🔍 Read the full analysis: From New Codebase To Useful Map: An AI-Assisted Guide on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A guide published by ThorstenMeyerAI.com on October 19 describes how the open-source tool Reverse Engineer Anything (REA) helps coding agents inspect existing software. It presents five investigations, including a QuickBooks case study, while warning that agent conclusions need verification and that the tool is not a security sandbox.
ThorstenMeyerAI.com published a guide on October 19 to using the open-source Reverse Engineer Anything (REA) project with AI coding agents to inspect existing software and document how specific features work. The report says a developer used REA to study QuickBooks Desktop and build a local accounting application whose financial statements matched the original program’s figures for Intuit’s sample company, offering a concrete example of how software investigation can inform new development.
REA is an MIT-licensed project on GitHub that connects tools for program analysis to agents including Claude Code, Codex, Cursor and Gemini CLI. The guide describes three components: a local MCP server, a command-line utility for setup and analysis, and an agent skill that lays out an investigation process. Its listed analysis targets include native applications, Electron and JavaScript software, .NET and Android apps, firmware, saved network traffic, WebAssembly, SQLite databases and older DOS programs.
The guide recommends starting with a specific behavior and a decision, rather than asking an agent to explain an entire application. For example, a developer might ask how a partial invoice payment changes the remaining balance and which account receives the posting. The agent should report stored data, calculations and conditions that affect the result, while marking findings as observed, inferred or unknown. A concrete example with inputs and outputs is presented as a check that the investigation has reached the underlying mechanism rather than just describing a screen.
The published QuickBooks example focused on inventory arithmetic, budget signs, reconciliation balances and cash-basis reporting. The guide says the developer examined QuickBooks Desktop for Mac 2024 using REA 6.4.0 and Ghidra, then compared the resulting local app’s profit-and-loss statement, balance sheet and trial balance with Intuit’s official sample company. The source reports account-by-account agreement to the cent; that result is an account by the author, not an independent evaluation presented in the supplied material.
Infographic 01 · Reverse Engineer Anything
Five places to point REA first, and how to tell when the answer is wrong.
REA gives coding agents such as Claude Code and Codex tools to inspect programs, apps and browser sessions. Each investigation needs a finishable question and a check.
npx rea-agents@latest setupThe five investigations
What to ask, and the check that catches a wrong answer.
- 1
Ask a question you can finish
One behaviour, one decision it informs. Example: how a partial payment changes an invoice balance.
It’s wrong ifThe agent can't walk through one concrete example with real inputs and outputs. - 2
Get REA connected and confirmed
Run the guided setup, then doctor, then call binary_session inside the agent before any real target.
It’s wrong ifAnswers arrive without a single REA tool call: you're reading the model's guesses. - 3
Turn a business rule into a spec
Inputs, stored fields, formula, edge cases, plus test cases checked against the original's own output.
It’s wrong ifYour version and the original disagree on a test case, even by one cent. - 4
See what has to survive a copy
Find what an app writes to the clipboard and what it keeps locally, then design your own copy and paste.
It’s wrong ifThe explanation doesn't predict what lands in a plain text editor, an email and your app. - 5
Your own app, your equipment, an old program
Start with software you own or rely on. Ask what it sends, stores or calculates when you do one thing.
It’s wrong ifIt only works for the example you watched. Test with a new file or a read-only command first.
Sources: REA on GitHub (stars via GitHub API, 19 Oct 2026); REA installation guide; REA security policy.
Powered by Thorsten Meyer AI
From Software Behavior to Buildable Rules
For developers recreating a workflow or replacing legacy software, visible features do not specify the rules behind them. A screen can show a balance without revealing which records produce it, how a partial payment is handled or which reporting branch applies. The guide’s central point is that these behaviors need to be investigated and written down before an agent can reliably help implement them.
The QuickBooks example matters because it frames reverse engineering as a way to understand business logic, not simply reproduce an interface. If the reported comparison is accurate, matching the sample company’s statements suggests the new app captured important accounting behavior for that test. It does not establish that the app is equivalent across all QuickBooks data, workflows or edge cases. The distinction is important for anyone considering an AI-assisted replacement for software that handles financial or operational records.
