REA - Reverse Engineer Anything - rea-agents-6.5.0

REA, short for Reverse Engineer Anything, is an open-source toolkit that helps AI coding agents investigate how software works, even when its original source code is unavailable. Hosted on GitHub, the project connects agents to analysis tools for native binaries, JavaScript applications, Electron apps, and other software.

Rather than attempting to recover an application's exact original source code, REA collects evidence from decompilers, disassemblers, strings, symbols, function references, and other analysis techniques. An AI agent can use that evidence to explain a feature, document an implementation, or build a compatible alternative for another project.

REA provides a command-line interface (CLI), a Model Context Protocol (MCP) server, and guided workflows for compatible AI coding tools. It is particularly useful for developers who need to understand undocumented behavior, investigate legacy software, or reproduce a feature without access to its implementation.

Features

AI-Assisted Reverse Engineering

REA is designed to let developers investigate software by describing what they want to understand in natural language.

For example, you could ask an AI agent to investigate how an application's offline search works, trace the relevant functions, explain the evidence, and implement similar functionality in your own project.

REA supplies the investigation tools and findings, while the AI agent performs the reasoning and writes the new implementation. This division makes it easier to investigate unfamiliar software without manually navigating every analysis tool.

The workflow generally follows three stages: decompile or inspect the target, trace the relevant behavior through the available evidence, and recreate the desired functionality in a separate implementation.

Native Binary Analysis

REA connects AI agents to tools that inspect compiled native applications. Depending on the configured analysis provider, developers can examine functions, strings, symbols, assembly instructions, pseudocode, references, and call relationships.

These capabilities help investigate how a binary implements a particular feature or interacts with other components.

For native analysis, REA supports integration with Hopper and Ghidra. The project also documents IDA-related support in its broader development direction, although provider availability and individual capabilities depend on the installed version and platform.

Hopper is a separate product with its own licensing requirements. Ghidra must be installed independently and configured before REA can use it.

Importantly, decompilation produces an approximation of the original program logic, not the original source code with all its comments, names, and design decisions intact.

JavaScript and Electron Application Inspection

REA can analyze JavaScript applications and Electron packages without executing the target application.

It can inspect application directories and ASAR archives to identify modules, imports, dependencies, and relationships between components. This is useful for understanding how a desktop application's frontend communicates with its underlying services.

For example, developers can investigate how an Electron application handles authentication, storage, updates, or networking by examining the available code and tracing the relevant modules.

Static analysis is especially convenient because it does not require a native decompiler for supported JavaScript targets. It also reduces the risks associated with running unfamiliar applications during an initial investigation.

Command-Line Interface

REA provides a CLI for running analysis tasks directly from a terminal or through automation scripts.

Install the command-line package globally with npm:

npm install --global rea-agents

Then start the guided setup:

rea setup

To check the environment and configured analysis tools:

rea doctor --json

For a JavaScript application or Electron package, you can run an analysis directly:

npx -y rea-agents@latest analyze-javascript-application \
  /absolute/path/to/app --json

The JSON output makes it easier to process analysis results programmatically or pass structured findings to another tool.

Native binary analysis requires an appropriate provider to be installed and configured. The CLI therefore serves as a common entry point rather than replacing the underlying analysis engines.

MCP Integration for AI Coding Agents

One of REA's strongest features is its MCP server, which exposes analysis operations to compatible AI assistants.

The setup utility can configure supported clients, including Claude Code, Claude Desktop, Codex, Cursor, Gemini CLI, and Windsurf. Additional clients can connect through manual MCP configuration if they support local MCP servers.

After setup, an agent can call REA's tools to inspect a target, search for strings, examine functions, trace references, and collect evidence without requiring the user to execute each analysis command manually.

This integration is valuable for AI-assisted software development because it allows reverse engineering to become part of the same workflow used to modify and test code.

