REA实战：用AI智能体与MCP进行逆向工程入门指南_CG群

本课程面向初学者，讲解如何通过MCP将Claude Code、Cursor等AI智能体与Ghidra、IDA等逆向工具连接，实现二进制、Electron应用、抓包与APK的多维分析，并建立五阶段功能重构与合规的AI协同逆向工作流。

原始标题：REA: Reverse Engineer Anything with AI Agents and MCP

REA: Reverse Engineer Anything with AI Agents and MCP

本课程是一门面向初学者的 AI 驱动逆向工程（REA）实战指南，核心教导如何利用模型上下文协议（MCP）将 Claude Code、Cursor 等 AI 智能体与 Ghidra、Hopper、IDA 等传统逆向工具无缝连接。在 1 小时 17 分钟的教学中，学员将全面掌握从原生二进制文件、Electron 应用（主进程/渲染进程追踪）到网络抓包、SQLite 数据库及 Android APK 的多维分析技术，并学习如何通过 REA 的“证据模型”建立起一套包含五阶段功能重构、安全运行时分析以及兼顾法律合规的 AI 协同逆向工作流。

Master AI-driven reverse engineering: native binaries, Electron apps, packet captures, MCP, and evidence models.

What you’ll learn
⚡ Install and configure REA using MCP to connect AI agents like Claude Code, Codex, and Cursor to reverse engineering tools.
⚡ Explain REA’s architecture, including the MCP server, provider abstraction layer, and the core evidence model.
⚡ Analyze native binaries using Hopper, Ghidra, or IDA to extract pseudocode, assembly, strings, and cross-references.
⚡ Trace features across Electron apps statically by mapping the renderer, preload scripts, and main process boundaries.
⚡ Inspect network captures (HAR, mitmproxy), SQLite databases, and specialized formats like .NET assemblies and Android APKs.
⚡ Evaluate REA’s evidence-backed findings by distinguishing between observed facts, agent inferences, and explicit unknowns.
⚡ Reconstruct software features using a five-stage pipeline, applying methods from case studies like DX-Ball and Notion.
⚡ Implement secure runtime analysis practices, use disposable environments, and navigate legal and licensing boundaries.

Requirements
❗ No prior reverse engineering experience needed. Basic command-line familiarity, Node.js installed, and an AI coding agent (like Claude Code) are helpful.

Description
AI DISCLOSURE — PLEASE READ FIRST

This course was developed with the assistance of artificial intelligence. AI tools were used to help draft, structure, and organize portions of the curriculum, lecture outlines, technical explanations, scenario prompts, and supporting written materials. All topics, sequencing decisions, accuracy checks, and final quality review were carried out by the instructor. This disclosure is placed at the very beginning of the course so that every learner can make a fully informed decision before enrolling. If you have questions about how AI was used in the creation of this material, please ask in the course Q&A before you purchase.

REA: Reverse Engineer Anything with AI Agents and MCP

Have you ever looked at an application and wondered,“How does that feature actually work?” Perhaps you wanted to understand a specific algorithm, trace how a desktop app communicates with its backend, or analyze a binary to see how a game calculates its physics. Traditionally, reverse engineering has been a high-friction endeavor. It required learning complex, fragmented tools—a disassembler for binaries, a bundler inspector for JavaScript, a packet analyzer for network traffic—and manually stitching their outputs together. Each tool has its own interface, its own output format, and its own quirks.

Today, that paradigm is shifting. EnterREA (Reverse Engineer Anything), an open-source Model Context Protocol (MCP) server and command-line tool that acts as a bridge between AI coding agents (like Claude Code, Codex, Cursor, and Gemini CLI) and professional reverse-engineering engines. This course is a practical, evidence-oriented guide to mastering REA. It is designed to take you from a complete beginner—someone who may have never opened a disassembler—to a practitioner who can orchestrate AI agents to inspect native binaries, trace Electron applications, analyze network captures, and reconstruct software features with verifiable evidence.

