NabilRFG12/Reverse-Engineer-anything
Reverse engineer anything with agents, from app behavior down to native binaries.
REA (Reverse Engineer Anything) – Quick Overview
What it is – REA is a Node‑based platform that lets large‑language‑model agents (Claude, Gemini, Grok, etc.) automatically investigate software they don’t have source code for. It talks to the agent through a local MCP (Modular Capability Provider) server, runs a suite of analysis tools (Hopper, Ghidra, IDA, pwntools, JADX, Binwalk, browsers, etc.) and returns evidence – pseudocode, assembly, module graphs, network captures, etc. – that the LLM can then explain, modify, or re‑implement for you.
Why it matters – Traditional reverse‑engineering is manual, requires deep expertise and a handful of heavyweight tools. REA abstracts those tools behind a simple CLI (rea …) and an MCP contract, letting an AI assistant do the heavy lifting: ask a question like “How does the clipboard work in Notion?” and get a step‑by‑step trace, code snippets, and a ready‑to‑use implementation.
Key capabilities
| Target type | What REA extracts | Required tooling |
|---|---|---|
| Native binaries (PE/ELF/Mach‑O) | Pseudocode, assembly, strings, symbols, call graphs | Hopper, Ghidra or IDA (installed or auto‑installed) |
| JavaScript/Electron apps | Module list, imports, source‑maps, IPC bridges | Node.js/npm only |
| .NET assemblies | Metadata, CIL, native dependencies | Static inspection |
| Android APKs | Manifest, decompiled classes | Head‑less JADX + JDK |
| Firmware images | Regions, extracted files | Binwalk/Unblob |
| Web sites & network captures | DOM structure, scripts, HAR data, screenshots | Chrome‑family browser, mitmdump |
| EVM bytecode, recorded Linux crashes, etc. | Dispatch tables, registers, signals | pwntools, optional GDB |
How you use it
- Install –
npx rea-agents setupregisters the MCP server and installs a “skill” for your chosen LLM agent. - Ask the agent – type a natural‑language request; the agent calls REA, which runs the appropriate analysis tool and returns structured evidence.
- CLI fallback – you can run the same commands directly, e.g.
rea analyze-javascript-application /path/to/app --json. - Update –
rea updateor repeat thesetupcommand to get the latest bug‑fixes.
Showcase examples – The README links to three detailed case studies:
- Reconstructing a sound‑pan calculation in the classic DX‑Ball game (x86 → C).
- Tracing the clipboard bridge in the Electron‑based Notion app.
- Recovering a DOS‑era bullet‑ring calculation from a PC‑98 game. Each includes a public GitHub repo with the reconstructed code.
Community & support – A Discord server, extensive docs (website, guides, MCP contract catalog), and a growing ecosystem of agents that can plug into REA.
Legal note – REA is intended for lawful reverse‑engineering research; users must ensure they have permission to analyze the target software.
TL;DR
REA is a Node.js‑driven, AI‑augmented reverse‑engineering framework that connects LLM agents to traditional binary‑analysis tools via a local MCP server, delivering evidence that the model can turn into explanations or new code. It supports many artifact types (native binaries, JavaScript/Electron, .NET, Android, firmware, web captures, etc.) and works with popular agents like Claude, Gemini, and Grok.
Related
- Project
- Project
- Project
- Project