Can AI Take an App Apart? How Far REA Really GetsA guide to reverse engineering, starting with one calculator button
Open Windows Calculator in Standard mode. Type 200 + 10 % = and you get 220. Now try 200 × 10 % =. You get 20. The same % button produces a different value depending on the operator. What rule is hiding inside that button? In October 2026, a tool that lets an AI dig into questions like this one took over GitHub. The name does not lack ambition: REA, Reverse Engineer Anything.
- REA is an open-source tool that hands an AI agent a magnifying glass for looking inside finished programs.
- It is not a photocopier for whole apps. It shines on small questions like “why does this button behave this way?”
- Possible is not the same as permitted. Run your first experiment on an app you wrote or one you have permission to inspect.
GhidraElectronNode.jsnpmAndroid.NETChromeWebAssemblyGo01Two rules hiding in one calculator button
Back to the calculator. The secret is simple. With addition, the calculator works out “10% of 200,” which is 20, and adds it. With multiplication, it turns 10% into 0.1 and multiplies.
One button, two rules. Does the calculator you use every day look a little suspicious now? Switch the operator below and try it yourself.
Try it: the same 10%, two results
For addition, add 10% of 200, which is 20.
Change the numbers in the fields below and choose an operator on the calculator. The number keys, C and ± are decorative only. An educational model of Windows Calculator in Standard mode when you press number, operator, %, then =. It does not run REA.
Most people shrug and move on. A curious developer does not. Where in the program is this rule written down? How would I build the same thing into my own app?
The very first example on REA’s official site is this % button. Not a whole app. One button. That choice is the key to understanding REA. Microsoft’s open-source calculator code confirms it: percent handling for addition and subtraction is separate from multiplication and division.[1] ·[2]
02Guessing a secret recipe from one taste of stew
Imagine your favorite restaurant makes an incredible kimchi stew. They will not share the recipe. Still, one spoonful tells you a lot. There is pork in here. That is well-aged kimchi. And is that anchovy broth at the finish?
Software is similar. Source code, the text people read and write, is the recipe, and the app you download and run is the finished stew. For native programs that run directly on Windows or the Mac in particular, the cook’s notes, meaning the names and comments people wrote, mostly disappear on the way from recipe to stew. Apps built with JavaScript, though, often keep a good deal of readable code.
Tasting the stew and working the recipe out backwards is reverse engineering. What you end up with is a reconstruction that resembles the original, not the cook’s actual notebook.
None of this is new. Security researchers take suspicious files apart, and maintainers repair old programs whose source code is long gone. Expert tools have existed for years: Ghidra, released by the US National Security Agency, Hopper, and the commercial IDA. The catch was that using them well took a lot of specialist knowledge.[3]
That is exactly what REA changes. It lets an AI agent operate those tools instead of a person. An agent such as Claude Code or Codex decides what to find out, and REA does the actual analysis and returns results with evidence and limits attached.[4] The two connect through MCP, a standard way for AI apps to use outside tools. You can think of it like a USB port, but it is not quite plug and play: an agent that supports MCP has to be set up before it can use REA.
THE AGENT
Returns evidence and limits
THE ANALYSIS TOOLS
GhidraREA does not only borrow other tools, either. For apps built with JavaScript or Electron, REA examines the code structure itself, with no separate native analysis engine. Native programs that run directly on Windows or the Mac are analyzed by connecting to tools like Ghidra, Hopper or IDA. Websites, Android apps and more are supported too, but how much you can learn, and how much can be rebuilt, differs from target to target.[5]
Windows, macOS and Linux programs: functions, strings and calls.
Which code loads which modules, and which messages processes exchange.
Page structure, scripts and network requests seen in a browser. Not server internals.
Manifest, classes and decompiled methods.
What you can recover differs by target.
Requests, responses and extractable regions actually in the file.
Grouped from the official README’s list of analysis targets. Official list
03From 400 stars to 260,000 in a month
A GitHub star is a bookmark that says “I am keeping an eye on this.” Through September, REA hovered around 400 stars. Then, in early October, the curve rose steeply. The day-by-day numbers live in the chart and the table below; here is what happened in between.
A quiet September, an explosive October
- 110k stars
- 2“Software is done.”
- 3Past 100k, 119k
- 4Korean Paint video
- 5260,870
See star counts by date
| Date (2026) | Stars |
|---|---|
| September 15 | 389 |
| October 1 | 405 |
| October 4 | 2,981 |
| October 6 | 10,464 |
| October 8 | 30,714 |
| October 9 | 53,790 |
| October 11 | 119,062 |
| October 13 | 218,135 |
| October 15 | 260,870 |
Downloaded from Star History[6] on October 15, 2026. GitHub’s own page showed about 262,000 stars when this was reviewed, a similar figure.
