AwesomeREA.org

Curated reverse engineering resources

Find tools, agent integrations, case studies, and research with primary sources, requirements, and review dates.

99 source-reviewed records; inclusion does not imply execution testing. Review method

Website

webcrack

Improves JavaScript readability by reversing supported obfuscation patterns and unpacking webpack/Browserify bundles.

Tool · Foundation tool · App, Website

Requirements and limits
  • The reviewed README specifies Node.js 22 or 24; results depend on the obfuscator/bundler patterns present in the input.

Primary evidence · Source reviewed: · Entry link

WABT

WebAssembly tools for binary-to-text conversion, section inspection, validation, interpretation and C translation.

Tool · Foundation tool · Binary, Website

Requirements and limits
  • Select a release supporting the module's WebAssembly features; optional proposals may require explicit flags.

Primary evidence · Source reviewed: · Entry link

wasm-tools

Bytecode Alliance CLI and Rust libraries for inspecting WebAssembly modules, metadata, components and WIT interfaces.

Tool · Foundation tool · Binary, Website

Requirements and limits
  • Use prebuilt release artifacts or a Rust toolchain; proposal/component support depends on the selected release.

Primary evidence · Source reviewed: · Entry link

Chrome DevTools MCP

Connect an agent to Chrome for live page inspection, network debugging, and performance traces.

Integration · Independent agent integration · Website

Requirements and limits
  • Supported Node.js LTS, Chrome, and an MCP client; selected browser profile and target must be available locally.

Primary evidence · Source reviewed: · Entry link

mitmproxy

Inspect and record HTTP traffic with an interactive proxy, web interface, or scriptable command-line tools.

Tool · Foundation tool · App, Website

Requirements and limits
  • Configure the client proxy; HTTPS inspection requires the appropriate local trust configuration. Saved captures and live interception are distinct workflows.

Primary evidence · Source reviewed: · Entry link

Playwright MCP

Drive browser interactions through structured accessibility snapshots to investigate reproducible web behavior.

Integration · Independent agent integration · Website

Requirements and limits
  • Node.js 18+ and an MCP client; the upstream also offers a separate CLI-and-skills approach for coding agents.

Primary evidence · Source reviewed: · Entry link

Wakaru

Recover readable modules from shipped JavaScript bundles by reversing recognized minifier and transpiler patterns. Supports bundle splitting and modern-syntax recovery for inspecting production frontend code.

Tool · Foundation tool · Website

Requirements and limits
  • The npm CLI declares Node.js >=16; standalone v1.14.0 binaries are published for macOS arm64, Linux arm64/x64, and Windows arm64/x64.
  • Provide supported JavaScript bundles or source maps. Original identifiers may be unrecoverable without maps; heavy control-flow or VM obfuscation requires other tooling. Package/version inventory is explicitly still in development.

Primary evidence · Source reviewed: · Entry link

Spectral

Analyze captured application HTTP traffic with an LLM to generate MCP tools, OpenAPI 3.1 specifications, or GraphQL schemas. Generated tools call the observed API directly after capture and authentication setup.

Integration · Independent agent integration · App, Website

Requirements and limits
  • Python >=3.11; capture through the Chrome extension or MITM proxy, and configure a supported LLM provider or local Ollama endpoint.
  • The reviewed v0.11.0 workflow depends on captured traffic and valid application authentication. Analysis and automatic repair use the configured LLM; this entry does not claim universal API coverage or verified generated-tool correctness.

Primary evidence · Source reviewed: · Entry link

jsdeob-workbench

Inspect JavaScript ASTs and variable scopes while building visual chains of Babel transforms. Save analysis projects and reusable plugins to iteratively simplify obfuscated scripts.

Tool · Foundation tool · Website

Requirements and limits
  • Run from source with Node.js and npm; the documented default standalone build targets Windows. No GitHub release was available at review time.
  • Built-in transforms may need sample-specific scripts, and deeply nested input can overflow the stack. Its optional evaluation helper executes code and should be used in a local sandbox, as upstream explicitly advises.

Primary evidence · Source reviewed: · Entry link

Game

DX-Ball: reconstruct sound panning

Recover one sound-pan function from instructions and constants; upstream cites 3,205 cases and a 63-byte match.

Case study · Official REA case study · Binary, Game

Requirements and limits
  • The matching DX-Ball 1.07 executable and the documented native-analysis environment.
  • The cited reconstruction checks concern one function, not full-game equivalence; no checks were rerun here.

Primary evidence · Source reviewed: · Entry link

TH04: recover a DOS bullet-ring helper

Inspect a 16-bit PC-98 DOS helper and relate its angle calculation to a pinned reconstruction and historical compiler checks.

Case study · Official REA case study · Binary, Game

Requirements and limits
  • The matching original TH04 MAIN.EXE and the documented Ghidra DOS load profile.
  • The showcase covers one helper; full-game reconstruction claims are outside its scope.

