{"content_id":"mqxmod7ehz","slug":"rea-ai-reverse-engineering-performance-and-limits","locale":"en","schema_type":"TechArticle","category":"knowledge_base","category_name":"Knowledge Base","title":"REA AI Reverse Engineering: How It Works and Its Limits","summary":"REA is a tool that connects AI agents with reverse engineering tools to investigate how software behaves. It distinguishes what published cases verify from the limits of server analysis and explains security, copyright, and the reproducibility of analysis results.","sponsorship_disclosure":null,"affiliate_disclosure":null,"commerce_disclosure":null,"author":{"name":"Injoys Editorial Team","url":"https://injoys.com/ko/about"},"key_points":["REA uses MCP to let AI agents call reverse engineering tools.","Understanding how an executable behaves is different from recovering its original source code.","The published DX-Ball case reports verification results for a specific function; it does not mean the entire game has been restored.","Server code or private models not included in an app cannot be obtained by analyzing the app alone.","Analysis results should record the supporting evidence and what remains unverified, then be compared with the original to check behavior."],"content_markdown":"REA connects AI to reverse engineering tools so it can investigate how an app works. Public examples show that specific features can be analyzed and potentially reimplemented. They are not evidence that the software industry is ending or that entire services can be copied.\n\nThe DX-Ball verification figures are based on the official case record from October 7, 2026.\n\n## What is REA?\n\nREA stands for Reverse Engineer Anything. It is a project that connects software analysis tools to AI agents. It is not a single AI model that performs every analysis on its own.\n\nReverse engineering is the work of tracing the structure and behavior of finished software. Its aim is to understand what is needed to explain a feature or achieve compatibility.\n\nCompilation turns human-written code into an executable form. Comments and some name information may be lost in the process. Optimization can also change how functions and calculations appear.\n\nNot every app, however, is reduced to machine code with no names. Some distributed packages include JavaScript code or debugging information. The analysis method therefore depends on the file format and the information that remains.\n\n| Term | Simple explanation | What to keep in mind when reading the results |\n| --- | --- | --- |\n| Disassembly | Represents machine code as assembly instructions | The purpose of the instructions needs further interpretation |\n| Decompilation | Represents executable code in a form resembling source code | It is not guaranteed to match the original source |\n| Static analysis | Examines files without running the program | Must be distinguished from the paths taken during execution |\n| Dynamic analysis | Observes behavior while running the program | Behavior outside the observed conditions remains unverified |\n| Reimplementation | Writes new code for behavior that has been identified | Requires comparison with the original |\n\n## How do AI and Ghidra connect?\n\nREA passes an agent's analysis requests to tools through MCP. MCP is a connection protocol for exchanging requests and results between AI and external tools. Ghidra is a reverse engineering tool for examining executable files.\n\nThe official README also describes integrations with Hopper and IDA. JavaScript static analysis does not require a native analysis engine. Describing REA solely as a way to automate Ghidra therefore understates its scope.\n\nAnalysis usually follows this sequence.\n\n1. Choose the app and feature to investigate.\n2. Find relevant locations through strings or function calls.\n3. Interpret the behavior by following instructions and data flow.\n4. Check gaps in the evidence with additional tool calls.\n5. Compare the reimplementation with the original behavior.\n\nGhidra already has automated analysis features. REA connects an agent so it can continue making analysis requests. Actual accuracy depends on the target, analysis engine, model, and verification method.\n\n## Scope of analysis under different conditions\n\nWhat REA can check depends on the files and execution environment it can access. A local app may contain code that communicates with a server. That does not mean it contains the server's internal implementation.\n\n| Analysis target | What can be checked | What analysis alone cannot establish |\n| --- | --- | --- |\n| Local executable file | Calculations, strings, relationships between function calls | All original comments and design intentions |\n| JavaScript and Electron app | Module structure, links between the interface and internal processing | Logic that exists only on the server |\n| Webpage and communication records | Downloaded scripts, observed requests and responses | The complete server source and database |\n| Locally included model file | Structure and information in accessible files | Private models used only on the server |\n| Feature observed during execution | Behavior under the given input and environment | Behavior under every input and failure condition |\n\nReimplementing a service also requires addressing requirements beyond the observed features. Account permissions and error handling are examples. Even if the interface behaves similarly, that does not establish that the entire service is the same.\n\n## What the 8-minute, 41-second calculator experiment verifies\n\nThe 8-minute, 41-second figure is a demonstration claim for which the original record has not been verified. The accompanying claim says there were 17 tool calls. The claim that 4 calculation rules were found has not been independently verified either.\n\nThe test conditions need to be checked against the original video and execution record. The time required varies with the model and program size. One success is not enough to judge general analysis speed or accuracy.