codila on X: "REA is most dangerous thing on the internet right now... It lets your AI agent reverse engineer any app, down to the binary If you use it correctly, you can rebuild any feature you pay for, for FREE In this article, I show you how: https://t.co/3P1FNXiXzl" / X

Motion design apps. Office. TradingView. Your notes app and others - All of it is just code on your disk

And every company is betting on one thing: that you will never look inside

https://substack.com/@0xcodila

Most people saw the screenshots, bookmarked them, and never tried it

So in this full course I'll show you everything in simple words:

• what reverse engineering actually is
• what REA can read, from desktop apps to games
• the honest answer to "isn't this just stealing?"
• how to install it step by step, straight from the official docs
• what people already rebuilt: Adobe, Office, TradingView, games
• how a normal person and a pro use it every day
• a pack of copy-paste prompts

So bookmark it, open your terminal, and go step by step

Part 1 - Understand

01. What Is Reverse Engineering (and What Is REA)

Reverse engineering is simple actually

You look at a finished app and figure out how it works inside, without its source code

That's it. You want to understand a feature well enough to explain it, change it, or build your own version

REA (Reverse Engineer Anything) does exactly that, with your AI agent doing the hard part. The official README says it in one line:

"See a feature you like. Understand how it works, down to the binary level."

Here's what it is technically:

• an MCP server + CLI that plugs into Claude Code, Codex, Cursor, Gemini CLI and other agents
• it runs locally. Your apps never get uploaded anywhere
• every conclusion comes with evidence: the function, the file, the call, and what is still unknown

You ask in plain English. REA inspects the program. Your agent explains it, builds your version, and tests it REA repo

The best example is on the official site

For example: why does Windows Calculator show 220 when you type 200 + 10%?

Without REA you'd decode branches and trace calls by hand. With REA you just ask

Or why the Chrome dinosaur game gets faster: speed starts at 6, adds 0.001 every update, and stops at 13

You don't read the code. You ask a question, and you get the rule

02. What REA Can Read

This is the official list, translated into normal words What you can analyze

• Desktop apps built on JavaScript/Electron (Notion, Slack, Discord, Obsidian and many more). Nothing extra to install
• Websites: page structure, scripts, network requests. You need a Chrome-family browser
• Saved network traffic (HAR files from your browser)
• Programs and games (.exe, Mac apps, old DOS games): pseudocode, assembly, strings, calls. You need Ghidra, Hopper or IDA
• .NET apps: no extra tools
• Android apps (APK): you need a JDK and JADX
• Smart contract bytecode: Linux x64
• Firmware, WASM, Go binaries and more

Here's the part almost nobody talks about:

Many Unity games ship their game logic as .NET code. And REA reads .NET without any extra tools

This is how one person took a Steam game he had bought and got it open in Unity in under 30 minutes:

so agent now does the whole job for you

03. Wait... Isn't This Just Stealing?

Let's talk about the elephant in the room!

The moment REA went viral, half of X screamed "piracy" and the other half screamed "software is dead"

Chamath even said on All-In that people "decompiled" the whole Adobe suite

And here's the funny part. That clip got a Community Note

The Adobe alternatives were not decompiled. Their developer calls them clean-room reimplementations

That one note explains the whole legal game. So let me explain clean room, because once you get it, everything clicks

Clean room is a 40-year-old trick

Step 1: one team studies the original and writes down what it does. Not the code. The behavior

Step 2: a different team builds a new product from that description only. They never see the original code

The result does the same thing, but contains zero of the original's code Clean-room design

This is how the PC industry was born. In the early 80s, Compaq rebuilt IBM's BIOS this way, at a cost of about $1 million. That's why "IBM compatible" PCs from other brands exist at all

And the courts kept backing reverse engineering:

• 1992, Sega v. Accolade. Accolade took apart Sega Genesis games to make their own compatible games. The court said taking apart code can be fair use when it's the only way to understand how it works Sega v. Accolade
• 2000, Sony v. Connectix. Sony lost 3-0. The final emulator contained none of Sony's code

And then there's the other side of history

In 2010-2011 hackers broke the PS3's security and published its root key. Sony sued George Hotz (geohot), and in April 2011 he settled and agreed to stop hacking Sony products TechSpot

So here's my honest take

Reading the app on your own computer to understand it, that's learning

Rebuilding a feature from its behavior, in your own code, that's how the industry has always worked

Copying their code, cracking paid features, or publishing someone else's decompiled source, that's the part that gets you sued

Even the REA team says it plainly: it's for lawful research, education, interoperability, software preservation, and software you own or are allowed to examine Disclaimer

Study the original. Ship your own. That's the rule for everything in this article

