ReverseEngineerAnything
Read the software you did not write
Every app on your disk is code you are allowed to read. REA puts a real disassembly engine behind your agent, so you ask in plain English and get the function, the file, the call site and what is still unknown. Twenty lessons from the install to a rebuild that is legally yours.
$ rea open_binary \ "/Applications/Target.app/.../Target" # arm64 · 1,284 functions · local only
"Why does the % button show 220
when I type 200 + 10%?"
Three jobs. Only one of them can see the binary.
An agent cannot run a disassembler, and a disassembler cannot explain anything. REA sits between them and turns a sealed file into questions the model can answer with proof attached.
Loads the file, finds the functions, turns machine instructions into something close to C. Knows everything, explains nothing.
- load
- decompile
- xrefs
Exposes the engine as callable tools over MCP, routes each target to the right one, and tags every finding as observation, inference or unknown.
- route
- inspect
- cite
Names the variables, spots the pattern, writes the spec and builds your version. Never sees the file, only the findings.
- name
- explain
- rebuild
Everything runs on your machine. The only thing that leaves is the findings the model needs to reason about, and every one of them points at an address.
A router you can poke
The first afternoon people lose is spent opening a disassembler on an app whose JavaScript was sitting right there. Pick a target and watch which entry tool the course teaches you to reach for, and what you actually need installed.
# name the file, let the agent pick the door rea analyze-javascript-application /path/apprea inspect_managed_artifact /path/Assembly.dllrea open_binary /path/Target --provider hopperrea inspect-android-package /path/App.apkrea inspect_artifact /path/capture.harrea inspect-evm-interface ./runtime.hex hex
Three kinds of claim. Only one of them is proof.
An agent that says "this function handles the export" is guessing out loud. REA makes every statement declare what it is, and puts the file and the line behind it. Filter the trace below and watch how much of a confident answer is actually evidence.
- observation
The Export button in the window calls a handler named
renderer.js : 48notes:export. - observation
That handler crosses into the main process through the context bridge.
preload.js : 12 - observation
The main process writes
main.js : 73notes.csvinto the Downloads folder. - observation
The file contains two columns, id and title, and nothing else.
main.js : 77 - inference
The write runs in the main process because the renderer has no filesystem access.
from the sandbox flag - inference
The filename is fixed, so exporting twice overwrites the first file.
no timestamp in the path - unknown
Whether a failed write is ever surfaced to the person using the app.
no error branch in this path - unknown
What happens when the Downloads folder is read-only.
never exercised statically
The unknowns are the point. Any model can produce a fluent paragraph about a binary it half understood, and you cannot tell the difference by reading it. A tool that never says "I do not know" is a tool that guesses, and a rebuild made from guesses fails its parity tests at the worst possible moment. Lesson 12 is about keeping this ledger honest while the investigation grows.
Twenty lessons, blank terminal to shipped rebuild
Five parts: the tool, every target type it reads, how to read deeply, how to scale past what one chat can hold, and how to turn findings into software that belongs to you. Every chapter ends with commands that run and prompts you can paste.
What this already produced
Public rebuilds from the first weeks after REA shipped. Look at the right column: those are not claims, they are test counts.
| who | what | the receipt |
|---|---|---|
| ArtCraft | Twelve clean-room rebuilds of Adobe and Office tools, written from scratch in Rust | free and open source |
| Aegis case | Authenticator with 3,077 classes taken apart, code generation recovered and rebuilt | 133 of 133 tests pass |
| DX-Ball | Sound-pan helper from a 1996 game recovered and rewritten in C | 3,205 tests, 63 of 63 bytes |
| Touhou rebuild | Whole game reconstructed with agents over about twelve days | 696 of 697 exact matches |
| Super Mario Sunshine | Work-in-progress native PC port built with Claude and Codex | 365 agent hours, 17.3B tokens |
| One developer | Bought Steam game decompiled to C# and opened in Unity, on medium reasoning | under 30 minutes |
What it can do, and what it can't
The course is specific about the edges, because the edges are where people waste a weekend or ship something that is not theirs.
- Open Electron, .NET, native, APK, WASM, Go and firmware targets
- Turn one function into pseudocode and then into named, typed code
- Show the exact address, bytes and call site behind every claim
- Trace a single feature from a click down through the layers
- Diff two releases and tell you what actually changed
- Audit an APK for permissions, trackers and the domains it talks to
- Recover the interface of an unverified contract from raw bytecode
- Touch code that runs on someone's server and was never shipped to you
- Hand you the original source, because a decompile is a reconstruction
- Beat stage-three obfuscation, which benchmarks at zero
- Make a stripped C++ binary as easy as a Unity game
- Give you an IDA, Hopper or JEB license
- Make copied code legal because an agent pasted it
Reading an app on your own machine is learning. Rebuilding a feature from its behavior is how the industry has worked since the eighties. Copying the code, cracking paid features or publishing someone else's decompile is the part that gets you sued. Part five is about staying on the right side of that line on purpose, not by luck.
Before you buy
What do I need?
Node 22 or newer, an agent such as Claude Code, and a machine you own. Two of the six target types need no engine at all, so you can finish the first two parts before installing Ghidra.
Do I need to know assembly?
No. The whole point is that you read findings, not instructions. You do need to be comfortable in a terminal and able to read code in one language.
Is this piracy?
No, and part five explains exactly why, with the cases that settled it. The course teaches clean-room rebuilds from behavior, and it is explicit about what crosses the line.
How do I get in after paying?
Access opens for the email you paid with. You log in with that email and a 6-digit code. One payment, lifetime access, card or USDT.
Closed sourcemeans show methe evidence
Lifetime access to all twenty lessons: the router across every target type, recon and decompilation, obfuscation budgets, the swarm, the clean room, and the parity report that proves your rebuild works.
Get the course