REVERSE ENGINEERING WITH REA

About this book

REVERSE ENGINEERING WITH REA is an evidence-centered guide to using AI-assisted tooling for authorized software investigation without confusing fluent explanations, decompiler output, or reconstructed code with proof. The book treats REA as evidence-access infrastructure that can connect an AI agent to bounded analysis operations, while keeping the analyst responsible for scope, authorization, interpretation, uncertainty and publication. It begins by distinguishing what REA can actually observe from what an agent merely infers, then establishes professional boundaries for lawful possession, inspection, runtime experimentation, evidence retention, independent implementation and public release. The recurring principle is simple: technical capability does not itself create permission, and a strong reverse-engineering conclusion must be traceable to authentic evidence rather than to a plausible narrative.

The workstation and tooling chapters turn setup into part of the experiment. Instead of assuming that a successful installer means the analysis stack is ready, the book separates runtime compatibility, agent registration, provider readiness and a genuine evidence-producing response. It covers reproducible host records, package and provider versions, hashes, least-privilege working directories, read-only originals, REA CLI and MCP concepts, and the need to distinguish a workflow skill from a live analysis provider. The text emphasizes that failures and blocked capabilities belong in the research record: an unavailable provider, incompatible runtime or missing capture must be documented as an unavailable lane rather than replaced by invented output.

The investigation methodology moves from question framing and artifact triage into native binaries, assembly, linking, disassembly, decompilation, data flow and structure recovery. Decompiler output is treated explicitly as a hypothesis constrained by architecture, inferred types and incomplete information—not as recovered source code. Readers are taught to cross-check pseudocode against lower-level evidence, use boundary tests to resolve ambiguities, preserve uncertainty when multiple interpretations fit the same bytes, and reconstruct behavior from tested contracts rather than from cosmetic resemblance to decompiled expressions. Native examples are complemented by JavaScript application graphs, Electron process boundaries, browser behavior, network and HAR evidence, Android APK analysis with JADX, .NET assemblies, managed and hybrid boundaries, saved captures, firmware, WebAssembly and packaged-program metadata.

A major part of the book is devoted to reconstruction rather than simple inspection. Findings are converted into explicit behavior specifications describing input domains, outputs, errors, state transitions, persistence, side effects, timing assumptions and known unknowns. The book then shows how an independently written implementation should be judged against that lawful, evidence-supported contract through acceptance tests, differential testing and edge cases. Visual similarity is deliberately separated from functional equivalence, and unexplained behavior remains an open requirement instead of being filled in by guesswork. Where separation from protected implementation details matters, the book advocates a clean behavioral-specification workflow so that implementation can be based on permitted observations rather than copied internals.

AI-agent reliability is treated as its own research problem. The book examines failure modes such as hallucinated commands, wrong-file selection, unsupported-provider claims, loss of important limitations during summarization, confusion between simulated and genuine results, and instruction-looking strings recovered from untrusted artifacts. Tool results, logs, comments, HTML and embedded strings remain lower-trust data; they cannot promote themselves into operational authority. Important conclusions are expected to cite the evidence record that supports them, and actions with filesystem, process, credential, browser-profile or network effects require explicit authorization. Honest uncertainty and a documented failed tool call are treated as stronger engineering than a polished but invented success.

The final chapters assemble the method into a complete professional REA investigation project. A capstone begins with a bounded research question, explicit authority, immutable artifact identity and a reproducible environment; it proceeds through evidence collection, claim-to-evidence mapping, a behavior contract, an independently written implementation and a declared differential test suite. The deliverable is not merely a working clone or demo video but an auditable package containing permission records, hashes, workstation and toolchain details, raw captures, hypotheses, verified figures, tests, contradictions, limitations, redaction decisions and publication rights. The resulting workflow makes reverse engineering useful for education, debugging, interoperability and responsible software research while keeping evidence quality, reproducibility and professional restraint at the center.

