rea

Product Introduction

1. Definition: REA (Reverse Engineer Anything) is a Model Context Protocol (MCP) server and command-line interface (CLI) tool designed for AI-assisted software reverse engineering. It is a technical platform that connects AI agents and developers to professional-grade binary analysis tools like Hopper, Ghidra, and IDA Pro, as well as static analyzers for JavaScript, Electron, .NET, and Android applications.
2. Core Value Proposition: REA exists to automate and democratize the complex process of software reverse engineering. It solves the critical problem of understanding undocumented, legacy, or closed-source software systems by providing structured, AI-native access to deep code analysis, enabling users to move from high-level feature observation to low-level binary comprehension and actionable reconstruction.

Main Features

1. AI-Agent Integration via MCP: REA functions primarily as an MCP server, allowing AI coding assistants like Claude Desktop, Cursor, and Windsurf to directly invoke reverse engineering tools. The agent can open binaries, decompile functions, trace call graphs, and analyze strings through natural language prompts, creating a seamless investigative workflow. Setup is automated via npx rea-agents setup.
2. Multi-Engine Binary Analysis: The platform provides a unified interface to multiple disassemblers and decompilers. It supports Hopper (with optional automated installation), Ghidra (headless analysis), and IDA Pro (via MCP bridge). This allows for cross-tool verification and lets users leverage their existing toolchain. Analysis is performed on local, temporary copies of the target binary.
3. Static Application Analysis Suite: Beyond native binaries, REA includes specialized providers for higher-level applications. It can statically analyze JavaScript and Electron application directories or ASAR archives without execution, reconstruct dependency graphs and recover logic. It also supports .NET assembly inspection and Android APK analysis using a headless JADX instance, all without requiring an emulator.
4. Evidence-Based Workflow: Every analysis conclusion is backed by immutable "Evidence" bundles. These JSON files contain the raw data (decompiled code, strings, call graphs) used to reach an insight, along with documented limitations and unknowns. This creates an audit trail, allows for result comparison (rea compare), and enables caching via snapshots for reproducible research.
5. Comprehensive CLI for Standalone Use: All capabilities are exposed through a robust CLI (rea). Users can perform deep analysis (rea analyze), decompile specific functions (rea decompile), capture runtime behavior (rea capture-process), and manage evidence bundles without an AI agent, making it a powerful standalone reverse engineering toolkit.

Problems Solved

1. Pain Point: The "black box" problem in software development and security. Engineers and researchers often encounter proprietary software, legacy systems, or malware with no available source code or documentation, making understanding, auditing, modernizing, or interoperating with them incredibly time-consuming and specialized.
2. Target Audience: Security Researchers (malware analysis, vulnerability discovery), Software Engineers (understanding third-party SDKs, legacy system modernization), Product Developers (competitive feature analysis, protocol reverse engineering), and Digital Forensics Analysts.
3. Use Cases: A developer sees a novel UI feature in a competitor's desktop app and wants to build a similar feature; a security auditor needs to verify there are no hidden backdoors in a closed-source vendor library; a maintenance team must document the data flow in a 20-year-old binary before a server migration; a researcher wants to trace the command-and-control logic in a malware sample.

Unique Advantages

1. Strengths & Limitations (Pros & Cons):

   • Pros:
     • Agent-First Design: Uniquely bridges the gap between AI reasoning and deep technical analysis, turning an agent into an interactive reverse engineering partner.
     • Tool Agnosticism: Abstracts away the complexities of different disassembler APIs (Hopper, Ghidra, IDA), providing a consistent interface.
     • Local & Private: All analysis runs on the user's machine. No code or binaries are uploaded to external cloud services, ensuring intellectual property and security.
     • Evidence-Driven: Promotes rigorous methodology by forcing explicit citation of evidence, reducing speculative conclusions.
   • Cons:
     • Engine Dependency: Deep native analysis requires a separate, often expensive (Hopper, IDA) or complex (Ghidra) analysis engine to be installed and configured.
     • Learning Curve: While it simplifies access, effective use still requires fundamental understanding of reverse engineering concepts (functions, assembly, calling conventions).
     • Platform Constraints: Advanced features have specific OS requirements (e.g., Windows Ghidra support is experimental, firmware analysis requires Linux tools).

2. Key Alternatives & Differentiation:

   • Traditional Disassemblers (Hopper, Ghidra, IDA Pro): These are the engines REA connects to. Differentiation: REA is not a replacement but a orchestrator and AI interface layer. It adds automation, evidence tracking, multi-tool abstraction, and AI-agent interoperability that these standalone GUI tools lack.
   • Cloud-Based Decompilers (e.g., Dogbolt): These services allow uploading a binary for quick decompilation. Differentiation: REA is entirely local, protecting sensitive IP. It also provides a structured investigative workflow, cross-reference tracing, and integration into a developer's existing AI-agent environment, rather than being a one-shot web tool.
   • Manual Scripting with r2 or objdump: Seasoned reversers often use Radare2 or GNU Binutils directly. Differentiation: REA provides a higher-level, more accessible, and agent-friendly API that reduces the need for writing low-level scripts, making advanced analysis accessible to a broader range of developers and AI agents.

Frequently Asked Questions (FAQ)

1. Does REA upload my software or binaries to the cloud? No, REA is designed for local reverse engineering. All analysis, including AI-agent-driven investigation, is performed on your local machine using your installed analysis engines. No binary data is sent to external servers.
2. Can I use REA without an AI agent like Claude Desktop? Yes. REA includes a full-featured command-line interface (CLI). You can use all its analysis, decompilation, and evidence management tools directly from your terminal without any AI agent integration.
3. What is the difference between REA and just using Ghidra? REA can use Ghidra as one of its analysis backends. The key difference is that REA provides a standardized API (via CLI and MCP) that works across Ghidra, Hopper, and IDA, enables AI agent control, automates evidence collection, and manages the analysis project lifecycle, whereas using Ghidra alone is a manual GUI-driven process.
4. Is REA free to use? The REA platform itself is open-source (MIT license). However, to use its native binary analysis features, you must provide a licensed copy of a supported disassembler (like Hopper or IDA Pro) or use the free Ghidra. REA does not include or provide licenses for these third-party tools.
5. What kind of applications can REA analyze? REA supports a wide range: native binaries (macOS, Linux, Windows), JavaScript/Electron applications (via static analysis), .NET assemblies, Android APKs (statically), and even firmware images (using Binwalk/Unblob on Linux). It covers from high-level web tech down to low-level machine code.