Building an AI Reverse Engineering Studio: 20 Repos and Clean-Room Loop
The creator of REA has released 20 curated GitHub repos forming a 5-stage reverse engineering toolkit to turn binaries into specs and verify rebuilt code.
The creator of the Reverse Engineering Agent (REA) has released a curated collection of 20 GitHub repositories designed to build a complete AI-powered reverse engineering studio. Rather than a single utility, this release offers an open-source toolset categorized into five functional stages for end-to-end binary analysis and clean-room rebuilding.
Image source: @N01ennn / X
Image Credit: @N01ennn / X
The toolset connects the entire pipeline from binary analysis to code refactoring and test verification, providing developers and security engineers with a practical reference to set up their own AI-assisted analysis environments.
5-Stage Reverse Engineering Studio Toolset Structure
The 20 released repositories are organized into five distinct modules based on their analytical scope and workflow stage.
- 01 / Analysis Core: REA (single MCP for everything), Ghidra (open-source decompiler), GhidraMCP (agent bridge to Ghidra), and ida-pro-mcp (IDA Pro connection).
- 02 / Mobile & Apps: jadx (Android APK to Java), Apktool (unpack and rebuild APKs), Frida (runtime hooks), and ILSpy (.NET decompiler).
- 03 / Binary & Low-Level: radare2 (terminal RE framework), x64dbg (Windows debugger), ImHex (hex editor with pattern language), and angr (symbolic execution).
- 04 / Network & Runtime: mitmproxy (intercept traffic), dnSpy (.NET debug and edit), rizin (radare2 fork), and raddebugger (Epic's debugger).
- 05 / Rebuild & Verify: A curated list of 122 graded AI reverse engineering repos, the author's personal RE list, and built-in REA investigation prompts.
All toolsets integrate around the analysis core's MCP interfaces and bridges, enabling seamless communication between large language models and decompilers.
From Binary to Spec: The Clean-Room Verification Loop
The core innovation of this architecture lies in its 'clean-room loop' workflow, which extends beyond bytecode analysis to actual code reconstruction.
The workflow operates in a continuous cycle: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry.
- Specification Extraction: The target binary is reverse-engineered via the analysis core and REA to generate a detailed specification document (
SPEC.md). - Code Reconstruction: Clean code is rewritten from scratch based on the extracted specification.
- Oracle Verification: The reconstructed code is validated against test oracles derived from the original binary's behavior, iterating until verification passes.
This pipeline enables developers to move past passive decompilation reading, establishing a verifiable automated process to safely respecify and rebuild software components.
Original Source
- @N01ennn X Post: 20 GitHub repos for reverse engineering studio
- Toolset Breakdown: 201 / analysis core & 5-stage toolkit breakdown