Skip to content

Back to the catalog

CyrilXBT (@cyrilXBT) on X
x.comthread

CyrilXBT (@cyrilXBT) on X

REA (repo github.com/morluto/rea) is an open-source tool that lets a coding agent such as Claude Code do reverse engineering. The agent gets an app and a question, REA picks Ghidra, IDA or JADX, runs it locally and returns findings with evidence. Targets include desktop apps, compiled programs and games, Android apps, web traffic and firmware. Setup is `npx rea-agents setup`. The tweet's author claims it rebuilt a DX Ball sound function that compiles to identical code.

TL;DR Tweet introducing REA, an open-source tool that lets Claude Code drive Ghidra, IDA and JADX to analyse apps and binaries with evidence.
Also seen from another angle🛡️ Security →
Document

What it claims

REA (github.com/morluto/rea) is an open-source tool that gives a coding agent such as Claude Code reverse-engineering abilities. The tweet by CyrilXBT (@cyrilXBT) says the repo has "200k+ stars" and is "100% open source." It calls REA possibly "the most powerful repo on GitHub right now." The tweet gives no source for the star count and names no licence. Both should be checked on the repo itself.

How it works

The tweet describes a loop between the agent and REA:

  1. The user gives Claude Code an app and a question about it.
  2. REA picks one of three tools: Ghidra, IDA or JADX.
  3. REA runs that tool on the user's own machine.
  4. REA returns findings with evidence attached to each claim.
  5. The agent uses those findings to dig further, explain the feature, or build and test its own version.

Supported targets are desktop apps, compiled programs and games, Android apps, websites and their network traffic, and firmware and binary files. The tweet does not say which tool handles which target, or how REA makes the choice.

Evidence

The only result is one demo. The tweet says REA rebuilt a sound function from the game DX Ball, and the rebuilt code compiles back to "the EXACT same code" as the original. It gives no compiler, function size, run time or count of other attempts.

How to use it

Setup is one command:

npx rea-agents setup

The tweet names Claude Code as the agent. It does not say whether Ghidra, IDA or JADX must already be installed, or whether IDA needs its own licence.

Limits

The tweet sets one usage rule: use REA only on software you own or are allowed to analyse. It is a promotional thread and gives no failure modes, accuracy figures or tested agent list. The star count and "open source" claim come from the tweet author, not from the repository.

Organisations named here

  • Claude Code
  • DX Ball
  • Ghidra
  • GitHub

Technologies named here

  • REA
  • Claude Code
  • Ghidra
  • IDA
  • JADX
  • npm
  • Node.js
  • GitHub
  • Android

Techniques named here

  • Agent-driven reverse engineering