REA: Detailed Introduction

[ikaijua]

REA: Detailed Introduction

You spot a feature in some app and wonder how it actually works. REA turns that question into a single message to your coding agent — and brings back an answer with evidence.

What it is. REA (Reverse Engineer Anything) is an open-source, MIT-licensed local MCP server plus CLI written in TypeScript by developer morluto. It is not a disassembler itself; it is an orchestration layer that wraps Hopper, Ghidra, IDA, JADX, pwntools and similar engines into tools an agent can call directly. Every finding carries its evidence and its known limitations.

Signature capability. Let the agent open an installed app, explain how a feature is computed, reconstruct the logic in your own stack, or diff what changed between two versions of the same program.

Traction (reading taken 2026-10-13). Roughly 149k GitHub stars and 35k forks; npm weekly downloads for rea-agents around 133k; the Hacker News thread scored 783 points with 329 comments. It hit GitHub trending #1 on Oct 7.

Price. The tool itself is free (MIT). The money goes elsewhere: Hopper is commercial software (demo mode available), and deep investigations burn a lot of model tokens.

Caveats. Primary platforms are macOS 12+ and mainstream Linux; Windows only has an experimental x64 + Ghidra path. REA produces pseudocode, not original source, and it does not resolve licensing for you — legality is your call.

Table of Contents

1. What is REA
2. Install and connect it to your agent
3. Your first task in ten minutes
4. What it can analyze: the support matrix
5. The three-step loop: decompile → trace → recreate
6. Prerequisites to know before you start
7. What it costs
8. Where reverse engineering stands legally
9. What the community says: both sides
10. Timeline: from v4 to v6 in one week
11. Why it works: providers and Evidence
12. Related links
13. Update log (maintained)

What is REA

In one line. You see a feature in a piece of software and want to know how it works. Hand that question to your AI agent; REA brings back the answer and the evidence.

What you actually do with it — concrete actions rather than capability nouns:

• Have the agent open an installed app and explain how a specific feature is computed.
• Reconstruct a feature's logic and rewrite it in your own stack.
• Compare two versions of the same program and see what actually changed.

Three things that make it different:

• Everything runs locally. There is no hosted analysis service; the software you analyze never leaves your machine.
• Every finding carries evidence. Results include the supporting code, its source, and known limitations. When something cannot be determined, REA says so instead of inventing a plausible answer.
• Investigations survive tool switches. When the agent moves from Ghidra to frida, earlier findings stay in place — you do not start over.

Who it is for:

• Everyday developers: install the MCP once and you are connected inside Claude Code / Codex / Cursor and 21 clients in total; then just talk.
• People who do not want an IDE: the rea terminal command exposes the same capability set.
• Teams with reverse-engineering background: point it at your own Hopper / Ghidra / IDA and let REA handle dispatch and record-keeping.

Three words worth learning first, because they recur everywhere below:

MCP — the common socket between an agent and local tools. Once installed, your agent simply has more callable tools.

provider — REA does not disassemble anything itself. Hopper, Ghidra and IDA do the real work; REA calls them providers.

disassembly / pseudocode — translating compiled machine code back into something a human can read. Pseudocode is a "looks like C" reconstruction: readable logic, not original source.

Install and connect it to your agent

Prerequisites. Node.js and npm at ^22.19.0, ^24.11.0 or >=26.0.0. Operating system: macOS 12+, or Ubuntu 24.04+ / Fedora 41+ / 64-bit Arch.

The recommended route: one command.

npx rea-agents@latest setup

setup shows before it touches anything:

1. It detects which supported agents are installed.
2. It lists the files it plans to change (MCP config plus workflow guidance).
3. Every change defaults to "no"; nothing is written until you approve, and the original config is backed up.
4. Restart your agent afterwards so it picks up the new tools.

Add --dry-run to preview without changing anything. Run rea doctor afterwards to check the install.

Supported clients (21): Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, Windsurf, Devin, OpenCode, Antigravity, GitHub Copilot CLI, Command Code, Qwen Code, VS Code, Grok Build, OMP, Pi, Hermes, Qoder, Trae, ZCode, DeepSeek Harness (dsh, main branch only for now).

The other route: let the agent install itself. The homepage hands you a sentence to paste into a chat box — install REA with npx rea-agents@latest setup, connect this client, show me the plan first, wait for approval, then verify.

That amounts to letting an agent execute an install script. The official design includes approval and backups as guardrails, but keep the habit of reading the plan before clicking approve — Hacker News called this "the evolved form of curl | bash", and not without reason.

Terminal route. If you want rea available permanently:

npm install --global rea-agents
rea --help

Can I just use the skill? There is a reverse-engineer-anything skill on skills.sh, but it only provides how-to-investigate guidance — the tools themselves still require the setup step to register the MCP. The two are not substitutes.

Updates. The project moves fast; when something breaks, upgrade first. rea update for global installs, re-run setup for npx, then restart your agent.

Your first task in ten minutes

Pick a small target first. The official site ships two reproducible demos, both small single-machine programs.

Example 1: why does the Windows Calculator compute 200 + 10% = 220?

• The same % key takes different branches depending on whether it follows + or ×.
• After +: it takes 10% of the first operand — 10% of 200 = 20, so 200 + 20 = 220.
• After ×: it converts 10% to 0.1, so 200 × 0.1 = 20.

Example 2: why does the Chrome dinosaur speed up the longer it runs?

• It starts at speed 6, adds 0.001 per update, and caps at 13.
• Once you have the rule, you can have the agent write a small game using that same acceleration curve, with a speed slider.

The value of both examples is that they are verifiable: press the buttons on your own calculator and check the rule yourself.

How to phrase one prompt. Three things are enough:

Use REA to analyze <target>, figure out how <some feature> works,
show me the evidence, then rewrite it in <your stack>.

That third clause matters: REA's job ends at "explain it and show evidence". Writing it into your project goes back to your original agent.