\n\nFor a calculator analysis, reading the formulas does not complete verification. The order in which discounts and coupons are applied can change the result. Truncation in integer division also needs to be checked separately.\n\n- The order in which discounts and coupons are applied\n- The amount used as the basis for tax calculation\n- Where intermediate calculations are rounded or truncated\n- Outputs at boundary values where conditions change\n- Records comparing the original and reimplemented code with the same inputs\n\nDemonstrating fast analysis requires records beyond the successful answer. Failed runs and the number of retries affect the comparison. The evidence checked so far does not support a general claim that it outperforms people.\n\n## Results confirmed in public cases\n\nThe official cases cover Notion's clipboard path and a DX-Ball calculation function. Both specify the scope of the feature investigated. It is also important to distinguish these as records published by the REA project.\n\n| Case | Work confirmed in public documentation | What should not be inferred |\n| --- | --- | --- |\n| Notion Desktop 7.6.1 | Traced the path from a call inside the app to the system clipboard | Replication of the entire Notion service |\n| DX-Ball 1.07 | Reimplemented a function that converts screen position into left and right audio values | Completion of a full game restoration |\n| Lightweight replacement app for Razer Synapse | No specific original verification record confirmed in this review | That it is an officially verified REA result |\n| Claude-related slide editor | The target and scope of reimplementation were not confirmed in this review | That Claude's private model was restored |\n\nThe Notion case traces how a call from the interface passes through internal communication. It ultimately reaches Electron's clipboard-writing function. This is an example that explains the processing path of a specific feature.\n\nThe DX-Ball case confirmed function inputs and calculation constants in the executable file. The function underwent **3,205** comparison tests. After the reviewed relocation handling was accounted for, 63 bytes of the compiled result matched.\n\nThis record supports the reimplementation of a specific function. The official document says work on a runnable restoration of the entire game is ongoing. Verification of some functions must be distinguished from completion of the whole product.\n\n## What do observation and inference labels guarantee?\n\nEvidence labels distinguish where conclusions came from. REA documentation separates observations, inferences, and unverified information. Not every tool, however, uses the same four labels.\n\nThe official documentation uses different status and confidence terms for different types of analysis. It helps to distinguish their meanings as follows. The categories in the table are provided to aid understanding.\n\n| Category | Meaning | What to review |\n| --- | --- | --- |\n| Observation | Confirmed directly in a file or execution result | Target version and location of the evidence |\n| Derived conclusion | Calculated from observed values and relationships | Calculation steps and assumptions |\n| Estimate | Interpretation that needs further confirmation | Possible alternative explanations |\n| Unverified | A point for which evidence was not obtained | Scope of investigation and why confirmation failed |\n\nThe official DISCLAIMER.md states the limits of analysis results.\n\n\u003e Decompilation, reconstruction, heuristics, and AI-assisted analysis may be incomplete or incorrect.\n\u003e\n\u003e Source: REA DISCLAIMER.md\n\nThis means decompilation and AI analysis can be incomplete or wrong. An observation label does not eliminate the possibility of a tool error. The value of evidence labels is that they identify what can be reviewed again.\n\n## Common mistakes\n\nThe most common mistake is treating a plausible explanation as a verified result. Readable code can behave differently from the original. Paths that were not investigated must be noted separately.\n\n| Misconception | More accurate interpretation |\n| --- | --- |\n| Decompilation recovers the original source | It often produces a representation resembling source code |\n| The code contains a path, so it must have run | A static connection is different from observed execution |\n| The feature was not found, so it does not exist | The investigation may have been limited, or tool support may be insufficient |\n| The tool completed successfully, so the analysis is complete | A successful result may still leave items unverified |\n| The result has evidence, so it contains no hallucinations | Both the evidence and its interpretation need review |\n\nREA's CLI documentation also distinguishes successful completion from a complete analysis. Some evidence or questions may remain unresolved even after a task finishes. Check the limitations of the result rather than relying on the completion message.\n\n## Records that allow analysis results to be verified again\n\nReproducible analysis must retain the conditions under which a conclusion was reached. Code can change with an update even when the app name stays the same. Recording only a function address makes it difficult to find the target in another version.\n\nREA's Evidence records preserve target identifiers and evidence locations. Snapshots allow analysis results to be reused when the conditions match. A saved result does not mean the latest version has been verified.\n\nTo keep a verification record, follow these steps.\n\n1. Record the target file's version and hash.\n2. Record the versions of REA and the analysis engine.\n3. Link each conclusion to a file location or function address.\n4. Keep the inputs and outputs of the original and reimplemented code together.\n5. List conditions that could not be investigated and tests that failed separately.\n\nA hash is an identifier used to compare whether files are the same. Keeping it makes it possible to trace which distributed package an explanation applies to. It also helps distinguish the scope of a result when AI cites it later.