THE REA TOOL / INDEPENDENT PRACTICAL GUIDES
REA: Reverse Engineer Anything
Understand how software works. Rebuild the feature you need.
Learn REA with guided investigations, interactive examples and tested code.
WITH CLAUDE CODE · CODEX · CURSOR
REA QUICK START
One prompt. Let your AI install REA.
Paste it into Claude Code, Codex or Cursor. Let your agent handle the setup.
- Copy the prompt
Everything your agent needs to get started.
- Send it to your coding agent
Review and approve the setup it proposes.
- Restart, then verify
Restart when prompted, then ask your agent to check the REA connection.
Install REA for this coding agent using npx rea-agents@latest setup. Show me the proposed configuration changes before applying them. Then tell me how to restart and verify the connection. My first target will be a local JavaScript package.THE TOOL BEHIND THE INVESTIGATIONS
What is REA?
REA (Reverse Engineer Anything) connects your coding agent to tools for investigating apps, binaries and websites. Your agent calls REA through MCP to inspect code and trace a feature, then uses the evidence to explain it or build and test a version for your project.
Start with one question: where does an export go, how is a login code calculated, or why does a game speed up? These independent guides help you follow the evidence and check the result. Recovering one rule does not establish that a whole app has been rebuilt.
FOUR NEW INVESTIGATIONS / HANDS ON
Play it. Then find out why.
Give the dinosaur a speed dial.
Change the pace. Jump the obstacle. Catch a surprising edge case.
Play & investigate ↗Make a bullet ring aim at you.
Move the player. Fire a ring. Decode the angles behind the pattern.
Play & investigate ↗Hear a 1990s game’s hidden math.
Move a brick from left to right. Hear the rule you are recovering.
Play & investigate ↗Find out what the % key really does.
Press % and watch the operand change before you hit equals.
Play & investigate ↗START WITH A FEATURE YOU WANT TO UNDERSTAND
Small questions. Real discoveries.
Rebuild an authenticator’s
30-second code.
Find the rule inside an APK. Move time forward. Watch the code change.
Open the Aegis walkthrough ↗How does Notion
copy rich text?
Trace one copy action from the editor, across processes, into the clipboard.
Follow the clipboard path ↗What really triggers
“File too large”?
Turn an error message into a function, a condition, and a boundary test.
Investigate the size check ↗TRY THE RESULT BEFORE YOU READ THE GUIDE
One second later.
A different code.
An authenticator turns time into a counter, then a six-digit code. Drag the clock across 60 seconds and see the rule for yourself.
- Locate the method in the APK.Follow the timestamp input through its calls.
- Rebuild just the calculation.Counter → HMAC → six digits.
- Test it against known answers.Check time boundaries and leading zeroes.
Based on the official Aegis investigation. This independently written demo uses public test data; the guide explains exactly what was verified.
PUBLIC TEST KEY · SHA-1 · 6 DIGITS
Unix time 59s Counter 1
59 ÷ 30 → counter 1. At 60 seconds, the counter becomes 2.
New teaching implementation using RFC 6238’s public test key. No account secrets. No REA calls in your browser.
GO BEYOND THE FIRST PROMPT
Bring a question. Leave with a method.
Where does this APK send its requests?
Find the networking code in an Android package, follow its callers, and distinguish an endpoint candidate from an observed request.
What happens after you click Export?
Observe one browser action, identify its network request, and discover when a file is generated entirely in the page.
An update broke your workflow. What changed?
Compare two Electron releases, narrow the investigation to one feature and turn the suspected change into a regression test.
NEW TO REA?
Start here. Then go deeper.
Connect your coding agent
Install REA, choose your client and check the connection.
Installation guide →Find an app’s export folder
Trace a sample app’s button through its bridge to a CSV file.
Your first investigation →Why is “!” still in my URL?
Read the actual package code and verify the option that fixes it.
A small worked example →