Part 2 · Install

03. Install REA in 5 Minutes

Follow it in order Get started

Step 1. Check Node.js

Open your terminal and run:

text

node -v
npm -v

You need Node 22.19+, 24.11+, or 26+. Versions 23 and 25 are not supported

If it's older or "command not found", install Node 24 LTS:

macOS (with Homebrew):

text

brew install node

Close Terminal, open it again, then:

text

fnm install 24
fnm default 24

text

winget install OpenJS.NodeJS.LTS

Type Y if it asks. Close PowerShell, open it again, run node -v

If Windows later says "running scripts is disabled", run this once:

text

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Step 2. Have an agent

I use Claude Code. It needs a paid Claude plan. Setup page: code.claude.com/docs/en/setup

Codex, Cursor, Gemini CLI, OpenCode and others work too

Step 3. Run REA setup

The easiest way: paste this into Claude Code and let it do everything:

text

Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

text

npx rea-agents@latest setup

What happens next:

• npm asks to download the package. Say yes
• REA shows a list of agents. Pick Claude Code
• REA shows a plan of every change it will make. Nothing changes until you approve. It also backs up your current config
• It adds the MCP connection plus a matching investigation skill

Setup will also offer Hopper, a separate engine for reading programs. On a Mac it downloads the official installer and opens it, and you pick demo mode. It's optional, you can say no for now

Step 4. Restart your agent

• Claude Code in terminal: exit and start a new session
• Desktop apps (Claude Desktop, Cursor): quit completely with ⌘Q. Closing the window is not enough

Step 5. Check

text

npx -y rea-agents@latest doctor --client claude_code --json

doctor only checks things, it never changes anything. If something failed, it tells you the next step

Want the short rea command forever:

Your result: Claude Code now has REA tools. Ask it "what REA tools do you have?" and it will list them

text

npm install --global rea-agents
rea --help

04. Your First Reverse Engineering in 2 Minutes

Don't start with something huge. REA has an official practice app for this First investigation

It's a tiny "Notes" app with an Export notes button. Your job: find out where the export goes

Paste this into Claude Code:

text

Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.

text

Show where notes.csv is written, which fields it contains, and the relevant files and lines.

What you should get back, the full path of one click:

1. The page (renderer.js) handles the button
2. The bridge (preload.js) sends a notes:export message
3. The handler (main.js) writes notes.csv into your Downloads folder with id and title

Congrats. That's reverse engineering

You just traced a feature through an app you didn't write, and every step came with proof

Now the fun part. Every Electron app on your computer works the same way, and you know where it lives:

• Mac: /Applications/<App>.app/Contents/Resources/app.asar (right-click the app → Show Package Contents)
• Windows: C:\Users\<you>\AppData\Local\Programs\<App>\resources\app.asar
• Linux: often /opt/<App>/resources/app.asar

And you can analyze it straight from the terminal, without running the app:

text

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Tip: on Mac, hold Option, right-click a folder and choose "Copy as Pathname". Or just drag the folder into your terminal

05. Add the Right Engine for What You Want to Read

Desktop JavaScript apps need nothing more. For everything else, add one engine

Programs and games: Ghidra (free, made by the NSA)

You need Ghidra 12.1.x and JDK 21 or newer

macOS / Linux:

text

export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

text

$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:/tools/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Windows support is still experimental and read-only

Then look at any function:

text

npx -y rea-agents@latest function /absolute/path/to/program main --provider ghidra --json

Programs and games: Hopper (Mac/Linux, commercial with a demo)

Just run setup again. It finds Hopper or offers to install it. On Mac, pick demo mode or your license on first launch

Programs and games: IDA (if you already own it)

Verified on Windows through an existing IDA MCP setup Get started

Android apps: a full JDK 17+ and jadx-headless-mcp 0.7.1 Android guide

text

export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
rea inspect-android-package /path/App.apk

Websites: any Chrome-family browser

Smart contracts: Linux x64

Keep it updated (REA ships fixes almost every day):

text

rea update

or npx rea-agents@latest setup. To remove it: rea uninstall

If your agent doesn't see REA: restart it, then run doctor --client claude_code --json again

Part 3 - What People Already Rebuilt

06. Adobe, Office, TradingView and Games

This is where it gets crazy

AI didn't just learn to read software. People are already rebuilding entire products

• Adobe

ArtCraft rebuilt seven Adobe apps as free, open-source alternatives: Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign and Acrobat. Built in Rust with help from Claude Opus 5.5

Remember the clean room? This is it. ArtCraft calls these clean-room reimplementations, without Adobe's source code. They're still early alpha, but they exist, and they're free

• Microsoft Office

Then they went after Office. WordCraft, GridCraft and DeckCraft: Word, Excel and PowerPoint

• TradingView

This one I love. Map how the platform behaves, turn it into a spec with Opus 5.5, then build your own charting engine and backtester with your own code

One honest note: building your own terminal is fine. Using someone's paid indicators for free is not. Build yours

• Games

This is where AI reverse engineering exploded first

A Super Mario Sunshine native PC port: about 365 agent hours and 17.3B tokens, using both Claude and Codex Repo

The PS1 game Tomba! now runs on PC through a static recompiler. Its builder had no prior experience and used Claude Code + Ghidra for about three weeks Write-up

And on the official REA blog, one person with AI agents rebuilt a Touhou game: 697 functions, 696 exact matches, playable in about 12 days The industrial revolution in reverse engineering

Kotaku even reported browser versions of Halo, GTA: Vice City and The Simpsons: Hit & Run attributed to AI-assisted decompiling. Those are unofficial and likely to get takedowns, which is exactly the line from the chapter above Kotaku

How to repeat any of this: pick a tool you pay for or a game you own, ask REA how one feature works, write the spec, build your own version. The prompts are in Step 10

Part 4 - Use It Every Day

Reverse engineering was invented for compatibility, security and preservation

But here's how I'd use it in normal life

07. For Beginners

1. "What is this app really doing on my phone?"

