REA: AI Agents Automate Reverse Engineering Across Binaries, Web, and Mobile

What REA Is

REA (Reverse Engineer Anything) is an MCP server plus a command-line interface that wraps existing reverse engineering tools so AI agents can call them directly. Created in April 2024, it reached 48,000 GitHub stars in under six months. REA does not perform reasoning itself; the AI agent (Claude Code, Codex, Cursor, Gemini CLI, Grok Build) decides which functions to inspect, what to query next, and what conclusions to draw. REA simply executes the agent's tool calls against Hopper, Ghidra, IDA, or other backends and returns the results.

Supported Targets

Native binaries (EXE, Mach-O, ELF): pseudocode, assembly, strings, symbols, call graphs. Requires Hopper, Ghidra, or IDA installed locally.

JavaScript / Electron apps : modules, imports, source maps, routes, IPC, native plugins. Runs with only Node.js — no reverse engineering engine needed.

Websites : page structure, scripts, network requests, screenshots. Requires a Chromium-based browser.

Android APK : manifest, classes, decompiled methods via JADX + JDK.

.NET assemblies : pure static analysis, no extra tools.

Firmware : extraction via Binwalk or Unblob.

Also supports EVM bytecode and process behavior capture.

Architecture and Workflow

The system has three layers:

Entry points: CLI and MCP server (shared logic).

Adapters: Hopper runs a Python script inside the GUI; Ghidra uses a headless Java script; IDA connects via the external ida-pro-mcp bridge.

Pure functions: evidence handling and comparison, no side effects.

The agent drives the investigation. For example, to learn how the 1996 Windows game DX-Ball calculates stereo panning when the ball hits a brick:

Agent locates the relevant function; decompiler shows only a lone __ftol() call with missing parameters.

Agent switches to assembly, finds an FILD instruction loading an integer from the stack — the decompiler had dropped it.

Tracing back to the caller reveals the brick's column index; the algorithm is 20 + 30 × column.

Further constants are read from memory addresses and decoded as floats: 1.5625, 500.0, plus a runtime scaling factor.

Agent assembles a C function mapping screen X coordinate (0–640) to pan value (−500 to 500).

Installation and Usage

npx rea-agents setup

Requires Node.js ≥ 22.19, ≥ 24.11, or ≥ 26. The interactive setup registers the MCP server, installs workflow instructions, and backs up existing configs. After restarting the agent, natural-language queries work immediately.

For one-off CLI analysis of an Electron app:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Global install: npm install --global rea-agents; then rea --help. Update with rea update (project moves fast). Run rea doctor to verify environment.

Prerequisites for native binaries: Hopper, Ghidra, or IDA must be configured. Setup can install Hopper automatically; Ghidra/IDA are user-managed. On macOS, Hopper first launch prompts for trial/license. For large binaries, increase REA_GHIDRA_STARTUP_TIMEOUT_MS.

Privacy: Analysis runs locally; target binaries are not uploaded. However, analysis results are sent to the backing model provider, subject to their data policies.

Official Case Studies

1. Notion Clipboard Tracking (Electron)

Agent traces clipboard API calls from renderer process through preload script and IPC to main process. JavaScript is shipped as plaintext, making this relatively straightforward.

2. Aegis Authenticator TOTP Generation (Android)

Agent locates the six-digit code generation method, extracts the algorithm, and drives a visual clock demo showing why codes rotate every 30 seconds.

3. DX-Ball: 63-Byte Perfect Reconstruction

After the agent produces the C function, two verification layers are applied:

Exhaustive test: original x86 function vs. reconstructed C across 0–640 positions × 5 scaling factors = 3,205 test cases — all match.

Byte-level equivalence: recompiling the C code with Visual C++ 4.0 yields exactly the same 63 bytes of machine code as the original binary.

This demonstrates reconstruction at compiler-output fidelity, not just behavioral similarity.

4. CTF Flag Verification (DownUnderCTF)

Agent finds the verification function, translates masks and sums into equations, and solves for the flag.

Impact on Reverse Engineering

Entry-level disruption: Call-chain tracing, constant extraction, assembly-to-C translation — the most time-consuming junior tasks — are now automated. CTF reverse challenges (small algorithm recovery) become trivial.

Experts remain essential: The DX-Ball case shows the high-value work is verification design (3,205 test cases + byte-for-byte comparison), not the mechanical translation. Future reverse engineers will focus on designing validation, auditing agent conclusions, and handling cases where automation fails.

Adversarial countermeasures: A May 2024 arXiv paper demonstrates poisoning decompiler output with genetic-algorithm-generated strings to mislead LLM-based analysis (targeting GhidraMCP-class tools). Malware authors will increasingly craft binaries that deceive AI agents, spawning a new cat-and-mouse discipline.

Impact on Software Industry

REA's README explicitly suggests: "See a feature you like, understand how it works, build your own version." Electron apps are especially exposed — .asar archives are unencrypted. Many modern desktop tools (Claude Code, ChatGPT desktop, etc.) are Electron-based, making feature replication significantly easier. Software protection and anti-cloning efforts face rising difficulty.

Limitations and Caveats

Cherry-picked demos: Official cases are author-selected. The DX-Ball function is only 63 bytes; real commercial software spans millions of lines with packing, obfuscation, and anti-debugging — untested in public examples.

Static analysis only: No support for live debuggers (WinDbg, x64dbg, GDB). GDB appears only for post-mortem Linux crash dumps, not interactive breakpoint/stepping.

Runtime capture collects terminal output, interactions, filesystem changes — not register/memory state tracing.

Dynamic debugging is essential for unpacking, bypassing anti-debug, tracking runtime-generated keys, and analyzing memory-resident code. Packed binaries show only stub code under static analysis.

Roadmap includes debuggers , but real-time debugging introduces breakpoint handling, anti-debug opposition, state synchronization, and token consumption orders of magnitude higher. LLVM/VMP-level protections will be even harder. REA can accelerate workflows but cannot yet replace skilled reverse engineers.