One of the people who lit the fuse was AI video creator Matthew Berman. On October 8 he posted a screenshot of the REA repository with a short caption: “Software is done.”[7]
The interesting part is a reply he posted the same day. He compared the moment to the lawless early days of Napster and predicted that lawsuits were coming. Excitement and worry spread together from the start.[8]
Not every story was a flashy clone. On October 12, a post in Reddit’s Civilization V community described something different. The Mac version of Civ V had a long-standing bug: the game crashed whenever a civilization recaptured its capital. One player wrote that they “got Claude + REA” to track down the cause and make a patch. According to the published repository, a function in the stripped game library read memory without checking for the value that means “no team is leading,” and crashed. The patch adds that check, changes 28 bytes, backs up the original file and refuses to run on unsupported versions. Instead of copying an app, it fixes a bug in a game the player already owns, which shows REA’s more practical side. The post was small, about 30 upvotes, and the fix is described by its author and repository. Another user had posted a ChatGPT-made patch for the same crash weeks earlier, so this is not something only REA can do.[9] ·[10]
The posts and videos people shared
- “Software is done.”
Matthew Berman’s X post, about 3.76M views (checked Oct 15).
- Rob Shocks
Has REA find a hidden rule in his own app, then checks his source.
- Nick Saraev
Compares a Mac Preview rebuild with and without REA.
- The Paint video
성공지식백과 adds an asset list to Paint, in Korean.
- A Civ V bug patch
A Reddit user traced a Mac Civ V capital-recapture crash with Claude and REA, then patched it.
04The report cards, and a plot twist
There was plenty of talk. So what did people who actually used REA pull off? We picked three demos where REA use is confirmed in the video description or transcript.[11][12][13] Each is a single run in the creator’s own setup, and view counts are as of October 15, 2026.
Adding a missing feature to Paint
Rebuilds Windows Paint and adds an asset-list panel for pasted images. The creator says it took about 11 minutes.
Watch outThe creator calls Paint relatively simple
Jump to the scene (8:35) ↗A race with and without REA
Builds the Mac Preview app two ways at once. The version without REA finished first; by the creator’s judgment, the REA version looked closer to the original.
Watch outOne demo, not a benchmark
Jump to the scene (4:16) ↗Testing with a hidden answer key
Builds his own app with a hidden unlock rule, strips function names, then compares REA’s findings with his saved source.
Watch outAnalyzes an app he built himself
Jump to the scene (4:30) ↗Put the three side by side and a pattern appears. First, one creator added a feature Paint never had, which is closer to “customize it my way” than to copying. Second, in the race, the version that crossed the finish line first was the one without REA, even though, by the creator’s judgment, the REA version came out closer to the original. Third, the demo with the clearest way to check the result was the one with a hidden answer key: the creator’s own app.
Each of the three demos focused on a specific feature or a limited set of behaviors. These results alone are not enough to conclude that every feature and edge case of the original app was reproduced.
Extra: briefly reported cases and an account-ban claim
An October 10 post by AIWarper[14] claims a purchased Steam game was analyzed with REA and running in Unity within 30 minutes. It names no game and shares nothing reproducible. An October 10 video by Eric Tech[15] shows REA and Hopper being used to recreate the voice-typing app Wispr Flow. Reports like these cannot tell us whether every feature and behavior matches the original, or whether permission was given.
On October 12, one user claimed on X that an OpenAI account they had used since 2022 was suspended while they were trying REA with Codex. The cause has not been confirmed, but it is a fair reminder to check the AI service’s usage policy as well.[16]
05We ran it ourselves: the clues left after an error
Videos alone were not enough to judge, so we ran REA ourselves. Our target was Electron API Demos[17], a sample app published by the Electron team. Electron is a way to build desktop apps with web technology; Slack and VS Code use it.
We picked it for one reason: it comes with an answer key. Its source is public, so we could check REA’s answers against the original line by line. One caveat: the repository was archived and made read-only on August 2, 2026, so it is an old sample, not a stand-in for today’s Electron apps.
The analysis ended in an error message, but part of the intermediate results remained inside the error response. We compared those results with a list we built by searching the source ourselves.
Same app, two different lists
18 versus 20: what was different?
REA read 79 relevant files and parsed 54 of them as JavaScript. By identifying IPC-related call syntax in the code structure, it recorded 18 IPC channel names, the labels processes inside the app use to pass messages. For example, the screen-side code sends “open a file picker,” and the main process (the part that manages the app’s windows and system features) receives it and opens the dialog.
