Best REA use cases by category
A live shortlist by purpose
The lists below come from published cases in the directory and refresh from the database; they are not a fixed list of repositories. Within each category, votes and GitHub stars order the shortlist. They measure community interest, not an independent test or an endorsement by this site or by the REA project.
Start from what you want to understand
Pick the category closest to your goal: recreating a feature, documenting a file format or protocol, recovering the lost source of your own program, defensive security work, CTF and learning, or tools built around REA. Read the original source of a case before you repeat it, and check which REA version and analysis engine it used.
Before you try a case
Repeat a case only on software you own or are authorised to examine, and run untrusted targets in an isolated environment. Every listed case passed the content rules; an empty category only means nothing is listed there yet. Resource entries explain a technique rather than providing software.
Directory statistics · What is REA? · Install REA
App feature recreation
- How Notion copies text and HTML — Traces a page-facing API in Notion's packaged JavaScript through its IPC wrappers to the system clipboard and shows how an HTML marker links rich block data to a copy.
- Untangle rebuilt from REA evidence only — An agent analysed only the shipped Windows binary of an open-source puzzle game, wrote its findings, froze them, rebuilt the game as a web page and was graded against the real source (52 of 54 claims correct).
- REA Research Lab: ten studies of released software — Ten bounded studies of released open-source components (Monaco, Grafana, n8n, Excalidraw, Joplin, Node-RED, KeePass, 7-Zip, restic, rclone), each with evidence, an independent reconstruction and thousands of differential checks.
Patches & fixes
File formats & protocols
- ASIAIR firmware study with REA — Notes and scripts from studying how a telescope controller's firmware is built: its INDI-based stack, plain JSON-RPC on port 4700 and the three hardware generations; no vendor firmware is included.
- A status-bar remote for a Bluetooth toilet, from its WeChat mini-program — Reverses the Bluetooth protocol that a smart toilet's WeChat mini-program speaks and builds a menu-bar remote with REA and Codex (original X post not linked from the showcase).
- QShare-linux: Quick Share for Linux — An open-source implementation of Google's Quick Share protocol for Linux, built by studying the Nearby connections with AI help so Linux can send files to Android.
Security & malware analysis (defensive)
- Outside-in leak check of a production Next.js and Stripe app — A black-box audit of the author's own portal: what can an anonymous visitor see, and what does the app leak, checked with REA from the outside.
Lost source recovery
- Reconstructing DX-Ball 1.07 — Rebuilds the 1990s Breakout game's logic in C and checks it against the original x86 program with differential tests and byte-exact compiled output.
- TH04 source reconstruction — Reconstructs a PC-98 DOS shooter's code, matching its 16-bit routines to readable C++ and the historical compiler's output.
- The industrial revolution in reverse engineering — An essay on rebuilding three Touhou games with agents: what verification looks like, where agents help, and how knowledge carries from one project to the next.
Game mods & interoperability
- OpenBattlefield2: a clean-room engine reimplementation — A C++20 clean-room reimplementation of the Refractor 2 engine behind Battlefield 2, an engine rather than a game; no game content is redistributed and there is no anti-cheat.
CTF & learning
- A stripped bzip2 build: what REA returned, checked against the source — Asks REA which function prints one message in a stripped, optimised bzip2 binary; the answer and 24 callees matched an unstripped build and the source, and the post lists what this does not prove.
- OpenBSD netcat, analysed with REA and Ghidra — A static analysis write-up of Ubuntu's netcat-openbsd binary using REA with Ghidra, with the evidence behind each finding.
- rea-playbook: from evidence to file:line to recreation — A hands-on teaching playbook using a minimal Electron target: extract evidence with file and line references, probe the MCP server and recreate the feature.
- Hands-on: analysing your own apps with REA, Ghidra and Claude Code — Follow-along exercises from a Korean video: build your own small Electron app and C program, then analyse them with REA, Ghidra and Claude Code.
- How an authenticator generates a login code — Follows the six-digit code calculation of the open-source Aegis authenticator through its released Android APK, and uses a demo clock to show why the code changes every 30 seconds.
- Solving a CTF flag checker — Inspects a DownUnderCTF binary, finds its checking functions, turns the masks and sums into equations and confirms the solved flag against the original program.
Tools & integrations
- REA on Fedora-based Linux: setup notes and gotchas — Practical setup notes for running REA on Fedora-based Linux, with the problems hit along the way and a queue of tests.
- My local model setup for REA on Linux (one 12 GB GPU) — How to run REA with local models on a single 12 GB GPU, and how five models compared.
- Reducing token waste in REA workflows — A show-and-tell thread on keeping token use down in REA workflows and what other people are using.
- REA (Reverse Engineer Anything) — Reverse engineer anything with agents, from app behavior down to native binaries.
- Benchmarks: REA on Linux across Node versions and five local models — Start-up timings of REA on Node 22, 24 and 26 on Linux, plus a comparison of five local models.
- REA in depth: an MCP toolchain for source-free analysis — A Chinese-language technical survey of how REA lets a coding agent analyse software without its source code.