---
title: "我對自己進行紅隊測試以了解逆向工程"
url: "https://reamcp.dev/zh-tw/cases/i-red-teamed-myself-to-learn-about-reverse-engineering-9b9cea"
source: "https://www.reddit.com/r/Pentesting/comments/1x6sla5/i_redteamed_myself_to_learn_about_reverse"
source_type: "reddit"
author: "Accurate-Screen8774"
author_handle: "Accurate-Screen8774"
stars: 0
category: "資安與惡意程式分析（防禦）"
categories: ["security-defense"]
tags: ["client-side-crypto", "decompilation", "p2p", "rust", "threat-modeling", "wasm"]
added: "2026-10-16T02:12:58.737Z"
updated: "2026-10-15T17:53:36.000Z"
locale: "zh-tw"
content_locale: "zh-tw"
---

# 我對自己進行紅隊測試以了解逆向工程

開發人員使用 REA 對自己的閉源 Rust/WASM P2P 訊息應用程式進行逆向工程，以評估其被反編譯的難易程度，並公布結果。

## Description

一篇 Reddit r/Pentesting 貼文，作者描述了透過對其應用程式的 TUI、APK 和網頁二進位檔案使用 REA（github.com/morluto/rea）來對自己的專案進行紅隊測試。他們將 REA 指向自己的文件，並取得了一個反編譯版本（github.com/positive-intentions/glitr-decompiled），然後討論了這對閉源軟體的影響以及他們計劃開源。該貼文連結了 REA 儲存庫和反編譯輸出，使其成為防禦性安全背景下 REA 的一個具體用例。

## Original README

https://glitr.io/blog/reverse-engineering-my-own-project i wanted to red-team myself on my project and id like to know how to reverse engineer so i can see what can be done to defend against it. my app is aiming to be fully client-side. things like javascript seem like it would relatively easy for an AI to chew-up, my latest project is in rust, which would make it harder for a person, but AI can digest binaries. i created a fairly unique p2p messaging app. a Rust-based frontend with a Git-server backend, which can be used to establish a P2P connection. while this version remains close-source, i have aimed to create the most comprehensive documentation (formal-verification and security audits too (all ai generated under my guidance)). https://glitr.io https://app.glitr.io a core detail to my project is the focus on local-first and client-side cryptography and storage. id wanted to learn how vulnerable this project is to decompilation. i think my older iteration as a javascript webapp would be relatively easy for AI, so i thought id put a spin-on-things by having a rust wasm frontend... i dont think it even slowed it down. i dont know much about decompiling, but i think the TUI would be the easiest for it to decompile and given its largly one codebase, it can be used to trace and see whats going on the build for the other platforms. it might be that all close source is obselete. i tried asking here , and the responses there are polar opposites, so i decided to get some first-hand experience. im using using cursor composer 2.5 (far from the frontier models available). i used https://github.com/morluto/rea and gave it a few binaries of my project (tui, apk, web) and pointed it to the documentation on the website. after a few prompts, it seems to have done a decent job decompiling the project here: https://github.com/positive-intentions/glitr-decompiled ( note: this is basically AI-slop ). like with many projects, i see AI lacks taste in architecture. it consolidates a lot of complexity into one repo, when in my project it's split into multiple repos. it also seems to lack a bunch of bells and whistles i added for my own benefit like formal verification and rigorous unit-tests (having done it myself before, i dont think that is a large gap to fill for somone who knows what they are doing). i think the overhead to keep up with new changes may become trivial if you can automate the process. i kinda offer the base in the repo above (maybe it saves you a few tokens?), but its for my own research and i dont plan to maintain it given it undermines the actual project. in general, im impressed. it seems this may push forward my timeline for when i open source my project, i wasnt expecting close-source being so easy to undemine. while the project can be decompiled, in a project like this, its important to consider the countless nuances there are in cybersecurity. the code is only a part of the project. (note: feel free to try decompile this yourself or offer tips on how i can improve. id be keen to see what can be done. feel free to reach out for clarity about how it works within the limitation of the original source code not being used)   submitted by   /u/Accurate-Screen8774   to   r/Pentesting [link]   [comments]