Building an AI-Powered Reverse Engineering Studio with REA and 20 Open-Source Tools

Security researcher @0xDeniAi has released a curated suite of 20 open-source repositories centered around REA (Reverse Engineering Assistant), building a complete AI agent-driven reverse engineering and clean-room reconstruction studio. Point it at any complex application, and watch the agent analyze, explain, and rebuild it.

Image source: @0xDeniAi on X

The pipeline shifts away from manual debugging by establishing a deterministic clean-room loop: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry. The workflow is organized into five distinct tiers that bridge static analysis, low-level inspection, runtime tracing, and verification.

The Five-Tier Reverse Engineering Tool Stack

The studio chains specialized open-source tools across five functional layers to give AI agents precise runtime and structural visibility:

• [01] Analysis Core: Anchored by REA, a single MCP that plugs into everything, alongside the free Ghidra decompiler, GhidraMCP for letting agents drive Ghidra directly, and ida-pro-mcp for IDA Pro integration.
• [02] Mobile & Apps: Tools like jadx for turning Android APKs back into Java, Apktool for unpacking and rebuilding packages, Frida for live runtime instrumentation, and ILSpy for .NET decompilation.
• [03] Binary & Low-Level: Terminal-native RE framework radare2, Windows debugger x64dbg, hex editor ImHex with a custom pattern language, and the angr symbolic execution engine.
• [04] Network & Runtime: mitmproxy for intercepting traffic, dnSpy for debugging and editing .NET binaries, rizin (the radare2 fork), and raddebugger from Epic Games.
• [05] Rebuild & Verify: Curated reference lists (including 122 graded RE repos) paired with the clean-room loop where SPEC.md specs are tested against execution oracles until parity is reached.

Practical Application in the Agent Workflow

By combining specialized decompilers and instrumentation frameworks with an MCP-native assistant like REA, agents can autonomously traverse complex instruction spaces without losing context. Engineers can deploy this stack locally to automate boilerplate inspection, generate accurate architectural specifications, and verify reimplementations against live binaries.

Original source

• Original Author: @0xDeniAi
• X Post Reference