Matt Van Horn@mvanhorn3h ago

📝 Reverse Engineer Anything: 40 to 229k GitHub stars in 12 days. WTF did people actually take apart? REA had about 40 stars on October 2nd, so I ran /last30days on the wave 13 times and kept the eight best things people actually took apart. I love this project and have had 8 PRs merged into it. 1. Find a bug in hardware you already own One of the biggest videos in the sweep was not about REA at all. Low Level's video on hacking the Dell S3422 monitor in the host's own office sat at 1,003,780 views and 16,037 likes when I pulled it. The host pointed an agent at the firmware through a Ghidra MCP server and let it lift the binary to pseudo-C. a hacking project that used to take me one or two days, maybe a week. I literally just did in 15 minutes with AI. This is starting to terrify me a little bit. Low Level, YouTube, 1,003,780 views This earned the top slot because the target is the most defensible one there is: a device in the researcher's own office, examined by a working vulnerability researcher. The skill did not go away. The week of grinding did. If you want the same bridge, GhidraMCP is the community default at 11,214 stars, and its README runs it with one line once Ghidra is up: ```bash uvx --from git+https://github.com/LaurieWired/GhidraMCP ghidra-mcp --transport streamable-http --mcp-host 127.0.0.1 --mcp-port 8081 --ghidra-server http://127.0.0.1:8080/ ``` 2. Ask how one feature works, and make the agent show its evidence This is what REA is actually for, and the best demos are small. Hyperautomation Labs had an agent study Obsidian's quick switcher, rebuild the ranking, and check it against the real app across 4,915 queries (16,627 views, 117 likes). Eric Tech went bigger and cloned Wispr Flow, the dictation app the creator uses every day, with REA driving Hopper for the binary work (69,053 views, 1,235 likes). My take: code is no longer the moat. Your brand and users are. Eric Tech, YouTube, 1,235 likes What I like about this pick is the shape of the question. Not "clone this app," which is where most of the hype lives, but "how does this one thing work, and prove it." Setup and the starter prompt are straight from the REA README: ```text Understand how search works in the Notes app, show me the evidence, and build a similar feature for my project. ``` ```text Decompile the release build in ./dist. List every hardcoded secret, endpoint, feature flag and license check you can recover, with the evidence for each. Do not run the binary. ``` Swap Notes for the app and the feature you care about. 3. Find out what your own build is leaking Rob Shocks built a Mac app with a hidden unlock code, stripped every name out of it, and watched the agent recover the rules from the compiled binary (323,910 views, 5,428 likes). It is the most honest REA demo in the set because the target was built for the test, and it lands the uncomfortable point: whatever ships in the binary is readable now. A team on r/AskProgramming did the defensive version on their own product and found API keys they thought they had removed (56 upvotes, 22 comments). The top reply is the right corrective. Honestly... that shouldn't have taken a fancy AI to find. Scanning the build result artifacts directory for some known keys is pretty easy. wrosecrans, Reddit, 30 upvotes Both are true. A grep catches the keys you know about. The agent catches the ones you forgot. This is my prompt, not theirs: 4. Replace the vendor app you hate for a device you own The most-liked post in the entire sweep was someone fixing their air conditioner. @icanberk reverse-engineered their AC and had an agent build a menu bar app so they could stop hunting for the remote (22,478 likes, 1,772,106 views). > [Embedded post on X](https://x.com/i/status/2109031477484937571) The method was in a reply: run the vendor's Android app in an emulator on their computer and have Codex inspect the network calls. No disassembler at all. That is the cheapest form of reverse engineering there is, and it is the one most people actually need. The Reddit version of the same itch: someone on r/ClaudeCode used Claude Code to reverse-engineer an LG TV and build a native Plex client for it (577 upvotes, 134 comments). Same genre, different gear: a Razer Synapse replacement built with REA (125 upvotes, 65 comments), and an open-source Android app that sends "Hey Meta" on Ray-Ban Meta glasses to Claude instead (68 upvotes). The Razer thread had the best pushback in the category, from someone who had