Primary evidence · Source reviewed: · Entry link

RenderDoc

Inspect frame captures, draw calls, shaders, and graphics resources in your own game or graphics application.

Tool · Foundation tool · App, Game

Requirements and limits
  • Supported graphics API and replay platform; upstream supports captures of your own, open-source, or free projects. Metal is not supported.

Primary evidence · Source reviewed: · Entry link

AssetRipper

Analyze Unity game files, inspect asset dependencies, and convert supported assets into Unity project formats.

Tool · Foundation tool · Game

Requirements and limits
  • Unity 3.5.0–6000.4.X coverage varies by version; GPL-3.0 open-source edition, with separate premium features.

Primary evidence · Source reviewed: · Entry link

Cpp2IL

Recover managed representations from Unity IL2CPP builds using binary and metadata analysis; reconstruction remains a work in progress.

Tool · Foundation tool · App, Binary, Game

Requirements and limits
  • Compatible Unity build and metadata; current development branch is a major rewrite and primarily targets .NET 9.0.

Primary evidence · Source reviewed: · Entry link

Il2CppDumper

Recover IL2CPP metadata and dummy assemblies, and generate helper scripts for native analysis tools; method code is not restored.

Tool · Foundation tool · App, Binary, Game

Requirements and limits
  • Matching IL2CPP executable and global-metadata.dat; documented Unity support is 5.3–2022.2.

Primary evidence · Source reviewed: · Entry link

RenderDoc MCP

Expose existing RenderDoc captures to an agent for bounded frame, pipeline, resource, and shader inspection.

Integration · Independent agent integration · App, Game

Requirements and limits
  • Windows and replayable .rdc capture; maintainer baseline is RenderDoc 1.43. Optional native Python backend needs a source-built binding.

Primary evidence · Source reviewed: · Entry link

UndertaleModTool

Browse and modify supported GameMaker data files, extract assets, and decompile or compile GML VM code. Includes room editing, scripted changes, a CLI, and the reusable UndertaleModLib library.

Tool · Foundation tool · Game

Requirements and limits
  • Supply a supported game data file such as data.win, game.ios, or game.unx. Stable 0.9.2.0 provides a 64-bit Windows GUI and CLI packages for Windows, Ubuntu, and macOS.
  • GML VM code editing excludes YYC, and some language features remain unsupported. Building the reviewed source requires the .NET 10 SDK or later and recursive submodules; the GUI build requires Windows.

Primary evidence · Source reviewed: · Entry link

frida-il2cpp-bridge

Inspect IL2CPP classes, methods, and fields in a live process, and trace or intercept method calls without supplying global-metadata.dat. Complements static IL2CPP dumpers with runtime observation.

Tool · Foundation tool · App, Game

Requirements and limits
  • Requires Frida access to a running IL2CPP application and the npm module. The current bundled CLI needs Python 3.12+ (inferred from its typing.override import) and Frida tooling.
  • The reviewed README states Unity 5.3.0–6000.3.x support. Android and Linux are the platforms upstream tests; Windows, iOS, and macOS are listed as supported with explicit warnings of possible breakage. Latest release at review: v0.14.0.

Primary evidence · Source reviewed: · Entry link

objdiff

Compare functions and data in reference and rebuilt object files to guide matching decompilation. Displays instruction-level differences, demangles C++ symbols, and can rebuild when source files change.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Provide reference and rebuilt object files. Project integration and automatic rebuilding use objdiff.json plus a working toolchain and build command; direct CLI comparisons can use file paths.
  • v3.8.2 provides GUI binaries for Windows/Linux x86_64 and macOS arm64/x86_64, with additional CLI targets. Building from source requires Rust. Supported architectures include ARM, ARM64, MIPS, PowerPC, SuperH, and x86/x86_64.

Primary evidence · Source reviewed: · Entry link

UE Explorer

Explore Unreal packages through class, property, and dependency trees; decompile and export UnrealScript classes, inspect bytecode, and examine structured binary data.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Windows application built on .NET Framework 4.8; provide supported Unreal Engine 1, 2/2.5, or 3 packages. Latest stable release at review: 1.6.2.
  • UE2X and UE4/5 are not generally supported; only limited experimental parsing of loose UE4 .uasset containers is documented. Game-specific engine modifications can affect compatibility; older 1.6-and-earlier builds require decompressed packages.

Primary evidence · Source reviewed: · Entry link

GARbro

Browse recognized visual-novel resource archives as folders, preview their contents, and extract images or audio with conversion to common formats.

Tool · Foundation tool · Game

Requirements and limits
  • Requires Windows and .NET Framework 4.6 or newer; archive browsing and conversion depend on the supported game/format list. Encrypted archives may require credentials or a recognized game selection.
  • Latest GitHub release at review remains v1.5.44 (2019-03-31). Treat it as a legacy format tool and check format support for the specific title rather than assuming compatibility with newer games.