\n\n## Local analysis and external data transfer\n\nSaying that analysis takes place locally does not rule out external transfer during the overall process. According to the official README, REA analyzes the target locally. The connected AI agent receives the tool results.\n\nIf an external model is used, analysis results may be sent to the model provider. The applicable data policy depends on the connected service. For company apps or private files, check the transfer path first.\n\n- The scope of code and strings sent to the model\n- Account information and access tokens included in logs\n- Personal information in communication records\n- Where analysis results are stored and the retention policy\n\nExamining static files must also be distinguished from running a program. Observing execution can affect files or account status. Handle untrusted programs in an isolated test environment.\n\n## Security and rights for developers to check\n\nSecrets placed in an app can be exposed through reverse engineering. OWASP describes the problem of putting sensitive information in distributed packages. This risk existed before REA.\n\nIn particular, an app must not include a secret API key with server privileges. OWASP advises keeping static secrets on the server. Obfuscation can make extraction harder but does not guarantee secrecy.\n\n- Check distributed files for passwords and secret keys.\n- Limit the permissions and validity period of authentication tokens.\n- Verify requesters' permissions on the server.\n- Replace exposed credentials.\n\nThe permitted scope of reverse engineering varies by country, contract, and type of work. It cannot be assumed that every action is permitted because the purpose is compatibility. Analysis and redistribution of code or images must be considered separately.\n\nREA's MIT license does not grant rights to the software being analyzed. The project's usage principles can be checked in the official DISCLAIMER.md. Check the applicable law and the target software's terms for the actual permitted scope.\n\n## What changes could this bring to the software industry?\n\nREA shows the potential to lower the cost of understanding existing features. That is a prospect that can be drawn from the published analysis cases. There are no verified figures for cost savings across the industry.\n\nKnowing how some features are implemented is separate from being able to operate a service. Data quality and incident response cannot be copied simply by analyzing an executable file. The ease of imitating features and business competitiveness should therefore be assessed separately.\n\n| Business element | Implication drawn from REA's scope of analysis |\n| --- | --- |\n| A single feature within an app | Potentially less effort needed to investigate and reimplement it |\n| Server-only processing | Difficult to obtain through client analysis alone |\n| Data and access rights | Must be obtained and managed separately from understanding the code |\n| Stability and operational trust | Testing, maintenance, and incident response remain necessary |\n| Preservation of existing software | Can be restored one small feature at a time while retaining evidence |\n\nREA's public cases show a change in how software can be understood. They are not evidence that demand for development is disappearing. Even after a feature is reimplemented, compatibility and operational quality still need to be verified.","content_html":"\u003cp\u003eREA connects AI to reverse engineering tools so it can investigate how an app works. Public examples show that specific features can be analyzed and potentially reimplemented. They are not evidence that the software industry is ending or that entire services can be copied.\u003c/p\u003e\n\u003cp\u003eThe DX-Ball verification figures are based on the official case record from October 7, 2026.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-is-rea\" class=\"anchor\" id=\"what-is-rea\"\u003e\u003c/a\u003eWhat is REA?\u003c/h2\u003e\n\u003cp\u003eREA stands for Reverse Engineer Anything. It is a project that connects software analysis tools to AI agents. It is not a single AI model that performs every analysis on its own.\u003c/p\u003e\n\u003cp\u003eReverse engineering is the work of tracing the structure and behavior of finished software. Its aim is to understand what is needed to explain a feature or achieve compatibility.\u003c/p\u003e\n\u003cp\u003eCompilation turns human-written code into an executable form. Comments and some name information may be lost in the process. Optimization can also change how functions and calculations appear.\u003c/p\u003e\n\u003cp\u003eNot every app, however, is reduced to machine code with no names. Some distributed packages include JavaScript code or debugging information. The analysis method therefore depends on the file format and the information that remains.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eTerm\u003c/th\u003e\n\u003cth\u003eSimple explanation\u003c/th\u003e\n\u003cth\u003eWhat to keep in mind when reading the results\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Term\"\u003eDisassembly\u003c/td\u003e\n\u003ctd data-label=\"Simple explanation\"\u003eRepresents machine code as assembly instructions\u003c/td\u003e\n\u003ctd data-label=\"What to keep in mind when reading the results\"\u003eThe purpose of the instructions needs further interpretation\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Term\"\u003eDecompilation\u003c/td\u003e\n\u003ctd data-label=\"Simple explanation\"\u003eRepresents executable code in a form resembling source code\u003c/td\u003e\n\u003ctd data-label=\"What to keep in mind when reading the results\"\u003eIt is not guaranteed to match the original source\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Term\"\u003eStatic analysis\u003c/td\u003e\n\u003ctd data-label=\"Simple explanation\"\u003eExamines files without running the program\u003c/td\u003e\n\u003ctd