Reverse engineering
Understanding a system from its artifacts — binary, protocol, behavior — without source. The discipline of recovering intent from evidence. Old as computing (IBM vs clean-room BIOS), newly hot because agents can now drive the whole pipeline (decompile → understand → recreate).
The method layers (target-shaped)
- Static binary analysis — disassembly/decompilation: Ghidra, IDA, Hopper, objdump; recover code, strings, symbols, structure. The classic core.
- Managed/runtime targets — .NET assemblies, Java/Kotlin (JADX for APKs, static — no emulator needed), JavaScript/Electron (ASAR trees: readable by design).
- Dynamic/behavioral — run it and watch: syscalls, network, filesystem; instrumentation, fuzzing.
- Protocol/web RE — API reverse engineering from app traffic; format reverse engineering.
- Output: the spec — a description of behavior good enough to reimplement (see Clean Room, below).
The agent-era consolidation: REA (2026-10)
Dinosn (123❤ / 5.6k views) → rea (OSS) (12k★ TypeScript): “Reverse engineer anything with agents, from app behavior down to native binaries” — one MCP server unifying the layers: native binaries (via your Hopper/Ghidra), JS/Electron, .NET, websites, static APKs (headless JADX), Apple bundles (XPC services, helpers, plists). The investigation model is the design worth copying: Decompile → Understand → Recreate — “see a feature you like… your agent investigates it, explains how it works, shows the evidence, and builds a version for your project.” Results include evidence and limitations (“does not claim to recover original source code”) — the honesty box as a product feature. Terminal parity (rea analyze... same tools, no MCP needed), scoped doctor checks, engine-ambiguity refusals instead of silent picks.
The legal frame (from this week’s captures)
- Clean-room procedure (the historical answer): room A documents, spec crosses in front of a lawyer, room B implements — the separation is the non-copying proof. acroll’s point (captured in Software engineering in AI era): an AI decompile→spec→implement chain “satisfies the letter while destroying the evidentiary logic” — the two-room wall was the evidence; now the wall is a model.
- /z80 + PhotoCraft (ghuntley, captured): decompile → non-code spec → LLM-implement = “running the LLM like a Bitcoin mixer for IP” — an 11k★ clean-room Photoshop reimpl in Rust exists as proof.
- REA’s positioning is deliberately not that: investigate and understand with evidence, recreate “adapted to your stack” — the defensible-and-useful side of the same capability.
Defenders’ RE (the flip side)
RE is also the defender’s tool: malware triage, CTF forensics, verifying what a binary actually does (Weight poisoning’s “scanner has no source to read” problem makes behavioral RE more valuable, not less), incident response. The skill is symmetric — the ethics live in the target and the license.
Vault kin
- apk-reverse (OSS) — the Android lane (smali patch/rebuild/sign)
- Software engineering in AI era — clean-room collapse + /z80 captures
- LLM security / Weight poisoning — RE as detection where scanners fail
- Agent-accessible product — “clone anything” as the moat-death argument
- Sysops interview questions — same evidence-over-definitions epistemic