already done it without any special tooling. Wrote a "SynapseLite" long ago myself with Claude and no plugins ... all it needed was to patch on CDP inside the Synapse ASAR to watch what commands it sends to the chip. privacyguy123, Reddit, 15 upvotes That is the honest read on this whole category. The tooling lowers the floor. A motivated person with a plain agent was already getting there. My prompt, built on that method: ```text This is the vendor app for a device I own, running in an emulator. Watch its network calls while I use it. Map the endpoints, message format, and the command behind each setting, with evidence for each. Then write a minimal replacement CLI. ``` 5. Decompile a whole game with an agent swarm The catalyst for the entire wave predates REA. Jaden Williams' video on agents mashing games together, Halo inside Modern Warfare 2, pulled 522,789 views and 28,785 likes, and the X post of it did bigger numbers still (39,594 likes, 2,036,251 views). It was a warning, not a celebration. The serious version of that story is momo5502's writeup, 500 billion tokens spent decompiling a first-person shooter. It hit 216 points on Hacker News, and the r/ReverseEngineering thread got 335 upvotes. In the final weeks it was 14 Luna and 2 Opus 5.5 agents. The end state: 99% of the game's functions present, 83% byte-exact. The part worth stealing is not the token count. It is what made the swarm converge. Reviewer agents kept accepting the workers' excuses, so the reviewers were replaced with a compiler-backed check. A simple PASS or FAIL signal would be enough and the agent can figure out on its own what's wrong. momo5502, blog, 216 points on Hacker News The bill is real. One HN commenter priced 500 billion tokens at $100,000 to $750,000 at API rates. The project also had earlier posts taken down. The recipe, as I read the writeup: ```bash npx rea-agents setup ``` 6. Mod or port a game you own The modding half of the wave has a clear origin. @rehan_shei packaged what Claude learned modding Terraria and Age of Empires into universal-modder, skills and tools that let Claude Code mod almost any game you own (14,348 likes, 3,829,604 views). > [Embedded post on X](https://x.com/i/status/2105161487509852622) The porting half is just as loud. The highest-voted Reddit thread in the sweep was r/pcgaming on dozens of AI-reverse-engineered games, GTA 5 to Modern Warfare 2, now playable in a browser (7,485 upvotes, 1,097 comments). The top comment was not about the tech. Ahh it's good when the companies themselves steal everything but used against them and it's suddenly bad, of course. Optimaldeath, Reddit, 3,812 upvotes The cleanest payload in the category came from a tiny post on X with 63 views. It is the whole technique in two sentences, and it is the author's wording, verbatim: ```text Make this game (folder path) run in the browser using wasm and webgpu. Use ghidra mcp if needed, and use rust and wgpu if you need any reverse engineering and recompilation to target a wasm binary. ``` Do this with games you own. 7. Give your agent IDA, the tool the pros already use While the consumer side went viral, the professional side moved quietly. Hex-Rays shipped an official IDA MCP server (384 likes on LinkedIn), free, open source and model-agnostic. The community version, ida-pro-mcp, sits at 12,829 stars. @Ryrenz's thread (261 likes) is the best plain-language map of what it exposes: decompile, disassemble, cross-references, types, even breakpoints and registers, plus a headless mode for batch work. > [Embedded post on X](https://x.com/i/status/2109903471470072278) This earned a slot because it is where people who did this for a living before September are actually going. The official install, per the Hex-Rays repo, needs IDA 9.4 or higher with idalib: ```bash uvx ida-hcli mcp install ``` 8. Check the agent's work against ground truth The best pick for anyone tempted to believe the hype had the smallest audience. Coding Crash Courses ran REA against Command & Conquer: Red Alert, then checked every claim against EA's GPL source release. Seven of eight were exactly right (2,126 views). Reverse engineering gives you the logic, not the source code. ```text For each conclusion, label it observed, inferred, or unknown, and cite the evidence. Then tell me the one experiment that would prove you wrong. ``` Coding Crash Courses, YouTube, 27 likes SoftsWeb did the runtime version: let REA map the Bruno API client statically, then launched the real app and watched it call