Guided Workflows and Evidence-Based Results

REA provides structured investigation workflows intended to guide an agent from an initial question toward a supported explanation.

Instead of returning only a conclusion, the tools can provide evidence and identify unresolved questions or limitations. Developers can then distinguish observed behavior from assumptions that require further testing.

The project also supports reusable analysis results and snapshots in relevant workflows, reducing the need to repeat expensive analysis operations unnecessarily.

This evidence-oriented approach is particularly useful when examining unfamiliar or poorly documented software, where an unsupported conclusion could lead to an incorrect implementation.

Local Analysis and Privacy

REA is designed to analyze target applications locally rather than uploading them to a hosted REA analysis service.

This is beneficial when investigating internal tools, proprietary software, or applications that cannot easily be shared with an external service.

However, the privacy boundary also depends on the AI agent and model provider being used. Analysis results returned to an agent may be sent to its configured model service, so developers should review that provider's data-handling policy before investigating confidential software.

Guided Installation and Diagnostics

REA includes a setup utility that configures the CLI, MCP server, and matching agent instructions. It can connect existing analysis tools and offer to install Hopper when needed.

The setup process presents proposed changes for review and approval and backs up existing agent configuration before applying changes.

Its diagnostic command checks dependencies, host compatibility, analysis tools, and agent configuration:

npx -y rea-agents@latest doctor

This helps developers identify missing dependencies or configuration problems before attempting a more involved investigation.

Performance and Compatibility

REA is distributed as a Node.js application and supports the command line and local MCP workflows. Its documented runtime requirements include Node.js 22.19 or newer in the 22.x line, Node.js 24.11 or newer in the 24.x line, or Node.js 26 and later.

Native analysis depends on the configured provider and supported host environment. The project documents support for macOS and selected Linux distributions, while Windows support varies by analysis provider and workflow.

Static JavaScript and Electron analysis has fewer dependencies because it does not require a native analysis engine. This makes it a convenient starting point for developers who want to try REA without installing a separate disassembler.

Actual analysis speed depends on the target application's size, the chosen provider, and the complexity of the behavior being investigated. Large native binaries may require more time and resources than a small JavaScript application.

REA is an analysis framework rather than a universal decompiler. Its capabilities depend on the tools available for the target platform, and the accuracy of conclusions depends on the evidence that can be recovered. It cannot guarantee recovery of original source code or perfectly reproduce every behavior of an application.

System Requirements

  • Runtime: Node.js 22.19 or newer in the 22.x line, 24.11 or newer in the 24.x line, or 26 and later.

  • Package manager: npm.

  • Operating systems: Supported macOS and Linux environments, with Windows support depending on the selected workflow and provider.

  • Native analysis: Hopper or Ghidra for the corresponding supported workflows.

  • AI integration: An MCP-compatible agent for interactive, agent-driven investigations.

  • JavaScript analysis: A local application directory or ASAR archive; no native decompiler is required for this workflow.

Ghidra integration has additional requirements, including a compatible Ghidra installation and Java Development Kit. Consult the current installation documentation for exact versions and platform-specific instructions.

Pros and Cons

Pros

  • Free and open-source under the MIT license.

  • Connects AI coding agents to reverse engineering tools through MCP.

  • Supports native binary investigation using decompilation and disassembly.

  • Analyzes JavaScript applications and Electron archives without executing them.

  • Provides CLI access for scripting and automation.

  • Collects evidence to support explanations of application behavior.

  • Offers structured workflows for investigating and recreating software features.

  • Designed for local analysis without a hosted REA analysis service.

  • Guided setup and diagnostic tools simplify configuration.

  • Can help developers understand legacy software and undocumented implementations.

Cons

  • Native analysis depends on external tools such as Hopper or Ghidra.

  • Some analysis providers have platform-specific limitations.

  • Decompilation cannot reliably recover the original source code.

  • Investigation quality depends on the available evidence and analysis engine.

