dsh-rea-reverse-preset

English · 简体中文 · Architecture · Troubleshooting · Changelog

The documents under docs/ are written in Chinese; this README and the code comments are bilingual.

A reverse-engineering mode for DeepSeek Harness (dsh).

It adds one entry to the dsh preset picker. Select it and the agent carries the reverse-engineering tooling of REA (~139 tools over Ghidra / Hopper / IDA, binaries and Electron artifacts), a reverse-engineer persona, and an evidence-first analysis workflow skill — ready to work on a sample straight away.

What it does

• Disassembly / decompilation — Ghidra, Hopper and IDA through their headless or CLI entry points: pseudocode, cross references, call graphs, function boundaries.
• Binary reconnaissance — strings, symbols, sections, import/export tables, entropy, compiler fingerprints.
• Packaged artifacts — Electron .app and asar, APK / IPA, JS bundles: unpack, then analyse.
• Cross-checking — the same function compared across engines, so one decompiler cannot mislead you.
• Written findings — notes written as evidence then conclusion, not as guesses.

A missing engine only removes its own group of tools; everything else keeps working.

Why use it

Advantage	Detail
One command	npm run setup installs into every surface, probes engines, verifies, then tells you what to restart.
One bundle, four surfaces	Desktop app, dsh web, dsh-tui and headless share the same bundle — no per-surface config.
Leaves the host alone	It only adds a subtree to a preset; permissions, model routing, sandbox and persistence stay yours.
Portable	No machine-specific paths; engine locations come from environment variables.
Never resident	No engine at host boot: the tool list comes from a local manifest, REA starts on the first real tool call and stops itself after 10 idle minutes.
Fails softly	If REA cannot start, the mode is still selectable — just without its tools.
Clean uninstall	Remove the bundle and you are back to stock; the shipped composition is untouched.
Self-checking	npm run verify checks structure and portability offline; verify:profiles replays the real host loading path.

Install

One command (recommended)

npx -y dsh-rea-reverse-preset setup   # from the published package
npm run setup                         # from a checkout

It checks node / dsh versions and local profiles, installs into each surface, probes Hopper / Ghidra / Java / IDA, runs the checks, and prints a restart list. No questions, and re-running is idempotent.

npx -y dsh-rea-reverse-preset --check         # report only
npm run setup -- --write-env                  # write probed engine paths into ~/.zshrc
npm run setup -- --warm                       # fetch REA now and build the tool manifest
npm run setup -- --uninstall                  # remove from every surface

Per surface, manually

You use	profile	Command	Takes effect
Desktop app	desktop	dsh plugin --profile desktop add github:Verisw/rea-dsh	Quit the app fully (Cmd+Q), reopen
dsh web in a browser	web	dsh plugin --profile web add github:Verisw/rea-dsh	Restart dsh web
dsh-tui in a terminal	dsh-tui	dsh plugin --profile dsh-tui add github:Verisw/rea-dsh	Restart the TUI
dsh -p (scripts, headless)	headless	dsh plugin --profile headless add github:Verisw/rea-dsh	Next run picks it up

The desktop app and dsh web are separate profiles — installing into one affects only that surface. The desktop profile must exist first (the app creates it), so quit the app before installing.

dsh plugin itself needs Node >= 22.18 / >= 24: earlier Node versions lack import.meta.main, so the command exits 0 without doing anything. npm run setup probes this; see docs/troubleshooting.md §10 (zh).

Check what is installed:

node scripts/install.mjs

A local checkout install also shows up in the plugin store (dsh-plugin-hub) under your own plugins, where its publish button can push it to GitHub/npm. Being visible in the public store list is a separate matter — see docs/market.md (zh).

Use

1. Restart that surface.
2. /preset → 逆向工程模式 (reverse engineering), or /preset reverse directly.
3. /mcp lists the mcp__rea__* tools; the engine itself starts on the first real call.
4. Point it at a sample and say what you want to know — behaviour, protocol, validation logic, version diffs.

Two things worth knowing:

• A session with conversation history cannot switch presets — start a new session.
• The engine is not resident. Mounting the mode starts a small supervisor only; the tool list is read from a local manifest (~/.dsh/cache/dsh-rea-reverse-preset/) so all 139 tools are still registered. REA itself starts on the first real mcp__rea__* call (1–2 s warm) and stops after 10 idle minutes, then starts again on the next call. A fresh machine has no manifest yet, so the first startup launches REA once to build it — or run npm run setup -- --warm to do that up front, which also downloads the npx package.

Engine locations (optional)

Nothing to configure: REA discovers engines itself. Use these when you have several versions or a non-default location.

Variable	Purpose
HOPPER_LAUNCHER_PATH	Hopper CLI launcher. On macOS the default location is used automatically when present.
GHIDRA_INSTALL_DIR	Ghidra install directory. The version must match what REA expects (12.1.4 today).
JAVA_HOME	JVM used by Ghidra; only needed when the java on PATH is too old.
REA_IDA_MCP_CONFIG	IDA MCP config file — the switch for IDA 9.x.
REA_MCP_SPEC	Override the REA version, e.g. REA_MCP_SPEC=rea-agents@6.7.0, without editing this package.
REA_LAZY_IDLE_MS	Idle milliseconds before the engine stops itself; default 600000 (10 minutes), 0 keeps it running.
REA_LAZY_MODE	eager restores the old behaviour (start at host boot); default lazy.

dsh reads these at startup, so restart after changing them. An empty string counts as unset and is dropped.

Uninstall

dsh plugin --profile <desktop|web|headless|dsh-tui> remove dsh-rea-reverse-preset
npm run unlink:all        # when installed through local symlinks

Troubleshooting

Symptom	Check first
No reverse-engineering entry in the preset list	Installed into a different profile, or not restarted; a dsh version outside the supported range skips the whole bundle.
Mode present, zero REA tools	Cold npx start timed out, an empty env value, a wrong engine path, or a proxy.
Fewer tools than expected	That engine was not found (IDA, typically) — expected behaviour.
Skills not mounted	The package was moved, or two copies are installed in one profile.
Config changes ignored	dsh reads this at startup only; restart the process.
A rea mcp process with no reverse session open	An older build that connected directly, or REA_LAZY_MODE=eager.
Not listed in the plugin store	The store builds its list from GitHub repos matching topic:dsh-plugin — see docs/market.md.

Step-by-step diagnosis: docs/troubleshooting.md.

Notes

• The package declares exactly one preset (id: reverse) containing 21 top-level rows / 34 plugin rows, packaged as a dsh bundle, so dsh plugin add is all it takes.
• Host requirement: @deepseek-ai/dsh >=0.2.0-rc.2 <0.3.0-0. Outside that range the bundle is skipped with a notice instead of breaking your composition.
• How it loads, why it is built this way, the !!js evaluation environment and the compatibility gate: docs/architecture.md.
• Store metadata (title, categories, README screenshots) and how the listing is discovered: docs/market.md. npm run market:check prints a readiness report.

License

MIT — see LICENSE. This package calls REA (MIT) without bundling its code. Ghidra, Hopper and IDA keep their own licenses; none is shipped or managed here.