软件完蛋了吗？REA三天狂揽12万星：无需源码，Agent就能克隆一切软件
Is Software Doomed? REA Gathers 120,000 Stars in Three Days: No Source Code Needed, Agents Can Clone Any Software
Summary
Author | Tina These past two days, a project called REA (Reverse Engineer Anything) has gone viral on GitHub. How viral? As of October 12
These past two days, a project called REA (Reverse Engineer Anything) has gone viral on GitHub.
How popular is it? As of October 12, its repository page shows 120,000 stars. By comparison, OpenClaw, which sparked a nationwide “lobster farming” craze at the beginning of the year and created a growth miracle, added 60,000 stars in its third day of the surge.
Project URL: https://github.com/morluto/rea
What it does, quoted directly from the GitHub README, is: “Reverse engineer anything with agents, from app behavior down to native binaries.”
In short, it uses AI programming agents like Claude Code and Codex, connects to reverse‑engineering tools such as Ghidra and Hopper via MCP, enabling the agent to analyze software without source code, trace the implementation clues of a specific feature, and attempt to write a similar function based on the analysis.
REA offers the deepest support for native binary files, and its coverage goes beyond that:
-
Native applications: Mach-O, ELF, PE, and macOS .app bundles, including Swift and Objective‑C metadata. -
Packages and archive files: ZIP, APK, IPA, ASAR; you can also generate a file manifest without extracting the archive.
As Replit CEO Ahmad Msad said, “The things happening in AI‑driven reverse engineering and decompilation are simply incredible. Soon, all software may effectively become open source.”
Over the past forty years, part of software’s value logic has been built on the premise that “source code is unavailable”: I write code, compile it into binaries, you can’t get them, so you have to buy from me. REA shakes this premise—when AI can understand binaries, trace call chains, and generate refactored code, can “unavailable source code” still block anyone?
This will obviously change the industry’s rules of the game. For companies that rest on past achievements, neither actively invest in products nor continuously update quickly, the problem is no longer “whether someone will clone you,” but “when you will be cloned and whether the cloner will move faster.”
The half‑century‑long myth of the “closed‑source moat” seems to have officially declared bankruptcy at this moment.
“These subscription models should disappear. Greedy and insatiable, truly speechless.” “The software is doomed.”
“If this really works, then nothing will be considered proprietary anymore! Software is completely doomed now!”
Have you ever had this moment: using an app and finding a feature that works flawlessly—offline search returns results instantly, the sync mechanism is so smooth it feels unreal. You want to implement something similar in your own product, but there’s no source code, no documentation, not even an idea of how it’s done.
In the past, when faced with this, the only option was to learn reverse engineering. Grab a disassembler, dig into its API, sift through strings and symbols, manually trace call graphs, and bounce between different tools. It’s a hard skill that most application developers simply don’t have time to learn.
REA changed its approach: hand this job over to your AI coding assistant, such as Claude Code, Cursor, Codex, Gemini CLI, Windsurf, and Claude Desktop.
More precisely, REA is an open‑source (MIT‑licensed) tool written in TypeScript that gives agents a consistent way to investigate software, with its core being a scheduler that sits between the AI agent and reverse‑engineering tools.
One netizen joked that it’s like “someone equipped Claude Code with a decompiler.”
The reverse‑engineering tools invoked by REA are actually not new; they have been developing for many years: Ghidra was open‑sourced in 2019, Hopper’s history goes back to 2011, and IDA has been used by reverse engineers since the 1990s. What REA does is enable the Agent to call these tools, integrating analysis steps that previously required manual chaining into the programming workflow.
For example, asking REA to “reverse‑engineer the Notes app, discover how offline search works and explain it clearly, then implement a similar version for my project using TypeScript and SQLite.” In the background, the Agent will roughly perform the following steps with the help of REA tools:
However, large models entering reverse engineering did not start with REA.
Large‑model‑assisted reverse engineering has been developing for several years. As early as 2022, research teams from NYU and the University of Calgary tested whether Codex could aid reverse engineering in the paper “Pop Quiz! Can a Large Language Model Help With Reverse Engineering?” The researchers had the model read source code and decompiled code, determine the purpose of functions, what capabilities the program possesses, and what variable names or key values might be.