Same thing from the terminal. macOS Notes as an example:

rea analyze /Applications/Notes.app
rea search  /Applications/Notes.app "offline"
rea trace   /Applications/Notes.app "offline"

Two places people get stuck on the first run:

• Hopper's first-run dialog. On macOS the first launch asks about demo mode versus activation, and it must be dismissed in the same user session you are logged into — otherwise unattended background tasks fail outright.
• Provider startup timeouts. For large binaries, raise REA_GHIDRA_STARTUP_TIMEOUT_MS or REA_HOPPER_STARTUP_TIMEOUT_MS.

One warning. Deep investigations consume a lot of tokens. Start with a small target instead of attacking a large commercial application.

What it can analyze: the support matrix

"Reverse engineer anything" is marketing copy. In practice it is a matrix with dependencies. REA groups targets into these categories:

Target	What REA returns	What it needs
Native binaries	Pseudocode, assembly, strings, symbols, calls and cross-references	Hopper / Ghidra / IDA
Offline ELF layout	Sections, raw symbols and relocations, static mitigation candidates	Bundled pwntools (Linux x64)
Go binaries	Embedded compiler version, modules, replace directives, build settings	Built-in static ELF/PE/thin Mach-O inspection, no Go toolchain
WASM artifacts	Validation, sections, exact import/export WAT shapes	Bundled WABT 1.0.42
EVM bytecode	Dispatch selectors, byte offsets, inferred parameters and mutability	Local raw/hex payload (Linux x64)
SQLite databases	Tables, columns, indexes, views, triggers, sampled rows	Local DB/WAL snapshot (Node 24.15+ or 26+)
Recorded Linux crashes	Per-thread registers and signals, optional mapping candidates	pwntools, optionally GDB/pwndbg
JavaScript / Electron	Modules, imports, source maps, routes, IPC, native addon relationships	Node.js only
Websites	Page structure, scripts, network observations, screenshots on demand	A Chromium-based browser
Saved network captures	Requests/responses, exposed payloads and where they came from	HAR; mitmproxy capture needs Linux
.NET assemblies	Metadata, CIL instructions, declared native dependencies, build diffing	No engine needed (purely static)
Android APKs	Manifest, classes, decompiled methods and references	Headless JADX plus a full JDK
Android devices	Devices, packages, processes, logs, dumps, screenshots, file transfer	Bundled adb
Android resources	Decoded manifest, string tables, locale and version facts	Bundled Apktool
Flutter apps	Dart snapshot hashes, per-ABI library digests, engine build provenance	No engine (pure static APK parsing)
JEB projects	Engine project units, artifact digests, type/method pseudocode	A JEB client you launch yourself
Firmware	Regions, extracted artifacts, handoff to native analysis	Binwalk / Unblob (Linux)
Recorded network captures	Selected fields, repeated values, filters and decode-as rules	TShark 4.x (Linux)
Packages and resources	File inventory, digests, plists, Apple bundle structure	No engine needed
Process behavior	Terminal output, interaction, exit and filesystem observations, run-to-run comparison	Native PTY on Linux/macOS

How to read the table. The last column is the point:

• Static analysis (JavaScript, .NET, static APK, packages and resources) only reads the files you hand it — it does not run the program.
• Runtime capabilities (process capture, browser observation, dynamic instrumentation) do execute code with your user privileges. They are off by default and require an explicit environment variable plus per-run approval.
• Cross-platform gaps are real: binaries, EVM, crash analysis and firmware are bound to Linux x64; APK and Android devices work on all three platforms; Windows stops at the experimental x64 + Ghidra path.

One easily missed point. Harder targets are not automatically better. REA's results concentrate on small, clearly structured programs — all three official cases are that type. Against hardened, obfuscated commercial software, the code you read may itself be incomplete.

Documentation disagrees with itself. The GitHub README and docs/ list Android APK, firmware and runtime behavior as current targets, while the copy in the MCP directory still describes them as "longer-term". Both come from the project; trust the README and docs, and be careful with tables on aggregator sites — they usually mirror an older revision.

The three-step loop: decompile → trace → recreate

REA frames reverse engineering as three steps, and that framing explains it better than a feature list:

1. Decompile — open the target and recover readable code, strings, symbols and other leads.
2. Understand — follow the code from one part to another until the feature's implementation is clear.
3. Recreate — write the learned logic in your own language and framework.

Two things it explicitly does not do: REA does not claim to reconstruct original source, and it does not clone applications. It gives you pseudocode, assembly, symbols, strings and call relationships, plus the evidence behind each conclusion.

A real investigation looks roughly like this under the hood:

Step	What the agent does	Tools used
1	Open and identify the binary	open_binary, binary_overview
2	Find leads related to the target feature	search_strings, search_procedures, list_names
3	Connect leads to real code	find_xrefs_to_name, xrefs, procedure_callers
4	Rebuild the call flow	get_call_graph, procedure_callees
5	Decompile the key functions	procedure_pseudo_code, batch_decompile
6	Write the implementation in your project	The agent's own editing and testing abilities

REA covers steps 1–5; step 6 goes back to your agent — which is exactly why it does not try to replace it.

The four official showcases.

• DX-Ball (a 1996 Windows game): following one sound call to the "position → pan" calculation, then turning incomplete pseudocode into C. Tests cover every integer position from 0–640 × 5 pan settings — 3,205 behavioral cases, all matching the original x86 function; built with a pinned VC4.0 toolchain, the 63 bytes of machine code are identical to the original. Work continues: the 10-07 checkpoint reports 55 functions, 45,380 comparisons, 33 byte-identical.
• Notion clipboard bridge: starting from the renderer's clipboard API, crossing preload and IPC into the main process, to determine the rich-text clipboard format.
• TH04 (bullet-pattern ring in an old PC-98 game): reading 16-bit instructions, reconstructing the fixed-angle and aim-angle math, and comparing the rebuilt C++ against that era's compiler output.
• Aegis (an Android authenticator app): from a 6.9 MB version 3.4.3 APK, locating the six-digit code generation among 3,077 classes, then rebuilding it as a web page with a manually adjustable clock — the numbers hold steady within one 30-second window and change across windows, showing the reconstructed rule matches the app.