What you will learn

• Distinguish evidence produced by an analysis tool from an AI agent's interpretation so that fluent output is never mistaken for proof.
• Define authorization separately for inspection, execution, capture, retention, reconstruction and publication before beginning a reverse-engineering investigation.
• Build a reproducible REA workstation by recording runtime, operating system, package, provider, permission and artifact versions rather than relying on the word latest.
• Understand the difference between an agent workflow, MCP registration, provider readiness and a genuine evidence-producing analysis response.
• Frame a reverse-engineering project around the smallest important behavioral question and select only the analysis capability needed to answer it.
• Perform artifact triage and maintain hashes, read-only originals, evidence directories, manifests and a chain of custody for research inputs and outputs.
• Read assembly, disassembly and decompiler output with explicit uncertainty, cross-checking recovered high-level expressions against lower-level evidence and boundary tests.
• Treat decompiled pseudocode as a testable hypothesis rather than as recovered original source code.
• Trace native data flow and structures while keeping inferred types, compiler transformations and hidden assumptions visible in the evidence record.
• Investigate JavaScript, Electron and browser applications by separating module graphs, process boundaries, runtime behavior and captured network evidence.
• Approach Android APK, JADX, .NET, managed and hybrid applications through artifact-appropriate evidence instead of forcing one reverse-engineering model onto every platform.
• Use controlled runtime experiments, saved captures, firmware and WebAssembly metadata only within a documented authorization and isolation boundary.
• Translate findings into a behavioral specification with explicit inputs, outputs, state transitions, failures, side effects, limits and unresolved questions.
• Build an independent implementation from a lawful behavior contract and validate it with acceptance tests, differential testing and edge cases rather than visual resemblance.
• Preserve contradictions and rejected hypotheses in the investigation record instead of silently rewriting the explanation around the final result.
• Recognize AI-agent failure modes including hallucinated commands, wrong-provider selection, simulated-result confusion and instruction-looking content recovered from untrusted artifacts.
• Keep artifact strings, comments, logs and HTML at a lower trust level than analyst instructions, requiring explicit approval for consequential filesystem, process or network actions.
• Package a complete REA investigation with permission statements, artifact hashes, toolchain records, raw evidence, claim mappings, implementation, tests, limitations and publication decisions.
• Evaluate success by evidence coverage, reproducibility, functional testing and restraint rather than by whether the final reconstruction merely looks convincing.

Key topics

• REA reverse engineering
• AI-assisted software analysis
• Responsible reverse engineering
• Evidence-based reconstruction
• Software investigation
• Binary analysis
• Authorized analysis
• Research scope and permission
• Evidence provenance
• Reproducible reverse engineering
• REA CLI
• MCP tool workflows
• AI coding agents
• Analysis providers
• Provider readiness
• Host environment reproducibility
• Artifact hashing
• Chain of custody
• Least-privilege analysis
• Artifact triage
• Assembly
• Execution model
• Binary structure
• Program linking
• Disassembly
• Decompilation
• Decompiler uncertainty
• Data-flow recovery
• Structure recovery
• Native binary analysis
• JavaScript application graphs
• Electron applications
• Browser behavior analysis
• HAR evidence
• Network capture evidence
• Android APK analysis
• JADX
• .NET assemblies
• Managed applications
• Hybrid applications
• Runtime experiments
• Saved analysis captures
• Firmware analysis
• WebAssembly
• Packaged programs
• Specialized metadata
• Behavior specifications
• Independent implementation
• Clean-room reconstruction
• Acceptance testing
• Differential testing
• Edge-case testing
• Evidence contradictions
• AI-agent failure modes
• Prompt injection from artifacts
• Tool-result verification
• Claim-to-evidence mapping
• Research reproducibility
• Reverse-engineering case studies
• Technical reporting
• Versioning
• Professional portfolio

Who this book is for

For software engineers, reverse engineers, AI-assisted development practitioners, security and interoperability researchers, technical investigators, students of binary analysis, and developers who want to use REA-style agent workflows while maintaining clear authorization, evidence provenance, reproducibility, independent validation and responsible publication practices.