Take the APK of any Android app: your broker, your exchange, that "free signals" app from Telegram. Ask:

text

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

Official proof this works: REA took apart the Aegis authenticator app (3,077 classes), found exactly how it makes its 6-digit login codes, and rebuilt it. The rebuild matched all 133 test cases Aegis case

2. "Is this file safe?"

Reverse engineering is how people catch malware. When a fake 113 GB "GTA 6 build" went around, someone who took the files apart found it was fake and full of malware

3. "Is this token a scam?"

Most memecoins don't publish their source. REA reads the raw contract bytecode and recovers its functions EVM guide

text

rea inspect-evm-interface ./runtime.hex hex --json

text

Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.

Function names here are guesses from the bytecode, so treat a red flag as "check deeper". And this command runs on Linux x64 for now

4. "I want that paid feature"

Don't crack it. Rebuild it. Ask REA how the feature works, then let Claude build your own version from public data and open-source parts

08. For Pros

REA ships guided workflows that almost nobody knows about. They're built into the MCP server Guided prompts:

• investigate_feature: trace a feature from discovery to the exact functions
• compare_application_versions: compare two releases of an app and see what really changed in the update
• verify_reconstruction: check your rebuild against the saved evidence
• trace_crash: connect a crash to the code paths behind it
• audit_residual_unknowns: list what is still unproven
• prepare_bounded_process_capture: plan a safe, limited runtime experiment before you run anything

The pro loop is investigate → spec → build → verify

text

Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.

How far this goes, from the official showcases:

• DX-Ball (1996): REA recovered the sound-pan function and rebuilt it in C. It passes 3,205 original-x86 test cases and reproduces all 63 compiled bytes DX-Ball
• Notion: REA traced how copy works, from the page through the IPC bridge to the system clipboard Notion

And the lessons from the Touhou rebuild are gold for anyone doing this seriously:

• give the agent a clear goal and clear acceptance criteria
• keep notes and checks in git so the next session can continue
• treat every explanation from the agent as a hypothesis to test
• test your tests. A broken comparison once let a wrong function pass

Security people are already running this at scale. One researcher built an AI pipeline with 8 MCP servers, 300+ tools, Ghidra, radare2 and Frida, and says it paid for itself through bug bounties:

Where the money is: security research and bug bounties, moving old software to new systems, making tools talk to each other, and helping companies understand software they lost the source code for

09. What REA Can't Do

I want you to trust this article, so here are the real limits

• It can't touch the server. It reads what's on your machine. The code that runs on a company's servers was never shipped to you. It won't hack a bank or move money Why it can't hack your bank
• Decompiled code is not the original source. It's a reconstruction. That's why the verify step matters
• Hard targets are still hard. Stripped C++ binaries are much tougher than Unity .NET games
• Your agent may refuse. Some firmware and console targets hit the model's safety rules
• Commercial tools need real licenses. REA gives you no IDA, Hopper or JEB license, and cracked copies are not allowed

10. The Prompt Pack

Save this. Every prompt works in Claude Code once REA is installed

Setup:

text

Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

text

Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.

text

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

text

Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project.

text

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

text

Use REA to inspect Windows Calculator's % button. Recover the rules after + and ×, then build a small calculator that uses both.

text

Inspect the dinosaur game and build a version with adjustable speed.

text

Reconstruct a game from its executable and test it against the original.

text

Clone the rea.tools website.

text

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

text

Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.

text

Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.

text

Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence.

Your One-Evening Protocol

Don't just bookmark this. Do this tonight:

1. Install REA with the setup prompt (5 min)
2. Practice on the official Notes example (2 min)
3. Pick one app on your computer that you use every day
4. Ask one question about one feature you love
5. Get the spec: what it does, step by step, with proof
6. Build your version from the spec in a new folder

That's it. One evening, and you'll never look at software the same way again

The shift

Closed source used to mean "you'll never know" → now it means "show me the evidence"

REA is not a hacking tool

It's a reading tool for software you didn't write

And the real alpha is not the 100K stars or the viral screenshots

The real alpha is that every feature you envy in someone else's app is now something you can understand:

• Let REA find the feature and the proof
• Let Claude write the spec and build your version
• Let the tests prove it works

Most people will keep paying for features they could understand in an afternoon

The few who learn to read software will build anything they want - absolutely for free.

Bookmark this course before your next build → @0xCodila