Reverse Engineering: How to Get Anything for FREE With Most Dangerous Repo & Opus 5.5 (Full Course)

REA is the most dangerous thing on the internet right now, and 99% of people have no idea how to use it

You pay every month for apps whose features are already sitting on your computer

Motion design apps. Office. TradingView. Your notes app and others - All of it is just code on your disk

And every company is betting on one thing: that you will never look inside

Now one open-source repo gives your Claude Code the same skill in one command

before the alpha - subscribe to my substack for more fresh alpha -

https://substack.com/@0xcodila

https://x.com/i/status/2108245653843509415

This 3 days it went everywhere. "Software is done". "Closed source is dead"

https://x.com/i/status/2109165852578992582

Most people saw the screenshots, bookmarked them, and never tried it

So in this full course I'll show you everything in simple words:

So bookmark it, open your terminal, and go step by step

Part 1 - Understand

01. What Is Reverse Engineering (and What Is REA)

Reverse engineering is simple actually

You look at a finished app and figure out how it works inside, without its source code

That's it. You want to understand a feature well enough to explain it, change it, or build your own version

REA (Reverse Engineer Anything) does exactly that, with your AI agent doing the hard part. The official README says it in one line:

"See a feature you like. Understand how it works, down to the binary level."

Here's what it is technically:

You ask in plain English. REA inspects the program. Your agent explains it, builds your version, and tests it REA repo

The best example is on the official site

For example: why does Windows Calculator show 220 when you type 200 + 10%?

Without REA you'd decode branches and trace calls by hand. With REA you just ask

The answer from the code: after +, the % button takes a percentage of the first number. 10% of 200 is 20, so 200 + 20 = 220. After ×, 10% simply becomes 0.1

- rea.tools

Or why the Chrome dinosaur game gets faster: speed starts at 6, adds 0.001 every update, and stops at 13

You don't read the code. You ask a question, and you get the rule

REA is open source under MIT, built by @morluto

The first release came out on July 12, 2026. Three months later it has 100K+ GitHub stars

https://x.com/i/status/2109281121749856655

02. What REA Can Read

This is the official list, translated into normal words What you can analyze

Here's the part almost nobody talks about:

Many Unity games ship their game logic as .NET code. And REA reads .NET without any extra tools

This is how one person took a Steam game he had bought and got it open in Unity in under 30 minutes:

https://x.com/i/status/2109060856466264566

so agent now does the whole job for you

03. Wait... Isn't This Just Stealing?

Let's talk about the elephant in the room!

The moment REA went viral, half of X screamed "piracy" and the other half screamed "software is dead"

Chamath even said on All-In that people "decompiled" the whole Adobe suite

https://x.com/i/status/2108761607857992104

And here's the funny part. That clip got a Community Note

The Adobe alternatives were not decompiled. Their developer calls them clean-room reimplementations

That one note explains the whole legal game. So let me explain clean room, because once you get it, everything clicks

Clean room is a 40-year-old trick

Step 1: one team studies the original and writes down what it does. Not the code. The behavior

Step 2: a different team builds a new product from that description only. They never see the original code

The result does the same thing, but contains zero of the original's code Clean-room design

This is how the PC industry was born. In the early 80s, Compaq rebuilt IBM's BIOS this way, at a cost of about $1 million. That's why "IBM compatible" PCs from other brands exist at all

And the courts kept backing reverse engineering:

And then there's the other side of history

In 2010-2011 hackers broke the PS3's security and published its root key. Sony sued George Hotz (geohot), and in April 2011 he settled and agreed to stop hacking Sony products TechSpot

So here's my honest take

Reading the app on your own computer to understand it, that's learning

Rebuilding a feature from its behavior, in your own code, that's how the industry has always worked

Copying their code, cracking paid features, or publishing someone else's decompiled source, that's the part that gets you sued

Even the REA team says it plainly: it's for lawful research, education, interoperability, software preservation, and software you own or are allowed to examineDisclaimer

Study the original. Ship your own. That's the rule for everything in this article

Part 2 · Install

03. Install REA in 5 Minutes

Follow it in order Get started

Step 1. Check Node.js

Open your terminal and run:

node -v
npm -v

You need Node 22.19+, 24.11+, or 26+. Versions 23 and 25 are not supported

If it's older or "command not found", install Node 24 LTS:

macOS (with Homebrew):

brew install node

macOS (without Homebrew):

curl -fsSL https://fnm.vercel.app/install | bash

Close Terminal, open it again, then:

fnm install 24
fnm default 24

Windows (PowerShell):

winget install OpenJS.NodeJS.LTS

Type Y if it asks. Close PowerShell, open it again, run node -v

If Windows later says "running scripts is disabled", run this once:

