freedzhost.cloud

Reverse engineering with evidence: let the agent prove, not guess

Level AdvancedEstimated time 1 hRead first Claude Code, two ways: on the subscription and on your own modelsA word you don't know? Glossary

An agent asked "how does this program do X" will answer, fluently, after skimming a few files. Often wrong. When we plugged our agents into an open-source agent core, we needed to know exactly what it sends and expects. REA, an open-source (MIT) reverse-engineering toolkit with a command line and a tool server for agents, made the agent answer with proof instead.

What you get. An agent that understands any program with proof, not guesswork: one analysis, then answers in seconds, each with its evidence. Plug your stack into anything, safely.

1. What it reads

Native binaries (through Ghidra), JavaScript and Electron apps, Android APKs, .NET assemblies, websites. Install it with npm, plus Ghidra and a Java runtime dedicated to it:

npm install -g rea-agents
rea --help

2. The process: analyze, evidence, questions, tested code

  1. Analyze the target once, and keep the snapshot. The first Ghidra pass on a large binary takes longer than ten minutes: run it from the command line, not through a tool call with a short timeout.
  2. Evidence: each answer comes with what proves it (a function, a string, a call) and what it does not cover.
  3. Follow-up questions reuse the snapshot and answer in seconds.
  4. Implementation: only then write the adapter, with a test that exercises the behaviour you proved.

Our rule for agents: never claim to know how a third-party program works from a skim of its sources when a tool can produce the proof.

3. The right to look

Analyze what you are allowed to: your own software, open-source projects, programs whose licence or local law permits analysis for interoperability. Reverse engineering to bypass a protection or copy a product is another matter, and not what this is for.

Traps

The tool server exposes many tools. Plugged as is into an agent whose provider caps the tool list size, it made every request fail with an error that looked like an outage (see Kimi Code). Give agents a small wrapper with a few commands instead.

Keep snapshots out of your repositories: they are large, and they contain someone else's code.

Sources

Found this useful? Tell us what to measure next.