按分类精选 REA 使用案例

应用功能复现

• How Notion copies text and HTML — Traces a page-facing API in Notion's packaged JavaScript through its IPC wrappers to the system clipboard and shows how an HTML marker links rich block data to a copy.
• Untangle rebuilt from REA evidence only — An agent analysed only the shipped Windows binary of an open-source puzzle game, wrote its findings, froze them, rebuilt the game as a web page and was graded against the real source (52 of 54 claims correct).
• REA Research Lab: ten studies of released software — Ten bounded studies of released open-source components (Monaco, Grafana, n8n, Excalidraw, Joplin, Node-RED, KeePass, 7-Zip, restic, rclone), each with evidence, an independent reconstruction and thousands of differential checks.

补丁与修复

文件格式与协议

• ASIAIR firmware study with REA — Notes and scripts from studying how a telescope controller's firmware is built: its INDI-based stack, plain JSON-RPC on port 4700 and the three hardware generations; no vendor firmware is included.
• 一个蓝牙马桶的状态栏遥控器，来自其微信小程序 — 逆向工程了智能马桶微信小程序所使用的蓝牙协议，并用 REA 和 Codex 构建了一个菜单栏遥控器（展示页未链接原始 X 帖子）。
• QShare-linux：Linux 版快速共享 — 一个 Linux 上 Google 快速共享协议的开源实现，借助 AI 研究 Nearby 连接而构建，让 Linux 能向 Android 发送文件。

安全与恶意软件分析（防御）

• 对生产环境 Next.js 和 Stripe 应用的外部泄漏检查 — 对作者自己门户的黑盒审计：匿名访问者能看到什么，应用会泄露什么，使用 REA 从外部进行检查。

遗失源码还原

• Reconstructing DX-Ball 1.07 — Rebuilds the 1990s Breakout game's logic in C and checks it against the original x86 program with differential tests and byte-exact compiled output.
• TH04 source reconstruction — Reconstructs a PC-98 DOS shooter's code, matching its 16-bit routines to readable C++ and the historical compiler's output.
• The industrial revolution in reverse engineering — An essay on rebuilding three Touhou games with agents: what verification looks like, where agents help, and how knowledge carries from one project to the next.
• 我把自己寫的 iOS App 編成執行檔丟給 AI,不給原始碼。 用免費的 REA + Ghidra,16 分鐘把損益公式原樣還原出來。前兩次它老實說「不知道」 — 開發者將自己撰寫的 iOS App 編譯成執行檔後交給 AI,在未提供原始碼的情況下,以 REA 搭配 Ghidra 於 16 分鐘內還原出損益計算公式,並分享前兩次失敗到修正設定後成功的過程。

游戏模组与互通

• OpenBattlefield2：洁净室引擎重实现 — 对《战地2》背后 Refractor 2 引擎的 C++20 洁净室重实现，是引擎而非游戏；不重新分发任何游戏内容，也没有反作弊。

CTF 与学习

• 一个被剥离符号的 bzip2 构建：REA 返回了什么，并与源代码核对 — 向 REA 询问在一个被剥离符号、经过优化的 bzip2 二进制文件中，哪个函数打印了一条消息；其答案及 24 个被调用函数与未剥离符号的构建及源代码一致，文章列出了这并不能证明什么。
• OpenBSD netcat, analysed with REA and Ghidra — A static analysis write-up of Ubuntu's netcat-openbsd binary using REA with Ghidra, with the evidence behind each finding.
• rea-playbook: from evidence to file:line to recreation — A hands-on teaching playbook using a minimal Electron target: extract evidence with file and line references, probe the MCP server and recreate the feature.
• Hands-on: analysing your own apps with REA, Ghidra and Claude Code — Follow-along exercises from a Korean video: build your own small Electron app and C program, then analyse them with REA, Ghidra and Claude Code.
• How an authenticator generates a login code — Follows the six-digit code calculation of the open-source Aegis authenticator through its released Android APK, and uses a demo clock to show why the code changes every 30 seconds.
• Solving a CTF flag checker — Inspects a DownUnderCTF binary, finds its checking functions, turns the masks and sums into equations and confirms the solved flag against the original program.

工具与集成

• 在基于 Fedora 的 Linux 上运行 REA：设置说明与注意事项 — 在基于 Fedora 的 Linux 上运行 REA 的实用设置说明，包括过程中遇到的问题以及待测试队列。
• My local model setup for REA on Linux (one 12 GB GPU) — How to run REA with local models on a single 12 GB GPU, and how five models compared.
• 减少 REA 工作流中的词元浪费 — 一个展示与分享帖，讨论如何在 REA 工作流中降低词元使用量，以及其他人正在使用什么方法。
• REA (Reverse Engineer Anything) — Reverse engineer anything with agents, from app behavior down to native binaries.
• 基准测试：REA 在 Linux 上跨 Node 版本及五个本地模型的测试 — REA 在 Linux 上 Node 22、24 和 26 的启动计时，以及五个本地模型的对比。
• REA in depth: an MCP toolchain for source-free analysis — A Chinese-language technical survey of how REA lets a coding agent analyse software without its source code.