🔍 Read the full analysis: Start Here: Using AI To Understand Software You Didn’t Write on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A guide published by ThorstenMeyerAI.com on October 19 describes using the open-source Reverse Engineer Anything (REA) toolkit with AI coding agents to inspect existing software. Its examples stress asking narrow questions, verifying that REA tools are connected, and checking agent explanations against concrete evidence; the article also warns that analysis runs locally but results reach the model provider.
ThorstenMeyerAI.com published a guide on October 19 to using the open-source Reverse Engineer Anything (REA) toolkit with AI coding agents to inspect software a developer did not write. The guide sets out a practical approach—investigate one behavior at a time, verify the tools are actually connected, and test explanations against specific inputs and outputs—while warning that local analysis does not mean information stays local.
REA combines a local Model Context Protocol (MCP) server, a command-line tool and an agent skill that guides investigations. The project says coding agents including Claude Code, Codex, Cursor and Gemini CLI can use it. Its analysis tools cover several kinds of software and files, including native applications, JavaScript and Electron apps, .NET and Android programs, firmware, network captures, WebAssembly and SQLite databases. It can also observe activity in a browser controlled by the user.
The guide recommends replacing broad requests such as “figure out how this program works” with a bounded question tied to a decision. For example, a developer investigating invoice payments could ask how a partial payment changes the remaining balance and which account receives the posting. The agent should identify stored data, calculations and conditions, then explain one complete example. The guide advises labeling findings as observed, inferred or unknown rather than presenting every explanation as established fact.
Installation is available through the project’s guided setup command, but the guide says setup checks alone do not prove that an agent can use REA. It recommends running the project’s diagnostic command and then asking the agent to call an REA tool to confirm the live connection. A key failure signal is an agent answering questions about a target without calling any REA tool: in that case, its response may be based on model knowledge rather than an inspection.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Working Specs
The method addresses a common problem in AI-assisted software development: a generated interface may look plausible while its underlying rules are wrong. Inspecting an existing program can help a developer turn observed behavior into a written specification for a replacement or related tool. That matters when details such as account postings, inventory calculations or report conditions affect real results.
The article points to Ledger Reborn as an example. Its author says a locally built accounting application matched QuickBooks Desktop’s profit-and-loss statement, balance sheet and trial balance for Intuit’s official sample company, account by account and to the cent. That is a reported result from the project’s case study, not independent verification in the supplied material. The guide’s broader point is that REA can provide evidence for understanding behavior; it does not make an agent’s interpretation automatically correct.
There are also practical security and privacy implications. REA analyzes targets on the user’s machine, but the guide says analysis results are sent to the coding agent and its model provider, subject to that provider’s data policy. It also cautions that REA is not a sandbox: opening an untrusted program gives analysis tools running under the user’s permissions access to it. Developers need to consider both what they inspect and what information the agent receives.
software reverse engineering tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How REA Reached This Guide
REA is an MIT-licensed open-source project hosted on GitHub under morluto/rea. According to the October 19 article, the project had about 325,000 stars and 82,000 forks at that time, following attention on GitHub’s trending page in early October. Those are dated figures reported by the source, not a measure of how well the tool works. The project’s version 6.7.0 was released on October 18; the article says its maintainer is anonymous.
The guide describes a case study using QuickBooks Desktop for Mac 2024, REA 6.4.0 and Ghidra. The investigation focused on selected behavior, including inventory arithmetic, budget number signs by account type, reconciliation balances and cash-basis reporting branches. The supplied source says Ledger Reborn’s author used that work to build a local accounting application. It frames the exercise as documenting rules and decisions, rather than copying screens or claiming that reverse engineering reproduces an entire product.
Requirements vary with the target. The guide says REA needs Node.js 22.19 or newer, while native analysis requires a disassembler such as Ghidra, which also requires Java, or licensed software such as Hopper or IDA. It advises restarting the coding agent after setup and checking that the relevant tools are available before relying on answers.
“This is not a sandbox.”
— REA project documentation, as quoted in the guide
As an affiliate, we earn on qualifying purchases.
What the Case Study Cannot Establish
The supplied material does not include independent testing of REA, Ledger Reborn’s results or the claimed account-by-account match. The accounting comparison is attributed to the project’s author, and its stated scope is Intuit’s official sample company and specified financial statements. It does not establish that the replacement reproduces every QuickBooks feature or behavior.
It is also unclear from the source how consistently REA works across all the file types and analysis engines it lists, or how accurate agent interpretations are across different targets. The guide itself treats an inability to explain a concrete example as a reason to question an answer. It does not provide comparative accuracy figures, a general benchmark or a detailed account of what data each model provider retains. Users are advised to consult the provider’s own data policy.
open-source reverse engineering toolkit
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Verify Before Building on Findings
The guide’s immediate next step for users is to confirm installation and a live agent connection, then try a small, harmless program they own. From there, they can pose one behavior-specific question, ask for a worked example and separate observed evidence from inference and unknowns. If the agent does not call REA, or cannot trace a result through a concrete example, the explanation should not be treated as a verified description of the software.
Further claims about the tool’s reliability, privacy handling and the scope of Ledger Reborn’s accounting match would require evidence beyond the supplied article. The source gives no announcement of a later REA release or independent audit. For now, its advice is methodological: use the toolkit to gather evidence, check the agent’s work, and keep security and data-sharing limits in view.
programming investigation software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is Reverse Engineer Anything?
REA is an open-source toolkit that connects analysis tools to coding agents through an MCP server. It also includes a command-line utility and an agent skill for guiding investigations of existing software.
Does REA keep all analysis data on my computer?
No. The guide says REA analyzes targets locally, but the results are sent to the agent and its model provider. How the provider handles that information depends on its own data policy.
How can I tell whether my agent is using REA?
Run the project’s diagnostic checks, then confirm the live connection inside the agent by asking it to call an REA tool. The guide warns that diagnostics check files and prerequisites, not whether the agent connection is live.
Does the QuickBooks example prove REA can reproduce accounting software?
No. The article reports that Ledger Reborn matched specified statements for Intuit’s official sample company, according to its author. The supplied material does not provide independent verification or establish a match across all QuickBooks features and cases.
Source: ThorstenMeyerAI.com
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