  • Requires an AI agent for the full natural-language investigation workflow.

  • Additional setup may be necessary for native binaries.

  • Model-provider privacy policies still matter when sending analysis results to an AI service.

  • Reverse engineering complex applications can require substantial technical knowledge and time.

Download REA - Reverse Engineer Anything - rea-agents-6.5.0 - Software Mirrors

REA - Reverse Engineer Anything - rea-agents-6.5.0 Source Code

REA - Reverse Engineer Anything - rea-agents-6.5.0 Source code (zip)

REA - Reverse Engineer Anything - rea-agents-6.5.0 Source code (tar.gz)

REA - Reverse Engineer Anything - rea-agents-6.5.0 Release Notes:

6.5.0 (2026-10-13)

Provider prerequisites and recorded verification scope are listed in the testing guide.

Highlights

  • Analyze selected JavaScript files and recover cross-bundle relationships without expanding the selected source scope.
  • Read compact summaries and page retained Evidence across binary, managed, Android, Dart, WASM and network workflows.
  • Inspect SQLite snapshots, packet and signal recordings, WebAssembly, Rust dependency metadata and Electron fuses offline.
  • Keep completed Evidence and partial observations available when analysis or cleanup fails.

Changes

  • JavaScript source selection: analyze exact application paths without expanding imports into the selected scope. Unselected files retain identity and explicit unknown coverage; summary delivery remains separate from source selection. (#1944, issue morluto/rea#1848). Thanks @kaoru0822-kitauji, @N0zoM1z0.
  • Code-split recovery: recover related bundles from multiple selected inputs, retaining per-file provenance and downstream cross-chunk imports. Recorded CLI/MCP coverage is Linux x64 with Wakaru 1.14.0 and source-owned esbuild/webpack fixtures; other hosts, releases and arbitrary application equivalence remain unverified. (#1686, issue morluto/rea#1605). Thanks @JingHao-Leon, @pionxzh.
  • Package imports: resolve exact package import aliases using the selected loader and package ancestry, rather than guessing sibling files. (#1862, issue morluto/rea#1838). Thanks @AWUQAQ, @mvanhorn.
  • Retained analysis views: opt into compact inventory/WASM, managed metadata, Android manifest, Dart AOT, Mach-O and EVM summaries, then page retained Evidence without rerunning analysis. Summary delivery preserves the complete recorded result and its original coverage. (#2122, #2193, #2413, #2438, #2455, #2634, #2308, 9a18251). Thanks @kaoru0822-kitauji, @N0zoM1z0.
  • Packet captures: inspect saved packets with bounded TShark output, compact capture summaries and retained pages; discover installed protocol/field definitions. Recorded real-engine coverage uses Linux and Wireshark 4.6.6; native Windows/macOS and Bun behavior remain unverified. (#2318, #2340, #2496). Thanks @3QL, @N0zoM1z0, @Olorinm.
  • Recorded signals: decode existing recordings and discover installed decoders/options through caller-supplied sigrok-cli 0.7.2. This is Linux-only and requires util-linux prlimit; it acquires no hardware samples. (#2339, #2487). Thanks @N0zoM1z0, @Olorinm.
  • Web captures: derive an inferred method/origin/path-template API surface from retained HAR data including observed query-parameter names while retaining unknowns; query values, headers and bodies remain excluded. (#1891, #2982, issue morluto/rea#2913). Thanks @mvanhorn, @wunianze666-netizen, @zhangguiping-xydt.
  • QUIC captures: inspect retained aioquic 1.5.0 JSON qlog 0.3 objects and page traces/streams/observations. Other qlog layouts remain unsupported; overlap and loss declarations do not prove retransmission or network loss. (#2277). Thanks @LuisTaffelli, @N0zoM1z0.
  • Fiddler captures: inspect native SAZ archives with retained HTTP provenance and bounded decoding. Recorded producer coverage is the pinned public encoding corpus; current Fiddler Everywhere variants and Bun-native execution remain unverified. (#2409). Thanks @N0zoM1z0, @zahhak.
  • SQLite snapshots: inspect an explicitly selected offline database with table/column selection and bounded Evidence. This operation requires Node 24.x >=24.15 or 26+ with DatabaseSync.limits; supported Node 22 and earlier 24 runtimes cannot use it. A live database/WAL copy does not establish an atomic snapshot. (#2271). Thanks @N0zoM1z0, @Y0UW1SH.