Primary evidence · Source reviewed: · Entry link

App

Aegis: trace a login-code calculation

An official APK investigation follows TOTP methods in Aegis and publishes artifact identities and selected Evidence.

Case study · Official REA case study · App

Requirements and limits
  • Upstream case: Aegis 3.4.3, REA 6.1.0, jadx-headless-mcp 0.7.1 and OpenJDK 21 on Linux x64.
  • Use the matching official APK for reproduction; this listing did not rerun the case.

Primary evidence · Source reviewed: · Entry link

Notion: trace the clipboard bridge

Trace a packaged Electron clipboard path using REA findings and separate source inspection; the dynamic wrapper remains a stated limit.

Case study · Official REA case study · App

Requirements and limits
  • Upstream case uses Notion Desktop 7.6.1 packaged JavaScript and REA 4.1.0.
  • The full clipboard route was not automatically paired or observed as a desktop execution.

Primary evidence · Source reviewed: · Entry link

JADX-AI-MCP

JADX plugin paired with a Python MCP server to inspect decompiled Android classes, resources, cross-references and debugger context.

Integration · Independent agent integration · App

Requirements and limits
  • JADX with the plugin and the separate JADX MCP Server component; upstream lists Java 11+ and Python 3.10+.

Primary evidence · Source reviewed: · Entry link

frida-mcp (yfe404)

Frida MCP server with persistent instrumentation sessions, runtime inspection and Android static-to-dynamic navigation.

Integration · Independent agent integration · App, Game

Requirements and limits
  • Node.js 20+, Frida 17 and an accessible target; on-device operations require the documented device/frida-server setup.

Primary evidence · Source reviewed: · Entry link

Super Trouper

Single-binary Frida MCP server for discovering devices, managing process sessions and loading instrumentation scripts.

Integration · Independent agent integration · App, Game

Requirements and limits
  • Published host binaries target macOS/Linux; target connectivity must support Frida. Source builds need Go, CGO and a matching Frida Core DevKit.

Primary evidence · Source reviewed: · Entry link

Frida

Dynamic instrumentation toolkit for observing and scripting the behavior of live native and managed processes.

Tool · Foundation tool · App, Game

Requirements and limits
  • Host bindings or CLI tools and a supported target setup; mobile/server/Gadget and signing requirements vary by platform.

Primary evidence · Source reviewed: · Entry link

JADX

Dex-to-Java decompiler with CLI/GUI navigation, resource decoding and cross-reference search for Android packages.

Tool · Foundation tool · App

Requirements and limits
  • 64-bit Java 11+ unless using a bundled runtime; decompilation can be incomplete and should be checked against bytecode.

Primary evidence · Source reviewed: · Entry link

Apktool

Decodes Android resources and smali into a project-like tree and can rebuild modified packages.

Tool · Foundation tool · App

Requirements and limits
  • A supported Java runtime and the release-specific launcher; rebuilding is distinct from recovering original Java source.

Primary evidence · Source reviewed: · Entry link

Androguard

Python toolkit for APK/DEX metadata, bytecode and reference analysis; the v5 source branch also documents agent skills and MCP.

Tool · Foundation tool · App

Requirements and limits
  • Version-sensitive: the reviewed README distinguishes the v5 source tree from PyPI 4.1.4; v5 extras require additional Rust/Python components.

Primary evidence · Source reviewed: · Entry link

ILSpy

.NET assembly browser and C# decompiler with whole-project export, metadata inspection and a scriptable command-line frontend.

Tool · Foundation tool · App

Requirements and limits
  • Choose a desktop or ILSpyCmd release and its matching .NET runtime; frontend and operating-system support are release-dependent.

Primary evidence · Source reviewed: · Entry link

dnSpyEx

Community continuation of dnSpy for debugging and editing .NET assemblies without the original source.

Tool · Foundation tool · App

Requirements and limits
  • Windows desktop workflow; Unity debugging requires the companion runtime setup documented by the project.

Primary evidence · Source reviewed: · Entry link

@electron/asar

Electron's archive tool lists and extracts ASAR contents so packaged JavaScript and application assets can be inspected.

Tool · Foundation tool · App, Website

Requirements and limits
  • The reviewed release requires Node.js 22.12+; extraction reveals archive contents, not missing source maps or original source names.

Primary evidence · Source reviewed: · Entry link

Mobile Security Framework (MobSF)

Inspect mobile application packages with static analysis and supported-device dynamic testing, including runtime behavior and network traffic, through a web interface and APIs.

Tool · Foundation tool · App

Requirements and limits
  • The documented container setup recommends Docker 20.10+; dynamic analysis additionally needs a supported device or emulator accessible from the container.
  • Android dynamic analysis is documented for rooted Android 4.1–11, up to API 30; Android 12+ is not supported by that workflow.
  • iOS dynamic analysis uses Corellium or a jailbroken device; the physical-device route is marked beta.

Primary evidence · Source reviewed: · Entry link

Native Binary

DownUnderCTF: masked-squares flag checker

An official educational challenge investigation connects binary checks to equations and records an original-program validation.