data-label=\"What to keep in mind when reading the results\"\u003eMust be distinguished from the paths taken during execution\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Term\"\u003eDynamic analysis\u003c/td\u003e\n\u003ctd data-label=\"Simple explanation\"\u003eObserves behavior while running the program\u003c/td\u003e\n\u003ctd data-label=\"What to keep in mind when reading the results\"\u003eBehavior outside the observed conditions remains unverified\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Term\"\u003eReimplementation\u003c/td\u003e\n\u003ctd data-label=\"Simple explanation\"\u003eWrites new code for behavior that has been identified\u003c/td\u003e\n\u003ctd data-label=\"What to keep in mind when reading the results\"\u003eRequires comparison with the original\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003ch2\u003e\n\u003ca href=\"#how-do-ai-and-ghidra-connect\" class=\"anchor\" id=\"how-do-ai-and-ghidra-connect\"\u003e\u003c/a\u003eHow do AI and Ghidra connect?\u003c/h2\u003e\n\u003cp\u003eREA passes an agent's analysis requests to tools through MCP. MCP is a connection protocol for exchanging requests and results between AI and external tools. Ghidra is a reverse engineering tool for examining executable files.\u003c/p\u003e\n\u003cp\u003eThe official README also describes integrations with Hopper and IDA. JavaScript static analysis does not require a native analysis engine. Describing REA solely as a way to automate Ghidra therefore understates its scope.\u003c/p\u003e\n\u003cp\u003eAnalysis usually follows this sequence.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eChoose the app and feature to investigate.\u003c/li\u003e\n\u003cli\u003eFind relevant locations through strings or function calls.\u003c/li\u003e\n\u003cli\u003eInterpret the behavior by following instructions and data flow.\u003c/li\u003e\n\u003cli\u003eCheck gaps in the evidence with additional tool calls.\u003c/li\u003e\n\u003cli\u003eCompare the reimplementation with the original behavior.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eGhidra already has automated analysis features. REA connects an agent so it can continue making analysis requests. Actual accuracy depends on the target, analysis engine, model, and verification method.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#scope-of-analysis-under-different-conditions\" class=\"anchor\" id=\"scope-of-analysis-under-different-conditions\"\u003e\u003c/a\u003eScope of analysis under different conditions\u003c/h2\u003e\n\u003cp\u003eWhat REA can check depends on the files and execution environment it can access. A local app may contain code that communicates with a server. That does not mean it contains the server's internal implementation.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eAnalysis target\u003c/th\u003e\n\u003cth\u003eWhat can be checked\u003c/th\u003e\n\u003cth\u003eWhat analysis alone cannot establish\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Analysis target\"\u003eLocal executable file\u003c/td\u003e\n\u003ctd data-label=\"What can be checked\"\u003eCalculations, strings, relationships between function calls\u003c/td\u003e\n\u003ctd data-label=\"What analysis alone cannot establish\"\u003eAll original comments and design intentions\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Analysis target\"\u003eJavaScript and Electron app\u003c/td\u003e\n\u003ctd data-label=\"What can be checked\"\u003eModule structure, links between the interface and internal processing\u003c/td\u003e\n\u003ctd data-label=\"What analysis alone cannot establish\"\u003eLogic that exists only on the server\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Analysis target\"\u003eWebpage and communication records\u003c/td\u003e\n\u003ctd data-label=\"What can be checked\"\u003eDownloaded scripts, observed requests and responses\u003c/td\u003e\n\u003ctd data-label=\"What analysis alone cannot establish\"\u003eThe complete server source and database\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Analysis target\"\u003eLocally included model file\u003c/td\u003e\n\u003ctd data-label=\"What can be checked\"\u003eStructure and information in accessible files\u003c/td\u003e\n\u003ctd data-label=\"What analysis alone cannot establish\"\u003ePrivate models used only on the server\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Analysis target\"\u003eFeature observed during execution\u003c/td\u003e\n\u003ctd data-label=\"What can be checked\"\u003eBehavior under the given input and environment\u003c/td\u003e\n\u003ctd data-label=\"What analysis alone cannot establish\"\u003eBehavior under every input and failure condition\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eReimplementing a service also requires addressing requirements beyond the observed features. Account permissions and error handling are examples. Even if the interface behaves similarly, that does not establish that the entire service is the same.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-the-8-minute-41-second-calculator-experiment-verifies\" class=\"anchor\" id=\"what-the-8-minute-41-second-calculator-experiment-verifies\"\u003e\u003c/a\u003eWhat the 8-minute, 41-second calculator experiment verifies\u003c/h2\u003e\n\u003cp\u003eThe 8-minute, 41-second figure is a demonstration claim for which the original record has not been verified. The accompanying claim says there were 17 tool calls. The claim that 4 calculation rules were found has not been independently verified either.\u003c/p\u003e\n\u003cp\u003eThe test conditions need to be checked against the original video and execution record. The time required varies with the model and program size. One success is not enough to judge general analysis speed or accuracy.\u003c/p\u003e\n\u003cp\u003eFor a calculator analysis, reading the formulas does not complete verification. The order in which discounts and coupons are applied can change the result. Truncation in integer division also needs to be checked separately.