The Problem REA Solves

Reverse engineering has always been a manual, time-consuming craft. Security researchers spend hours staring at disassembly, tracing call graphs, and mentally reconstructing logic flows. Meanwhile, AI coding assistants have revolutionized how we write code — but they hit a wall when facing closed-source binaries.

REA (Reverse Engineer Anything) changes the game by acting as an intelligent bridge between AI coding agents and industry-standard analysis engines like Ghidra, Hopper, and IDA Pro.

What Makes REA Different

The Architecture

REA operates as multi-layer orchestration middleware. When your AI agent wants to inspect a file, it doesn't fumble through raw bytes — it goes through a carefully designed pipeline.

┌─────────────────────────────────────────────────────────────┐
│                    AI CODING AGENT                        │
│           Claude Code  ·  Codex  ·  Cursor  ·  Pi           │
└─────────────────────────────┬───────────────────────────────┘
                              │
                    Model Context Protocol (MCP)
                              │
                              ▼
┌─────────────────────────────────────────────────────────────┐
│                      REA SERVER                           │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Middleware Chain                                    │   │
│  │  Audit → Kill-Switch → Policy → Redaction           │   │
│  └─────────────────────────────────────────────────────┘   │
│  ┌─────────────────────────────────────────────────────┐   │
│  │  Evidence v2 Tracking  ·  State Management          │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────┬───────────────────────────────┘
                              │
        ┌─────────────────────┼─────────────────────┐
        │                     │                     │
        ▼                     ▼                     ▼
┌───────────────┐   ┌───────────────┐   ┌───────────────┐
│ NATIVE APPS   │   │  ELECTRON     │   │   BROWSER    │
│ Hopper/Ghidra │   │  JS / ASAR    │   │   CDP / DevTools│
└───────────────┘   └───────────────┘   └───────────────┘

The Middleware Chain

Every REA tool call passes through a strict, fail-closed pipeline:

1. 1Audit Enter

   Logs a hash-chained record of the invocation

2. 2Kill-Switch

   Instantly denies execution if .rea/HALT exists

3. 3Tier Classification

   Categorizes tool as read, write, or destructive

4. 4Policy Check

   Validates against autonomy levels (L0–L3) in .rea/policy.yaml

5. 5Injection Filter

   Scans arguments for protected paths and prompt-injection attempts

6. 6Redaction

   Scrubs secrets before they reach LLM context windows

The Investigation Flow

An AI-driven reverse engineering session follows a disciplined cycle:

    ┌──────────────┐         ┌──────────────┐         ┌──────────────┐
    │              │         │              │         │              │
    │  DECOMPILE  │────────▶│ UNDERSTAND  │────────▶│  RECREATE   │
    │              │         │              │         │              │
    └──────────────┘         └──────────────┘         └──────────────┘
           │                        │                        │
           ▼                        ▼                        ▼
    ┌──────────────┐         ┌──────────────┐         ┌──────────────┐
    │ Extract:     │         │ Trace:       │         │ Generate:    │
    │ • Pseudocode │         │ • Xrefs      │         │ • Functional │
    │ • Symbols    │         │ • Call graphs│         │   code       │
    │ • Strings    │         │ • IPC flows  │         │ • Tests      │
    └──────────────┘         └──────────────┘         └──────────────┘

What REA Can Analyze

Installation & Setup

Step 1: Install Globally

npm install --global rea-agents

Step 2: Run Interactive Setup

rea setup

This detects installed agents (Claude Code, Codex, Cursor, etc.), shows a transparent review plan, backs up existing configs, and waits for your approval.

Step 3: Verify Installation

rea doctor

Real-World Case Studies

REA vs. Lean REA

While REA ships with a robust 207-tool MCP server, some developers encounter context window bloat. Enter Lean REA — a lightweight alternative.

Install the lean variant:

npx skills add a16z/lean-rea

Practical Example: Analyzing an Electron App

Let's walk through a real example of using REA to analyze Slack's desktop app and understand how it handles deep links.

Step 1: Point REA at the Target

# Navigate to the Slack app bundle
cd /Applications/Slack.app/Contents/Resources
Start Claude Code (REA is already configured via rea setup)
claude

Step 2: Ask the Agent to Investigate

Now you can have a natural conversation with Claude Code about the app:

# Your prompt to Claude Code:
> How does Slack handle slack:// deep links? Trace the flow from 
> URL click to the actual channel navigation.
# Claude Code will use REA tools to:
1. Scan the app.asar for protocol handlers
2. Find the deep link registration in package.json
3. Trace the IPC channel from main → renderer
4. Identify the router that parses slack:// URLs
5. Return evidence-backed findings with code snippets

Step 3: Review the Evidence

REA returns structured evidence you can verify:

{
  "evidence_id": "ev2_a8f3c2d1",
  "sha256": "9f86d08...",
  "finding": {
    "file": "dist/main.bundle.js",
    "function": "handleDeepLink",
    "line": 4521,
    "snippet": "protocol.registerHttpProtocol('slack', (req) => {...})"
  }
}

Step 4: Generate Replacement Code

Once you understand the mechanism, ask the agent to write code for your own app:

> Based on what you found, write a deep link handler for my 
> Electron app that handles myapp:// URLs and routes to React views.
# Claude Code generates working code based on the traced logic

Security Considerations

Safety Mechanisms

Best Practices Checklist

Conclusion

REA represents a paradigm shift in how we approach reverse engineering. By bridging AI coding agents with battle-tested analysis tools, it transforms what was once a week-long manual effort into an interactive conversation with your code.

Whether you're tracing IPC channels in Electron apps, reconstructing game logic from DOS-era binaries, or auditing the behavior of closed-source tools — REA lets you move from curiosity to working code faster than ever before.