  • WASM artifacts: Inspect local modules with bring-your-own WABT 1.0.42 without executing them. Compare imports/exports from two complete core-module inspection Evidence records without requiring an active WABT installation; unsupported signatures and duplicate identities remain unknown, and comparisons do not establish runtime compatibility. Recorded real-tool inspection coverage is macOS arm64. (#1533, issue morluto/rea#884, #2464, issue morluto/rea#2356). Thanks @matbrgz, @N0zoM1z0, @thangldw.
  • Go binaries: inspect embedded build metadata, including file-backed unmapped Mach-O debug segments. (#1363, 7fb097d). Thanks @Y0UW1SH.
  • Flutter APKs: identify snapshot/engine builds and inspect AOT structure without an external engine. Recorded real APK coverage uses the documented Flutter Gallery fixture; macOS/Windows and complete pool semantics remain unverified, and pool coverage stays partial. (#1582). Thanks @3QL.
  • HarmonyOS packages: inventory HAP/HSP/App Pack structures without executing code. The recorded real workflow covers one pinned HAP through repository-built CLI/MCP; installed-package and real HSP/App Pack coverage remain unverified. (#1447). Thanks @BaaRai.
  • Ghidra raw inputs and references: compatible Linux/macOS Ghidra profiles accept caller-selected raw architecture/entry information and expose typed incoming references at exact addresses. Windows Ghidra P0 admits the raw NMOS 6502 profile described below; other raw targets and the incoming-reference facet remain outside Windows P0. (#1868, issue morluto/rea#1836, #1715, issue morluto/rea#1245). Thanks @bugstan, @casesolved-co-uk, @mvanhorn, @N0zoM1z0.
  • Ghidra MIPS: Add bounded MIPS32r2/o32 relocatable objects, soft-float integer-register storage, admitted MIPS16 shared ELF, and a narrowly admitted recordless legacy MIPS32 executable profile. The latter pins an endian-matched 32-bit language and records inferred o32 as an analysis assumption. Admission follows each documented ABI/flag/relocation boundary. (#1949, issue morluto/rea#1937, #1950, issue morluto/rea#1938, #1991, issue morluto/rea#1851, #1898, issue morluto/rea#1620). Thanks @AurelioB, @BaaRai, @bqw371, @kaoru0822-kitauji, @N0zoM1z0.
  • Ghidra RISC-V: admit little-endian RV32/RV64 ET_EXEC ELF declaring the supported double-float ABI. Relocatable/shared, big-endian and other ABI profiles remain refused; see the profile and recorded lane. (#2151). Thanks @NIU-123370.
  • PSP static ELF profile: the Ghidra profile is Linux x64, bounded little-endian ELF32 ET_EXEC with the documented PSP/ABI declarations and a compatible caller-installed Allegrex extension. PRX, shared/relocatable images, PBP/ISO/CSO and runtime emulation are outside scope. Historical extension experiments are separate from public-provider verification; real public Ghidra PSP coverage remains unverified. (#1599). Thanks @jaelliot.
  • Ghidra analysis settings: apply validated analyzer overrides before analysis while retaining the selected analysis profile. (#1913). Thanks @akushonkamen, @kaoru0822-kitauji, @N0zoM1z0.
  • Attached native IDA MCP: add an optional native bridge alongside existing legacy/headless profiles. Recorded native runs use Linux IDA Free 9.4 with a navigation correction and Windows IDA Pro 9.3 with a loopback-listener change; stock native switching, native macOS and Windows IDA Free remain unverified. Attached databases remain read-only and are never saved or closed. (#1544). Thanks @imissapixel, @N0zoM1z0.
  • Frida instrumentation: add explicit local/remote target selection, caller-supplied scripts and retained messages, with script-read/input diagnostics and bounded message eviction. Recorded real coverage is the Linux local Node marker workflow; macOS, Windows and remote devices/servers remain unverified. Instrumentation executes foreign code and is destructive, not read-only. (#1359, #2211, issue morluto/rea#2209, #2217, issue morluto/rea#2213, #2628). Thanks @dandgabr, @kaoru0822-kitauji, @N0zoM1z0.