Set-ExecutionPolicy -Scope CurrentUser RemoteSigned

Step 2. Have an agent

I use Claude Code. It needs a paid Claude plan. Setup page: code.claude.com/docs/en/setup

Codex, Cursor, Gemini CLI, OpenCode and others work too

Step 3. Run REA setup

The easiest way: paste this into Claude Code and let it do everything:

Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

Or run it yourself:

npx rea-agents@latest setup

What happens next:

Setup will also offer Hopper, a separate engine for reading programs. On a Mac it downloads the official installer and opens it, and you pick demo mode. It's optional, you can say no for now

Step 4. Restart your agent

Step 5. Check

npx -y rea-agents@latest doctor --client claude_code --json

doctor only checks things, it never changes anything. If something failed, it tells you the next step

Want the short rea command forever:

Your result: Claude Code now has REA tools. Ask it "what REA tools do you have?" and it will list them

npm install --global rea-agents
rea --help

04. Your First Reverse Engineering in 2 Minutes

Don't start with something huge. REA has an official practice app for this First investigation

It's a tiny "Notes" app with an Export notes button. Your job: find out where the export goes

Paste this into Claude Code:

Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.

Then ask:

Show where notes.csv is written, which fields it contains, and the relevant files and lines.

What you should get back, the full path of one click:

Congrats. That's reverse engineering

You just traced a feature through an app you didn't write, and every step came with proof

Now the fun part. Every Electron app on your computer works the same way, and you know where it lives:

And you can analyze it straight from the terminal, without running the app:

npx -y rea-agents@latest analyze-javascript-application /absolute/path/to/app --json

Tip: on Mac, hold Option, right-click a folder and choose "Copy as Pathname". Or just drag the folder into your terminal

05. Add the Right Engine for What You Want to Read

Desktop JavaScript apps need nothing more. For everything else, add one engine

Programs and games: Ghidra (free, made by the NSA)

You need Ghidra 12.1.x and JDK 21 or newer

macOS / Linux:

export GHIDRA_INSTALL_DIR=/absolute/path/to/ghidra_12.1.4_PUBLIC
export JAVA_HOME=/absolute/path/to/jdk-21
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Windows PowerShell:

$env:GHIDRA_INSTALL_DIR = "C:/tools/ghidra_12.1.4_PUBLIC"
$env:JAVA_HOME = "C:/tools/jdk-21"
npx -y rea-agents@latest doctor --provider ghidra --json
npx rea-agents@latest setup

Windows support is still experimental and read-only

Then look at any function:

npx -y rea-agents@latest function /absolute/path/to/program main --provider ghidra --json

Programs and games: Hopper (Mac/Linux, commercial with a demo)

Just run setup again. It finds Hopper or offers to install it. On Mac, pick demo mode or your license on first launch

Programs and games: IDA (if you already own it)

Verified on Windows through an existing IDA MCP setup Get started

Android apps: a full JDK 17+ and jadx-headless-mcp 0.7.1 Android guide

export REA_JADX_MCP_JAR=/absolute/path/jadx-headless-mcp-0.7.1-all.jar
rea inspect-android-package /path/App.apk

Websites: any Chrome-family browser

Smart contracts: Linux x64

Keep it updated (REA ships fixes almost every day):

rea update

or npx rea-agents@latest setup. To remove it: rea uninstall

If your agent doesn't see REA: restart it, then run doctor --client claude_code --json again

https://x.com/i/status/2109018088872239310

Part 3 - What People Already Rebuilt

06. Adobe, Office, TradingView and Games

This is where it gets crazy

AI didn't just learn to read software. People are already rebuilding entire products

ArtCraft rebuilt seven Adobe apps as free, open-source alternatives: Photoshop, Illustrator, Premiere, Lightroom, After Effects, InDesign and Acrobat. Built in Rust with help from Claude Opus 5.5

https://x.com/i/status/2108437553615425881

Remember the clean room? This is it. ArtCraft calls these clean-room reimplementations, without Adobe's source code. They're still early alpha, but they exist, and they're free

Then they went after Office. WordCraft, GridCraft and DeckCraft: Word, Excel and PowerPoint

https://x.com/i/status/2109358375209427301

This one I love. Map how the platform behaves, turn it into a spec with Opus 5.5, then build your own charting engine and backtester with your own code

https://x.com/i/status/2109347169316839434

One honest note: building your own terminal is fine. Using someone's paid indicators for free is not. Build yours

This is where AI reverse engineering exploded first

A Super Mario Sunshine native PC port: about 365 agent hours and 17.3B tokens, using both Claude and Codex Repo

https://x.com/i/status/2102957888477995067

The PS1 game Tomba! now runs on PC through a static recompiler. Its builder had no prior experience and used Claude Code + Ghidra for about three weeks Write-up