Our own plain-text search of the source turned up 20 candidates. That is two more, but it does not prove REA missed them. REA’s number comes from parsing the code’s structure and identifying IPC call syntax; it does not confirm that the code actually runs. A text search grabs every match. Because they count differently, you cannot divide one by the other and call it a detection rate.
The two names only the search found were open-file-dialog-sheet and compute-factorial. open-file-dialog-sheet appeared in code inside an HTML file, and compute-factorial appeared in an HTML file and in a webContents.send call in a JavaScript file. In a demo app, the HTML code may be sample code displayed on screen, and different call styles may have been counted differently. So these two are extra candidates, not confirmed misses.
A zero in the summary, true in the source
Electron has a switch called nodeIntegration. It lets the web code inside an app window reach into your computer, for example to read files. That makes it a security-critical setting.
REA’s summary reported zero places that explicitly set window options (webPreferences). Yet when we opened the source, nodeIntegration: true appeared in several files. Read on its own, the summary could suggest there were no security settings to worry about. A zero in the summary does not always mean the original has none.
What the error was
The error was a separate issue from the analysis. After finishing, REA tried to confirm that its helper processes had been cleaned up. Our test environment blocked access to the process list, so it could not confirm this. That does not mean a process was actually left running. Since the run did not complete normally, we do not treat the numbers above as a performance score.
Test environment and error summary
- Operating system: macOS 27.2 (build 26B5112a) according to
sw_versoutput. This may differ from Apple’s public release list, so it may have been a test build. The run took place inside an isolated environment for AI agents. - Node.js 26.5.0, npm 11.17.0
- REA: rea-agents 6.5.0, local folder analyzed with
analyze_javascript_application - Target: electron/electron-api-demos, master branch, commit
26b3d1d(October 17, 2022) - Statistics: 79 relevant files, 54 JavaScript files parsed, 427,872 bytes of text read, 253 findings, 0 parse failures
- Error code:
cleanup_incomplete(categoryexecution_failure) - Error message: “Provider cleanup could not be fully confirmed. Review the reported local resources before opening another target.”
- Recorded cause: “process table could not be inspected: spawn EPERM”
- Limits REA reported with its results: static analysis does not prove what actually runs, and some scripts inside HTML were not analyzed
- The full raw JSON result (about 17MB) is not published; the key items are summarized above.
REA quickly mapped out the files and how they connect. Deciding whether it was right took a person checking against the original. Read results in three boxes: what you saw directly, what you reasonably inferred, and what you still do not know.
Sort the evidence into three boxes
Pick an answer to see why.
1. The inspected file contains the number 0.001.
2. It sits near update code, so it probably controls acceleration.
3. The recommendation formula on an inaccessible server is not available.
No answers yet.
06Possible is not the same as permitted
“I paid for this app, so what’s the problem?” “It’s only for me.” Fair things to say. But the law is not that simple. What matters is what you take apart, why, and what you do with the results. This article is not legal advice; if you need a real answer, ask a professional.
Korea’s Copyright Act, Article 101-4, narrowly defines when program code may be reverse analyzed without permission. All three conditions must hold: you are a lawful user of the program (or have that user’s permission), the information needed for interoperability cannot readily be obtained and obtaining it is unavoidable, and you analyze only the parts needed for interoperability.
Even the information you gain has limits. It cannot be used for purposes other than interoperability or provided to third parties, and it cannot be used to develop, produce or sell a program substantially similar in expression to the original. Development and production are each covered, not only sale. Article 101-3, just before it, sets separate conditions for copying, including copying to investigate, study or test a program’s functions to understand its underlying ideas and principles, but neither article is a blanket license that says “reverse engineering is always fine.”[18]
Your own apps, open source that permits analysis, or targets you have permission for.
Analysis for interoperability with software you lawfully use. Korea’s Copyright Act Article 101-4 allows it without permission only when the needed information is not readily available and obtaining it is unavoidable, and only for the necessary parts. The information may not be used for other purposes, given to third parties, or used to develop, produce or sell a program substantially similar in expression.
Copying or distributing protected code or assets without the rights holder’s permission or another applicable legal basis, bypassing licenses or payments, or analysis that breaks terms of service.
General information, not legal advice. Outcomes vary by country and contract. Copyright Act text
The REA project itself stresses lawful research, education, interoperability, preservation, and software you are authorized to analyze. REA’s MIT license covers REA’s own code; it does not unlock any rights to the software you analyze.[19]
Also keep an eye on where your data goes. Even when the analysis runs on your computer, code fragments can travel along when the agent sends results to an AI model. For work apps, check your company’s rules and the model provider’s data policy first.