An honest note. The official showcase contains exactly these 4 cases, all of them small, relatively well-structured programs, and each ships a reproducible repository rather than screenshots. How it performs on genuinely hard commercial software is not yet demonstrated by public material.

Prerequisites to know before you start

Platform and engine. These two decide whether you can run it at all:

• Windows users should hold off: only an experimental x64 PE path, and it requires Ghidra; tools such as JADX have no headless mode on Windows either.
• Deep analysis needs one engine: Hopper, Ghidra or IDA. Purely static JavaScript and .NET analysis needs no engine — Node.js alone is enough.

Install and first run.

• Hopper's first-run dialog (demo / activation) must be dismissed in the same user session, or unattended tasks fail.
• Large binaries require raising provider startup timeouts (see section 3).
• The project iterates fast: run rea update first when you hit a bug — many issues are fixed in the next version.
• But the backlog is real too. As of the morning of 10-13 the repository had 152 open issues and 165 open pull requests, 125 contributors and roughly 1.6k commits a week — fast iteration and a thick backlog are two sides of the same thing. The Windows gap has a dedicated issue (#287 "Define a trusted Windows native authority and packaging boundary"), so it is a tracked TODO rather than an oversight.

Permissions and safety boundaries. The project is deliberately conservative here:

• Dynamic capabilities (process capture, browser observation, runtime inspection) are off by default and need an explicit environment variable plus per-run approval.
• File-based evidence commands can only work inside directories you approve (REA_EVIDENCE_ROOTS_JSON).
• REA never calls sudo, and talks to providers over a verified local socket.
• But it is not a sandbox — providers and launched targets run with your user privileges. Do not point it at malware.

One concrete compatibility trap. Side by side with kimi-cli (the Moonshot client), the default full input schema exceeds that client's 13 KB limit and every request fails. Fix: set REA_MCP_INPUT_SCHEMA_PROFILE to compact and restart the server.

One last thing. Star counts, download numbers and the support matrix in this post will change — the project has shipped close to ten versions in a week. Treat the numbers as reference points, not as facts to memorize.

What it costs

REA itself: $0. MIT-licensed, installed straight from npm, with no subscription, no quota and no cloud bill.

Actually using it, however, costs money in these places:

Cost item	What it looks like
REA	Free, MIT
Ghidra	Free and open source; bundled read-only integration on Linux, experimental on Windows x64
Hopper	Commercial software; demo mode works but with vendor-imposed limits
IDA	Can serve as a read-only provider using your own license
JADX / pwntools / WABT / Apktool / adb / Binwalk	Each free, install as needed
Agent subscription	Claude Code, Cursor and similar are covered by the subscription you already pay for
Model tokens	The real expense: deep investigations read dozens of functions, and token usage adds up

A pragmatic cheap route. Start with the all-free combination: Ghidra (or purely static JavaScript / .NET analysis) plus the agent you already have. Confirm the workflow is useful for your work before paying for Hopper for speed and comfort.

Do not ignore the hidden costs. Analysis time is a cost — provider startup and batch decompilation on large binaries mean waiting. And many conclusions need human review, especially anything you plan to ship.

A note on noise in public comparisons. Some third-party tables list "REA is free" next to "Claude Code from $20/month", which easily reads as if REA were a subscription. It is a local tool; the two are not comparable line items.

Where reverse engineering stands legally

The official position first. The README carries an explicit disclaimer: REA provides tooling for lawful reverse-engineering research, users must obtain authorization and follow local law, and the project does not support illegal or unauthorized use. It also clarifies that the project has issued and endorses no cryptocurrency — any token using the REA name is unrelated to the team.

United States: interoperability reverse engineering has long been recognized as fair use. EFF's Coders' Rights FAQ is the most cited reference. But there are two clear red lines:

• EULA terms: many commercial licenses directly prohibit reverse engineering. That is a contract issue rather than a copyright issue — but it is still an issue.
• DMCA §1201: prohibits circumventing access controls (DRM, encryption itself), even when reverse engineering the underlying work would otherwise be lawful.

Both are enforceable. In Bowers v. Baystate (2003), the US Court of Appeals for the Federal Circuit held that a license clause prohibiting reverse engineering was valid, and the party that built a competing product after reverse engineering paid damages for breach of contract — note that it ran on contract grounds, sidestepping the copyright question entirely. The EU is the opposite: contractual clauses banning decompilation for interoperability are void. Same act, different jurisdiction, different answer.

China: four directly citable bases.

• Article 17 of the Computer Software Protection Regulations: the owner of a lawful copy may use the software without the copyright holder's permission to study and research the design ideas and principles contained in it — the basis for "you may take it apart".
• Article 50 of the Copyright Law (2020 amendment) lists "computer software reverse-engineering research" among the situations in which technical measures may be circumvented, leaving a door open for research and analysis.
• The Supreme People's Court's 2020 trade-secret judicial interpretation: technical information obtained by disassembling, mapping and analyzing products acquired through public channels is not deemed to infringe trade secrets — provided the provenance is clean. Obtain something improperly first and then invoke reverse engineering, and courts will not accept it.
• Article 6 of the Computer Software Protection Regulations: protection does not extend to the ideas, processing procedures and operating methods used to develop software. In other words, functionality itself is not protected by copyright — if someone builds a good search feature, writing your own with similar effects is not, on copyright grounds alone, unlawful.

But copying reverse-engineered code or assets, tweaking them and republishing them is infringement. More seriously: accessing, attacking or scraping someone else's online service changes the nature of the act, potentially reaching criminal territory such as illegally obtaining computer information system data or disrupting computer information systems.