Case study · Official REA case study · Binary

Requirements and limits
  • Upstream case: public DownUnderCTF 2023 challenge, REA 4.1.0 and Ghidra 12.1.4 on Linux x64.
  • Target hash and source revision are documented; author-reported execution was not repeated here.

Primary evidence · Source reviewed: · Entry link

Ghidra

Open-source analysis suite for disassembly, decompilation, graphs and Java/Python automation across executable formats.

Tool · Foundation tool · Binary, Firmware, Game

Requirements and limits
  • An official Ghidra release and its required JDK; extension and script compatibility must match the installed release.

Primary evidence · Source reviewed: · Entry link

radare2

Scriptable command-line framework for inspecting, disassembling, debugging and modifying binaries across many architectures.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Use the release/build for your host; decompilers and other optional functionality may require separate plugins.

Primary evidence · Source reviewed: · Entry link

Cutter

Rizin-powered graphical reverse-engineering workspace with extensible views and Ghidra decompiler integration.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Desktop builds are available for Linux, macOS and Windows; use plugins compatible with the selected Cutter release.

Primary evidence · Source reviewed: · Entry link

Qiling

Python emulation framework that adds OS, filesystem and API behavior around CPU emulation for instrumented binary analysis.

Tool · Foundation tool · Binary, Firmware

Requirements and limits
  • A supported Python environment and the target's required root filesystem/libraries; emulation coverage varies by platform.

Primary evidence · Source reviewed: · Entry link

Unicorn Engine

Multi-architecture CPU emulator for executing selected instruction ranges with register, memory and hook control.

Tool · Foundation tool · Binary, Firmware, Game

Requirements and limits
  • Use a supported binding and explicitly supply the CPU state and memory model; it is a CPU emulator rather than a complete OS environment.

Primary evidence · Source reviewed: · Entry link

angr

Python binary-analysis framework combining control-flow recovery, symbolic execution, data-flow analysis and decompilation.

Tool · Foundation tool · Binary

Requirements and limits
  • A compatible Python 3 environment; useful results require an appropriate model of program inputs, state and external functions.

Primary evidence · Source reviewed: · Entry link

LIEF

Library for structured parsing and modification of executable formats including ELF, PE and Mach-O.

Tool · Foundation tool · Binary

Requirements and limits
  • C++, Python or Rust integration; check the distinction between core and extended features for the selected distribution.

Primary evidence · Source reviewed: · Entry link

Capstone

Disassembly library with architecture-neutral APIs and instruction details for custom binary-analysis pipelines.

Tool · Foundation tool · Binary

Requirements and limits
  • Select a library/binding release supporting the target ISA and mode; the next branch can differ from stable releases.

Primary evidence · Source reviewed: · Entry link

ImHex

Hex editor with a binary-pattern language, structured data inspection and visual tools for understanding file formats.

Tool · Foundation tool · Binary, Firmware, Game

Requirements and limits
  • Desktop build or web edition; some data sources and features depend on the platform and selected build.

Primary evidence · Source reviewed: · Entry link

x64dbg

Windows binary debugger with disassembly, memory views and plugins for analyzing programs without source code.

Tool · Foundation tool · Binary

Requirements and limits
  • Windows; choose x32dbg or x64dbg according to the executable's architecture.

Primary evidence · Source reviewed: · Entry link

GDB

Native and remote debugger for controlling execution and inspecting live or crashed program state.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • A GDB build supporting the target architecture and a permitted local process, core dump, simulator or remote debug endpoint.

Primary evidence · Source reviewed: · Entry link

rr

Records process execution and replays it under GDB, enabling repeatable inspection and reverse execution.

Tool · Foundation tool · Binary

Requirements and limits
  • Linux with supported CPU performance counters; VM use depends on counter virtualization and the project's hardware requirements.

Primary evidence · Source reviewed: · Entry link

Diaphora

IDA-based binary diffing that matches functions and transfers names, comments and types between analyzed versions.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • IDA with Python 3 support; richer pseudocode and microcode comparisons depend on the corresponding decompiler capabilities.

Primary evidence · Source reviewed: · Entry link

BinDiff

Compares disassembled binaries to find matching functions and changed code across versions.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Requires a separate supported disassembler/export pipeline; upstream documents IDA Pro, Binary Ninja and Ghidra configurations.

Primary evidence · Source reviewed: · Entry link

Detect It Easy

Format-aware file identification and static inspection using parsers, signatures and programmable heuristics.

Tool · Foundation tool · Binary, Game

Requirements and limits
  • Use the project-linked DIE-engine releases for the host platform; identification results require analyst interpretation.

Primary evidence · Source reviewed: · Entry link

objection

Explore running Android and iOS apps with a Frida-backed command interface for inspecting app storage, memory, runtime objects, and instrumented behavior.