And on the official REA blog, one person with AI agents rebuilt a Touhou game: 697 functions, 696 exact matches, playable in about 12 daysThe industrial revolution in reverse engineering

Kotaku even reported browser versions of Halo, GTA: Vice City and The Simpsons: Hit & Run attributed to AI-assisted decompiling. Those are unofficial and likely to get takedowns, which is exactly the line from the chapter above Kotaku

How to repeat any of this: pick a tool you pay for or a game you own, ask REA how one feature works, write the spec, build your own version. The prompts are in Step 10

Part 4 - Use It Every Day

Reverse engineering was invented for compatibility, security and preservation

But here's how I'd use it in normal life

07. For Beginners

1. "What is this app really doing on my phone?"

Take the APK of any Android app: your broker, your exchange, that "free signals" app from Telegram. Ask:

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

Official proof this works: REA took apart the Aegis authenticator app (3,077 classes), found exactly how it makes its 6-digit login codes, and rebuilt it. The rebuild matched all 133 test casesAegis case

2. "Is this file safe?"

Reverse engineering is how people catch malware. When a fake 113 GB "GTA 6 build" went around, someone who took the files apart found it was fake and full of malware

https://x.com/i/status/2091221918561317355

3. "Is this token a scam?"

Most memecoins don't publish their source. REA reads the raw contract bytecode and recovers its functions EVM guide

rea inspect-evm-interface ./runtime.hex hex --json

Then ask:

Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.

Function names here are guesses from the bytecode, so treat a red flag as "check deeper". And this command runs on Linux x64 for now

4. "I want that paid feature"

Don't crack it. Rebuild it. Ask REA how the feature works, then let Claude build your own version from public data and open-source parts

08. For Pros

REA ships guided workflows that almost nobody knows about. They're built into the MCP server Guided prompts:

The pro loop is investigate → spec → build → verify

Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.

How far this goes, from the official showcases:

And the lessons from the Touhou rebuild are gold for anyone doing this seriously:

Security people are already running this at scale. One researcher built an AI pipeline with 8 MCP servers, 300+ tools, Ghidra, radare2 and Frida, and says it paid for itself through bug bounties:

https://x.com/i/status/2098033761317446083

Where the money is: security research and bug bounties, moving old software to new systems, making tools talk to each other, and helping companies understand software they lost the source code for

09. What REA Can't Do

I want you to trust this article, so here are the real limits

10. The Prompt Pack

Save this. Every prompt works in Claude Code once REA is installed

Setup:

Install REA and connect it to this coding agent using npx rea-agents@latest setup. Show me the setup plan for approval, then verify the installation.

Your first test

Download https://rea.tools/examples/notes-example.zip into a new example folder and unpack it. Use REA to find what happens when I click Export notes.

The universal one:

Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project.

Real-time features:

Figure out how Discord shows who's typing in real time, show me the proof, and build something similar for my project.

The calculator:

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

Use REA to inspect Windows Calculator's % button. Recover the rules after + and ×, then build a small calculator that uses both.

The game:

Inspect the dinosaur game and build a version with adjustable speed.

Reconstruct a game:

Reconstruct a game from its executable and test it against the original.

Clone a website:

Clone the rea.tools website.

Phone app audit:

Use REA on this APK. List every permission, every analytics or tracking SDK, and every domain the app talks to. Show the class and method for each finding.

Token check:

Use REA on this contract bytecode. List every function that can change state. Flag anything that looks like mint, blacklist, pause, fee change or owner-only transfer. Mark what is confirmed and what is inferred.

Pro rebuild:

Use REA to investigate how [feature] works in [app]. Write SPEC.md: behavior, inputs, outputs, edge cases, no copied code. Then build it from SPEC.md in ./my-version, write tests from the observed behavior, and run them until they pass.

What changed in the update:

Use REA's compare_application_versions workflow on [old version] and [new version] of [app]. Tell me what actually changed, with evidence.

Your One-Evening Protocol

Don't just bookmark this. Do this tonight:

That's it. One evening, and you'll never look at software the same way again

The shift

Closed source used to mean "you'll never know" → now it means "show me the evidence"

https://x.com/i/status/2109361546505966046

REA is not a hacking tool

It's a reading tool for software you didn't write

And the real alpha is not the 100K stars or the viral screenshots

The real alpha is that every feature you envy in someone else's app is now something you can understand:

Most people will keep paying for features they could understand in an afternoon

The few who learn to read software will build anything they want - absolutely for free.

Bookmark this course before your next build →@0xCodila