  • Client setup: register Qoder, Trae, ZCode, DeepSeek Harness, Kimi Code, Factory Droid and WorkBuddy through the existing scoped setup flow. DeepSeek is included from 6.5.0; the historical npm 6.4 check did not cover it. Live Trae and DeepSeek API integration remain unverified. (#1564, #1572, #1573, #1929, issue morluto/rea#1839, #2744, #2309, #3041, issue morluto/rea#3040). Thanks @0xRafie, @BaaRai, @cainiao1992, @IvenKooLab, @whoishaha, @ysntony.
  • Website: Add maintained language editions, persistent/system-aware themes, keyboard styling and nested Evidence indentation, plus the reverse-engineering models essay. A simpler home page and beginner journey connect platform prerequisites, client/provider setup and a supplied first investigation. (#1779, issue morluto/rea#1022, #1699, #1714, #1894, #2250, #2432, #2732, #3274). Thanks @CassieFox23, @kaoru0822-kitauji, @N0zoM1z0.
  • Rust dependency metadata: Inspect embedded cargo-auditable package/dependency records in ELF, PE and thin Mach-O without executing the file. Missing metadata and inferred compiler hashes retain explicit limitations; universal Mach-O requires a selected thin slice. (#2456). Thanks @mvanhorn.
  • Electron fuses: Read packaged fuse bytes and per-slice runtime implications without launching or modifying the app. Missing, truncated and unknown wires remain explicit; fuse observations do not prove other Inspector-enablement paths. (#2399). Thanks @kaoru0822-kitauji, @mvanhorn, @N0zoM1z0.
  • Ghidra PowerPC: Admit bounded ELF32 big-endian ET_EXEC PowerPC with an explicit language profile on supported Linux/macOS hosts. PPC64, DOL and other variants remain outside this lane; see the profile and verification prerequisites. (#1747). Thanks @arielfikru.
  • Reference-source summaries: Use CLI import-reference-source --detail summary for compact manifest, count, state and path-outline output. The complete graph remains available and is still the default; hidden outline entries retain separate coverage counts. (#2768, issue morluto/rea#2442). Thanks @matbrgz, @To3akaRin.
  • Recorded AArch64 crashes: Decode 34 ABI register values per thread from supported Linux ELF64 little-endian core notes using the documented caller-provided Python dependencies. These are recorded facts, not proof of current process or library identity. (#2505, issue morluto/rea#2353). Thanks @matbrgz, @NIU-123370.
  • Ghidra byte search: Search initialized analyzed memory using wildcards, bit masks, address bounds and paged results. Unloaded, overlay and uninitialized blocks retain skipped coverage; this is not a raw-file search. (#2341). Thanks @mvanhorn.
  • Raw NMOS 6502 images: Analyze explicitly selected headerless images with Ghidra, including Windows P0, using a caller-selected entry and source mapping within the 16-bit address space. Cartridge parsing, reset-vector inference and 65C02/65816 are outside this profile. (#2079). Thanks @Zhong-fan.
  • Swift String observations: Ghidra function dossiers derive supported AArch64 Swift String literals from constant-register pairs at recognized use sites, retaining instruction/register provenance and explicit omissions. This is a bounded derivation, not a complete string inventory. (#2049, issue morluto/rea#2030). Thanks @thefolahan.
  • Headless IDA procedure lookup: Resolve addresses to canonical containing-procedure entries and identify the session’s admitted program document in the modern headless profile. Incomplete surveys remain errors; attached profiles do not advertise this containment capability. (#2374, issue morluto/rea#2335). Thanks @nikolay-dementiev.
  • Passive browser attachment: Six existing passive browser tools accept an explicit-port loopback browser WebSocket endpoint when HTTP target discovery is unavailable. Existing consent and target/origin checks remain required; this does not launch a browser or enable runtime instrumentation. (#2346). Thanks @all-black-493.
  • Android DEX references: Retain exact method descriptors and individual direct-invoke observations with source method, DEX entry, opcode and code-unit offset. These are static references; unavailable instruction facts remain separate from method-level usage totals. (#2439). Thanks @LcokHcak.
  • Offline EVM metadata: Retain bounded, lossless facts from plausible terminal Solidity CBOR root-map candidates. Candidates do not prove Solidity origin or source/compiler identity, and linked metadata is not fetched. (#2790). Thanks @matbrgz.