Tool · Foundation tool · App

Requirements and limits
  • Current package metadata requires Python 3.11+ and Frida 16+; this supersedes the older Python minimum still shown in the installation wiki.
  • The target must support the documented Frida attachment or patched-app workflow. Android patching requires Android build tools and Apktool 2.9.0+; iOS patching requires the documented Xcode and signing tools.

Primary evidence · Source reviewed: · Entry link

r2frida

Use radare2 commands and Frida instrumentation together to inspect local or remote process memory, symbols, classes, and runtime calls on desktop and mobile targets.

Tool · Foundation tool · App, Binary

Requirements and limits
  • Install with r2pm or use a plugin build matching the radare2 major/minor ABI; the reviewed README reports CI against radare2 6.2.2 and git master.
  • Mobile or remote operation needs a reachable Frida target, such as frida-server over USB or TCP. The plugin bundles the host Frida library; separate host frida-tools are not required.

Primary evidence · Source reviewed: · Entry link

Firmware and Hardware

PicoPrint: LX-D02 printer investigation

The author describes REA-assisted Android investigation followed by separate Hermes decompilation to support a Windows BLE printer.

Case study · Author-reported mixed workflow · App, Firmware

Requirements and limits
  • Project README lists Windows 10/11, Bluetooth LE, an LX-D02 printer and Go 1.25+ to build.
  • REA's stated role was readiness/device discovery and investigation framing; hermes-dec handled Hermes v98.
  • Hardware behavior and author-reported results were not reproduced here.

Primary evidence · Source reviewed: · Entry link

Binwalk

Identifies embedded formats and optionally extracts their contents, with entropy analysis for firmware triage.

Tool · Foundation tool · Firmware

Requirements and limits
  • The current v3 implementation is Rust-based; extraction needs the appropriate external tools or the documented container environment.

Primary evidence · Source reviewed: · Entry link

unblob

Recursively extracts archives and filesystems from binary blobs while reporting chunk boundaries and unknown regions.

Tool · Foundation tool · Firmware

Requirements and limits
  • Python package plus external extractors, or the bundled Docker image; check the project's dependency inventory for the formats needed.

Primary evidence · Source reviewed: · Entry link

Ghidra Firmware Utilities

Ghidra loaders and helpers for PCI option ROMs, UEFI firmware volumes, Intel flash descriptors and coreboot images.

Tool · Foundation tool · Firmware

Requirements and limits
  • The reviewed build instructions require Ghidra 12.0+ and JDK 21+; build against the same Ghidra/JRE environment used for analysis.

Primary evidence · Source reviewed: · Entry link

EMBA

Extract firmware, combine static checks with emulation-based analysis, inventory software components, and generate web reports and SBOMs for further investigation.

Tool · Foundation tool · Firmware

Requirements and limits
  • Upstream recommends an x86-64 Kali Linux VM and the default Docker mode; Ubuntu 22.04/24.04 is also listed. Native ARM execution is not supported.
  • Documented resource guidance is at least 16 GB RAM, 8 CPU cores recommended, and 30–100 GB free disk space; larger firmware or more parallel workers need more resources.
  • Install the external dependencies through the project installer. Emulation can execute firmware content; upstream reserves developer mode for development, and findings still require interpretation.

Primary evidence · Source reviewed: · Entry link

Firmware Analysis and Comparison Tool (FACT)

Unpack and analyze firmware through an extensible platform whose web interface and HTTP API make component contents and analysis results searchable and comparable across samples.

Tool · Foundation tool · Firmware

Requirements and limits
  • The reviewed installer supports Debian 13 and Ubuntu 22.04/24.04/26.04; Kali support is experimental. The README lists Python 3.10–3.14.
  • Minimum documented resources are 4 CPU cores, 8 GB RAM, and about 10 GB for installation, plus storage for unpacked firmware and results.
  • The standalone FACT_docker distribution is marked unmaintained; use the documented local or Vagrant setup. Some analysis plugins have separate licenses.

Primary evidence · Source reviewed: · Entry link

OFRAK

Recursively identify, unpack, analyze, modify, and repack firmware and binary formats using a resource-tree GUI and Python API, with optional disassembler backends.

Tool · Foundation tool · Binary, Firmware

Requirements and limits
  • The PyPI installation guide requires Python 3.9+ and format-specific external tools; macOS also needs cmake and libmagic, avoiding the documented libmagic 5.47 regression.
  • Docker builds require BuildKit; Docker 23+ enables it by default. Analysis backends such as Ghidra or Binary Ninja have their own installation and licensing requirements.
  • OFRAK uses its own Community License for personal and educational use; commercial users should review the separate Pro or Enterprise licensing terms.

Primary evidence · Source reviewed: · Entry link

FirmAE

Emulate router and IP-camera firmware to inspect network services and runtime behavior, with automated emulation checks and separate analysis, run, and debugging modes.

