REA: Reverse Engineer Anything with AI Agents and MCP

AI DISCLOSURE — PLEASE READ FIRST

This course was developed with the assistance of artificial intelligence. AI tools were used to help draft, structure, and organize portions of the curriculum, lecture outlines, technical explanations, scenario prompts, and supporting written materials. All topics, sequencing decisions, accuracy checks, and final quality review were carried out by the instructor. This disclosure is placed at the very beginning of the course so that every learner can make a fully informed decision before enrolling. If you have questions about how AI was used in the creation of this material, please ask in the course Q&A before you purchase.

REA: Reverse Engineer Anything with AI Agents and MCP

Have you ever looked at an application and wondered, "How does that feature actually work?" Perhaps you wanted to understand a specific algorithm, trace how a desktop app communicates with its backend, or analyze a binary to see how a game calculates its physics. Traditionally, reverse engineering has been a high-friction endeavor. It required learning complex, fragmented tools—a disassembler for binaries, a bundler inspector for JavaScript, a packet analyzer for network traffic—and manually stitching their outputs together. Each tool has its own interface, its own output format, and its own quirks.

Today, that paradigm is shifting. Enter REA (Reverse Engineer Anything), an open-source Model Context Protocol (MCP) server and command-line tool that acts as a bridge between AI coding agents (like Claude Code, Codex, Cursor, and Gemini CLI) and professional reverse-engineering engines. This course is a practical, evidence-oriented guide to mastering REA. It is designed to take you from a complete beginner—someone who may have never opened a disassembler—to a practitioner who can orchestrate AI agents to inspect native binaries, trace Electron applications, analyze network captures, and reconstruct software features with verifiable evidence.

The Problem REA Solves

When a human analyst reverse engineers software, they rely on intuition and experience to know which tool to use and how to interpret the results. When an AI agent tries to use these tools directly, it faces immense friction. The interfaces are inconsistent, the raw outputs are massive and flood the AI's context window, and there is no standard way to distinguish between what was actually observed and what the AI simply inferred.

REA solves this by placing one consistent, normalized interface in front of many analysis engines. The AI agent speaks MCP to REA, and REA handles the complex toolchain, the analysis session, and the target lifecycle. Crucially, REA introduces an Evidence Model. Every result returned to the agent is wrapped in structured metadata that includes the actual findings, the location of the evidence (such as a file offset or address), the confidence level, and—most importantly—the explicit limitations and unknowns. This prevents the AI from hallucinating a function or guessing an architecture, forcing it to ground its conclusions in hard data.

What You Will Learn

This course is structured around the real-world capabilities of REA, moving from foundational concepts to advanced case studies. You will not just learn what REA is; you will learn how to use it effectively.

• Understand the Architecture: Learn how the MCP server, the provider abstraction layer, and the workflow skill interact. Understand the difference between static analysis (which safely reads files without executing them) and runtime capture (which runs the target).

• Master the Evidence Model: Learn to read REA's output critically. You will be taught to ask the four essential questions of any finding: What was observed? Where did it come from? What did the tool infer? And what remains unknown?

• Analyze Native Binaries: Discover how to connect REA to Hopper, Ghidra, or IDA to extract pseudocode, assembly, strings, and cross-references. You will learn how to navigate large binaries and raise provider startup timeouts when dealing with massive targets.

• Trace Electron and JavaScript Apps: Follow features across the security boundaries of modern desktop apps. You will learn to trace execution from the renderer process, through preload scripts, across IPC channels, and into the main process—all without running the application.

• Inspect Databases and Network Captures: Learn to analyze SQLite databases, read HAR files, and use tools like mitmproxy and Wireshark to understand how an application communicates over the network. You will learn to extract API endpoints, authentication patterns, and payload shapes from recorded traffic.

• Analyze Specialized Formats: Explore REA's built-in static inspectors for .NET assemblies, Android APKs, Flutter apps, Go and Rust binaries, and specialized formats like WASM and EVM bytecode.

• Develop Custom Providers: Go beyond the built-in tools. Learn about REA's extension and plugin architecture, and discover how to develop custom providers to connect REA to your own specialized tools or workflows.

• Security and Best Practices: Understand the security posture required for reverse engineering. Learn how to isolate targets, manage agent permissions, and handle memory management. We will also cover batch processing to scale your analysis.

Course Curriculum Overview

Section 1 begins with a comprehensive introduction to REA, including how to set up the Hopper provider, analyze SQLite databases, and use mitmproxy for native captures. From there, you will dive into recorded packets, Flutter app analysis, and the critical process of provider selection. We will begin a deep dive into the DX-Ball case study, exploring how to trace and reconstruct the sound-pan calculation. The section continues with the TH04 case study, a look at the project's security documentation, and essential concepts of memory management. Finally, we cover broader security considerations, Wireshark integration, extension architecture, custom provider development, and best practices for scaling your REA workflows.

The Case Studies: Learning Through Real Examples

One of the most powerful aspects of REA is its documented case studies, which we will explore in detail.

First, we look at DX-Ball, a classic game. You will learn how REA follows a sound call into its position-to-pan helper function, inspects the assembly, and turns incomplete pseudocode into C code that passes thousands of original test cases. This demonstrates what true evidence-based reconstruction looks like.

Next, we examine TH04, a PC-98 game written in 16-bit code. You will see how REA handles the complexities of segmented memory and historical compilers, recovering the fixed and aimed angle calculations for a ring of bullets.

We also look at Notion, an Electron app. You will learn how to find the renderer's clipboard API, follow it through the preload and IPC into the main process, and inspect the rich clipboard format—teaching you how to document a feature chain and reimplement it safely in your own projects.

Who This Course Is For

This course is designed for developers, security researchers, and students who want to understand how software works under the hood. If you are curious about how MCP turns specialist tools into capabilities an AI agent can use, this course will demystify the process.

No prior reverse-engineering experience is assumed. We start from the ground up, teaching you how to install Node.js, set up the REA MCP server, and configure your AI agent. If you can read basic terminal output and have a willingness to learn, you are ready for this course. For native binary analysis, we will guide you on how to use existing installations of Hopper, Ghidra, or IDA.

Legal and Ethical Boundaries

Reverse engineering is a powerful skill that must be practiced responsibly. This course emphasizes the legal, ethical, and licensing considerations of using REA. You will learn that REA is intended for lawful research, education, interoperability, software preservation, and the analysis of software you own or are authorized to examine. We will discuss the importance of legally obtaining commercial tools like IDA Pro and Hopper, and we will cover the project's stance on responsible disclosure and data privacy.

Why Take This Course?

The hype around AI coding agents is immense, but knowing how to point those agents at complex, low-level problems is a rare skill. REA is a connector, not a magic button. It does not give you the original source code back; it gives you what can be observed, along with what is unknown. By taking this course, you will learn how to use REA to lower the friction of reverse engineering, while keeping your expectations honest and your findings verifiable. You will learn how to ask the right questions, demand evidence, and build features based on solid, observable behavior.

Join me in this course to master the intersection of AI agents, MCP, and reverse engineering, and start exploring the binaries, applications, and networks around you with confidence and evidence.