the same servers the report had named (23,467 views). And the most useful counterpoint came from a 12-hour head-to-head on X (322 likes): same app, with and without REA, and plain Opus finished first. That is the right instinct to copy. Treat every finding as a claim until something independent agrees with it. My prompt: ```text Use the original compiler. After every function, compile it and byte-compare against the original. PASS or FAIL is the only review. Workers keep going until PASS. ``` The Adobe clones: the loudest story, and not what it looks like You cannot write about this week without them. ArtCraft shipped open-source Rust rebuilds of Adobe's suite: PhotoCraft for Photoshop, plus FilmCraft, LightCraft, VectorCraft and EffectCraft for Premiere, Lightroom, Illustrator and After Effects. A week later came Word, Excel, PowerPoint and AutoCAD clones. PhotoCraft alone had 58,799 stars when I checked tonight. The videos about them were the biggest things in the whole sweep, led by FUTC's, a creator who builds photography apps for a living, at 2,348,178 views. they made a Rust version of every single Adobe app, which is completely insane. FUTC, YouTube, 43,332 likes Then the internet handed the credit to REA. Reels this week sold it as Claude stealing software with one MCP install, and a TikTok with 24,980 views put it flatly: "It's not vibe coding, it's reverse engineering." The repos say otherwise. PhotoCraft's README describes it as clean-room, "implemented from public specs and observed behaviour only," with PSD support written from Adobe's public specification. The ArtCraft repos are dated September 30, before REA's star count took off. I found no primary evidence REA was involved. It still belongs in this piece, because it is the same move pointed at a much bigger target. SavvyNik's breakdown (435,005 views) called it black box reverse engineering, and Matthew Berman (937 likes) described the loop in one line. An AI agent attempts a feature, compares the result with the original, and keeps revising it. matthewberman_ai, Instagram, 937 likes That is pick 2 and pick 8 at the scale of a whole product suite: study what the original does, rebuild it, check against it, repeat. No decompiler required, which is exactly why the "clean-room" claim matters legally. PhotoCraft's own README calls it early alpha and "not yet a Photoshop replacement for daily professional work." NixOS packagers opened an issue on ArtCraft's legal status and floated not caching the packages for now. Simon Taylor had the cleanest summary of the week (105 likes): "Software is done. You can now reverse engineer anything. IP and liability. That's another matter entirely." How I picked these 13 /last30days runs plus one Grok pass on X, 100+ candidates, one pick per source. A pick had to show someone doing a specific thing, with a receipt. Commands and the REA prompt are verbatim from each project's README, the WASM prompt is the author's verbatim, the decompile recipe is my summary of momo5502's writeup, and the other prompts are mine. The Adobe clones got their own section because they did not use REA. Patterns across the picks The winning question is narrow. "How does this one feature work, show me" beats "clone this app" in every demo that held up. Verification is the real product. Byte-matching for games, a 4,915-query check for Obsidian, GPL source for Red Alert. The ones without a check are the ones that got called out. Your own stuff is the safe and useful target: your monitor, your TV, your build, your games. The tooling lowers the floor more than the ceiling. Plain agents were already doing most of this; the tools make it repeatable and show the evidence. The pushback is loud and fair. The top Hacker News thread (802 points) asked why this beats telling Claude to install Ghidra itself, and the top comment on a TikTok explainer (2,986 likes) called this "the wild west era of ai before everything gets banned and regulated." All Agents Reported Back 13 /last30days runs, October 11 to 13. Tonight's 8 facets, summed per facet (an item can show up in more than one): YouTube 49 videos / 15,227,589 views; TikTok 80 videos / 2,565,777 views; Instagram 59 reels / 835,356 views; Reddit 95 threads / 91,153 upvotes; LinkedIn 96 posts / 13,915 likes; X 111 posts / 7,063 likes; Hacker News 38 stories / 3,506 points; GitHub 62 items. Top voices: Low Level, Nick Saraev, Rob Shocks, momo5502; r/ReverseEngineering, r/ClaudeCode, r/pcgaming. https://x.com/i/article/2110259339588194304