Tool · Foundation tool · Firmware

Requirements and limits
  • The README documents Ubuntu 20.04 as the tested host; prepare the recursive source checkout, downloaded dependencies, initialized database, and a supported firmware image.
  • The installer configures QEMU, PostgreSQL, extraction tools, and other host packages; documented run modes require elevated privileges. Docker orchestration is also provided.
  • Successful emulation depends on the firmware image; upstream benchmark results are not a guarantee for an untested device or newer host distribution.

Primary evidence · Source reviewed: · Entry link

Agents and MCP

REA — Reverse Engineer Anything

The upstream CLI and MCP server for evidence-based investigations of shipped software and runtime behavior.

Project · Official REA project · App, Binary, Firmware, Game, Website

Requirements and limits
  • rea-agents 6.5.0 was the published npm version at review time.
  • Node.js ^22.19.0 || ^24.11.0 || >=26.0.0; additional tools depend on the target.

Primary evidence · Source reviewed: · Entry link

Official reverse-engineer-anything skill

Target routing, connection recovery and evidence practices for agents using REA.

Integration · Official REA skill · App, Binary, Firmware, Game, Website

Requirements and limits
  • Installing the skill provides instructions; it does not by itself register MCP or install analysis engines.
  • Use the connected server's actual tool schemas; repository main may be ahead of an installed release.

Primary evidence · Source reviewed: · Entry link

dsh-mcp-rea

A community MCP bridge presents a smaller selected tool surface and forwards explicit commands to the REA CLI.

Integration · Community REA integration · App, Binary, Firmware, Game, Website

Requirements and limits
  • Requires REA and the relevant analysis providers; distributed as a local bundle rather than a public npm package.
  • Use the documented REA_ENTRY mode for direct execution; PATH fallback invokes a shell.
  • Its README's provider/platform claims may lag upstream; no installation or security audit was performed.

Primary evidence · Source reviewed: · Entry link

rea-jev

A Claude Code plugin adds Jev-based routing and evidence checks around a pinned REA MCP integration.

Integration · Community REA integration · App, Website

Requirements and limits
  • Claude Code, supported Node.js and the plugin's documented macOS/Linux environment.
  • Optional Jev service credentials enable external model calls; excerpts may be sent to that service.
  • Hooks fail open on provider failure; they are not a security guarantee.

Primary evidence · Source reviewed: · Entry link

rea-casebook

A Claude Code mod collects received REA Evidence, tracks unknowns and records findings that cite delivered evidence IDs.

Integration · Community REA integration · Binary

Requirements and limits
  • README requires Claude Code 2.1.296 or newer and an MCP server registered under the name rea.
  • Developed with REA 6.4.0 and Ghidra 12.1 on Windows; broader behavior was not tested here.
  • Evidence IDs being present does not itself prove a conclusion is correct.

Primary evidence · Source reviewed: · Entry link

Hex-Rays IDA MCP

Official Hex-Rays MCP server for agent access to IDA databases, with headless operation and optional GUI integration.

Integration · Independent agent integration · Binary

Requirements and limits
  • IDA 9.4+ with idalib, Python 3.11+, Git and uv; the GUI plugin is optional for headless use.

Primary evidence · Source reviewed: · Entry link

GhidraMCP

Ghidra extension and MCP bridge exposing decompilation, symbol navigation and renaming to agents, with GUI and headless modes.

Integration · Independent agent integration · Binary

Requirements and limits
  • Match the extension to the documented Ghidra release; Python 3.10+ for the bridge, with additional PyGhidra requirements for headless mode.

Primary evidence · Source reviewed: · Entry link

Binary Ninja MCP (official)

Binary Ninja's own MCP interface exposes functions, symbols, disassembly, intermediate languages and decompiled text to agents.

Integration · Independent agent integration · Binary

Requirements and limits
  • Reviewed in the development manual: use a build containing MCP. GUI server uses HTTP; headless stdio requires Commercial or Ultimate on macOS/Linux.

Primary evidence · Source reviewed: · Entry link

Binary Ninja MCP (fosdickio)

Community Binary Ninja plugin and bridge for MCP clients, including workflows that switch among multiple open binaries.

Integration · Independent agent integration · Binary

Requirements and limits
  • Binary Ninja, Python 3.12+ and an MCP client; install the plugin separately from the client bridge.

Primary evidence · Source reviewed: · Entry link

IDA Pro MCP (mrexodia)

Community IDA integration useful for existing setups and migration context; its maintainer now recommends the official Hex-Rays MCP server.

Integration · Independent agent integration · Binary

Requirements and limits
  • IDA Pro rather than IDA Free, Python 3.11+ and an MCP client; consult the upstream migration notice before choosing a new setup.

Primary evidence · Source reviewed: · Entry link

Radare2 MCP Server

Native radare2 MCP server offering binary-analysis tools, reusable sessions and configurable read-only access.

Integration · Independent agent integration · Binary

Requirements and limits
  • A compatible radare2 build and r2pm, plus an MCP client; advanced HTTP session features depend on the radare2 ABI.

