So, What Does REA Actually Do?
Reverse engineering isn't new. Tools like Ghidra, Hopper, and IDA Pro have existed for years. They let developers inspect compiled programs, decompile functions, and trace how different parts of an application connect.
The problem? Using them manually can be brutal. A specialist might spend days or weeks digging through assembly instructions just to understand one particular feature.
Now imagine giving that same task to an AI agent.
Without the right tools, the model might start guessing, inventing function names and explanations that sound convincing but aren't grounded in the actual software.
That's where REA comes in.
It acts as a bridge between AI agents and reverse-engineering tools, allowing agents to inspect symbols, trace cross-references, decompile functions, and work with structured evidence.
And it isn't limited to native executables. REA also supports Android APKs, .NET assemblies, and JavaScript/Electron applications through different analysis tools.
But does it actually work?
Do you prefer watching instead? Check out the full breakdown and live benchmark video:
How to Get Started With REA
Want to give REA a shot yourself? Getting started is pretty straightforward.
REA supports several AI coding agents, including:
Codex: OpenAI's coding agent, which I used for the Sony experiment.
OpenCode: An open-source coding agent that supports multiple AI models.
Claude Code: Anthropic's terminal-based coding agent.
All three can connect to REA through MCP, so you can use whichever agent you prefer.
1. Install REA
First, make sure you have Node.js and npm installed. REA requires a supported Node.js version (22.19+, 24.11+, or 26+).
Then run:
npx rea-agents@latest setup
The installer lets you select your coding agent, configure the MCP connection, and install REA's investigation skill.
Want to configure all three at once?
npx rea-agents@latest setup --client codex --client opencode --client claude_code
Review and approve the setup changes.
2. Verify Everything Works
Restart your coding agent, then run:
npx -y rea-agents@latest doctor
This checks your setup and reports any missing dependencies.
3. Start Reverse Engineering
Open your preferred agent and try something like:
Use REA to inspect this application, identify how its authentication flow works, and show me the evidence behind your findings.I Put REA to the Test With Sony's Android App
My problem was simple. Enabling Wind Noise Reduction on my Sony WH-1000XM4 headphones takes too many steps inside Sony's Sound Connect app.
So I connected my Samsung Galaxy S24 Ultra to my PC, enabled USB debugging, and gave Codex, powered by GPT-6.1 Sol, one task:
Use REA to build a standalone Android app that enables Wind Noise Reduction when I open it.
The agent pulled the installed Sony APK and used REA to inspect compiled classes and noise-cancellation settings.
But here's the interesting part.
REA didn't magically figure out everything. Some initialization code couldn't be decompiled, so Codex also used existing open-source Sony protocol references.
It then built and installed a standalone Android app called XM4 Wind.
I tested regular Noise Cancelling and Wind Noise Reduction. After each change, the app read the setting back from the headphones, confirming both worked.
I also added a power button and verified the On/Off indicator and disabled controls after shutdown.
Was it a one-shot prompt? Nope. There was some back-and-forth.
But the crazy part? It took roughly 30 minutes.
Does the AI Model Matter?
Absolutely.
Two benchmarks give us an idea of how different models handle reverse-engineering tasks, although neither tests REA directly.
First, Retrobench measures how closely models can reconstruct C code from compiled game binaries and reproduce the original machine code.
Model | Average Byte Match |
|---|---|
Claude Opus 5.5 | 98.4% |
Claude Fable 5.1 | 97.8% |
GPT-6.1 Sol | 94.9% |
GPT-6 Astra | 94.3% |
These percentages measure matching compiled bytes, not the percentage of tasks solved.
Pretty close, right?
But look at SRE-Bench, which evaluates agents investigating compiled programs, including binaries protected against reverse engineering.
Model | Fully Solved Instances |
|---|---|
GPT-6 Astra | 56.87% |
GPT-6.1 Sol | 50.76% |
Gemini 4 Argon | 44.27% |
Claude Opus 5.5 | 33.59% |
And suddenly, the leaderboard flips.
Different reverse-engineering challenges clearly reward different model capabilities.
What Else Has REA Been Used For?
The project's showcases include some pretty interesting examples:
DX-Ball: Reconstructed a classic game's sound-panning calculation in C, passing 3,205 behavior tests, with 63 matching compiled bytes.
Notion: Investigated how Notion preserves formatted blocks when copying and pasting, including its Electron clipboard bridge and locally stored block data.
Touhou 4: Traced the original game's bullet-angle calculations and connected them to a C++ reconstruction, with 2,139 matching bytes verified.
But There Are Limitations
REA isn't some magic button that can reverse engineer absolutely anything.
Tools like VMProtect can make software extremely difficult to analyze. And if an application's important logic runs on private servers, inspecting the local app won't magically reveal the backend source code.
The AI model still matters, and not every investigation will succeed.
The Bottom Line
REA didn't invent reverse engineering. Tools like Ghidra have existed for years.
What REA does is put those capabilities directly into the hands of AI agents.
Instead of guessing how software works, an agent can inspect the actual code, trace its behavior, and use that evidence to help recreate functionality.
And as my Sony experiment showed, that can be pretty powerful.
▶️ For more technical breakdowns, benchmarks, and local AI engineering tests, head over to the YouTube channel HERE.
Until next time, keep building!