
package, SDK and permission declarations, engine identity and class/resource
counts without decoded manifest text or duplicate raw provider replies. A
retaining session keeps the complete original Evidence and returns a distinct
linked inspect_analysis_view summary. This changes delivery, not JADX analysis.
Use the returned normalized_result.parent_evidence_id with
inspect_analysis_view, source kind retained-evidence, and
view: {kind: "android", facet: "manifest", offset: 0, limit: 4096} to read the
exact decoded manifest without reopening the APK. Offsets and limits count UTF-16
code units; follow coverage.next_offset. The page preserves source_status and
reported_total_bytes: exhausting retained text does not make a partial decoded
manifest complete. Complete source Evidence remains exportable under the existing
session lifetime. Servers without retention reject summary before starting JADX.
One-shot CLI output remains complete. Older servers require the existing complete
request after schema discovery. APK authenticity and runtime behavior remain
unverified.
Supply tools
Use a full JDK 17 or newer (including its compiler module) and
jadx-headless-mcp 0.7.1.
Verify the downloaded JAR's SHA-256 against
REA's pinned release metadata
before using it. The following download and verification commands work for npm
package consumers as well as repository checkouts; the repository-only
npm run fixtures:android helper is not included in the npm package.
On macOS or Linux, choose a destination and verify the pinned digest:
mkdir -p "$HOME/.local/share/rea/android" &&
cd "$HOME/.local/share/rea/android" &&
curl -fL -o jadx-headless-mcp-0.7.1-all.jar https://github.com/1013503897/jadx-headless-mcp/releases/download/v0.7.1/jadx-headless-mcp-0.7.1-all.jar &&
if command -v sha256sum >/dev/null; then
echo '6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7