cabbit
@cabbitar • 1,207 subscribers
posting insights from my personal experience only | @zscdao member
Shorts
![this is getting really dangerous... REA creator posted 20 GitHub repos to build a whole reverse engineering studio: [01] analysis core > REA: a single MCP that plugs into everything > Ghidra: decompiler, free > GhidraMCP: lets your agent drive Ghidra > ida-pro-mcp: hooks your agent into IDA Pro [02] mobile & apps > jadx: turns Android APKs back into Java > Apktool: take APKs apart and put them back together > Frida: hook into apps while they run > ILSpy: decompiles .NET [03] binary & low-level > radare2: RE framework that lives in your terminal > x64dbg: debugger for Windows > ImHex: hex editor with its own pattern language > angr: symbolic execution engine [04] network & runtime > mitmproxy: sits in the middle and reads the traffic > dnSpy: debug and edit .NET apps > rizin: the radare2 fork > raddebugger: the debugger from Epic Games [05] rebuild & verify > awesome-ai-reverse-engineering: 122 repos, every one graded > awesome-reverse-engineering: curated by the guy who made REA > REA workflows: ready-made investigation prompts, ship with REA > clean-room loop: SPEC.md, oracles and checks until it matches how it runs: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry save this, point it at any app and watch it explain itself, then read the full guide below:](https://image.24vids.com/tw-2117301123354620098/amplify_video_thumb/2117301088588083200/img/RkoS5sMpF5AA_xVi.jpg)
this is getting really dangerous... REA creator posted 20 GitHub repos to build a whole reverse engineering studio: [01] analysis core > REA: a single MCP that plugs into everything > Ghidra: decompiler, free > GhidraMCP: lets your agent drive Ghidra > ida-pro-mcp: hooks your agent into IDA Pro [02] mobile & apps > jadx: turns Android APKs back into Java > Apktool: take APKs apart and put them back together > Frida: hook into apps while they run > ILSpy: decompiles .NET [03] binary & low-level > radare2: RE framework that lives in your terminal > x64dbg: debugger for Windows > ImHex: hex editor with its own pattern language > angr: symbolic execution engine [04] network & runtime > mitmproxy: sits in the middle and reads the traffic > dnSpy: debug and edit .NET apps > rizin: the radare2 fork > raddebugger: the debugger from Epic Games [05] rebuild & verify > awesome-ai-reverse-engineering: 122 repos, every one graded > awesome-reverse-engineering: curated by the guy who made REA > REA workflows: ready-made investigation prompts, ship with REA > clean-room loop: SPEC.md, oracles and checks until it matches how it runs: binary -> REA -> SPEC.md -> rebuild -> oracle -> retry save this, point it at any app and watch it explain itself, then read the full guide below:
65,202 views
holy f*ck, someone just dropped an entire reverse engineering degree on GitHub for free. Now you can build agents that can reverse engineer almost anything: 1. Ghidra How to read any binary. The NSA’s reverse engineering framework. Where almost everyone starts. 2. radare2 The same skill, but in the terminal. UNIX-style reverse engineering framework and command-line toolset. 3. LLM4Decompile An LLM that decompiles. Turns binary code into readable C. The 9B v2 model hits 64.9% re-executability on its own benchmark. 4. r2ai An LLM inside radare2. LLM-powered reversing for radare2. This is where AI starts reading the binary with you. 5. ida-pro-mcp Let the agent drive the tool. Bridges IDA Pro to language models through MCP. 6. reverse-engineering-assistant The same thing for Ghidra. An MCP server for reverse engineering tasks inside Ghidra. 7. REA Agents that reverse engineer anything. 35 target types: native binaries, APKs, firmware, websites, Electron apps, and more. Every finding is backed by evidence. Read the full REA guide below ↓
20,375 views