Fixes

  • JavaScript loader and export identity: Respect import/require conditions and unavailable package metadata, keep export links separate from writes, and resolve default identifier exports to the value captured at the export statement. (7e5cffa, 322506d, 81f7638, dae1e55). Thanks @paoValle, @VarunGore36, @xu91102.
  • JavaScript traces: Retain nested bridge calls and surviving early-return predicates. Honor node-ID match options, match route seeds against source values, and keep ambiguous runtime candidates unknown. (0351328, 5031099, 44c9d29, 5e79d46). Thanks @jpdefo.
  • Browser comparison coverage: Compare only known redirect response fields and retain network-selection recovery guidance alongside independent event changes. Missing response facts do not prove equality or a change. (2b60e09).
  • Evidence comparison and ledger input: Report display-only bundle differences as unchanged while retaining digests, and classify noncanonical bundle records as invalid caller input. (030c477, 3a34ad3).
  • Capture and admission cleanup: Keep deleted-file observations and original bytes when a parent becomes a file, preserve unrelated I/O failures during cancellation, and require explicit pre-launch proof before releasing an unknown LLDB target owner. LLDB failure controls used simulated boundaries. (e67c364, 2daeff4, 45b6a7f). Thanks @SII-YDD, @xu91102.
  • Client configuration: Validate MCP output-schema profiles before setup writes, ignore untrusted Gemini workspace settings before parsing them, and identify installed skills independently of marker-only client roots. (0930e94, aade9bb, ba33c70). Thanks @CmsChase, @paoValle, @sx4im.
  • Host tool discovery: Share macOS Hopper launcher discovery across setup and runtime, preserve explicit paths, and report validated ADB and Apktool availability. (7582f0d, e5deb83). Thanks @Chessing234, @kaoru0822-kitauji, @viniciusdsandrade.
  • SAZ encoding validation: Reject invalid XML bytes, unsupported encodings and declarations that contradict the archive bytes, including records outside the selected request. (1250aae).
  • Managed member matching: Keep malformed TypeDef list ownership unknown, distinguish constants during structural method matching, and accept legacy small exception-section sizes. (3f6b575, ee5cfbe).
  • Bounded diagnostics: Bound SDK validation messages and terminal normalization before allocation while retaining diagnostics and explicit unknown final output sizes. (7fb0a0c, 1d826f3). Thanks @CRYPTONIKAV.
  • Windows artifact classification: identify .exe, .com, .bat and .cmd artifacts as launchable host executables. (#1823, #1824, issue morluto/rea#1819). Thanks @dollarsmoney, @JasonBuildAI, @kaoru0822-kitauji.
