DemensDeum

Notes

Language

REA and OpenCode: installation and first investigation

Written by

demensdeum

in

REA (Reverse Engineer Anything) is an MCP server that allows you to reverse engineer software applications, binaries, and behavior in real time. The tool covers the path from application behavior to machine code, and it is convenient to use OpenCode as the agent that manages it.

OpenCode is an open programming agent that lives in the terminal. It reads project files, edits code, runs commands and tests, and most importantly, it supports MCP out of the box, so REA connects to it directly.

What makes REA unique

REA stands out in the field of reverse engineering with comprehensive support for several platforms and types of analysis:

  • Native binaries: Hopper, Ghidra, IDA or Kuna for disassembly and decompilation
  • JavaScript applications and Electron: static analysis of Electron modules, imports and boundaries
  • Managed Code: Analyzing .NET Assemblies
  • Real-time analysis: monitoring process behavior
  • Network traffic: capture and analysis of HTTP/S requests and responses
  • Mobile applications: analysis of APK and IPA files for Android and iOS
  • Embedded software: analysis of embedded systems and IoT devices
  • Model files: extracting GGUF and safetensors metadata
  • GPU code objects: analysis of CUDA and HIP kernels
  • Saving games: restoring game logic and executable files

Basic architecture and philosophy

REA follows a three-step research process that makes reverse engineering accessible to developers:

  1. Inspection: REA connects to analysis tools and examines targets (binaries, applications, websites)
  2. Analysis: traces through the code, determining rules and behavior
  3. Recovery: the agent uses the results to explain behavior and build or test an implementation

This process allows the AI ​​agent to answer complex questions, such as: “Understand how search works in the Notes app, show me the evidence, and create a similar feature for my project.”

Practical examples of use

1. Analysis of mobile applications

REA can analyze Android APK files for recovery:

  • declarations and permissions in the manifest;
  • class methods and dependencies;
  • links to native libraries;
  • network endpoints and data flows.

For example, an analysis of Aegis Authenticator showed how six-digit authorization codes change every 30 seconds: it examined how time-based code generation (TOTP) works.

2. Desktop Application Function Extraction

Analysis of the % button in Windows Calculator demonstrates the capabilities of REA:

  • define different behavior depending on the context (after + or ×);
  • parsing assembly instructions to understand the logic;
  • extracting and explaining mathematical operations;
  • restoring the rules: “After +: 10% of the first number” and “After ×: convert 10% to 0.1.”

3. Restoring Web Application API

REA can record a browser session and reconstruct it as an RL environment where the AI ​​agent performs tasks like working with folders without running the original application.

4. Restoring game logic

The DX-Ball case showed how REA restored the soundscape calculation from the 1996 Windows game by reverse-engineering C code that runs through 3,205 test cases and matches the original compiled code.

Technical capabilities

Native analysis

  • Works with Hopper, Ghidra, IDA or Kuna for deep binary file analysis
  • Supports ELF, PE, Mach-O and other executable file formats
  • Extracts pseudocode, assembler, symbols and calls
  • Performs offline analysis without having to launch the original tools

JavaScript Analysis

  • Analyzes Node.js and Electron applications
  • Tracks module imports and dependencies
  • Captures behavior in real time via a browser connection
  • Извлекает source maps и минифицированный код

Security

  • Static analysis of PE certificates (Authenticode)
  • Analysis of defense mechanisms (PIE, NX, RELRO, CFG)
  • Mapping imports and DLLs
  • Analysis of crash reports (Apple IPS)

What does REA return

REA does not give the agent ready-made conclusions without reason. The result of each query is the findings along with the evidence on which they are based. Depending on the purpose, the response includes:

  • Links to code – specific files and lines where the function under study is implemented.
  • Pseudocode and assembler – for native binaries: decompiled functions, instructions and connections between calls.
  • Application structure – for JavaScript and Electron: modules, imports, routes, IPC and connections with native add-ons.
  • Metadata and facts – manifests, certificates, signatures, format headers and other static data.
  • Restrictions – places that could not be sorted out, with a note about what exactly remains unknown.

The agent uses this data to explain behavior, answer clarifying questions, or assemble and test its implementation. It is the presence of evidence and explicit limitations that distinguishes an REA result from a simple guess of the model.

Before you begin

It is assumed that OpenCode is already installed and the model is connected to it. Node.js 22.23.4+, 24.22.1+ or 26.12.1+ is needed by REA itself, so check the version:

node -v

Step 1: Connect REA to OpenCode

REA registers with OpenCode as an MCP server. Run in terminal:

npx rea-agents@latest setup

To directly specify OpenCode, use its identifier opencode:

npx rea-agents@latest setup --client opencode

What setup does:

  • registers REA as an MCP server;
  • adds workflow instructions;
  • makes a backup copy of the existing configuration;
  • asks for confirmation before applying changes.

Important point:
For the first experiment, you can skip the optional Hopper installation. After setup is complete, restart OpenCode: exit the session and run opencode again.

Check the connection:

npx -y rea-agents@latest doctor --client opencode --json

Successful result: "healthy": true.

