Safe and legal use of REA
The short version
Use REA on software you own or are authorised to examine, for a legitimate purpose. Never use it to crack, pirate, cheat, steal or attack. This page sums up the REA project's disclaimer and this directory's content rules. It is not legal advice.
Legitimate uses
- Analysing your own software, or software you are authorised to examine: debugging, auditing, recovering lost source you have the rights to.
- Studying open-source projects.
- Interoperability: making a program, file format or protocol work with another.
- Defensive security: vulnerability research with coordinated disclosure, incident response, and malware analysis for defence.
- Software preservation.
- CTF challenges and practice targets made for learning.
- Education: explaining how a program works, with the evidence.
Never
The REA project does not support these uses and closes requests for them. This directory never lists them:
- cracking licences, generating keys, or bypassing activation or trial limits;
- circumventing DRM, licence checks or other copy protection, and piracy;
- game cheats, tampering with online services, and anti-cheat bypasses;
- stealing credentials, accounts or personal data;
- bypassing authentication or access controls, or attacking systems you do not own or are not allowed to test;
- writing or deploying malware;
- copying proprietary software or reproducing its protected code and assets;
- evading the usage policies or safety measures of AI model providers, or reselling and sharing AI accounts or API access.
Malware analysis is in scope only for defence: understanding, detecting and removing a threat, never building or improving one.
Before you analyse
- Check your authority. Owning a file, finding software online or reaching a debugging endpoint does not by itself give permission for every operation. Permission to inspect a file does not automatically cover running it, intercepting its traffic or interacting with someone else's system.
- Read the licence and the EULA. Many licences restrict reverse engineering. Respect them, and the terms of service of any online service involved.
- Use a suitable environment. Some workflows run the target, capture traffic or operate on connected devices. Review what your agent plans to run, and keep untrusted targets in an isolated environment such as a virtual machine.
- Protect what you collect. Credentials, personal data, captured traffic and analysis files are your responsibility.
Tools and results
You must legally obtain and license commercial tools such as IDA, Hopper and JEB. REA grants no licence, key or activation; cracked copies, stolen keys and unauthorised key sharing are not allowed. Analysis results may be incomplete or wrong, so verify the evidence. An analysis report or source-like output gives you no rights to the original program: check those rights before you publish or reuse anything.
Legal notes
Whether reverse engineering is allowed depends on where you live and on the licence of the software. Some jurisdictions allow it for interoperability or security research under conditions; others restrict it. Follow your local law, the licences and agreements involved, and intellectual-property and privacy rules. If you are unsure, ask the rights holder or a qualified lawyer. Nothing on this site is legal advice.
Reporting
Found a vulnerability? Report it to the vendor through coordinated disclosure. Vulnerabilities in REA itself go through the project's SECURITY.md. See a case on this site that breaks these rules? Use the report link on that case's page.