  • Ghidra setup and analysis: preserve launcher/JVM diagnostics, Java-property and extension identity, stale-client recovery, UTF-8 bridge output and pending-startup progress. File-offset decompilation is Ghidra-specific; recorded coverage is Linux x64 with Ghidra 12.1.4. Startup/progress/compiler failure paths that use simulations remain unverified with a real engine. (#1698, #1877, #1931, #2011, issue morluto/rea#1992, #2014, #2101, issue morluto/rea#2078, #2206, issue morluto/rea#2204, 2187e16, b953f96). Thanks @EDMND-SRC, @Ha1baraA11, @kaoru0822-kitauji, @lovecontroing, @lyly-bonbon, @N0zoM1z0, @nosmile99, @Petru101, @sx4im, @Zhong-fan.
  • Bun updates: locate global installations before changing directories and reuse parsed client activation during maintenance. The update flow is covered with package-manager/filesystem simulations; a real Bun global installation update remains unverified. (#1735, e90acae, b045df1). Thanks @xeropresence.
  • Browser observations: preserve effective source-map URLs, empty query/fragment identity, response-body provenance, service-worker policies and explicit uncertainty for malformed events. Bound discovery lifetimes and retain cleanup ownership. Interrupt/retry/failure cases validated with controlled CDP/session fixtures do not establish those paths in real Chromium. (#1742, issue morluto/rea#1729, #1829, #2074, #2099, #2239, issue morluto/rea#2169, #2477, 486b567, a82e37c, a8d4984, 966f7cc, 221c856, 951b095, f09bb8a, 6bd2b28). Thanks @1052326311, @chAng-L19, @chqcjq, @coygeek, @evenafterallisaid, @fisforfaheem, @itsF4LCON, @N0zoM1z0, @shayanxcyber.
  • Hopper failure ownership: preserve startup/process outcomes, retain cleanup leases across one-shot failures, wait for late bridges, and stop owned Linux demo children when their REA owner exits. Denied/crashed/late-bridge/queued-request failure paths use simulated process or bridge fixtures; they are not fresh installed-Hopper verification. (#1763, issue morluto/rea#1751, #1817, #1866, #1927, #2474, #2499, issue morluto/rea#2459). Thanks @coygeek, @Joshwong1908, @kaoru0822-kitauji, @N0zoM1z0, @rudycelekli.
  • ADB acquisition: preserve device paths and directory identity, prevent host destination collisions/overwrites, count UTF-8 logcat bytes and restricted permissions, and evaluate the complete Activity Manager start report. Launch attempts, status, activity and raw failure output remain observations; real-device timeout/mixed-report and Android 8 directory-read paths remain unverified beyond the documented fixtures. (#1962, #2212, issue morluto/rea#2175, #2221, issue morluto/rea#2220, #2359, c42232f, 55b6148, 3bdc873, c89972c, e1cd292). Thanks @coygeek, @dakjdakd, @DeryFerd, @huiq777, @sx4im.
  • WASM names and diagnostics: preserve debug/custom-section names including NUL and leading BOM, accept unpadded WABT section rows, and avoid irrelevant tool-remediation advice on unrelated runtime-root failures. (#1963, issue morluto/rea#1956, #1967, #1981, #2084, #2102). Thanks @1052326311, @bugstan, @N0zoM1z0, @sathariels, @STiFLeR7, @viniciusdsandrade.