Then ask the agent:

“Check that REA is connected and show me which REA tools you can use.”

Step 2: First investigation

REA can analyze applications without launching them.

  1. Download the example: 
    Download https://rea.tools/examples/notes-example.zip

    Unpack the archive into the notes-example.

    2. folder

  2. Give the agent a task:

    “Use REA to inspect the app at /absolute/path/to/notes-example. Find what happens when I click Export notes. Show where notes.csv is written, which fields it contains, and the relevant files and lines.”

Expected response:

“The button sends a notes:export message. The main process formats the notes as CSV and writes notes.csv in the user’s Downloads folder. The columns are id and title.”

Step 3: Ghidra installation and native analysis

To analyze native binaries (executables and libraries), REA uses an analysis provider. The most affordable free option is Ghidra from NSA. The tool is installed once on the computer where REA runs.

What you need

  • 64-bit JDK 21 or later, including Java compiler (javac).
  • Ghidra archive from the releases page.

Installation

  1. Install 64-bit JDK 21 or later. Select a package for your computer architecture.
  2. Download Ghidra from the Assets list on the releases page and unzip the ghidra_…_PUBLIC_….zip archive. Take the release archive, not the “Source code.”
  3. Find the unpacked folder that contains ghidraRun or ghidraRun.bat. This path will be needed for the GHIDRA_INSTALL_DIR variable.

Check out Java. The first command prints java.home – this path is needed for JAVA_HOME. The second confirms that the compiler is installed:

java -XshowSettings:properties -version
javac -version

Ghidra connection

Windows (PowerShell):

$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:/tools/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx -y rea-agents@latest setup

macOS / Linux:

export GHIDRA_INSTALL_DIR="/absolute/path/to/ghidra_12.1.4_PUBLIC"
export JAVA_HOME="/absolute/path/to/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx -y rea-agents@latest setup

Replace the paths with your own. Keep the commands in one terminal session: after setting the environment variables, re-run setup, confirm the configuration update and restart OpenCode.

The provider check should return a successful report:

npx -y rea-agents@latest doctor --provider ghidra --json

Native analysis example

Give the agent the full path to the executable file and specify the provider:

“Use REA with a configured provider to explore /absolute/path/to/program. List the functions and lines, then explain the part that handles user input, with references to the code.”

Or run the command directly from the terminal:

npx -y rea-agents@latest function "/absolute/path/to/program" main --provider ghidra --json

Replace main with the function name or address from the target program’s list of functions. The result contains pseudocode, assembler, and references between calls.

Analysis of another type of software

Select target software category:

  • JavaScript / Electron – requires Node.js and npm. Guide.
  • Websites – Requires Chrome, Chromium or Edge browser. Guide.
  • Android APK – requires JADX and JDK 17+. Manual.
  • Native executables – requires Hopper, Ghidra or IDA. Guide.
  • .NET assemblies – requires Node.js and npm. Manual.

Using REA from the terminal

Static analysis of JavaScript/Electron application

npx -y rea-agents@latest analyze-javascript-application "/absolute/path/to/app" --json

Replace the path with the folder with the application or .asar file.

Where to find the Electron application .asar file:

  • Windows: C:\Users\<you>\AppData\Local\Programs\<App>\resources\app.asar
  • macOS: /Applications/<App>.app/Contents/Resources/app.asar
  • Linux: /opt/<App>/resources/app.asar

Global installation of the rea command

npm install --global rea-agents

After this, the rea --help command is available.

Installation via curl (macOS / Linux)

curl -fsSL https://raw.githubusercontent.com/morluto/rea/main/install.sh | bash

After installation, follow the instructions to configure the agent. If the setup menu does not appear, run rea setup.

Update and delete

REA update

npx rea-agents@latest setup

For global installation: rea update

Removing REA

npx rea-agents@latest uninstall

Getting help

Typical problems

OpenCode does not see REA

Restart OpenCode after setup. Use the doctor command to test the connection:

npx -y rea-agents@latest doctor --client opencode --json

The provider requires configuration

For Ghidra run:

npx -y rea-agents@latest doctor --provider ghidra --json

The report will show the failed test and the suggested next step.

Windows, WSL and paths with spaces

  • Use PowerShell for Windows clients
  • If the agent is running inside WSL, install Node.js and REA inside that Linux system and use the Linux paths
  • In the terminal, enclose paths with spaces in quotes

Setting up Hopper on macOS

If macOS asks you to allow Automation, allow the app that runs REA in System Preferences: System Preferences → Privacy & Security → Automation, then try again.

Links

https://github.com/morluto/rea
https://rea.tools/
https://rea.tools/get-started/
https://rea.tools/guides/
https://opencode.ai/
https://opencode.ai/docs/
https://opencode.ai/docs/mcp-servers/

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts

DemensDeum
Powered by  GDPR Cookie Compliance (opens in a new tab)
Privacy Overview

This website uses cookies so that we can provide you with the best user experience possible. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team to understand which sections of the website you find most interesting and useful.