REA · Reverse Engineer AnythingIndependent
Reverse engineer anything with REA, using AI coding agents
A feature you admire is a set of rules wearing a UI. This is a field guide for getting the rules out — app behaviour, JavaScript and Electron layers, .NET assemblies, native binaries, browser runtimes — using coding agents like Claude Code and Codex, then rebuilding the behaviour yourself.
Independent guide — not the official REA site, and not affiliated with the project’s authors. The toolkit itself lives at github.com/morluto/rea. Nothing on this site is software you download.
01
Start here: what “reverse engineer anything” actually means
Not decompiling for fun. Answering one question — how did they make this feel this way? — well enough to write your own version. REA is the open-source MCP server and CLI that plugs reverse-engineering tools into an agent, so the agent does the reading while you decide what is worth rebuilding.
The 6-step loop
Name the behaviour → fingerprint the stack → pick your layer → let the agent inspect and instrument → extract the rule → rebuild and diff against the original.
Read the loop →SetupWire it into your agent
Register the MCP server in Claude Code, Codex, or Cursor, approve which commands it may run, and give it a target that fits in one afternoon.
Setup guide →JudgementREA vs Ghidra
Agents read behaviour and draft a rebuild fast. A disassembler gives instruction-level control over a native binary. Which one you need depends on the target.
Comparison →Pick your layer before you touch a tool
| Target | Where the logic usually lives | First move | Hardest part |
|---|---|---|---|
| Electron / desktop web app | JS bundles, IPC between renderer and main process | Read the bundle, then trace the IPC calls the UI fires | Minified, split into many chunks |
| Website / SPA | Client JS + API responses | Watch runtime state and network calls together | Rules enforced server-side |
| .NET desktop app | Managed assemblies, often still close to original naming | Inspect types and map them to the feature | Obfuscation |
| Native binary (macOS / Linux / Windows) | Machine code, plus symbols if you are lucky | Read behaviour from outside, then disassemble the function you care about | Hardest to name the rule with confidence |
| Mobile app | Compiled binary + local storage + API traffic | Observe inputs and outputs, then inspect the package | Packaging and protection vary wildly |
Stay on the right side of two lines. We document behaviour and write our own implementations. We do not distribute software, installers, or cracks — and the REA authors explicitly warn about copycat repos and fake download packages, so verify you are on github.com/morluto/rea. Studying behaviour is not the same as copying protected code or defeating licence checks: know your licence and your jurisdiction.
02
Walkthroughs: one feature per page
Each page takes one visible behaviour apart and ends with a rule you can rebuild. These are the pages that compound — documentation for specific features is what no official README will ever cover.
Why the dinosaur jump feels right
GRAVITY 0.6, initial velocity 12, a 35 px floor — and why those constants still do not predict the arc.
Walkthrough →GamesWhy dinosaur game night mode flips every 700 units
Not a timer. A modulo on the metered distance, and a score that is an integral of speed.
Walkthrough →ClipboardCopy does nothing
Five gates between your function and the paste. Three of them fail without an error.
Walkthrough →LoginWhy an expired 2FA code still works
The generator is in the app. The acceptance window is not. Bound it from outside.
Walkthrough →LabDinosaur jump lab
Two models of the same three constants. Measure which one your machine agrees with.
Walkthrough →GamesHow 2048 decides the next tile
A 90/10 line, and why four twos become 4 and 4. A blocked swipe spawns nothing.
Walkthrough →GamesTetris never waits 13 pieces for an I
Seven pieces, one bag, 5,040 orders. The drought cap is 12, and a loop can break the claim.
Walkthrough →ImagesMultiply, Screen, Overlay
The formulas, then a pixel read back from your browser. Soft light is several formulas under one name.
Walkthrough →FilesHow a PDF is actually laid out
Objects, the xref index, startxref, and why page order is not byte order.
Walkthrough →WebWhere a paywall actually lives
Client state, the response payload, or the server. Three observations, and no way through.
Walkthrough →MoreAll walkthroughs
One behaviour per page, including the gaps we could not confirm.
Walkthrough →03
The rule in 20 seconds
Two readings of the same three constants, live. The full instrument — sliders, a refresh measurement, and a diff table against the real game — is the dinosaur jump lab.
discrete 126.0 px · continuous 120.0 px · both 333 ms to apex
04
What this site does not do
This field guide does not install software, ship a download, or hand you a package to run. The toolkit stays on GitHub; these pages only describe how an agent reads a behaviour and how you rebuild the rule in your own code. We do not write paywall bypasses, licence cracks, or steps that take content you are not entitled to. A server-side gate is a finding, not a target.
05
FAQ
Short answers. The longer versions live in the setup guide, the Ghidra comparison, and the loop.
What is REA (Reverse Engineer Anything)?
An open-source MCP server and CLI that connects AI coding agents to reverse-engineering tools, so an agent can inspect native binaries, JavaScript and Electron apps, .NET assemblies, and websites, then explain how a feature behaves. This site documents how to use that pattern; the toolkit itself is on GitHub, and we host no downloads.
Can an agent really rebuild a feature I like?
It can recover observable behaviour: rules, thresholds, and data flow you can reach from outside. It cannot recover someone’s private source code, and rebuilding protected or licensed material can be illegal. Work from behaviour and write your own implementation.
Which agent works best with it?
Any agent client that speaks MCP — most commonly Claude Code, Codex, and Cursor. The pattern is identical; what changes is where you register the server and how you approve commands.
Do I still need Ghidra?
Different questions. Agent toolkits are fast at reading behaviour, tracing a runtime, and drafting a rebuild. A disassembler gives instruction-level control over a native binary. Start with the agent, drop to Ghidra when a native target genuinely needs it.