REA: A ferramenta que está mudando a engenharia reversa

Summary

The video introduces REA (“Reverse Engineering Anything”), an open-source tool that connects AI coding agents—such as Claude Code—to established reverse-engineering tools through MCP, a standard for connecting AI applications to external systems.

Rather than inventing a new way to analyze software, REA lets an agent inspect programs whose source code is unavailable, trace relevant behavior, and present findings with supporting evidence.

The analysis runs locally, though results are passed to the AI agent, so the model provider’s data policies still apply. REA can work with several kinds of software and data, including native executables, web-based applications, mobile apps, and network-traffic recordings. Requirements vary by target.

Demonstrations featured

1. Computer calculator: REA traces why 200 + 10% returns 220. The calculator treats 10% as a percentage of 200, producing 20, and then adds it to 200.
2. Password challenge: The agent analyzes a small executable with removed function names, derives a system of equations from its checks, and finds a password that is verified in the original program. The explanatory code is reconstructed from evidence, not recovered source code.
3. Mobile authenticator: The analysis identifies how a six-digit code is generated from an account key and a 30-second time interval. A browser demonstration matches six reference cases from the relevant standard.
4. Browser dinosaur game: REA finds that the game’s speed increases gradually with each update, up to a cap. The agent uses this rule to create a new minigame with adjustable speed. The video also mentions a separate, ongoing effort to reconstruct a 1996 game function by function.
5. Note-taking application: The agent traces how copying a block passes text and formatting through internal application components, and how an HTML identifier refers to locally stored block data.

What REA does—and does not—do

REA can help investigate undocumented legacy systems, understand application behavior, support integrations, or examine software as part of authorized security work. It does not recover a program’s original source code, guarantee that every program can be understood, or reveal logic running only on a company’s servers. Readable code shown in demonstrations is an explanation based on analysis, not the original code written by the developer. Understanding one feature is also not the same as rebuilding a complete product.

The video stresses that REA is not a sandbox. An analyzed program or captured process may run with the user’s permissions, so suspicious software should be examined in a virtual machine or another isolated environment. Files and websites may also contain hidden instructions intended to manipulate an AI agent; permissions and execution confirmations remain important.

Legal rules vary by jurisdiction and product license. The video notes that some reverse engineering may be permitted under specific conditions, but technical capability does not remove legal responsibility. It also cautions software developers that code distributed to users can be examined after compilation. Sensitive logic should be protected through system architecture, such as keeping it on the server, rather than relying only on unavailable source code.

The speaker presents REA as a way to make certain analyses more accessible by combining AI reasoning with specialized tools and technical evidence—not as a system that magically reconstructs any software. Findings should be checked against evidence, tested in the original program where possible, and pursued only with proper authorization.

Main speaker and sources

• Main speaker: Leonardo Bissoli, the video’s narrator.
• Sources discussed: REA’s project materials and demonstrations; established reverse-engineering tools; MCP; security guidance; software standards; and EU and Brazilian software-law provisions.