REA Reverse Engineering Tool Exposes Smart TV Surveillance, Banned by Claude & ChatGPT

REA: AI-Powered Reverse Engineering Toolkit

The open-source project REA (Reverse Engineering Assistant) provides a complete suite of reverse engineering tools for AI, allowing models to deconstruct software and replicate functionality without source code. The project has garnered 38.6k stars on GitHub and spawned numerous creative applications.

Notable Reverse Engineering Projects Using REA

Xiaomi tablet running iOS: A developer reverse engineered a Xiaomi Pad 5 to boot iOS 16.5, showing "iPhone X" as the model. The same project enables quad-boot of Android, Windows, Linux, and iOS. Repository: https://github.com/oosexgang/hackios-xnu-kernel Smart toilet: Reverse engineered a WeChat mini-program's Bluetooth protocol to build a native remote control.

Dental scanning software: Fully open sourced after reverse engineering.

The Elder Scrolls game: Reimplemented entirely in TypeScript and Three.js.

Smart TV ad removal: Project cleanyourtv disables ad services and bloatware on Android TV/Google TV via Wi-Fi, replacing the launcher with an Apple TV-like interface. Repository: https://github.com/Gathin23/cleanyourtv Claude web UI: Reverse engineering revealed Claude adjusts font weight from 500/600 to 460/560 in dark mode to compensate for retinal light scatter, making text appear equally thick in both themes. Repository: https://github.com/Caho1/open-claude-ui Claude Code local client: Extracted 2,589 modules (~47 MB) of code, exhausting memory. Repository:

https://github.com/morluto/rea/issues/1563

awesome-reverse-engineered Collection

A curated list named awesome-reverse-engineered aggregates 16,809 open-source reverse engineering projects, categorized into game decompilation (6,071), devices/IoT (3,059), AI tools & LLM clients, automotive, firmware, file formats, and a "Resurrection" section (130 projects) for devices revived after vendor abandonment (e.g., Spotify Car Thing, Amazon Dash Button, Nest thermostats). Repository:

https://github.com/alexgaoth/awesome-reverse-engineered

Log4j's Smart TV Investigation

Blogger Log4j reverse engineered a "certain star" TV (likely Samsung) after noticing eerily targeted ads. The investigation steps:

Firmware analysis blocked: Firmware used AES encryption without available keys.

Hardware debugging considered: UART/JTAG interfaces would require physical teardown.

Zero-day exploit used: Leveraged an unpatched vulnerability to gain root access.

Key configuration file: security-policy.xml listed component csapi-tv-service-alwaysonvoice ("always-on voice").

Always-On Voice & Sound Classification

The TV's microphone stays active to detect wake words ("Hi, Bixby"). Under event EV201/SOUNDSENSOR_ON, counters track dog barks and baby cries . These key-value pairs are uploaded to the vendor's cloud server. While sound recognition itself is not secret, linking counts to user accounts reveals household activity patterns.

Camera & Sensor Telemetry

Telemetry data includes camera-related fields: sensor settings, event counters, and camera streaming duration. This implies the vendor knows camera on/off state, ambient light conditions, and potentially video preview data.

Microphone Scavenging

If the TV lacks a built-in microphone, it searches for connected devices with microphones (soundbars, Bluetooth devices) and routes audio to Bixby. Hugging Face engineer ngxson tested this by emulating a USB microphone with a Flipper Zero; the TV activated the microphone for 5 seconds then stopped.

Behavioral Tracking & Geolocation

The TV loads region-specific neural networks to track in-app behavior (e.g., YouTube ad skips). Detailed packet logs reveal cross-device identifiers for ad targeting. Log4j also alleged the TV sends GPS coordinates to over 400 data collection partners and speculated that performance degradation may stem from background audio/screenshot processing.

AI Platform Bans Following Disclosure

Approximately 42 hours after Log4j's findings went viral on X:

OpenAI banned Log4j's account for "Cyber Abuse," revoking ~$500 in credits. Log4j stated they only performed local reverse engineering without using OpenAI tools for exploitation, but triggered the Daybreak detection system.

Other users reported bans after merely typing keywords like "reverse" or "crawler."

Claude Opus 5.5 began interrupting reverse engineering analyses mid-response (from Oct 21), with users on Reddit's r/Claude confirming the pattern.

Consequently, many practitioners are migrating to local models to run REA without risk of account termination.

Conclusion

REA's significance lies not in the volume of software it can reverse engineer, but in democratizing reverse engineering — making previously opaque binary analysis accessible to non-experts. This shifts the information asymmetry: users can now independently verify what their devices actually do. However, the discovery of suspicious code does not prove malicious execution; further evidence is needed. The controversy highlights a growing tension: as AI lowers the barrier to reverse engineering, more hidden behaviors may surface, prompting platforms to restrict such tools. Whether REA becomes a standard for transparency or a primary target for suppression remains an open question.