Primary evidence · Source reviewed: · Entry link

r2ai

AI plugins inside radare2 for function explanations, naming suggestions and model-assisted decompilation using local or remote models.

Integration · Independent agent integration · Binary

Requirements and limits
  • radare2 with the matching r2ai/decai plugins; configure a local model or the credentials required by the selected remote provider.

Primary evidence · Source reviewed: · Entry link

DAILA

Decompiler-independent AI assistant for function summaries and naming across IDA, Ghidra, Binary Ninja and angr-management.

Integration · Independent agent integration · Binary

Requirements and limits
  • A supported decompiler and dailalib; configure a model backend. Ghidra requires the documented PyGhidra setup.

Primary evidence · Source reviewed: · Entry link

RevEng.AI Ghidra Plugin

Connects Ghidra to RevEng.AI for function similarity, recovered names, AI explanations and agent-assisted annotation.

Integration · Independent agent integration · Binary

Requirements and limits
  • A compatible Ghidra/Java build and a RevEng.AI API key; creating service-side analysis uploads the selected binary.

Primary evidence · Source reviewed: · Entry link

LLDB MCP

LLDB's official MCP interface gives agents debugger sessions and commands for breakpoints, memory inspection and stepping.

Integration · Independent agent integration · App, Binary

Requirements and limits
  • An LLDB distribution/build containing lldb-mcp and a compatible stdio MCP client; debug-target access follows the host platform's requirements.

Primary evidence · Source reviewed: · Entry link

Claude Reverse Engineering Skill

Community agent skill for triage, headless exports and evidence-based RE reports; explicitly documents workflows with REA and other MCP servers.

Integration · Independent agent integration · App, Binary

Requirements and limits
  • An Agent Skills-compatible client and Python 3.8+ for bundled scripts; analysis engines and MCP servers are configured separately.

Primary evidence · Source reviewed: · Entry link

SpecterOps Reverse Engineering Skills

Focused Binary Ninja and Ghidra analysis skills that describe MCP tool use, analysis recipes and annotation practices.

Integration · Independent agent integration · Binary

Requirements and limits
  • Configure the chosen Binary Ninja or Ghidra MCP integration separately; the skill package does not install or wrap those servers.

Primary evidence · Source reviewed: · Entry link

References and Learning

Installation and client setup

Reviewed setup plans, client registration, provider prerequisites and scoped readiness checks.

Documentation · Official REA documentation · App, Binary, Firmware, Game, Website

Requirements and limits
  • Supported Node.js and npm.
  • Setup previews client configuration changes; native engines have separate prerequisites.

Primary evidence · Source reviewed: · Entry link

CLI and Evidence

CLI workflows for saving Evidence and projecting smaller views from completed analysis.

Documentation · Official REA documentation · App, Binary, Firmware, Game, Website

Requirements and limits
  • Installed REA CLI or an explicitly pinned package runner.
  • CLI processes are separate; retain result files for later operations.

Primary evidence · Source reviewed: · Entry link

MCP contracts and generated catalog

Canonical tool contracts, provider discovery and Evidence semantics for integration authors.

Documentation · Official REA documentation · App, Binary, Firmware, Game, Website

Requirements and limits
  • A compatible MCP client for live use.
  • Discover the live catalog before relying on tools documented on main.

Primary evidence · Source reviewed: · Entry link

Native binary investigation

Locate a function, inspect instructions and pseudocode, and follow references with a selected native provider.

Documentation · Official REA documentation · Binary, Game

Requirements and limits
  • A target binary and a configured supported provider such as Ghidra, Hopper or IDA.
  • Host, architecture and provider support are scoped separately; pseudocode is not original source.

Primary evidence · Source reviewed: · Entry link

Cross-layer JavaScript application workflows

Trace features and compare authenticated JavaScript application graphs while preserving static-analysis limits.

Documentation · Official REA documentation · App, Website

Requirements and limits
  • Evidence from analyze_javascript_application or supported runtime reconciliation.
  • No native engine is required for the static JavaScript path; keep the complete parent Evidence.

Primary evidence · Source reviewed: · Entry link

Static Android APK analysis

Inspect Android package identity, classes, methods and references through REA's JADX integration.

Documentation · Official REA documentation · App

Requirements and limits
  • Full JDK 17 or newer and caller-supplied jadx-headless-mcp 0.7.1 with the documented digest check.
  • Linux requires a procps-compatible ps for provider process ownership.

Primary evidence · Source reviewed: · Entry link

Managed-code analysis

Read PE/CLI metadata and CIL, compare managed members and inspect declared native boundaries without loading the assembly.

Documentation · Official REA documentation · App

Requirements and limits
  • A supported PE/CLI assembly; no native engine is required for metadata/CIL inspection.
  • NativeAOT, IL2CPP and packaged single-file deployments have different boundaries.

Primary evidence · Source reviewed: · Entry link

Historical web network captures

Inspect saved web captures offline; recorded URLs are not fetched and no proxy is started.