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe order in which discounts and coupons are applied\u003c/li\u003e\n\u003cli\u003eThe amount used as the basis for tax calculation\u003c/li\u003e\n\u003cli\u003eWhere intermediate calculations are rounded or truncated\u003c/li\u003e\n\u003cli\u003eOutputs at boundary values where conditions change\u003c/li\u003e\n\u003cli\u003eRecords comparing the original and reimplemented code with the same inputs\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eDemonstrating fast analysis requires records beyond the successful answer. Failed runs and the number of retries affect the comparison. The evidence checked so far does not support a general claim that it outperforms people.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#results-confirmed-in-public-cases\" class=\"anchor\" id=\"results-confirmed-in-public-cases\"\u003e\u003c/a\u003eResults confirmed in public cases\u003c/h2\u003e\n\u003cp\u003eThe official cases cover Notion's clipboard path and a DX-Ball calculation function. Both specify the scope of the feature investigated. It is also important to distinguish these as records published by the REA project.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCase\u003c/th\u003e\n\u003cth\u003eWork confirmed in public documentation\u003c/th\u003e\n\u003cth\u003eWhat should not be inferred\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Case\"\u003eNotion Desktop 7.6.1\u003c/td\u003e\n\u003ctd data-label=\"Work confirmed in public documentation\"\u003eTraced the path from a call inside the app to the system clipboard\u003c/td\u003e\n\u003ctd data-label=\"What should not be inferred\"\u003eReplication of the entire Notion service\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Case\"\u003eDX-Ball 1.07\u003c/td\u003e\n\u003ctd data-label=\"Work confirmed in public documentation\"\u003eReimplemented a function that converts screen position into left and right audio values\u003c/td\u003e\n\u003ctd data-label=\"What should not be inferred\"\u003eCompletion of a full game restoration\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Case\"\u003eLightweight replacement app for Razer Synapse\u003c/td\u003e\n\u003ctd data-label=\"Work confirmed in public documentation\"\u003eNo specific original verification record confirmed in this review\u003c/td\u003e\n\u003ctd data-label=\"What should not be inferred\"\u003eThat it is an officially verified REA result\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Case\"\u003eClaude-related slide editor\u003c/td\u003e\n\u003ctd data-label=\"Work confirmed in public documentation\"\u003eThe target and scope of reimplementation were not confirmed in this review\u003c/td\u003e\n\u003ctd data-label=\"What should not be inferred\"\u003eThat Claude's private model was restored\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eThe Notion case traces how a call from the interface passes through internal communication. It ultimately reaches Electron's clipboard-writing function. This is an example that explains the processing path of a specific feature.\u003c/p\u003e\n\u003cp\u003eThe DX-Ball case confirmed function inputs and calculation constants in the executable file. The function underwent \u003cstrong\u003e3,205\u003c/strong\u003e comparison tests. After the reviewed relocation handling was accounted for, 63 bytes of the compiled result matched.\u003c/p\u003e\n\u003cp\u003eThis record supports the reimplementation of a specific function. The official document says work on a runnable restoration of the entire game is ongoing. Verification of some functions must be distinguished from completion of the whole product.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-do-observation-and-inference-labels-guarantee\" class=\"anchor\" id=\"what-do-observation-and-inference-labels-guarantee\"\u003e\u003c/a\u003eWhat do observation and inference labels guarantee?\u003c/h2\u003e\n\u003cp\u003eEvidence labels distinguish where conclusions came from. REA documentation separates observations, inferences, and unverified information. Not every tool, however, uses the same four labels.\u003c/p\u003e\n\u003cp\u003eThe official documentation uses different status and confidence terms for different types of analysis. It helps to distinguish their meanings as follows. The categories in the table are provided to aid understanding.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eCategory\u003c/th\u003e\n\u003cth\u003eMeaning\u003c/th\u003e\n\u003cth\u003eWhat to review\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eObservation\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eConfirmed directly in a file or execution result\u003c/td\u003e\n\u003ctd data-label=\"What to review\"\u003eTarget version and location of the evidence\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eDerived conclusion\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eCalculated from observed values and relationships\u003c/td\u003e\n\u003ctd data-label=\"What to review\"\u003eCalculation steps and assumptions\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eEstimate\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eInterpretation that needs further confirmation\u003c/td\u003e\n\u003ctd data-label=\"What to review\"\u003ePossible alternative explanations\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Category\"\u003eUnverified\u003c/td\u003e\n\u003ctd data-label=\"Meaning\"\u003eA point for which evidence was not obtained\u003c/td\u003e\n\u003ctd data-label=\"What to review\"\u003eScope of investigation and why confirmation failed\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eThe official DISCLAIMER.md states the limits of analysis results.\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eDecompilation, reconstruction, heuristics, and AI-assisted analysis may be incomplete or incorrect.\u003c/p\u003e\n\u003cp\u003eSource: REA DISCLAIMER.md\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003eThis means decompilation and AI analysis can be incomplete or wrong. An observation label does not eliminate the possibility of a tool error. The value of evidence labels is that they identify what can be reviewed again.