How does this skill prevent the AI from making up logic when analyzing obfuscated code?

This skill solves the issue of AI 'hallucinations' during decompilation by using an evidence-based matrix that strictly categorizes findings as Seen, Inferred, or Unknown rather than guessing logic.

Which AI agents or IDEs are compatible with this reverse engineering skill?

The skill is designed to work with advanced coding agents like Claude Code, Cursor, and Codex, leveraging the rea-agents CLI to bridge the gap between the LLM and local analysis tools.

Are there any specific local software requirements I need to install for this to work?

Beyond the skill itself, you will need to have the `rea-agents` CLI installed locally alongside standard industry tools like Ghidra, JADX, or Hopper for the agent to perform deep binary analysis.

Can this skill handle both mobile applications and desktop binaries?

Yes, the skill is highly versatile and includes specific investigation routing for Android APKs, Electron ASAR files, and native binary formats like ELF or PE.

What exactly is included in the purchase of this skill?

You will receive the full skill integration package, access to the systematic REA framework, and the documentation required to connect your agent to the supported local deobfuscators.

Does this skill allow for the recovery of server-side logic from a client-side binary?

While the skill can reconstruct client-side logic and structure, it cannot recover server-side code or secrets that are never exposed in the compiled binary or bundle.

Reverse Engineer Anything (REA)

Example session with this skill installed

Analyze the minified webpack bundle at ./dist/main.js and reconstruct the API service layer and authentication flow.

Read your context and instructions
Compiled the reverse engineer anything

I have completed the analysis of the provided webpack bundle. Using the REA Evidence Matrix, I identified the API module boundaries and the Bearer token injection logic.

Reverse Engineering Report: API & Auth Service

Component	Status	Evidence	Notes
Base URL	`SEEN`	Hardcoded string `https://api.internal.v1`	Found in module 402.
Auth Strategy	`SEEN`	`localStorage.getItem('jwt_token')`	Standard JWT implementation.
Login Endpoint	`SEEN`	`/v1/auth/login`	POST request observed in AST.
Refresh Logic	`INFERRED`	Axios interceptor pattern	Matches standard 401 retry logic.
Secret Key	`UNKNOWN`	Hashed value in ENV	Server-side validation only.

Reconstructed Source Code

// Reconstructed from module 402 (API Client)
import axios from 'axios';

const API_BASE = "https://api.internal.v1";

export const apiClient = axios.create({
  baseURL: API_BASE,
  headers: {
    'Content-Type': 'application/json'
  }
});

apiClient.interceptors.request.use((config) => {
  const token = localStorage.getItem('jwt_token');
  if (token) {
    config.headers.Authorization = `Bearer ${token}`;
  }
  return config;
});

export const authService = {
  login: async (credentials) => {
    const { data } = await apiClient.post('/v1/auth/login', credentials);
    return data;
  },
  logout: () => {
    localStorage.removeItem('jwt_token');
    window.location.href = '/login';
  }
};

Next steps

Run python scripts/deobfuscate_helper.py ./dist/main.js to extract remaining environment variables.
Verify the INFERRED token refresh logic against network logs in Chrome DevTools.
Map the identified data schemas to your local TypeScript interfaces.

Connects securely to your tools. The creator never sees your data.

About this skill

Reverse engineering often results in hallucinated logic and buggy guesses when handled by standard LLM prompts. This skill provides a systematic framework for agents to decompose compiled binaries, Electron apps, and obfuscated bundles into clean, maintainable source code.

What it does

Multi-target decompilation handles Android APKs, Electron ASAR files, and native binaries like ELF or PE.
Evidence-based reporting tags every finding as SEEN, INFERRED, or UNKNOWN to eliminate AI hallucinations.
Logic deobfuscation restores human-readable variable names and isolates core business logic from minified scripts.
Contract extraction maps API routes, database schemas, and state management patterns from runtime behavior.
Modular reconstruction generates modern source code that mirrors original functionality without technical debt.

How it works

Inventory phase identifies package formats, manifests, and runtime dependencies.
Deobfuscation mode uses local scripts or the REA MCP engine to unpack bundles and extract module boundaries.
Investigation routing applies domain-specific guides for Android, JavaScript, or Native environments.
Code generation outputs a reconstructed repository based on the observed evidence matrix.

Frameworks & tools

This skill utilizes rea-agents CLI, Python-based deobfuscators, Ghidra, Hopper, and JADX. It integrates with agents like Claude Code, Cursor, and Codex.

Why this beats prompting it yourself

Generic prompts fail to distinguish between hard facts and guessed logic in minified code. This skill enforces a strict evidence matrix that prevents the agent from making up API endpoints or internal logic that does not exist in the source.

Use cases

Reconstructing a lost source code repository from a production Electron app.
Auditing a third-party Android APK for undocumented API calls or trackers.
Mapping the architecture and state management of a minified React frontend.
Converting a legacy native binary into a modern, documented API service.

Known limitations

Requires local installation of the rea-agents CLI and supporting tools like Ghidra or JADX for deep binary analysis. Logic hidden behind server-side secrets cannot be recovered.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

Reverse Engineer Anything (REA)