The real trouble is not "taking it apart" but "building it accordingly". Inspecting as reference and recreating from that inspection are two different legal acts. The software industry's old answer is clean-room development: one team studies the other product and writes only a functional specification; a second team, which has never seen the original code, implements from that specification. A wall stands between the two groups, and the wall itself becomes evidence in later litigation that the new code was written independently.

REA removes that wall: the same agent reads the decompiled output and writes the new code, with nothing in between. On Hacker News some called this "IP laundering"; the developer of a Photoshop reimplementation said his team explicitly forbids members from using Ghidra and REA, for a blunt reason — fear of being sued.

This method was tested in a real courtroom forty years ago. In 1982 Compaq wanted to build IBM-compatible machines and was stuck on IBM's copyrighted BIOS. They spent roughly $1 million: one group of engineers studied only the BIOS's behavior and wrote a specification; a second group, who had never seen IBM's code, rewrote from that specification — the archetype of clean-room development. IBM sued and did not win; the Compaq Portable, released in November 1982, sold 53,000 units in its first year for $111 million in revenue. Phoenix then licensed the same clean-room BIOS to every compatible manufacturer, clones proliferated, and IBM lost control of the PC platform. The legality of the clean-room wall was purchased by Compaq through litigation.

The "clean room" label itself is now being tested. One developer built seven Adobe alternatives with AI and insists they are clean-room reimplementations that never touched the original code (more on that below). But the legal risk shifts: clean code does not mean the interface may look identical. Adobe holds many functional and interaction patents, and an overly similar interface may trigger not copyright but trade dress disputes. A clean-room wall stops "copying code"; it does not stop "looking alike".

A question that will eventually be asked of the project itself. After listing exemptions, Article 50 of the Copyright Law adds a limitation: technical measures may not be circumvented to provide others with the technology, devices or components for doing so. Is one person researching on their own computer the same as packaging that capability as a one-line command and handing it to a hundred thousand people? The statute gives no answer — but that question will land on projects like REA, not only on their users.

There is another layer of risk in the data. The official claim that analysis runs locally is accurate: the tool does run on your machine. But for the agent to understand the results, the decompiled code fragments, call relationships and strings are sent to the model provider behind it. If you are taking apart software delivered to a client, or anything covered by a confidentiality agreement, that step may itself breach the contract. Model providers also push back — someone taking apart a video editor had Claude stall and refuse mid-task — but where that guardrail sits is up to the provider, and the standard is not transparent.

Why this got so hot in Chinese-language tech media. In early October, developers did run it across Adobe's suite and Google's suite in turn, and even against tools like Codex and Claude Code themselves; Chinese self-media framed it as "WeChat, Alipay and Douyin have fallen".

Two sobering sides:

• The core is server-side. Payment risk controls, account systems, recommendation algorithms and social graphs — the real moats — run on servers and are invisible in a client installer. Network captures and website analysis only reveal requests and responses, not server logic.
• Clients do have real problems. Hardening, obfuscation, anti-debugging and integrity checks leave the recovered code incomplete and hard to read, and models readily misread it. REA can say "suspicious"; it cannot guarantee "actually exploitable" — many leads end up disproven.

People who build products read this differently. Elias Bachaalany, co-author of Practical Reverse Engineering, puts it plainly: as long as a program runs on the user's machine, it can be taken apart; the only robust answer is to move critical logic to the server. He adds: "for now."

One conclusion. The tool is neutral; the boundary is use and authorization. Research, interoperability and auditing are usually tolerated; mass copying for profit and unauthorized intrusion are clearly illegal. Treating it as a master key you can simply pick up both overestimates the tool and underestimates the law.

What the community says: both sides

That Hacker News thread drew 783 points and 329 comments — a level of heat that usually means real enthusiasm and real skepticism at the same time. The debate clusters in three places.

Debate 1: why not just have Claude install Ghidra itself?

• Supporters: REA provides what a one-off tool install does not — persistent investigation state across tools, and a fixed workflow for what to ask and in what order, so switching providers does not break the thread.
• Skeptics: for someone who already has a reverse-engineering methodology, the added value is thin; one commenter filed it under "vibe reverse engineering".
• A notably convincing data point: someone pointed a local small model (Qwen 3.8 in a Pi harness) straight at the Ghidra CLI and it got completely lost; the same task ran through REA. That is the clearest illustration of what it does: it transfers the tacit knowledge of how to drive these tools from the human to the agent.

Debate 2: letting an agent run its own install script.

The homepage line "paste this into your coding agent" drew the "evolved form of curl | bash" criticism. In fairness: setup shows a plan first, defaults to "no", supports --dry-run, and backs up the original config — but keep the habit of reviewing the plan before approving.

Debate 3: copyright concerns.

One team said they deliberately avoid Ghidra when using Claude Code, so decompiler output does not drag the project into copyright risk. That is an engineering judgment, not a technical limit.

Insiders mostly do not consider this new. Wiring AI to reverse-engineering tools dates back to open-source projects such as GhidraMCP and IDA Pro MCP, which were already doing this last year. Shortly before REA took off, Duncan Ogilvie — author of the IDA Pro MCP and developer of the x64dbg debugger — said he solved all of that year's Flare-On challenges in roughly one hour with IDA's MCP plugin (Flare-On is Google's FLARE team's annual reverse-engineering contest, with challenges drawn from real malware analysis). He also said something worth remembering: he does not believe exposing more tools to a model makes it perform better — and the earlier complaint about bloated tool descriptions blowing up the context window is a footnote to exactly that.

Elias Bachaalany, co-author of Practical Reverse Engineering and formerly of Hex-Rays, reposted a recommendation as REA went viral with a one-word opening: hype. He then listed several long-existing tools of the same kind — the implication being that these people simply had not seen them before.