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#common-mistakes\" class=\"anchor\" id=\"common-mistakes\"\u003e\u003c/a\u003eCommon mistakes\u003c/h2\u003e\n\u003cp\u003eThe most common mistake is treating a plausible explanation as a verified result. Readable code can behave differently from the original. Paths that were not investigated must be noted separately.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eMisconception\u003c/th\u003e\n\u003cth\u003eMore accurate interpretation\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Misconception\"\u003eDecompilation recovers the original source\u003c/td\u003e\n\u003ctd data-label=\"More accurate interpretation\"\u003eIt often produces a representation resembling source code\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Misconception\"\u003eThe code contains a path, so it must have run\u003c/td\u003e\n\u003ctd data-label=\"More accurate interpretation\"\u003eA static connection is different from observed execution\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Misconception\"\u003eThe feature was not found, so it does not exist\u003c/td\u003e\n\u003ctd data-label=\"More accurate interpretation\"\u003eThe investigation may have been limited, or tool support may be insufficient\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Misconception\"\u003eThe tool completed successfully, so the analysis is complete\u003c/td\u003e\n\u003ctd data-label=\"More accurate interpretation\"\u003eA successful result may still leave items unverified\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Misconception\"\u003eThe result has evidence, so it contains no hallucinations\u003c/td\u003e\n\u003ctd data-label=\"More accurate interpretation\"\u003eBoth the evidence and its interpretation need review\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eREA's CLI documentation also distinguishes successful completion from a complete analysis. Some evidence or questions may remain unresolved even after a task finishes. Check the limitations of the result rather than relying on the completion message.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#records-that-allow-analysis-results-to-be-verified-again\" class=\"anchor\" id=\"records-that-allow-analysis-results-to-be-verified-again\"\u003e\u003c/a\u003eRecords that allow analysis results to be verified again\u003c/h2\u003e\n\u003cp\u003eReproducible analysis must retain the conditions under which a conclusion was reached. Code can change with an update even when the app name stays the same. Recording only a function address makes it difficult to find the target in another version.\u003c/p\u003e\n\u003cp\u003eREA's Evidence records preserve target identifiers and evidence locations. Snapshots allow analysis results to be reused when the conditions match. A saved result does not mean the latest version has been verified.\u003c/p\u003e\n\u003cp\u003eTo keep a verification record, follow these steps.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eRecord the target file's version and hash.\u003c/li\u003e\n\u003cli\u003eRecord the versions of REA and the analysis engine.\u003c/li\u003e\n\u003cli\u003eLink each conclusion to a file location or function address.\u003c/li\u003e\n\u003cli\u003eKeep the inputs and outputs of the original and reimplemented code together.\u003c/li\u003e\n\u003cli\u003eList conditions that could not be investigated and tests that failed separately.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eA hash is an identifier used to compare whether files are the same. Keeping it makes it possible to trace which distributed package an explanation applies to. It also helps distinguish the scope of a result when AI cites it later.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#local-analysis-and-external-data-transfer\" class=\"anchor\" id=\"local-analysis-and-external-data-transfer\"\u003e\u003c/a\u003eLocal analysis and external data transfer\u003c/h2\u003e\n\u003cp\u003eSaying that analysis takes place locally does not rule out external transfer during the overall process. According to the official README, REA analyzes the target locally. The connected AI agent receives the tool results.\u003c/p\u003e\n\u003cp\u003eIf an external model is used, analysis results may be sent to the model provider. The applicable data policy depends on the connected service. For company apps or private files, check the transfer path first.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe scope of code and strings sent to the model\u003c/li\u003e\n\u003cli\u003eAccount information and access tokens included in logs\u003c/li\u003e\n\u003cli\u003ePersonal information in communication records\u003c/li\u003e\n\u003cli\u003eWhere analysis results are stored and the retention policy\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eExamining static files must also be distinguished from running a program. Observing execution can affect files or account status. Handle untrusted programs in an isolated test environment.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#security-and-rights-for-developers-to-check\" class=\"anchor\" id=\"security-and-rights-for-developers-to-check\"\u003e\u003c/a\u003eSecurity and rights for developers to check\u003c/h2\u003e\n\u003cp\u003eSecrets placed in an app can be exposed through reverse engineering. OWASP describes the problem of putting sensitive information in distributed packages. This risk existed before REA.\u003c/p\u003e\n\u003cp\u003eIn particular, an app must not include a secret API key with server privileges. OWASP advises keeping static secrets on the server. Obfuscation can make extraction harder but does not guarantee secrecy.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCheck distributed files for passwords and secret keys.\u003c/li\u003e\n\u003cli\u003eLimit the permissions and validity period of authentication tokens.