Practical Agentic Reverse Engineering
Binaries, Electron, Android and the Web with REA and Ghidra
A short, hands-on guide to reverse engineering with AI agents and REA 6.4.0: drive Ghidra from Claude Code, Codex or Cursor, check every claim against evidence, and work through native, Electron, Android, .NET and web targets you are allowed to analyse. Every output shown is a real lab run.
Minimum price
$19.00
$29.00
You pay
Author earns
About
About the Book
A coding agent can open a binary, decompile a function and explain it in seconds. It can also invent an address, misread a cross-reference or describe code that isn't there. This book teaches you to get the speed without the fiction.
It is a short, hands-on guide to REA (Reverse Engineer Anything), the open-source MCP server and CLI that lets Claude Code, Codex, Cursor and other agents drive Ghidra, JADX, ASAR extraction and network-capture decoding. The method at its centre is the evidence loop: ask, trace, read the evidence, follow up, reconstruct, verify. Every step has a named failure mode and a check that catches it.
- Know where reverse engineering is legal, and practise on targets you own.
- Install REA 6.4.0 with Ghidra 12.1.4 and pin both versions.
- Trace a feature from a string to the function that decides it, and read REA's evidence records instead of trusting the agent's summary.
- Find a path-traversal bug and missing IPC sender checks in an Electron app.
- Reconstruct a function from a stripped x86-64 binary and prove the reconstruction with differential tests.
- Analyse HAR and mitmproxy captures, an Android APK with an exported debug activity, and a .NET licence check.
- Spot hallucinated analysis, and know when to reach for GhidraMCP or ida-pro-mcp instead.
- Capstone: take a stripped licence checker from strings to a working key generator, and list exactly what was established and what remains unknown.
Every target in the book is a small program written for it and released into the public domain, so you can run each step yourself. No tool output is invented or retyped: each output block comes from a real REA 6.4.0 run in a sandboxed lab, and every claim cites its source, whether that is the REA documentation, the rea-agents-6.4.0 source tree or the captured run.
Researched and drafted with AI assistance by Ground Truth Books. The text was checked against the REA 6.4.0 documentation and source, and the commands were run under REA 6.4.0 with Ghidra 12.1.4. "REA" and "Ghidra" are used descriptively; this book is not affiliated with or endorsed by the REA project, the NSA or the Ghidra project.
Feedback
Author
About the Author
Ground Truth Books publishes practical technical books on computer science, IT tools, data science, machine learning, software engineering and AI.
The name comes from machine learning, where "ground truth" means the real, verified answers you check a model against. That's how these books are made. They're researched and drafted with AI assistance, and then checked against reality. Examples are run against real captures and data in a lab, and those runs are cited like any other source, so you can see which output came straight from the tool. Every claim is cited to its source, with official documentation, specifications and source code preferred over blog posts.
Each book is built around doing the work. Chapters end with exercises, and an appendix gives worked answers you can reproduce on your own machine, using the same freely available data and captures.
Books are updated when the tools change. If you find an error, please report it: a corrected edition is free for every reader, which is one of the best things about Leanpub.
Contents
Table of Contents
Chapter 1: Introduction
- The problem and the promise
- Who this book is for
- How the book is organised
- The Method
Chapter 2: What AI Agents Change
- Where agents help
- Hallucinated addresses
- Stale tool state
- Context churn
- The human boundary
Chapter 3: Ground Rules for Owned Targets
- DMCA 1201(f) and the EU directive
- EULA clauses
- Crackmes and CTF binaries
- Your own builds
- Reporting and disclosure
Chapter 4: Setting Up REA with Ghidra
- Node and npm prerequisites
- Installing rea-agents
- Ghidra and analyzeHeadless
- Providers and configuration
- Pinning REA and Ghidra versions
Chapter 5: The Evidence Loop
- Ask and trace
- Read the evidence
- Follow up
- Reconstruct
- Verify by differential testing
- Worked Investigations
Chapter 6: Electron and JavaScript
- Electron application artifacts
- Preload and IPC surface
- JavaScript reconstruction
- Passive runtime observation
Chapter 7: Native Binaries and Differential Tests
- Reconstructing pan_from_x in C
- Cross-references and tracing
- Differential testing harness
Chapter 8: Websites and Network Captures
- Browser observation
- mitmproxy capture
- Request tracing and HAR
- Source location
Chapter 9: Android APK and Devices
- APK artifacts and jadx
- Decompiling with jadx
- adb device inspection
- Linking static and live
Chapter 10: .NET, WASM and Firmware
- The LabLicensing DLL
- Inspect-managed commands
- WASM in brief
- Firmware in brief
- Less common formats
- Staying Reliable
Chapter 11: Detecting Hallucinated Analysis
- Why agents confabulate
- Doctor checks and diagnostics
- Cross-checking providers
- Recording unknowns
- Beyond REA
Chapter 12: An End-to-End Investigation
- The investigation question
- Strings and cross-references
- Reconstructing key_digest in C
- Differential verification
- A working key generator
- Established and unknown
Chapter 13: Conclusion
- What the loop gives you
- What to do next
Appendix A: REA CLI Reference (pinned to 6.4.0)
- Scope and version
- Global options
- Core analysis commands
- Target-family commands
- Setup, readiness and maintenance
- Evidence and verification commands
- Exit status
Appendix B: Prompt Cookbook
- Using this cookbook
- Stage recipes
- Target recipes
- Discipline prompts
Appendix C: Legal Practice Targets
- Why a target is lawful
- The statute and the cases
- Practice targets
- Out-of-bounds targets
- The pre-flight checklist
- Reporting findings
Glossary
References
Get the free sample chapters
Click the buttons to get the free sample in PDF or EPUB, or read the sample online here
The Leanpub 60 Day 100% Happiness Guarantee
Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms...
Earn $8 on a $10 Purchase, and $16 on a $20 Purchase
We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.
(Yes, some authors have already earned much more than that on Leanpub.)
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Write and Publish on Leanpub
You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!
Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.
Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.