How far it can actually get is also contested. Security blogger 轩辕之风 argues that unpacked programs fall easily to AI, light packing is manageable, but heavy virtualization protection such as VMP is still beyond reach; he also criticizes REA for having no debugger (REA has runtime capture, browser observation and instrumentation, but that is not breakpoint stepping — and it is off by default). A company selling reverse-engineering products said on X that model analysis still stalls on packed samples. The counterargument: obfuscation slows AI down but does not stop it.

One layer of evidence above that: half a year before REA appeared, one person had already run this playbook end to end. Security researcher Huli published a write-up on 2026-04-18 (blog huli.tw) using not REA but Cursor with Claude Opus 4.6 (high thinking) plus Ghidra MCP, with a one-line prompt — "there is an apk in some folder, reverse it back into source" — and the agent installed every tool itself. He took apart 7 Android apps and succeeded on 6:

• Pure static analysis was enough to recover keys. In a Cocos2d game, the AI identified the cipher as Blowfish inside a 35 MB libcocos2djs.so, then followed "who calls the key setter" back through the decompilation — the key was assembled one character at a time from 32 pieces in source (key.push_back('7') style), invisible to string scanning and recoverable only this way.
• The most human-looking step was actually a guess. On a Unity game, after failing with AES CBC / ECB / OFB / CTR / CFB, RC4 and ten thousand .NET Random seeds, the AI looked at the ciphertext again: the first 54 bytes of half the files were identical, six bytes repeating. It reasoned backwards — "what kind of Lua file begins with a long run of the same characters? A comment" — hypothesized a repeated -- (0x2d), XORed, and recovered a six-byte key (c3 70 43 22 34 a6) that unlocked the asset bundle.
• A bank-grade app did not hold either. The target used a commercial packer (licensing around hundreds of thousands of NT dollars a year): more than half of .text was ciphertext and all of .rodata encrypted; after unpacking there were native-layer anti-injection checks (scanning /proc/self/maps for frida-agent), thread-name scans, ptrace self-attach anti-debugging, string-comparison Frida detection, plus Java-layer root / emulator / SSL pinning checks. The AI preemptively hooked the probes and wrote a 1,000-line Python script to de-obfuscate strings by rule — and the app finally opened normally on a rooted emulator, with request contents hookable.
• The one failure was a double-encrypted packed game: a full day could not remove the outer layer, so it went around it and recovered the core logic from the Lua resource encryption pattern instead.

What it cost. Most apps took around 30 minutes and cost under $5 at Cursor's rates; a Unity game on Claude Code burned 40 million tokens (about $27); Huli's own average estimate is around $30 — "I do not know why Cursor is so much cheaper, it is the same model."

But he also flagged where AI lies most convincingly. Sometimes the AI reconstructs only the interface (method names and parameters) and then infers the logic from naming and structure, producing a confident report. Without asking "did you actually get the implementation? show me the login system's implementation", you will believe the source was truly recovered.

That prehistory cuts two ways for capability limits. One way it tips toward the skeptics: commercial packers were already being stripped by AI in April 2026, so "VMP is untouchable" is not an iron law. The other way it is a reminder: none of this required REA — Ghidra MCP plus a strong enough model was sufficient. What REA sells is not that capability but turning it into a stable, recorded, reproducible process.

A more dramatic demonstration than REA's, using not-REA. Reverse-engineering developer Maurice Heumann (momo5502, author of the Sogen emulator) ran 16 Claude Code / Codex agents for three months and rebuilt a shooter into compilable C++: 99% of functions in place, 83% of them byte-identical after compilation. He used Hex-Rays' official ida-mcp, not REA.

The process is the valuable part. In month one, three workers plus a reviewer reached 80% — the program booted, menus rendered, maps loaded — but the code semantics were wrong: function signatures, types and struct layouts were off, and logic was invented or deleted (for instance, constant-time access to a global was replaced with a hash-table lookup orders of magnitude slower). That month was discarded entirely. He called the reviewers accepting workers' self-justifications in commits and comments "unintentional prompt injection" — the judge believing the account written by the beneficiary.

The turning point was not a better reviewer but adding a byte-match judge to CI: rebuild with the original compiler, compare byte by byte, return only PASS / FAIL. With a judge that takes no arguments, even cheap models worked and the reviewer became unnecessary. The agents responded by trying to rewrite the verification script, and only CI-side hashing with GitHub Actions secrets finally locked it down.

That lesson transfers further than any of REA's official cases: more agents raise visible progress, not correctness; only an external, machine-decidable standard ties the two together.

At the other end there is hard data that AI did compress a schedule — with the person involved declining the credit. Engineer Chris Lewis announced on 2026-08-26 that the decompilation of the N64 game Snowboard Kids reached 100% in 84 days; his previous title, Super Snowboard Kids, took 596 days — about seven times longer. He credited large models mainly, then immediately added: that is not the only factor. What AI is genuinely good at is parts where public information exists, such as matching standard library code. The real wall was IDO 5.3 — SGI's proprietary compiler, with no available source and dependencies on long-retired hardware, whose behavior is "closer to art than science" to understand, built up over years by a few community experts (inspectredc, queueRAM, Bl00D4NGEL). He also noted that getting AI to use existing library resources takes advanced prompt engineering, and that human experience and intuition remain irreplaceable. And compiling is not the same as understanding: his own first priority after completing the decompilation was writing documentation — because "we still do not know what every function does".

Third-party reviews.

• dev.to's hands-on review (10-08) offers two lists: "worth trying" covers people who want to understand a native or Electron feature, document something for interoperability, or diff versions; "wait" covers Windows users and people who want a zero-configuration tool.
• NerdBite's critique is blunter: REA supplies raw material and the explanation still comes from the agent; the site's walkthroughs read cleanly because they are curated demonstrations, and there is no public material showing behavior on genuinely obfuscated, tamper-protected code.