Checklist before you start
- Prerequisites: You need npm and Node.js 22.19 or later on the 22.x line, 24.11 or later on the 24.x line, or 26 or later (23 and 25 are not supported). Then run
npx rea-agents setup, pick your agents and approve the changes.[20] - Analysis engine: JavaScript and Electron apps need no separate native analysis engine, though some environments have conditions, such as a procps-compatible
pson Linux. Native programs need one of Hopper, Ghidra or IDA. - Cost: REA itself is free, MIT-licensed open source, but AI model usage and commercial analysis-tool licenses cost extra.
- First target: Start with a small program you wrote or an open-source sample that permits analysis.
07Knowing the recipe is only part of running a restaurant
Back to the kimchi stew. Say you tasted carefully and figured out the ingredients. You can try to make something similar. But running a restaurant like that one? You would need good ingredients every day, a kitchen that survives the lunch rush, and the same taste today as yesterday. The secret of the flavor is only one slice of a much bigger job.
- Which ingredients went in
- The order of seasoning
- How the heat is managed
- A first attempt at a similar taste
- Running servers and data
- Security and privacy
- Ongoing updates
- Customer support
- Legal rights and licenses
- Keeping the taste consistent every day
Software is the same. REA makes the first slice, finding the rule behind one button and organizing the evidence, far easier. Running servers, shipping updates and answering customers still come after. Learning a recipe and running a restaurant are different jobs.
Three quick checks
Pick an answer to see why.
1. Which best describes REA’s role?
2. A feature does not show up in the analysis. Then?
3. The best first target to practice on?
No answers yet.
One question to try first
Open a small app you wrote and ask: “When I press this button, which function runs? Show me the evidence, and keep what you are still unsure about separate.”
Five questions readers ask
Does REA give you back an app’s original source code?
No. Native programs lose most human-written names and comments when they are built, so what analysis produces is a reconstruction that resembles the original. REA is strongest at finding evidence for how a specific feature works.
Can I use REA without knowing how to code?
Setup and checking results need some basic terminal use. Install Node.js and npm, connect an agent with npx rea-agents setup, then ask questions in plain language. Checking whether the answers are right is still a human job.
If the analysis runs on my computer, does my data stay local?
Not necessarily. The analysis itself can run locally, but code fragments may travel along when the agent sends results to an AI model. For work apps, check your company’s rules and the model provider’s data policy first.
If I bought an app, can I analyze it however I like?
Buying an app does not automatically permit every kind of analysis or distribution. Korea’s Copyright Act, Article 101-4, allows reverse analysis only when a lawful user cannot readily obtain the information needed for interoperability and obtaining it is unavoidable, and only for the necessary parts. The information also cannot be used for other purposes or to develop a substantially similar program.
What should I practice on first?
A small app you wrote, or an open-source sample that permits analysis. You have the original source to check REA’s answers against, and the permissions are clear.
Sources
- [1]REA · Official site (rea.tools)
- [2]Microsoft · Windows Calculator source (GitHub)
- [3]NSA · Ghidra (GitHub)
- [4]morluto · REA repository and README (GitHub)
- [5]morluto · REA README: What you can analyze
- [6]Star History · morluto/rea star history (downloaded 2026.10.15)
- [7]Matthew Berman · “Software is done.” (X, 2026.10.08)
- [8]Matthew Berman · Napster reply (X, 2026.10.08)
- [9]Reddit r/civ5 · Fixed the Mac Civ V crash when an AI recaptures its capital (2026.10.12)
- [10]jtutlis · civ5-mac-capital-crash-fix (GitHub)
- [11]성공지식백과 · “Is software over?” REA video, in Korean (YouTube, 2026.10.12)
- [12]Nick Saraev · I Tested The Viral Github Repo To Reverse Engineer Anything (YouTube, 2026.10.10)
- [13]Rob Shocks · The Fastest-Rising Repo on GitHub Is a Little Scary REA (YouTube, 2026.10.09)
- [14]AIWarper · Steam game decompile claim (X, 2026.10.10)
- [15]Eric Tech · How To Use REA To Clone Any Software In Minutes (YouTube, 2026.10.10)
- [16]Vincent_AINotes · OpenAI account suspension claim (X, 2026.10.12)
- [17]Electron · electron-api-demos (GitHub, archived 2026.08.02)
- [18]Korea Law Information Center · Copyright Act, Articles 101-3 and 101-4 (Korean)
- [19]morluto · REA DISCLAIMER.md (responsible use)
- [20]morluto · REA README: Quick start (setup requirements)
We checked official documentation, public repositories and the text of the law first. Star, view and download counts are as of October 15, 2026, and will change. The video and post cases are the creators’ and authors’ own accounts; we did not reproduce their results. Our own test is a partial static-analysis result left in an error response. Figures and screenshots are shown with credit for explanation.
