🔥 Reverse Engineer Anything (REA): The Viral AI Repo Turning Compiled Software Open Source

What happens when you connect an AI coding agent to the world's most powerful binary reverse-engineering tools? You get REA (Reverse Engineer Anything) — the open-source project created by @morluto that exploded to 195,625 stars and 47,769 forks, making it one of the fastest-rising repositories on GitHub.

Tech leaders and developers are calling it a watershed moment, sparking debates on whether commercial software as we know it is about to be commoditized. Here is everything you need to know about REA, how it works under the hood, and what it means for the future of software engineering.

Verified facts: MIT licensed · TypeScript · 47,769 forks · 531 open issues · 31 npm releases · website at rea.tools · created April 2026.

---

🛠️ What Is REA and How Does It Work?

At its core, REA is a Model Context Protocol (MCP) server that bridges AI coding agents — such as Claude Code, Codex, Cursor, and Gemini CLI — directly to specialized static and dynamic analysis engines.

Instead of forcing an LLM to guess how a compiled application works purely from screenshots or high-level descriptions, REA allows your agent to systematically disassemble, decompile, trace, and extract evidence from running apps and binaries.

┌─────────────┐       ┌─────────────┐       ┌────────────────────────┐
│  AI Agent   │ ────> │   REA MCP   │ ────> │  Analysis Tool Adapter │
│ (Claude/    │ <──── │   Server    │ <──── │ (Ghidra / Hopper / IDA)│
│   Codex)    │       └─────────────┘       └────────────────────────┘
└─────────────┘                                         │
       │                                                ▼
       └─────────────────────────────────── Decompiled Pseudocode,
                                            Assembly & Module Maps

The key design choice is that REA does not ask the model to guess. It returns evidence — pseudocode, function calls, assembly, and IPC route maps — alongside the limitations behind each conclusion. Analysis runs locally, which matters a great deal when you are inspecting binaries you do not control.

The Engine Behind the Magic

REA doesn't reinvent binary analysis; it orchestrates battle-tested decompilers and disassemblers that security experts have relied on for decades:

• NSA's Ghidra — the open-source reverse engineering framework originally leaked on WikiLeaks before being released by the NSA in 2019.
• Hopper Disassembler — the native macOS/Linux tool for analyzing Mach-O and ELF executables.
• IDA Pro — the industry-standard disassembler for deep binary analysis.

When you ask your agent to investigate a feature in a target application, REA invokes the appropriate adapter, executes local inspections, and returns pseudocode, function calls, assembly, and IPC route maps with explicit proof of how the logic operates.

---

🚀 What Can You Analyze & Rebuild With REA?

REA supports an extensive matrix of target environments and binary types:

• Native Executables — pseudocode, registers, calls, and assembly for ELF, Mach-O, and PE binaries.
• JavaScript & Electron Apps — extracted module structures, source maps, routes, native add-on bindings, and IPC bridges.
• Android APKs & Devices — decompiled DEX/JAVA methods via JADX and Apktool, manifest declarations, resource tables, and direct adb device interactions.
• Websites & Network Captures — Chrome browser instrumentation, HAR/Fiddler SAZ network logs, and TShark packet summaries.
• Managed & Domain Binaries — .NET CIL assemblies, Go compiler modules, WASM artifacts, SQLite WAL snapshots, and EVM bytecode.

Supporting utilities that show up alongside REA in serious reverse-engineering workflows include Binwalk, Unblob, WABT, pwntools, sigrok-cli, Frida, and JEB for commercial-grade decompilation.

Its own repository topics tell you the scope: ghidra, hopper, decompiler, disassembler, binary-analysis, static-analysis, ctf, mcp, agent-skills.

Real-World Case Studies

Developers are already showcasing reverse-engineering feats powered by REA:

1. Recreating a native image viewer — asking an agent to inspect Apple's Preview.app resulted in a working replica with zooming, canvas rotation, annotation drawing, and file saving.
2. Deconstructing an Electron clipboard bridge — tracing renderer clipboard APIs through preload scripts and Electron IPC into main-process formats.
3. Reconstructing legacy game engines — recovering sound-pan calculations from DX-Ball (passing 3,205 x86 test cases) and 16-bit bullet-ring math from PC-98 classics.
4. Decompiling 2FA authenticator APKs — analyzing Android binaries offline to discover exact TOTP 30-second secret key generation routines without viewing source code.

---

⚡ REA vs. Vanilla AI: Do You Actually Need It?

A hot topic in the developer community is whether specialized tooling like REA is strictly necessary, or if LLMs are getting good enough to reverse engineer software on their own.

In head-to-head benchmarks analyzing 2FA authenticator APKs, both vanilla Claude Code/Codex and Codex backed by REA successfully extracted the correct underlying code logic. For lightweight UI recreation or visual cloning, vanilla agents can move fast using screenshot reasoning alone.

