REA: New AI-Powered Reverse Engineering Tool Supports Ghidra, Hopper, and Claude Code

REA, short for Reverse Engineer Anything, connects AI coding agents to reverse-engineering tools, enabling in-depth analysis of native binaries, applications, and runtime behavior.

This open-source project supports Ghidra, Hopper, and IDA as native analysis providers. It integrates with Claude Code and other agents through the Model Context Protocol (MCP).

New AI-Powered Reverse Engineering Tool

Rather than replacing established disassemblers, REA provides an interface that lets agents inspect software, trace relevant code, and request additional evidence.

Morluto findings include supporting artifacts and limitations, enabling the agent to explain observed behaviors or develop and test a reconstructed implementation without access to the source code.

For native executables and libraries, REA exposes pseudocode, assembly instructions, strings, symbols, calls, and references. Deep native inspection requires a configured installation of Hopper, Ghidra, or IDA.

Each provider’s capabilities and supported host environments can vary, with Windows Ghidra support currently experimental. Additionally, Ghidra supports investigations involving 16-bit DOS programs.

JavaScript and Electron workflows recover modules, imports, source maps, routes, interprocess communication relationships, and native add-on connections.

This functionality allows investigators to trace behavior across renderer, preload, and main process boundaries. Static JavaScript inspection doesn’t require a native decompiler.

At the same time, .NET analysis provides metadata, Common Intermediate Language (CIL) instructions, declared native dependencies, and build comparisons.

The broader toolkit encompasses Android APKs, firmware, WebAssembly artifacts, saved network captures, and recorded Linux crashes.

Each workflow has specific prerequisites: Android decompilation requires JADX and a full JDK; firmware extraction depends on Binwalk or Unblob in a Linux environment; and selected binary diagnostics necessitate caller-supplied pwntools. Browser inspection requires a Chrome-family browser.

Users can configure the integration by running `npx rea-agents setup`. This setup process registers REA’s MCP server, installs compatible investigation instructions, and backs up existing configurations.

Users are prompted to review and approve proposed changes before restarting their agent. Supported clients include Claude Code, Codex, Cursor, Gemini CLI, and Grok Build, with the option for other compatible clients to use manual registration.

REA Supported Analysis Capabilities

Analysis target	Key outputs	Required tools
Native binaries	Pseudocode, assembly, strings, symbols, calls, and references	Ghidra, Hopper, or IDA
JavaScript / Electron	Modules, imports, source maps, routes, IPC, and native add-on relationships	Node.js and npm
.NET assemblies	Metadata, CIL instructions, native dependencies, and build comparisons	No additional analysis engine
Android APKs	Manifest declarations, classes, decompiled methods, and references	Headless JADX and a full JDK
Firmware	Identified regions, extracted artifacts, and native-analysis handoffs	Binwalk or Unblob on Linux
Websites	Page structure, scripts, network observations, and requested screenshots	Chrome-family browser
Go binaries	Embedded compiler version, modules, replacements, and build settings	Built-in static inspection; no Go installation
Process behavior	Terminal output, interactions, exit status, filesystem observations, and run comparisons	Linux/macOS with a native PTY

REA requires npm and Node.js versions 22.x (from version 22.19), 24.x (from version 24.11), or version 26 and later.

Terminal workflows utilize the same analysis mechanisms as agent-driven investigations, including a command that inspects extracted JavaScript application directories or Electron ASAR archives and returns structured JSON results.

While REA analyzes targets locally, it does not guarantee that findings remain entirely offline; agents receive tool results, and their model providers apply separate data policies.

Static inspection of JavaScript and .NET does not execute applications. However, runtime capture can launch or interact with targets using the current user’s permissions.

The project reports reconstructing the game DX-Ball, which passed 3,205 original x86 cases and reproduced 63 compiled function bytes.

This achievement demonstrates validated reconstruction rather than accuracy across every target. REA is MIT-licensed and intended for authorized, lawful research.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.