Documentation · Official REA documentation · App, Website

Requirements and limits
  • A supported existing capture and an explicit format selection.
  • PCAP/TShark workflows are separate and have different host/tool requirements.

Primary evidence · Source reviewed: · Entry link

Firmware analysis

Inspect firmware regions with Binwalk and explicitly extract with Unblob, retaining tool and artifact identity.

Documentation · Official REA documentation · Firmware

Requirements and limits
  • Caller-supplied Binwalk 3.1.x for inspection; Unblob 26.6.x for extraction.
  • The documented verification scope is Linux x64; extraction needs a new caller-selected output directory.

Primary evidence · Source reviewed: · Entry link

Browser observation guide

Follow a user-triggered export request in the supplied Notes browser example and connect it to the downloaded result.

Documentation · Official REA guide · Website

Requirements and limits
  • A user-owned Chrome-family browser, loopback CDP connection and explicitly allowed origins.
  • The recorded upstream example used a separate controller to click; REA did not perform the click.

Primary evidence · Source reviewed: · Entry link

JavaScript and Electron: follow a CSV export

A source-owned Notes fixture teaches the renderer, preload, IPC and CSV path with linked analysis evidence.

Documentation · Official REA guide · App

Requirements and limits
  • Supported Node.js and REA; no native engine is required for this static fixture.
  • The fixture is source-owned teaching material, not an installed Electron distribution; static findings do not prove execution.

Primary evidence · Source reviewed: · Entry link

rea-playbook

An Electron practice target, Evidence extractor and MCP probe; offline fixture mode is distinguished from real REA analysis.

Learning resource · Community REA learning resource · App

Requirements and limits
  • README pins the real-analysis path to rea-agents 6.3.0 and lists supported Node.js versions.
  • The offline demo reads bundled results without running REA; its tests were not rerun here.

Primary evidence · Source reviewed: · Entry link

rea-lab

A Windows REA/Ghidra lab with seeded challenges, published studies, upstream contributions and recorded limitations.

Research · Community REA learning resource · Binary

Requirements and limits
  • The documented environment uses Windows 11, REA 6.4.0 and Ghidra 12.1.4.
  • Study results are author-reported and task/model-specific, not independently reproduced by this index.
  • Code and documentation use different licenses; inspect the relevant repository notices.

Primary evidence · Source reviewed: · Entry link

OpenSecurityTraining2

Free self-paced security courses with learning paths for reverse engineering, firmware and systems foundations.

Learning resource · Learning resource · Binary

Requirements and limits
  • Browser access; choose classes according to their published prerequisites and lab requirements.

Primary evidence · Source reviewed: · Entry link

pwn.college: Reverse Engineering

Hands-on reverse-engineering module covering functions, data access, static tools and dynamic tools with hosted exercises.

Learning resource · Learning resource · Binary

Requirements and limits
  • Browser access and the platform's account/environment setup for interactive challenges.

Primary evidence · Source reviewed: · Entry link

Reverse Engineering for Beginners

Dennis Yurichev's free book on understanding compiled programs and assembly, available in multiple languages.

Learning resource · Learning resource · Binary

Requirements and limits
  • A browser or PDF reader; use the toolchains relevant to the exercises being followed.

Primary evidence · Source reviewed: · Entry link

The Official Radare2 Book

Official practical reference for radare2 analysis, disassembly, scripting, debugging and related plugins.

Learning resource · Learning resource · Binary

Requirements and limits
  • Upstream lists radare2 5.8.x as the minimum and recommends a current release for following the examples.

Primary evidence · Source reviewed: · Entry link

LLM4Decompile (EMNLP 2024)

Research on direct binary decompilation and refinement of Ghidra output with language models. Evaluates re-executability on HumanEval and ExeBench; useful for distinguishing readable output from functional recovery.

Research · Learning resource · Binary

Requirements and limits
  • EMNLP 2024 paper. Results are author-reported for the evaluated models and benchmarks; this collection has not reproduced them.

Primary evidence · Source reviewed: · Entry link

DecompileBench (Findings of ACL 2025)

A benchmark combining functions from real programs, runtime-aware validation, and LLM-assisted assessment of decompiled-code usability. Helps separate functional correctness from perceived understandability when comparing decompilers.

Research · Learning resource · Binary

Requirements and limits
  • Findings of ACL 2025 paper. LLM-as-judge assessments and runtime correctness measure different properties; published results are not independent reproductions by this collection.

Primary evidence · Source reviewed: · Entry link

ReSym (CCS 2024)

Combines language models and program analysis to recover variable and user-defined data-structure symbols from stripped binaries. The authors provide training, inference, evaluation, and posterior-reasoning artifacts.

Research · Learning resource · Binary

Requirements and limits
  • CCS 2024 paper with author-provided artifacts. Symbol and type recovery is a narrower task than reconstructing an entire original program; artifacts were not executed for this listing.

Primary evidence · Source reviewed: · Entry link