This pioneered the use of large models to parse decompiled pseudocode, but at the time AI was still a “read‑comprehension cheat” that required manual copy‑pasting. In the following years, the technology diverged: one camp, such as the open‑source LLM4Decompile from Southern University of Science and Technology, tried to bypass traditional engines and directly translate machine code into native C source; the other camp moved toward Agent‑based REA architectures—building a scheduling bridge between large models and traditional tools like Ghidra and IDA, giving AI actual “hands and eyes” to automatically extract symbols, trace call chains, and generate concrete code in an end‑to‑end reverse‑engineering workflow.
In April of this year, a senior security professional used an Agent together with Ghidra MCP to reverse‑engineer everything from a regular game to a bank‑grade app.
Game‑related cases were nothing special: a Cocos2d game could be analyzed statically to identify the Blowfish algorithm and recover the key, while a Unity game allowed the XOR key to be derived by observing ciphertext patterns and guessing the Lua comment format.
The truly surprising part was the bank app. Such apps typically have multiple layers of packing and obfuscation, plus a full suite of protections like anti‑injection, anti‑debugging, root detection, and emulator detection. According to his post‑mortem, the AI peeled away these defenses layer by layer, eventually managing to launch the app on a rooted emulator and capture its request traffic.
The whole process was done with Cursor paired with Claude Opus 4.6 high thinking. Most of the time the prompt was simple: there is an APK in a certain folder, decompile it back to source code. Many apps could be reverse‑engineered in about 30 minutes, and according to Cursor’s pricing model it cost less than $5; a Unity game tested with Claude Code consumed 40 million tokens, roughly $27. On average, the cost was around $30.
He even exclaimed, “That’s when I realized I’m the limiter for AI.” Things he previously thought AI couldn’t do were actually just things he didn’t dare let it try. “As long as you give AI an environment to operate in, ensure it can see enough logs and verify correctness, and give it enough time, there’s no reverse‑engineering task it can’t solve.”
It can be said that reverse engineering various apps has theoretically been feasible for a long time, but the recent emergence of REA has drawn more attention to this.
A netizen mentioned: “I suspect this is why, in the past few days, my YouTube feed has been flooded with Vibe Code clone videos of various commercial applications. From Adobe to Microsoft Office flagship products, everything is covered.”
App cloning has already occurred in the mobile gaming sector: someone released a renamed Flappy Bird, and the next day a flood of copies appeared. Now it’s not just a flood, but countless copies. As long as someone wants a particular software, they can clone it. This is happening to small teams now, but Adobe is also affected—Photoshop, Illustrator, the entire Adobe suite have clone versions, and in some aspects they are even better, and this may not be just individual actions.
Regarding REA itself, a netizen who tested it reported: “The hype around REA is no exaggeration; I tried it with Jianying and a few projects, and it really stripped away the basics.”
He mentioned that when he sees a feature done well by someone else, he follows the module, routing, IPC communication all the way to the implementation logic and reproduces it directly in his own project; even software and libraries that don’t expose APIs can be dissected, and many Electron/desktop applications end up running bare. Another scenario is “saving old software and libraries without source code—Agent can invoke Ghidra, Hopper to read decompiled code and assembly, even accurately reconstruct algorithms from legacy games.”
So the question arises: if even old software without source code can be dissected and reproduced, where is the moat for software companies?
Technical expert Xu Hao’s view is that cloning can take the code, but it can’t take the knowledge. When facing software without source code, the focus has never been “rewriting it with another technology,” but rather inferring its business logic and clarifying exactly what it does. “If you just reenact it, I don’t think it’s meaningful.”
“Software itself is not the product; the knowledge within the software is.” In the REA context, this can be understood as: REA can decompile binaries back into code and produce a seemingly complete implementation, but there is a layer between “recovering the code” and “understanding the software”—why it was designed that way, what the business rules are, which behaviors are intentional, and which are legacy burdens.
In other words, writing code has never been a moat for a software company.
An expert interviewed by InfoQ also placed the answer beyond code: “Customer relationships, community, trust between people, and insight into needs are what a company truly has to manage.”