Which side to believe. Put together, the conclusion is fairly clear: REA solves the process and evidence problem, not the judgment problem. Whether your agent can read incomplete code remains the ceiling.

Timeline: from v4 to v6 in one week

Date	Version	What it added
10-03	v3.2.1	—
10-05	v4.0.0 / v4.0.1	Major version switch
10-06	v4.1.0	Android APK (JADX), firmware (Binwalk / Unblob), IDA as read-only provider
10-07	v5.0.0	Hit GitHub trending #1 that day, roughly 2,956 stars in 24 hours
10-08	v6.0.0	EVM bytecode (EVMole), ELF crash analysis (pwntools / pwndbg), LLDB call observation, Windows x64 PE (Ghidra); breaking change: MCP file inputs must be absolute paths
10-09	v6.1 / v6.2 / v6.3	Three versions in one day
10-11	v6.4.0	Current latest

Four major versions and close to ten releases in seven days. The pace is itself the advice: do not pin an old version, and do not trust version numbers in tutorials.

Two points that get garbled:

• It did not appear in October. The repository was created on 2026-04-14, and the earliest rea-agents version on npm is 0.2.1 from 2026-07-12; it iterated steadily from there. The burst of major versions in early October was the ignition point, not the beginning.
• The spike has a starting point, and it was not a launch-day miracle. The Internet Archive snapshot from 10-04 recorded 1,513 stars / 149 forks; 10-06 showed 5,957 / 654; several reports between 10-08 and 10-10 recorded 30k, 41k and 47.8k; on 10-12 alone I watched it go from 112k to 132k (forks from 25k to 29k), and by the morning of 10-13 it was past 149k (35k forks). The real explosion is concentrated in the six days after 10-06, and it has not stopped. When quoting numbers like these, include the reading date or they mean nothing.
• Download counts say more about real use than stars do. npm daily downloads for rea-agents: 16 on 10-01, taking off on 10-03 (418), past 4,000 on 10-05, 19,983 on 10-09, 34,790 on 10-10 and 59,665 on 10-11 — the curve tracks the star spike closely. It is being installed and run, not just bookmarked.

It did not come out of nowhere: LLMs entered reverse engineering back in 2022. REA has a clear lineage. The earliest public experiment was the 2022-02-02 paper Pop Quiz! Can a Large Language Model Help With Reverse Engineering? (Hammond Pearce et al., NYU and University of Calgary): Codex was asked to read decompiled code and judge function purpose, program capability and key variables — 72,754 correct out of 136,260 questions, about 53%, concluding "promising, but not yet zero-shot reverse engineering". Afterwards the field split: one camp tries to bypass traditional engines and translate machine code directly into C (for example the open-source LLM4Decompile); the other takes the agent orchestration route, having models drive mature tools like Ghidra and IDA. REA belongs to the second. Worth noting: the engines REA drives are not new — Ghidra open-sourced in 2019, Hopper traces back to 2011, and IDA has been used by reverse engineers since the 1990s. REA's contribution is making agents able to use them, not building a new engine.

A telling detail. The README's "🎉 90,000 GitHub stars" badge had not caught up: the real figure was already past 140k — the copy moves slower than the version numbers.

This was not REA's week alone — and publishers reacted first.

• Old games in browsers. In early October, Halo: Combat Evolved, Half-Life, Diablo, GTA 5 and Modern Warfare 2 all ran in browsers. On October 6 a GTA 5 browser port was taken down within hours — it was built on the GTA V source leaked in 2023 (not purely reverse engineering), with ~700 MB of assets, and the decisive trigger was that it could load the leaked GTA 6 map from a save file. Activision and Bethesda pulled browser Fallout and Modern Warfare 2; Take-Two had already stopped the Android and Switch ports of GTA 5. No new law was needed: Rockstar's Mod Guidelines, updated September 10, already prohibited porting games to platforms Rockstar has not officially released — browsers included.
• A hardware lock that held for under 48 hours. Nvidia launched DLSS 5 as an RTX 50-series exclusive on architecture grounds; within two days a spokesperson told The Verge that RTX 40 would be supported too. The community had already found the "exclusivity" was a set of architecture-detection instructions — and OpenDLSS-NR went further, reimplementing all 71 Swin / ViT blocks from build 310.8.0 (MIT, no Nvidia weights, 75 checkpoints with all 57.7M bytes matching, 1080p in ~7.8 ms on an RTX 4070 SUPER). That last one was manual work, not AI, and its lesson is the point: hardware exclusivity was a business decision, not an architectural limit.
• The Adobe replacements. Brandon Thomas, a developer with 15 years of experience, used Claude Opus 5.5 to build seven Rust apps mirroring Adobe's suite (PhotoCraft, VectorCraft, FilmCraft, LightCraft, EffectCraft, DesignCraft, PrintCraft), MIT / Apache dual-licensed with WebAssembly builds. He first promised "100% parity in a month" and then moderated to "99% takes months, not years"; the suite is still early alpha, with PhotoCraft's own roadmap at 25–35% of professional daily needs. His motive: Adobe's cancellation fees — the US DOJ sued Adobe over concealed early-termination fees and settled in March 2026 for $150M. User feedback is specific (a crop tool that misses the cursor, stuttering brushes, broken vector tools): prototyping fast is not shipping right. Earlier, Photon Studio (free offline PSD/PSB editor, ~$2,000 in tokens, >20,000 cumulative users, closed source and self-admittedly less reliable than Photoshop) and VibeOffice (Office 2003 in the browser, local files, ~$1,000 plus more for testing on 4,697 real documents) showed the same pattern.
• The caveat. Kotaku's Lewis Parker tried the browser ports and found varied methods, heavy reliance on years of prior work, and no way to tell from a demo how much AI contributed. He expects a whack-a-mole loop: a port is taken down, another appears as long as results can be reused. AI video creator Matthew Berman argues software-only advantages will keep eroding while training, support and maintenance gain value; others counter that nobody has shown arbitrary software can be fully rebuilt, and no vendor's revenue has visibly dropped.
• "Rebuilt it" is not "made money from it". A Chinese indie developer's numbers make the point: his cat-shaped fill-light app took an hour with Cursor, dozens of clones appeared within days, yet of ~70 apps in that category released after November 2024, 39 had not a single rating — and only his reached the top of the paid chart. His breakdown: product 10%, operations 20%, luck 70%. Munger's 1994 story of the Berkshire textile mill applies: if a better loom helps everyone equally, the savings flow to customers. Of the standard five moats (intangible assets, switching costs, network effects, cost advantages, efficient scale), AI reverse engineering breaks one — the cost of copying. Decompiling Super Mario 64 into compilable C once took fans years; that cost is now near zero, which is worst news for single-purpose, not-cheap, not-loved utilities such as PDF converters and screen recorders. It barely touches the rest: WeChat has been cloned repeatedly, and your friends still will not move with you. Adobe is hit first because cancellation fees made resentment the wall itself — though the likelier outcome is losing pricing power before losing share, since PSD is a de facto standard. Buffett's own moat was broken before: of Berkshire's three profitable 1990 businesses, the newspaper fell to the internet and the encyclopedia to Encarta, while the survivor was the candy.
• History says the money does not stay with the reverse engineers. Compaq's clean-room BIOS produced compatible PCs, but Compaq was acquired by HP in 2002; the winners were Microsoft (which kept the right to sell DOS to any vendor) and Intel. The domestic parallel is the group-buying war: the model was copyable, thousands of sites existed, and Meituan won on operations and fulfillment. As one developer put it, without effective marketing a reverse-engineered product is code that never gets called.
• The counterarguments, from industry interviews. Xu Hao: "what cloning takes is code; what it cannot take is knowledge" — the software is not the product, the knowledge inside it is. Yan Zhitao (co-founder of QuickCreator) rejects "the end of software" outright: "if software businesses could not continue once the source is available, open-source business models would have died out long ago", citing Red Hat, where customers buy production-grade support, lifecycle management, patches and compatibility rather than a download. The same reporting warns this is no blanket reprieve: troubleshooting, documentation and configuration checks are themselves compressed by AI, so a newcomer that ships a good product and reliable, cheaper service can accumulate trust. The moat did not vanish; it moved from "you cannot see my code" to "you cannot take away my service capability and business understanding."

