leanrea: fast path

You already know these tools. This file only lists the fastest command for each target, and the traps.

Rules

Work on a copy (
```
cp -c
```
on APFS is instant). Put each extraction in a new dir under
```
$TMPDIR/re/<name>
```
. Reuse an extraction if one exists.
Route by
```
file -b T
```
and the magic bytes first. Run the cheapest inventory next. Only then decompile or read code.
```
rg
```
skips hidden and ignored files, and bundlers hide code (Electron:
```
.webpack/
```
,
```
.vite/
```
). Always search extracted trees with
```
rg -uu
```
.
Never
```
cat
```
a big or minified file. Slice it:
```
rg -o '.{0,200}NEEDLE.{0,200}' F | head
```
. Dump a disassembly once to a file, then grep that file.
Batch independent probes into ONE shell call with
```
;
```
and
```
echo '--- name'
```
markers (quoted: zsh expands a bare
```
==x
```
). Cap every output with
```
head
```
or
```
-m
```
.
Answer from evidence. In the answer, mark each claim as seen (cite file:offset, or a symbol/string) or inferred. A fact you did not find is unknown, not "absent". Static reading is not observed execution.
A missing tool is not a blocker. Use the fallback in the same row, or
```
brew install <x>
```
if the user allows it.
Turns cost more than bytes. Aim for 2–4 tool calls: one batched recon call, one or two targeted slices, then answer. Stop when every item you were asked has evidence. Do not re-verify what you already saw.

First move: one call each, paste and run

Native (Mach-O):

T=./bin; D=$TMPDIR/re/$(basename $T); mkdir -p $D; file $T; lipo -info $T; otool -L $T; echo '--- EXPORTS'; nm -gU $T | head -150; echo '--- IMPORTS'; nm -u $T | rg -v '^__Z|napi_' | tr '\n' ' '; echo; echo '--- STRINGS'; strings -a -n 6 $T | rg -v '^[_$.]' | head -400; otool -tV $T > $D/dis.txt; echo '--- FUNCS'; rg '^[_a-zA-Z].*:$' $D/dis.txt | rg -v '^_?_?Z?N?St3' | head -150

Then read one function:

awk '/^FUNC_LABEL:$/{p=1;next} p&&/^[_a-zA-Z].*:$/{exit} p' $D/dis.txt | rg 'bl|b\.|cmp|literal|mov\s+w2'

Electron:

A=./app.asar; X=$TMPDIR/re/asar; rm -rf $X; npx -y @electron/asar extract $A $X && jq '{name,version,main}' $X/package.json; find $X -path '*/node_modules' -prune -o -type f \( -name '*.js' -o -name '*.node' \) -print | head -60; ls ${A}.unpacked/node_modules 2>/dev/null; rg -uu -l --glob '!node_modules' 'exposeInMainWorld' $X

Then slice the needle across the bundle:

rg -uu -o --glob '!node_modules' '.{0,250}NEEDLE.{0,250}' $X | head -20

Go:

go version -m T

alone usually answers the question.