In the past, some people took “a few programmers writing code well” as a reason to start a business, but they didn’t think clearly about what problem they wanted to solve or what value they could bring to the business. Software and code are only means to achieve business value. Today, with development costs decreasing, for those who truly understand the industry, have know‑how, and can solve real problems, it actually means they have the opportunity to turn experience into products.
Co‑founder Yan Zhitai of the overseas content marketing platform QuickCreator also believes, “REA will indeed further affect the business model of the software industry, but I don’t agree that this is the end of software.” From being able to create similar functionality, to customers being willing to pay, to being able to serve customers well over the long term, there are many steps in between; obtaining the code cannot do it for you.
“If source code can be obtained, software business cannot continue, then the business model of open‑source software should have disappeared long ago.”
Many open‑source projects’ code is already available for anyone to obtain, study, and, within the bounds of the license, use and modify. Yet enterprises still choose to purchase related commercial subscriptions, hosting, and technical services—a phenomenon that has existed for many years. Take Red Hat as an example: its official subscription description lists value such as production‑grade software, lifecycle management, compatibility, patches and updates, as well as technical support and expert resources. What customers pay for clearly exceeds merely downloading a copy of the code.
Enterprises can of course choose to build their own teams and handle these tasks themselves. But doing it in‑house also incurs costs: recruiting, training, accumulating experience, and maintaining the team over the long term. For some companies, paying a specialized vendor is a more appropriate choice than taking on everything internally.
After a version is released, who maintains it? If a dependent component has an issue, who determines whether it impacts the business? When multiple products are used together, who verifies compatibility? These tasks do not automatically get done just because the code is public.
Enterprises are willing to pay a substantial portion of that money to reduce the cost and uncertainty of using the software well and maintaining it over the long term. This also explains why, even when centered around the same open‑source project, different companies can generate vastly different business outcomes. The accessibility of the code may be similar, but service capabilities, customer relationships, and performance records can vary widely.
However, this does not mean that existing software vendors can rest easy; the service model itself will also be transformed by AI. Tasks that previously required many people—troubleshooting, documentation, configuration checks, and some implementation work—may later be handled by smaller teams leveraging AI. If a new company can deliver a suitable product and provide reliable services at lower cost, it has the opportunity to gradually earn customer trust. Established giants cannot assume that their past comprehensive service ecosystems will remain an everlasting advantage.
Returning to REA itself, what changes is not “whether software has value,” but “what supports the value of software.” As code and features become increasingly easy to copy, the basis for charging must shift from “implementation difficulty” and “information opacity” to other areas—understanding the business, responding to customers, and ensuring the long‑term operation of the system.
This shift may make some features cheaper, squeeze existing revenue streams, and also create opportunities for new service providers to enter the market. Its impact on business models will be tangible, but the demand for reliable software, professional services, and ongoing support does not disappear because of it.
The moat has not vanished; it has simply moved from “you can’t see my code” to “you can’t take away my service capabilities and business understanding.”
Related reading:
‘REA is not the end of software; having the source code does not equal having the business’：https://mp.weixin.qq.com/s/K_z60c0XKG9oFUgG-k2xHg
‘AI can use any means, write anything, but you have to be a “middle-aged veteran”’：https://mp.weixin.qq.com/s/_y1BXuRO9DSmToQEnPHFiw
https://blog.huli.tw/2026/04/18/ai-reverse-engineering-op/
https://arxiv.org/html/2202.01142v1
Disclaimer: Compiled by InfoQ, does not represent the platform’s views, nor constitute investment advice, and reproduction is prohibited without permission.
Jensen Huang backs Microsoft: No Windows, no Nvidia; Satya immediately “asks for market value”
The QCon Global Software Development Conference 2026 (Shanghai) will be held from October 22–24. This year’s conference focuses on engineering practices in the Harness AI era, ranging from “building AI” to “harnessing AI”, covering hot technical topics such as AI‑Native architecture, Agent Runtime, AI Infra, Agent security and observability, Loop Engineering, embodied intelligence and world models. We invite the global tech community and frontline industry practitioners to share the most valuable engineering experience in the AI‑Native era. Limited‑time 10% off discount saves 680! For more details, scan the QR code or contact ticket manager 18514549229.
Get MirrorSpeed