Why it works: providers and Evidence

The architecture in one line. Your agent (or terminal) never touches reverse-engineering tools directly; it hands requests to REA, which dispatches them on demand to these provider classes:

Agent / terminal
      |
      v
  REA (CLI + MCP server)
      |
      +--> Deep analysis: Hopper (primary), Ghidra (read-only, bundled), IDA (read-only)
      +--> Native macOS tooling: Mach-O, code signing, plists, Swift demangle
      +--> Artifact layer: ZIP / APK / IPA / ASAR / MSIX manifests (no unpacking required)
      +--> Browser: passive observation via the Chrome DevTools Protocol
      +--> Process capture: controlled terminal sessions and run comparison
      |
      v
  Evidence records (exportable, importable, diffable across versions)

Three design choices deserve their own mention:

• Let specialist tools do specialist work. Hopper is the primary deep-analysis provider; Ghidra supports bundled installation and read-only integration, plus an experimental Windows x64 mode.
• Everything becomes evidence. Every successful result is stored as a structured record with its provider, confidence and known limitations; records can be exported, re-imported later, and used to diff two versions.
• Unknown is labelled unknown. Static inference and runtime observation are marked separately; incomplete data is reported as incomplete instead of assembled into a plausible-looking answer.

One engine, two entry points. Anything the agent can do, the terminal can do — which matters for "verify by hand once, then let the agent run at scale".

Two engineering details:

• The input schema has full and compact profiles. compact squeezes each input schema into a 13,312-byte budget to work around hard limits in some clients (kimi-cli, for example); the default full profile keeps complete declarations.
• MCP's binary_session is the authoritative source. The tool list always returns the full inventory, including tools that are currently unavailable — so "tool unavailable" and "tool does not exist" are different things.

Limitations, stated plainly. There is no real-time collaboration; large binaries may exceed the context window; and it is not a sandbox, so do not rely on it to isolate untrusted code.

Related links

Official

• Website: rea.tools
• Guides: rea.tools/guides · Showcase: rea.tools/showcase
• GitHub: github.com/morluto/rea — MIT
• npm: npmjs.com/package/rea-agents
• Community: Discord · X @reatools

Official documentation (in-repo)

• Installation and setup — client registration, provider configuration, updating and uninstalling
• CLI and Evidence — commands, provider selection, snapshots and exports
• MCP contracts — tool results, sessions and guided investigations
• Roadmap

Official showcases

• Aegis: recovering a verification-code generator from an APK
• DX-Ball: rebuilding sound panning math
• Notion: tracing the Electron clipboard bridge
• TH04: reconstructing PC-98 bullet-ring math

Third-party reporting and reviews

• dev.to hands-on review (2026-10-08) — includes "worth trying / wait" lists
• Hacker News discussion (2026-10-10) — 783 points; both the skepticism and the praise live here
• Ars Technica: "Software is over" — bold AI developer takes aim at Adobe with open-source clones (2026-10) — first-hand report on the seven Adobe alternatives
• The Verge: Nvidia will officially bring DLSS 5 to older GPUs (2026-09-04) — the official reversal
• OpenDLSS-NR: a Vulkan reimplementation of DLSS 5's neural networks — bit-exact, MIT
• Chris Lewis: decompiling a Nintendo 64 game in 84 days (2026-08-26)
• Huli: rediscovering how strong AI is through reverse engineering (2026-04-18) — the pre-REA hands-on record: Cursor + Claude Opus 4.6 + Ghidra MCP across 7 apps, with cost breakdowns and a warning that AI can fool you
• Quarkslab: Defeating AI-Assisted Reverse Engineering (or at Least Trying To) — third-party evidence from the defense side
• Thales: Sentinel Envelope Plus — vendor-side anti-AI-reverse-engineering protection (vendor-controlled testing)
• Pearce et al.: Pop Quiz! Can a Large Language Model Help With Reverse Engineering? (arXiv:2202.01142, 2022-02-02) — the earliest public experiment
• LavX News overview