The Problem REA Solves

When a human analyst reverse engineers software, they rely on intuition and experience to know which tool to use and how to interpret the results. When an AI agent tries to use these tools directly, it faces immense friction. The interfaces are inconsistent, the raw outputs are massive and flood the AI’s context window, and there is no standard way to distinguish between what was actually observed and what the AI simply inferred.

REA solves this by placing one consistent, normalized interface in front of many analysis engines. The AI agent speaks MCP to REA, and REA handles the complex toolchain, the analysis session, and the target lifecycle. Crucially, REA introduces anEvidence Model. Every result returned to the agent is wrapped in structured metadata that includes the actual findings, the location of the evidence (such as a file offset or address), the confidence level, and—most importantly—the explicit limitations and unknowns. This prevents the AI from hallucinating a function or guessing an architecture, forcing it to ground its conclusions in hard data.

What You Will Learn

This course is structured around the real-world capabilities of REA, moving from foundational concepts to advanced case studies. You will not just learn what REA is; you will learn how to use it effectively.

✨Understand the Architecture: Learn how the MCP server, the provider abstraction layer, and the workflow skill interact. Understand the difference between static analysis (which safely reads files without executing them) and runtime capture (which runs the target).

✨Master the Evidence Model: Learn to read REA’s output critically. You will be taught to ask the four essential questions of any finding: What was observed? Where did it come from? What did the tool infer? And what remains unknown?

✨Analyze Native Binaries: Discover how to connect REA to Hopper, Ghidra, or IDA to extract pseudocode, assembly, strings, and cross-references. You will learn how to navigate large binaries and raise provider startup timeouts when dealing with massive targets.

✨Trace Electron and JavaScript Apps: Follow features across the security boundaries of modern desktop apps. You will learn to trace execution from the renderer process, through preload scripts, across IPC channels, and into the main process—all without running the application.

✨Inspect Databases and Network Captures: Learn to analyze SQLite databases, read HAR files, and use tools like mitmproxy and Wireshark to understand how an application communicates over the network. You will learn to extract API endpoints, authentication patterns, and payload shapes from recorded traffic.

✨Analyze Specialized Formats: Explore REA’s built-in static inspectors for .NET assemblies, Android APKs, Flutter apps, Go and Rust binaries, and specialized formats like WASM and EVM bytecode.

✨Develop Custom Providers: Go beyond the built-in tools. Learn about REA’s extension and plugin architecture, and discover how to develop custom providers to connect REA to your own specialized tools or workflows.

✨Security and Best Practices: Understand the security posture required for reverse engineering. Learn how to isolate targets, manage agent permissions, and handle memory management. We will also cover batch processing to scale your analysis.

Course Curriculum Overview

Section 1 begins with a comprehensive introduction to REA, including how to set up the Hopper provider, analyze SQLite databases, and use mitmproxy for native captures. From there, you will dive into recorded packets, Flutter app analysis, and the critical process of provider selection. We will begin a deep dive into the DX-Ball case study, exploring how to trace and reconstruct the sound-pan calculation. The section continues with the TH04 case study, a look at the project’s security documentation, and essential concepts of memory management. Finally, we cover broader security considerations, Wireshark integration, extension architecture, custom provider development, and best practices for scaling your REA workflows.

The Case Studies: Learning Through Real Examples

One of the most powerful aspects of REA is its documented case studies, which we will explore in detail.

First, we look atDX-Ball, a classic game. You will learn how REA follows a sound call into its position-to-pan helper function, inspects the assembly, and turns incomplete pseudocode into C code that passes thousands of original test cases. This demonstrates what true evidence-based reconstruction looks like.

Next, we examineTH04, a PC-98 game written in 16-bit code. You will see how REA handles the complexities of segmented memory and historical compilers, recovering the fixed and aimed angle calculations for a ring of bullets.

We also look atNotion, an Electron app. You will learn how to find the renderer’s clipboard API, follow it through the preload and IPC into the main process, and inspect the rich clipboard format—teaching you how to document a feature chain and reimplement it safely in your own projects.

Who this course is for
⭐ Developers, security researchers, and students curious about using AI agents and MCP to understand how software works without source code.

隐藏内容

百度网盘下载：