\u003c/li\u003e\n\u003cli\u003eVerify requesters' permissions on the server.\u003c/li\u003e\n\u003cli\u003eReplace exposed credentials.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe permitted scope of reverse engineering varies by country, contract, and type of work. It cannot be assumed that every action is permitted because the purpose is compatibility. Analysis and redistribution of code or images must be considered separately.\u003c/p\u003e\n\u003cp\u003eREA's MIT license does not grant rights to the software being analyzed. The project's usage principles can be checked in the official DISCLAIMER.md. Check the applicable law and the target software's terms for the actual permitted scope.\u003c/p\u003e\n\u003ch2\u003e\n\u003ca href=\"#what-changes-could-this-bring-to-the-software-industry\" class=\"anchor\" id=\"what-changes-could-this-bring-to-the-software-industry\"\u003e\u003c/a\u003eWhat changes could this bring to the software industry?\u003c/h2\u003e\n\u003cp\u003eREA shows the potential to lower the cost of understanding existing features. That is a prospect that can be drawn from the published analysis cases. There are no verified figures for cost savings across the industry.\u003c/p\u003e\n\u003cp\u003eKnowing how some features are implemented is separate from being able to operate a service. Data quality and incident response cannot be copied simply by analyzing an executable file. The ease of imitating features and business competitiveness should therefore be assessed separately.\u003c/p\u003e\n\u003cdiv class=\"overflow-x-auto\"\u003e\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eBusiness element\u003c/th\u003e\n\u003cth\u003eImplication drawn from REA's scope of analysis\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Business element\"\u003eA single feature within an app\u003c/td\u003e\n\u003ctd data-label=\"Implication drawn from REA's scope of analysis\"\u003ePotentially less effort needed to investigate and reimplement it\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Business element\"\u003eServer-only processing\u003c/td\u003e\n\u003ctd data-label=\"Implication drawn from REA's scope of analysis\"\u003eDifficult to obtain through client analysis alone\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Business element\"\u003eData and access rights\u003c/td\u003e\n\u003ctd data-label=\"Implication drawn from REA's scope of analysis\"\u003eMust be obtained and managed separately from understanding the code\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Business element\"\u003eStability and operational trust\u003c/td\u003e\n\u003ctd data-label=\"Implication drawn from REA's scope of analysis\"\u003eTesting, maintenance, and incident response remain necessary\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd data-label=\"Business element\"\u003ePreservation of existing software\u003c/td\u003e\n\u003ctd data-label=\"Implication drawn from REA's scope of analysis\"\u003eCan be restored one small feature at a time while retaining evidence\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\u003c/div\u003e\n\u003cp\u003eREA's public cases show a change in how software can be understood. They are not evidence that demand for development is disappearing. Even after a feature is reimplemented, compatibility and operational quality still need to be verified.\u003c/p\u003e\n","tags":["AI Agents","AI Development","Technology strategy","Development Tools"],"faqs":[{"question":"Is REA an AI model of its own?","answer":"REA is a project that connects AI agents with software analysis tools. Analysis requests and results can be sent through MCP."},{"question":"Do you need Ghidra to use REA?","answer":"It depends on what you are analyzing. Native analysis uses engines such as Ghidra. JavaScript static analysis is possible without a native analysis engine."},{"question":"Does REA restore the original source code exactly?","answer":"It does not guarantee a reconstruction identical to the original source. Comments or name information may be lost during compilation. Decompilation output should be read as a representation that helps you understand the behavior."},{"question":"Can analyzing an app also give you the server code?","answer":"Server code that is not included in the app cannot be obtained by analyzing the app alone. Requests and responses can be observed. Those records do not show the server's entire internal implementation."},{"question":"Can other programs also be analyzed in 8 minutes and 41 seconds?","answer":"There is no basis for generalizing that. We also could not verify the original record of that calculator demonstration. The time required varies with the target's size, the model, and the analysis environment."},{"question":"Does REA eliminate AI hallucinations?","answer":"Hallucinations do not disappear. Identifying the evidence and what remains unverified makes it easier to review conclusions. Tool results and the AI's interpretation must be verified separately."},{"question":"Does the DX-Ball case show a reconstruction of the entire game?","answer":"The cited figure is a validation result for a specific sound calculation function. The official case study describes 3,205 comparison tests. It states that a working reconstruction of the entire game is still in progress."},{"question":"Is all REA analysis handled offline?","answer":"REA analyzes the target locally. The agent receiving the tool results may use an external model. Check the connected service for the full scope of data transmission."},{"question":"Can I put code analyzed with REA into a commercial product?","answer":"Obtaining analysis results alone does not grant usage rights. You must check the rights and license for the target software. Also review applicable laws and the analysis tool's terms of use."},{"question":"If REA is open source, is analysis free too?","answer":"The license for REA's code and the total cost of the work are separate matters. The connected model or commercial analysis tools may incur costs. Check each provider's pricing and terms of use for the amounts."