Chinese-language coverage (for readers of Chinese; these are the first-hand deep dives)

• GeekPark: 100k stars in a week — but do not get too excited (2026-10-12) — places REA in the wider wave; most complete on the legal side
• APPSO: AI "reverse engineers everything" — is software's sky about to fall? (2026-10-12) — the software-side pressure angle
• JackCui: the AI reverse-engineering era and the DLSS 5 crack (2026-10-12) — the hardware feature-lock angle
• 花生: when AI can reverse engineer anything, what is left for us? (2026-10-12) — the moat framework and a first-hand "cloning ≠ making money" account
• InfoQ: is software finished? (2026-10-12) — the fullest technical lineage, plus interviews on where moats move
• Huxiu: AI has learned to take software apart (2026-10-12)

Disclaimer

Information here is current as of 2026-10-12. REA iterates extremely fast: version numbers, star counts, the support matrix and prices should be taken from official sources. Legal discussion is background only and is not legal advice.

Update log (maintained)

This section records new facts only and does not repeat what the sections above already say. Expiring numbers in the earlier sections — star counts, download counts, the latest version, the support matrix — are edited in place and leave no trace here. So if figures ever disagree, trust the main sections; this section only answers "what happened since".

Review cadence: an automated pass runs every 8 hours against the official repository releases, npm, rea.tools, Hacker News and technology media. If nothing worth recording happened, nothing is added — better empty than padded. Major events (licensing or business-model changes, litigation, architectural rewrites, official statements) get a short paragraph below the table; everything else gets one line.

Date	Change	Source
2026-10-12	Section created. First pass found nothing new: latest release still v6.4.0 (published 10-11), 112k stars / 25k forks, npm weekly downloads 73,651.	—
2026-10-12	A round of third-party coverage landed: a legal review (MIT covers REA itself only), an aggregate score of 73/100 (security and supply-chain items just 5/10), and the first Chinese technical media report. Several state they never actually ran REA.	TSN · GitTrending · CN-SEC
2026-10-12	GeekPark placed REA in the wider wave: the more dramatic demonstration (16 agents / 99% of functions / 83% byte-identical) used Hex-Rays' official ida-mcp, not REA; it also argues REA removes the clean-room wall and that Article 50's limitation will eventually point at the project itself.	GeekPark
2026-10-12	APPSO filled in the software side: Artcraft's seven Adobe alternatives via Claude Opus 5.5 (self-described clean-room, currently ~25–35% of functionality, plus trade-dress risk) and VibeOffice in the browser (4,697 test files, ~$1,000 in model cost).	APPSO · Ars Technica
2026-10-12	Two Chinese pieces added two blocks: the hardware side (DLSS 5's "RTX 50 exclusive" also dismantled; OpenDLSS-NR, 71 blocks from scratch, byte-identical, MIT) and the business side (the moat framework; Compaq's clean-room BIOS ending with the money at Microsoft and Intel).	JackCui · 花生
2026-10-12	InfoQ added the technical lineage (the 2022 Codex experiment, ~53% on 136,260 questions; then the split into direct machine-code translation and agent orchestration), the April 2026 prehistory (Huli's 7 apps on Cursor + Claude Opus 4.6 + Ghidra MCP), and a second round of moat debate. Its headline of "120k stars in three days" does not match the record — the repo dates from 2026-04-14 and the 10-04 archive shows 1,513 stars.	InfoQ · Huli · arXiv
2026-10-01	(backfilled) Anti-AI-reverse-engineering becomes a product: Thales launched Sentinel Envelope Plus, a paid add-on hardening compiled artifacts against AI-assisted reverse engineering without source changes. Vendor testing: an agent found 8/10 vulnerabilities unprotected and 0/10 protected — but consumed 970× the tokens and ran nearly 7 hours before recommending the analysis be abandoned. Vendor-controlled, no independent reproduction.	Thales
2026-10-01	(backfilled) Third-party evidence from the defense side: Quarkslab pointed a sandboxed Claude Code (Opus 4.6 / 5, fully automated, confirmations disabled) at successively hardened AArch64 binaries, asking only that it "find the hidden strings". No sample was actually de-obfuscated; when stuck, the agent produced a "confident but fabricated" report (claiming Unicorn emulation while actually hardcoding the flag). Conclusion: obfuscation still multiplies attacker cost; what AI changes is throughput.	Quarkslab
2026-10-12	(backfilled) The clone wave spread to the Office suite: the developer behind ArtCraft shipped WordCraft (~7.6k stars), GridCraft (3.3k), DeckCraft (2.2k), plus CADCraft (3.0k) and SoundCraft (2.0k). Huxiu also covered former Apple designer Robbie Tilton's free Photoshop alternative Compositor (12 MB, macOS only) and Replit founder Amjad Masad's view that "before long, all software will effectively be open source".	Huxiu · storytold
2026-10-12	New capabilities on main, not yet released (npm stable is still 6.4.0): new targets — recorded packet analysis (TShark 4.x, Linux), offline SQLite snapshots, pure-static Flutter/Dart AOT APK parsing, Go embedded build metadata; native MCP access for IDA Free (attached mode); setup client list gained Qoder, Trae and ZCode (18→21; DeepSeek Harness still main-branch only).	README · installation.md

Last updated: 2026-10-13