⚠ BREAKING CHANGES

  • Runtime attachment state: attached may be null in JavaScript, browser and Electron discovery/inspection results. Treat null as unknown; do not coerce it to false. (e55ef72).
  • Source maps: original-source and mapping rows preserve a null source name when unavailable. Handle null explicitly instead of expecting an invented unknown-source string; new index fields remain optional when reading older Evidence. (ee50ed1).
  • Streamed filtered JSON: --filter-output now emits JSON null instead of {} when the selected value is null; consumers must distinguish a present null from a missing selection. Use --full-output when an object envelope is required. (#2333). Thanks @Jackmeson1.
  • Call graphs: get_call_graph.normalized_result is now { graph, limitations }; read traversal-depth groups under graph and retain relationship-specific caveats. Contract/fixture validation does not establish new Ghidra or IDA engine coverage. (5dfb9d0).
  • MCP discovery: binary_session no longer repeats server_identity.catalog.tools. Use the connected server tool list, grouped tool_availability and provider capabilities; see MCP contracts. Origin: 6395e8d. (#1988). Thanks @kaoru0822-kitauji, @N0zoM1z0.
  • Provider admission: MIPS targets with unresolved GNU ABI attributes are refused. Supply supported ABI declarations. Saved Hopper databases on macOS are unavailable because the launcher cannot run the analysis bridge when opening a database; select an executable target instead. Database support requires a script-capable database launch route. (d4bd65c).
  • Segment extents: binary_overview segment length may be null when Hopper coordinates cannot establish a finite extent in one address space. Preserve unknown rather than converting it to zero or a saturated value. (36db19c).
  • Invocation identity: server.command_path may be null, and registration/setup statuses or doctor classifications may be unknown. Preserve these states and establish the actual invocation before treating a registration as aligned. (187f113). Thanks @hemv-857, @qorvr.
  • ADB installation: the optional replace input is unchanged. Results now require replace_requested to record the requested adb install -r mode; replaced is nullable because prior device package state was not observed. Update result readers to accept null instead of treating reinstall intent as proof of replacement. (864314a).
  • Managed/native verification: unresolved P/Invoke results may retain matched_native and candidate facts when module identity is unknown. Interpret status, basis and limitations; module-identity-unknown does not verify correspondence, and unresolved no longer implies empty observations. (3f6b575).
Full contribution record: 893 commits and 529 merged PRs.

How to Install

The recommended approach is to install REA through its guided setup utility.

First, ensure that a supported Node.js runtime and npm are installed. Then run:

npx rea-agents@latest setup

Choose the AI agents you want to configure, review the proposed changes, and approve them. Setup configures the MCP connection and installs the corresponding workflow instructions.

Restart the configured AI client after setup so it can load the new MCP server.

To use REA as a regular command-line application, install it globally:

npm install --global rea-agents

Then verify the installation:

rea doctor --json

For native binary analysis, configure Hopper or an existing Ghidra installation according to the official documentation. Static JavaScript and Electron analysis can be used without installing either tool.

To update an existing installation, follow the update instructions for the installation method you used. If you use the npx workflow, refresh the agent configuration with:

npx rea-agents@latest setup

Review the proposed changes and restart the relevant client when its MCP registration changes.

Final Verdict

REA is a compelling open-source toolkit for developers who want to combine reverse engineering with AI-assisted software development. Its biggest advantage is the way it connects analysis tools, structured evidence, and MCP-compatible agents into a single investigation workflow.

Support for native binaries, JavaScript applications, and Electron packages gives it a broad range of uses, from understanding undocumented features to investigating legacy software and building compatible implementations. The CLI and evidence-oriented results also make it useful beyond interactive AI sessions.

Its main limitation is that REA depends on external analysis engines for many native workflows, and its capabilities vary by operating system and provider. It also cannot recover original source code automatically or guarantee that an implementation recreated from analysis will behave identically to the original.

For developers working with unfamiliar applications, REA is worth exploring, particularly if they already use an MCP-compatible coding agent. It is best viewed as a bridge between reverse engineering tools and AI development workflows rather than a replacement for established disassemblers or the expertise required to interpret their results.

REA - Reverse Engineer Anything - rea-agents-6.5.0
Free
Download

Software Informations:
Developer:

Operating System:
All Platforms
Date Added:
2026-10-15T12:07:23.246Z
Categories:

Post a Comment/Report Broken Link: