How to Use REA: Step-by-Step Guide to the Reverse Engineer Anything GitHub Tool

Whether you are analyzing a legacy closed-source binary, debugging an undocumented third-party REST API, inspecting an Electron desktop application, or auditing an Android APK for security vulnerabilities, learning how to use REA provides developers with unprecedented forensic visibility.

In this step-by-step engineering guide, we examine what REA is, how to set up the rea-agents MCP server with your favorite AI coding assistant (Cursor, Claude Code, Windsurf, or Gemini CLI), and how to execute real-world clean-room reconstruction workflows with complete ethical and technical rigor.

memory What is REA and How Does It Work?

Unlike naive AI scripts that attempt to hallucinate code from vague descriptions, REA is an evidence-driven forensic orchestrator. It acts as a standardized bridge between an AI reasoning engine and battle-tested local disassemblers, network proxies, decompilers, and dynamic instrumentation harnesses.

checklist Prerequisites & System Setup

Before installing REA, verify that your development machine satisfies the following prerequisites:

• Node.js: Version 20.x, 22.x LTS, or newer with npm and npx available in your system PATH.
• AI Coding Client: Cursor IDE, Claude Desktop, Claude Code CLI, Windsurf, or Gemini CLI with Model Context Protocol (MCP) support enabled.
• Optional Analysis Engines:
  • For native binaries: objdump, strings, gdb, or a headless installation of Ghidra / Rizin.
  • For Android applications: jadx or apktool.
  • For web/Electron apps: asar CLI (npm install -g @electron/asar).

download Step 1: Installing and Configuring REA

The creators of morluto/rea provide an automated onboarding script distributed through npm as rea-agents. Run the setup script in your terminal:

# Run the official REA onboarding wizard
npx rea-agents@latest setup

The interactive installer performs the following automated actions:

1. Detects your installed AI assistants (e.g., Claude Desktop, Cursor, Windsurf).
2. Verifies presence of Node.js and system inspection dependencies.
3. Updates or proposes the JSON configuration file to register the REA MCP server.

{
  "mcpServers": {
    "rea": {
      "command": "npx",
      "args": ["-y", "rea-agents@latest", "server"],
      "env": {
        "NODE_ENV": "production"
      }
    }
  }
}

Restart your AI coding assistant. You should see rea appear in your active MCP tools list with functions such as rea_inspect_binary, rea_extract_strings, rea_trace_network, and rea_decompile_function.

terminal Step 2: How to Prompt Your AI Agent with REA

Once REA is hooked into your agent environment, you interact with it directly through natural language instructions. The key to successful reverse engineering with REA is hypothesis-driven prompting. Instead of saying *"copy this app,"* prompt the agent with specific investigative targets:

# Example Prompt for Agent in Cursor / Claude Code:
"Use REA to inspect the target binary located at ./bin/payment_calculator.
1. Extract all string literals and symbol tables.
2. Identify the core algorithm calculating interest rates.
3. Decompile the calculate_tax() routine and explain its inputs and outputs.
4. Reimplement this logic in modern TypeScript with 100% test coverage."

web Step 3: Reverse Engineering an Electron Desktop App

A substantial portion of modern desktop applications (including Slack, Discord, VS Code, and internal enterprise dashboards) are packaged using Electron. When you need to understand how an application communicates with its backend or handles local caching, REA provides an automated workflow:

npx @electron/asar extract ./app.asar ./unpacked_app

// Generated by AI Agent using REA evidence
export interface DeviceTelemetryPayload {
  deviceId: string;
  firmwareVersion: string;
  batteryStatus: number;
  timestampUtc: number;
}

code Step 4: Reverse Engineering Native C/C++ & Go Binaries

When examining compiled native binaries (such as proprietary CLI tools or device drivers), REA invokes disassembly tools and translates the machine code into human-readable pseudocode:

# The AI Agent invokes REA tools under the hood:
# 1. Inspect binary file headers
rea_inspect_binary --file ./tools/auth_verifier

# 2. Extract ASCII and UTF-16 string constants
rea_extract_strings --min-length 6 --file ./tools/auth_verifier

# 3. Disassemble the validation subroutine
rea_decompile_function --symbol verify_license_key --file ./tools/auth_verifier

The AI agent synthesizes the disassembled assembly instructions:

// Disassembled pseudocode extracted via REA & Ghidra Bridge
bool verify_license_key(char *input_key) {
    if (strlen(input_key) != 19) return false;
    
    // Check checksum algorithm: sum of ASCII values mod 97 == 42
    int sum = 0;
    for (int i = 0; i < 19; i++) {
        if (input_key[i] != '-') {
            sum += (int)input_key[i];
        }
    }
    return (sum % 97) == 42;
}

With the algorithm identified through empirical evidence, you can create compliant documentation, write a license validation service, or build automated regression tests.

verified Step 5: Clean-Room Feature Reconstruction Methodology

In enterprise software development, copying proprietary source code directly can trigger severe intellectual property infringement claims. Clean-room design (also known as the Chinese wall technique) is the industry standard legal defense:

gavel Legal & Ethical Considerations

Reverse engineering is protected under various legal doctrines (such as interoperability exceptions under EU Directive 2009/24/EC and Section 1201(f) of the US DMCA), provided it is performed for legitimate technical purposes:

help_outline Frequently Asked Questions: How to Use REA