},{"question":"What should I record to cite the analysis results?","answer":"Record the target version, file hash, and location of the evidence. The analysis tool's version and comparison test results are also needed. Recording unverified conditions as well helps clarify where the conclusions apply."}],"sources":[{"url":"https://github.com/morluto/rea","title":"REA Official Repository README: How It Works, Supported Targets, Local Analysis, and Model Data Policy","type":"source"},{"url":"https://ghidra.re/ghidra_docs/GhidraClass/Beginner/Introduction_to_Ghidra_Student_Guide.html","title":"Ghidra Official Training Documentation: Introduction to Ghidra","type":"source"},{"url":"https://rea.tools/showcase/notion/","title":"REA Official Case Study: Analysis of Notion's Electron Clipboard Path","type":"source"},{"url":"https://rea.tools/showcase/dx-ball/","title":"REA Official Case Study: Reimplementing and Comparing DX-Ball Sound Position Calculations","type":"data_point"},{"url":"https://github.com/morluto/rea/blob/main/docs/tool-design.md","title":"REA Tool Design: Distinguishing Observations, Derivations, Inferences, and Limitations","type":"source"},{"url":"https://github.com/morluto/rea/blob/main/docs/javascript-application-graph.md","title":"REA JavaScript Application Graph: Evidence, State, Confidence, and Target Locations","type":"source"},{"url":"https://github.com/morluto/rea/blob/main/docs/javascript-application-workflows.md","title":"REA JavaScript Application Workflows: Distinguishing Static Relationships from Runtime Verification","type":"source"},{"url":"https://raw.githubusercontent.com/morluto/rea/main/docs/cli.md","title":"REA CLI and Evidence: Record Preservation, Snapshots, and Exit Status","type":"source"},{"url":"https://raw.githubusercontent.com/morluto/rea/main/DISCLAIMER.md","title":"REA Disclaimer: Analysis Limitations, Usage Rights, and Rights to Outputs","type":"source"},{"url":"https://mas.owasp.org/MASWE-0004/","title":"OWASP MASWE-0004: Sensitive Information in App Packages and Mitigation Methods","type":"source"}],"images":[{"id":1947,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6Mjk5NzksInB1ciI6ImJsb2JfaWQifX0=--2b1213d9736d5cae1ff35ed8e5e7db570784612e/ai-ab7036b9.webp","is_representative":true,"generation_method":"ai_photo","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"노트북 옆에서 공과 패들 테스트 화면이 뜬 태블릿 두 대를 비교하는 개발자","caption":"특정 함수의 동작이 일치해도 게임 전체가 복원됐다는 뜻은 아닙니다.","description":null},"en":{"alt":"A developer compares ball-and-paddle test screens on two tablets beside a laptop.","caption":"Matching the behavior of one function does not mean the entire game has been restored.","description":null},"ja":{"alt":"ノートパソコンの横で、ボールとパドルのテスト画面を表示した2台のタブレットを見比べる開発者","caption":"特定の関数の動作が一致しても、ゲーム全体を復元できたとは限りません。","description":null},"es":{"alt":"Un desarrollador compara dos tabletas con pruebas de pelota y paleta junto a un portátil.","caption":"Que coincida el comportamiento de una función no significa que se haya reconstruido todo el juego.","description":null},"id":{"alt":"Pengembang membandingkan dua tablet dengan uji bola dan pemukul di samping laptop.","caption":"Kecocokan perilaku satu fungsi tidak berarti seluruh gim telah berhasil dipulihkan.","description":null},"pt":{"alt":"Um desenvolvedor compara duas telas de teste de bola e raquete em tablets ao lado de um notebook.","caption":"A correspondência no comportamento de uma função não significa que o jogo inteiro foi reconstruído.","description":null},"zh-hant":{"alt":"開發者在筆電旁比較兩台平板上的球與擋板測試畫面。","caption":"特定函式的行為一致，不代表整個遊戲已經還原。","description":null},"de":{"alt":"Ein Entwickler vergleicht Ball-und-Schläger-Tests auf zwei Tablets neben einem Laptop.","caption":"Stimmt das Verhalten einer Funktion überein, ist damit nicht das ganze Spiel rekonstruiert.","description":null}}},{"id":1948,"url":"https://injoys.com/rails/active_storage/blobs/proxy/eyJfcmFpbHMiOnsiZGF0YSI6Mjk5ODUsInB1ciI6ImJsb2JfaWQifX0=--1f2adeb39e8cbbe1342eb9e3c6b1d619bea6e20f/ai-ccb48b79.webp","is_representative":false,"generation_method":"ai_semi","license":"ai_generated","mime_type":"image/webp","width":1536,"height":1024,"translations":{"ko":{"alt":"짙은 회색 스웨터를 입은 엔지니어가 소형 컴퓨터에서 파란색 네트워크 케이블을 뽑고 있다.","caption":"신뢰할 수 없는 앱을 분석할 때는 보안 위험을 먼저 통제해야 합니다.","description":null},"en":{"alt":"An engineer in a dark gray sweater disconnects a blue network cable from a compact computer.","caption":"Security risks should be controlled before analyzing an untrusted app.","description":null},"ja":{"alt":"濃い灰色のセーターを着た技術者が、小型コンピューターから青いネットワークケーブルを抜いている。","caption":"信頼できないアプリを分析する前に、セキュリティ上のリスクを抑える必要があります。","description":null},"es":{"alt":"Un ingeniero con un suéter gris oscuro desconecta un cable de red azul de un ordenador compacto.","caption":"Antes de analizar una aplicación no confiable, hay que controlar los riesgos de seguridad.","description":null},"id":{"alt":"Seorang teknisi bersweter abu-abu gelap mencabut kabel jaringan biru dari komputer kecil.","caption":"Risiko keamanan perlu dikendalikan sebelum menganalisis aplikasi yang tidak tepercaya.","description":null},"pt":{"alt":"Um engenheiro de suéter cinza-escuro desconecta um cabo de rede azul de um computador compacto.","caption":"É preciso controlar os riscos de segurança antes de analisar um aplicativo não confiável.","description":null},"zh-hant":{"alt":"身穿深灰色毛衣的工程師正從小型電腦拔出藍色網路線。","caption":"分析不受信任的應用程式前，應先控管安全風險。","description":null},"de":{"alt":"Ein Ingenieur im dunkelgrauen Pullover zieht ein blaues Netzwerkkabel aus einem kompakten Computer.","caption":"Vor der Analyse einer nicht vertrauenswürdigen App sollten Sicherheitsrisiken begrenzt werden.","description":null}}}],"published_at":"2026-10-19T05:55:51+09:00","updated_at":"2026-10-19T05:55:51+09:00","license":"cc_by","translation_status":"reviewed","available_locales":["ko","en","ja","es"],"data_locales":["ko","en","ja","es","id","pt","zh-hant","de"],"url":"https://injoys.com/en/articles/rea-ai-reverse-engineering-performance-and-limits"}