← REA Area

REA Training · hands-on track in 5 guides

Your agent opens a program without the code and shows how it works.

REA connects Claude Code or Codex to reverse-engineering specialist tools such as Ghidra. In 5 hands-on steps you install it, point it at a program you are allowed to analyze, read the evidence behind each finding, and rebuild a function in your project, with your own code.

Guide in PT, EN, and ES. Videos in Portuguese. REA is a third-party project, MIT; INEMA made the guide, the tests, and the videos.

REA — reverse engineering with AI agents: the agent opens the program and explains how it works.
4steps to get started
11videos and reels in Portuguese
13.500findings in our test of 6.4.0
3languages in the guide: PT · EN · ES

The problem

When AI builds an app from scratch, it guesses what you want.

With the original program beside it, the agent has a right answer to compare against. Without a method, the problems below show up.

  • The agent reads whatever is at hand, guesses the rest, and doesn't say what it doesn't know.
  • A native binary is a black box and the decompiler looks like something only specialists use.
  • Asking "reverse the whole app" gives a vague answer that can't be tested.
  • Claude, Codex, and Gemini sometimes refuse parts of a legitimate reverse-engineering job.
  • You clone the screen and only later discover the engine was on the server.

After the training

By the end of the track, you can:

01

Connect REA to your agent

Try it without installing, using npx, run the setup with --dry-run, and check only what you will use with doctor.

02

Choose the tool by app type

Electron and JavaScript through REA's own analyzer, for free; native binaries through Ghidra, Hopper or IDA.

03

Separate what was seen from what was inferred

Each finding marked as seen, inferred or unknown, with the quoted excerpt and the limitations stated.

04

Rebuild one function at a time

Summary first, then one module, one function, and each finding becomes a test against the original.

05

Run without refusals

An open model running locally on Ollama or on a prepaid platform in the style of OpenRouter, knowing when the code leaves your machine.

06

Know the limit

What runs on the server can't be opened: the database, pricing rules, prompts and payments stay out of reach.

5 guides in order · from concept to real test

Five steps, from what it is to your first test.

There is no course: the training is the INEMA guide, read in order, with the step-by-step, the method, the path without refusals and our real test. The videos go along with each part.

  1. 1

    Guide

    What REA is and why it works

    The bridge between your agent and Ghidra: it opens, understands, proves and rebuilds, as a CLI and as an MCP server, and what stays out of reach.

  2. 2

    Guide

    Step by step

    Prerequisites, the cost of each decompiler and the 4 steps: analysis without installing, setup with --dry-run, doctor with a scope, and the request to the agent.

  3. 3

    Guide

    The method: one function at a time

    One function, not the whole app; summary first; seen, inferred or unknown; and each finding tested against the original.

  4. 4

    Guide

    REA without guardrails

    Open models without refusals, dsh and the local models tested, and two prepaid platforms for those who don't have a machine.

  5. 5

    Real-world test

    Real test 6.4.0

    The Electron app that hung on 6.3.0 analyzed in 94.5 s on 6.4.0: 202 files read, 0 failures and 13,500 findings.

Who it's for

Made for you if

  • You use Claude Code or Codex and want to understand how a program works on the inside.
  • You want to make your own version of an everyday program, with your own code.
  • You build apps and want to know what any agent can map in yours.
  • You need to analyze a native binary and have never opened Ghidra.

Not for you yet if

  • You want to copy code, icons or branding from a program: rebuilding is not copying.
  • You want to clone what runs on another company's server: that doesn't show up in the app.

Included in the training

You don't leave with theory alone.

The guide, the test results and the script to run it isolated are in the INEMA repository. The official repository and the REA site come along, with the videos from the concept to the technical.

Projects and kits

Videos

Why this training

What changes compared with watching a viral video about REA.

Tested here

We ran REA isolated, with a memory and time cap. On 6.3.0 an app hung; on 6.4.0 the same app was analyzed in full.

Frankly

In a third-party test, the agent without REA finished first. For simple apps, sometimes it isn't even needed, and the track says so.

Precautions before the command

Only programs that are yours or that you have permission for, an isolated test folder, and reading the source of each finding.

From beginner to technical

A Windows walkthrough starting from Obsidian for those who don't program, and REA 6.4 under the hood for those who do.

Questions

Before you start.

Do I need to know reverse engineering?

No. You need an agent, Node.js and a program you are allowed to analyze. REA operates the decompiler for you.

In what order do I do them?

1 → 2 → 3 and then 4, if your agent refuses. 5 shows what to expect from a real test. Start with the 6-minute video if you want the overview.

Which tools do I need?

Node.js 22.19+, 24.11+ or 26+ (versions 23 and 25 are not supported) and Claude Code, Codex or another agent with MCP. For a native binary, Ghidra, which is free, or Hopper or IDA.

Does it work on Windows?

Yes. The track has a Windows walkthrough starting from Obsidian. If you hit an error, use WSL or a VPS.

Is it legal?

Only with programs that are yours or that you have permission for. Usage licenses may prohibit reverse engineering. Studying for personal use is the safe ground; distributing or copying code, icons and texts is not.

Choose a program you own and ask the agent to explain how it works.

Start with the guide. With Node installed, the first test runs with one npx, without Ghidra and without running the app.