The process also puts verification responsibility on the developer. An AI agent can produce a confident explanation based on incomplete evidence or its own prior knowledge. The guide advises checking that REA tools were actually called and asking for a complete, traceable example. This makes the report relevant beyond reverse engineering: it illustrates a way to separate tool observations from model interpretation when using coding agents to investigate unfamiliar systems.
Popular right now
Roborock Q7 M5+ Robot Vacuum and Mop
Roborock Q7 L5 Robot Vacuum and Mop Combo
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How REA Connects Agents to Analysis
The guide describes REA as a local analysis setup rather than a hosted service. Its report says that, as of October 19, the project had about 325,000 GitHub stars and 82,000 forks, following a run on GitHub’s trending page in early October. Those figures are a dated snapshot supplied by the source, not a measure of accuracy or adoption in production. Version 6.7.0 was released October 18, according to the article.
Setup is described as a guided command that detects supported agents, with Node.js 22.19 or newer required. Native-program analysis may also require a disassembler such as Ghidra, which requires Java, or a licensed tool such as Hopper or IDA. The guide recommends restarting the agent after setup and checking prerequisites with REA’s doctor command. It cautions that this check does not confirm the live agent connection; developers should separately verify that the agent can call an REA tool before relying on its answers.
That distinction matters because an agent can respond from its general model knowledge even when the analysis tool is not connected. The guide suggests asking the agent to call REA’s binary-session tool before opening a target, then testing with a harmless application the user owns. If the agent answers questions about a target without invoking REA, the source says its response may be a guess rather than an observation from the program.
“This is not a sandbox.”
— REA project documentation, as quoted in the guide
Limits of the Published Evidence
The supplied article describes the QuickBooks comparison but does not provide an independent replication, a full test suite or enough detail to establish how the local app performs across other companies, versions or accounting scenarios. The reported match for Intuit’s sample company is a specific result under a described test, not proof of complete compatibility or correctness in general.
It is also unclear from the supplied material how REA’s analysis performs across every supported software type, how often its findings require manual correction, or what limits apply to particular tools. The guide says analysis happens locally, but adds that results are sent to the AI agent and its model provider, subject to that provider’s data policy. Users therefore need to assess the sensitivity of both the target and the information passed to their chosen model. The source also identifies the project maintainer as anonymous; it does not provide further information about project governance or support.
Verify Tools Before Investigating
The guide’s recommended next step is to confirm that REA is installed and reachable before beginning a substantive investigation. Developers can use its setup and diagnostic tools, then check from inside the agent that an REA function is available. A first test should use a program they own and consider safe to inspect, rather than an unknown binary or sensitive production application.
For each investigation, the source advises defining one behavior, stating the development decision it will inform and asking the agent to show the evidence behind its account. The next meaningful test of the QuickBooks example would be independent checks against additional transactions and edge cases; the supplied material does not say whether such testing has been completed. Until then, readers should treat the reported match as a case study and REA as an investigative aid, not a guarantee that an AI-built replacement is ready for accounting use.
Key Questions
What is Reverse Engineer Anything?
REA is an open-source software-analysis project that connects analysis tools to AI coding agents through a local MCP server. It also includes a command-line tool and an agent skill for guiding investigations.
What did the QuickBooks case study report?
The guide says a developer used REA 6.4.0 and Ghidra to investigate selected QuickBooks Desktop for Mac 2024 behaviors, then built a local accounting app. Its profit-and-loss statement, balance sheet and trial balance reportedly matched Intuit’s sample company account by account, to the cent. That is a result reported by the source, not an independent verification in the supplied material.
Does REA make an AI agent’s answer reliable by itself?
No. The guide recommends confirming that the agent actually called an REA tool and checking its explanation against a concrete example. It says findings should distinguish what was observed from what was inferred or remains unknown.
Is REA safe to use on an unknown program?
The project’s documentation warns that REA is not a sandbox. The guide says analysis tools run with the user’s permissions, so unknown binaries should be treated like other untrusted files. It also notes that results go to the model provider under that provider’s data policy.
Source: ThorstenMeyerAI.com