Router

Target (detect)	Fastest path
Electron app ( `*.app/Contents/Resources/app.asar` )	`npx -y @electron/asar extract app.asar X` (also see `app.asar.unpacked/` for `.node` addons). Entry point: `jq .main X/package.json` . Surface: `rg -n -o '.{0,120}(ipcMain.(handle
Web bundle / minified JS	Find `sourceMappingURL` . If the map has `sourcesContent` , dump the sources: `jq -r '.sources[]'` . For webpack, grep the module ids, then slice around the hit. For pretty-print: `npx -y prettier --parser babel F > F.pretty.js` , then read with line ranges.
Hermes / bytenode / V8 snapshot	Hermes magic is `c6 1f bc 03` ( `index.android.bundle` ): use `hermes-dec` / `hbc-decompiler` . `.jsc` (bytenode) cannot be decompiled: use strings and runtime hooks.
Mach-O ( `file` : Mach-O)	`lipo -info` (thin first: `lipo -thin arm64 -o T1 T` ). Then: `otool -L` (libs); `xcrun dyld_info -exports -imports` ; `nm -gU` (exports) / `nm -u` (imports = the capability map); `strings -a -n 6` ; `otool -l \| rg -A3 'LC_(RPATH\|BUILD_VERSION)'` ; `codesign -d --entitlements :- T` ; `otool -ov` (ObjC classes/methods); `xcrun swift-demangle --compact` .
Native code logic	`otool -tV T > $D/dis.txt` (or `llvm-objdump -d --no-show-raw-insn -C` ). Find the function: `rg -n '^_?.Name.:$'` . Read the call/string trail: `awk '/^FUNC:/{p=1} p&&/^[_a-zA-Z].*:$/&&!/FUNC/{exit} p' dis.txt \| rg 'bl\|call\|literal\|cmp'` . otool labels string literals and stubs inline, which is often enough. Only for real pseudocode: Ghidra `analyzeHeadless $D p -import T -postScript DecompileAll.java -deleteProject` or `r2 -qc 'aaa; pdc @ sym.X' T` .
ELF / PE	`readelf -hlSW` , `readelf -dW` (NEEDED), `nm -D --defined-only` , `objdump -d -M intel` . PE: `objdump -x` , `pefile` / `wrestool` for resources. checksec: `pwn checksec` .
Go ( `__go_buildinfo` , `.go.buildinfo` )	`go version -m T` gives the toolchain, path, mod, deps and build flags in one call. Without Go: `strings -a T \| rg -m1 -A200 'Go buildinf'` . Symbols survive stripping: `go tool nm T \| rg main\.` .
Rust	Deps (cargo-auditable): `cargo audit bin T` , or extract `.dep-v0` / `__DATA,.dep-v0` and zlib-inflate it. Compiler: `strings -a T \| rg -o '/rustc/[0-9a-f]{40}' \| sort -u` . Crates from paths: `strings -a T \| rg -o '[a-z0-9_-]+-[0-9]+\.[0-9]+\.[0-9]+/src' \| sort -u` .
.NET ( `file` : Mono/.Net)	`ilspycmd -p -o X T.dll` (install: `dotnet tool install -g ilspycmd` ), then `rg` . P/Invoke: `rg DllImport X` . NativeAOT/IL2CPP are native: use the native rows.
Android APK	`jadx -d X --show-bad-code a.apk` then `rg` . Resources/manifest only: `apktool d --no-src -o X a.apk` . Quick look: `unzip -l a.apk` . `lib/*/libflutter.so` means Flutter (Dart AOT: `blutter` ); `libhermes.so` means React Native (Hermes row).
Flutter snapshot hash	In `libapp.so` , find magic `f5 f5 dc dc` ; the 32 hex chars at +20 are the snapshot hash. Map it to a Dart version.
WASM	`wasm-objdump -x` , `wasm2wat` , `wasm-decompile` (WABT).
SQLite	Copy the db, plus the `-wal` file if present. `sqlite3 'file:C?mode=ro' '.schema'` , then `SELECT * FROM t LIMIT 20` .
plist / nib / car	`plutil -p F` . Info.plist holds the bundle id, URL schemes and privacy strings. Asset catalogs: `assetutil --info Assets.car` .
pcap / HAR	`tshark -r C -q -z conv,tcp` ; `tshark -r C -T fields -e dns.qry.name -e tls.handshake.extensions_server_name -e http.request.full_uri \| sort -u` . HAR: `jq -r '.log.entries[].request \| .method+" "+.url'` .
Firmware	`binwalk -e F` or `unblob -e X F` . Then route each extracted binary through this table.
Website	`curl -sL URL` for the HTML and script srcs, then fetch the JS and slice it. For runtime behavior, use a headless browser with a network log (Playwright `page.on('request')` ) or Chrome `--remote-debugging-port` .
Running app / runtime	macOS: `lldb -p PID` , `dtrace` / `fs_usage` / `log stream --predicate 'process=="X"'` . Electron main: `--inspect` (only if the RunAsNode/inspect fuses allow it). Android: `adb logcat` , `frida -U -f pkg -l hook.js` .

Speed patterns

Strings and imports first. On a small binary,
```
nm -u
```
+
```
strings
```
+ the export list usually answer "what does it do" with no disassembly.
To find who uses a string: get its address from
```
otool -tV
```
"literal pool for" comments, or
```
rg -n 'literal pool for: "X'
```
. Then find the enclosing function label above that line.
A C++ name in a
```
bl
```
target already tells you the protocol (for example
```
getpeereid
```
,
```
write
```
,
```
std::hash
```
). Read the call sequence, not every instruction.
For JS, go from the native/JS boundary inward: find the native call, then its caller class, then the IPC registration, then the renderer/preload.
Comparing versions: diff the inventories (
```
nm
```
, the module list,
```
go version -m
```
) before you diff any code.
Rebuilding: write the minimal reimplementation, then test it against the original (same inputs, same outputs).

Install (only on request)

brew install jadx apktool radare2 binwalk wabt wireshark ghidra

npm i -g @electron/asar

dotnet tool install -g ilspycmd

cargo install cargo-audit

leanrea

NPX Install

Tags

SKILL.md Content