Get REA connected before you investigate anything.
Check Node, preview setup, connect your chosen agent, and verify the workflow you actually need.
Read the guideFOR THE CURIOUS. AND THE BUILDERS.Take software apart.
Take software apart.
Put understanding
together.
That app feature you keep wondering about?
Let’s find out how it actually works. Practical guides, real evidence, and a little healthy curiosity.
✓New to reverse engineering? You’re in the right place.
POCKET-NOTES / EXPORT INVESTIGATION
› “What happens when I click Export?”One question. Follow the evidence.
renderer.js
the button
→the button
preload.cjs
the bridge
→the bridge
main.cjs
the file writer
the file writer
01 Found the exposed notesAPI bridge
02 Matched the notes:export IPC channel
03 Located the CSV writer and cancellation branch
STATIC FINDINGA connected export path. Runtime still to check.
✓ILLUSTRATED FROM OUR RECORDED LAB · NOT A LIVE TERMINAL
ONE PROJECT. MANY WAYS IN. JavaScript & Electron Native binaries Browser behavior Android apps Real-world case studies
CHOOSE YOUR STARTING POINT
A SMALL QUESTION IS A GOOD START.What brought you here?
01 / THE FIRST-TIMER
“I’m new to all of this.”
Get the idea, connect your agent, and follow one small feature from start to finish.
Take the beginner path02 / THE INVESTIGATOR
“I have something to take apart.”
Pick the right workflow, trace the behavior, and check what the evidence really tells you.
Find your next investigationFROM THE FIELD NOTES
All 15 guides A little less mystery. A lot more how.
6 guides
Follow an export button all the way to a CSV file.
A small, reproducible Electron lab with actual REA findings, source files, and a clear boundary between static evidence and runtime proof.
Read the guideBetter REA prompts start with a smaller question.
Copyable prompts for locating a feature, tracing evidence, checking unknowns, and planning a reconstruction.
Read the guideThe interesting part of an Electron button is often the bridge.
Read renderer, preload and main-process relationships without assuming that matching names prove runtime behavior.
Read the guideDo you actually need Ghidra, Hopper, or IDA?
Choose an analysis route from your target instead of installing every tool before your first investigation.
Read the guideA convincing explanation still needs something you can check.
Keep observations, interpretations and unknowns separate before you turn an investigation into code.
Read the guideNo guides in this view.
Choose All notes to see the featured collection.
A HABIT WORTH BUILDINGGood investigations end
Good investigations end
with evidence. Not guesses.
What did the tool find? What are we inferring? What’s still unknown? We keep those questions visible, so you can trust what you’re learning.
Learn to read the evidenceINVESTIGATION NOTE / POCKET NOTES EXPORT
OBSERVEDThe preload invokes
The main process registers the same channel.
notes:export.The main process registers the same channel.
INFERREDThis bridge connects the page’s export action to the CSV writer.
UNKNOWNWhether a runtime save completes correctly.
Static analysis alone cannot prove it.
Static analysis alone cannot prove it.
BEYOND THE HEADLINES
Explore the case studies Real work. Worth a closer look.
NATIVE / DX-BALL
A sound effect. A small function. A checkable result.
How a documented reconstruction follows instructions and constants to recover a game’s sound-pan calculation.
Read the case study ELECTRON / NOTIONWhat really travels when you copy a block?
An attributed look at the clipboard bridge between page code, Electron, and structured content.
Read the case study ANDROID / AEGISSix digits. Thirty seconds. One useful question.
A published APK investigation follows a code generator, then checks its behavior with public test data.
Read the case studyCase studies credit the original investigators. Their findings are reported with their original scope and limitations.
FOLLOW YOUR CURIOSITY
One good question leads to the next.
Keep a reading list, explore the sources, or follow new field notes in your RSS reader.