However, for complex binary decompilation, native C/C++ memory patterns, IPC boundaries, or obfuscated Android/iOS apps, REA provides the structured verification, decompiler adapters, and evidence logs required for production-grade engineering.

That is the honest summary: REA is not magic, it is evidence. It wins on the hard targets, not the easy ones.

---

🔮 The Big Picture: Is Commercial Software Done?

While viral headlines claim that "software is dead," the reality is a shift in where value lives in the AI stack:

• The Commoditization of Code — frontends, backends, and simple wrapper applications are moving up the abstraction layer. AI models can now synthesize functional analogs on demand. This is the software commoditization debate playing out in public.
• The Premium on Deep Engineering — easy software creation is becoming commoditized, but human expertise in security verification, zero-knowledge proofs, system architecture, and liability governance is more critical than ever.

---

💡 Try REA Yourself

Getting started takes a single terminal command if you have Node.js installed:

npx rea-agents setup

Once registered with your local agent (Claude Code, Codex, Cursor, Gemini CLI), you can simply prompt:

"Inspect how feature X works in target app Y, show me the evidence, and build a working implementation for my project."

The "show me the evidence" part matters. It is what separates REA from asking a model to hallucinate an explanation.

---

❓ Frequently Asked Questions

How to reverse engineer an app without source code using AI

You point an agent at a running or compiled app and ask questions about specific behaviour. REA makes this evidence-based: it attaches the real decompilers and returns pseudocode, call graphs and IPC routes rather than guesses. Without a decompiler attached, an LLM is reconstructing your binary from a screenshot, which is why results diverge so badly on hard targets.

Connect Ghidra to Claude Code via MCP

Install Ghidra, point GHIDRA_INSTALL_DIR at the extracted release, then run npx rea-agents setup. REA registers itself as an MCP server with your agent and exposes the Ghidra bridge as tools. Restart the agent afterwards so it picks up the new MCP configuration.

npx rea-agents setup tutorial

Run it once per machine. It installs the workflow skill, registers REA as an MCP server with whichever agents it detects (Claude Code, Codex, Cursor, Copilot CLI, Gemini), and installs matching workflow instructions. Verify the result with rea doctor, which reports each analysis engine and each agent registration as healthy or missing.

How to decompile Android APK with JADX and AI agent

REA's Android path routes through JADX for DEX-to-Java decompilation and Apktool for the manifest and resource tables, then lets the agent reason over real classes instead of a hex dump. It can also drive adb directly for device interaction, so behaviour and static structure line up.

Reverse engineer Electron JavaScript ASAR apps

Extract the ASAR, map the module graph, and follow the preload scripts that bridge the renderer to the main process. REA's Electron adapter is built for exactly this: module structures, source maps, routes, native add-on bindings, and the IPC bridge between processes.

Vanilla Claude Code vs REA benchmark

On lightweight targets — UI recreation, visual cloning, screenshot reasoning — vanilla agents are faster and good enough. On complex binary decompilation, native C/C++ memory patterns, IPC boundaries and obfuscated mobile apps, REA wins because it supplies decompiler adapters and evidence logs. The honest answer is that REA is worth it on hard targets, not on easy ones.

Decompile native Mach-O ELF PE binaries with Hopper and Ghidra

Hopper is the smoother option on macOS and Linux; Ghidra is the free, cross-platform choice and the one REA requires on Windows, since Hopper does not run there. REA does not care which engine is attached — it adapts. You get pseudocode, registers, call targets and assembly either way.

Reconstruct source code from compiled EVM bytecode and WASM

REA covers managed and domain-specific bytecode directly: .NET CIL assemblies, Go compiler modules, WASM artifacts, SQLite WAL snapshots and EVM bytecode. The practical caveat is the same as everywhere else — reconstruction is only as good as the symbols and debug information the original build left behind. Stripped release builds give you behaviour, not names.

---

⚖️ A Note on Responsible Use

REA is a legitimate open-source security and interoperability research tool (MIT licensed). Its power is real, and so is its potential for misuse.

• Only analyse software you own, have written permission to test, or that is covered by an explicit licence.
• Understand your jurisdiction's rules on circumvention — they differ significantly between countries.
• Respect licences, terms of service, and intellectual property. Reading a binary to fix an interoperability problem is not the same act as redistributing it.
• Report security issues to vendors through their disclosure programmes rather than publishing exploits.

If you need help setting up REA for legitimate analysis, or you want a custom analysis pipeline built for your own products, get in touch.

---

Want this kind of tooling set up on your machine? I build and configure AI-native development environments, MCP servers, and reverse-engineering workflows for teams and businesses. Contact: steven@growths.dev