On this page

AI reverse engineering 10 tools to choose from

Document type
Atlas
Updated
Reading time
12 min

A source-checked guide to zg0820's 10-item list, covering REA, reverse-skill, Android, replica-skill, leanrea, CTF and JS tools, their installation, dependencies and limits, with separate treatment of ambiguous repository matches.

Source
Document details

Choose a tool for the sample and question, then check its installation, evidence sources and reproducible results.

Items in the source
10ItemsSource order preserved; not a performance ranking

01Editor's note

Scope and source identities

zg0820's original post lists 10 AI reverse-engineering tools for applications, Android, frontend JavaScript, CTF and public product research. The projects include method documents, skill collections, CLIs, MCP servers and complete workspaces, each with its own installation and runtime requirements.

Neither the original post nor the author's follow-up contains GitHub links. The sources were matched by name and features. The Android item has a derivative, and two ctf-skills candidates partially match the description, so the author's intended repositories cannot all be confirmed.

02Capabilities and inputs

Ten tools in source order

Rank 01/10

morluto/rea

REA

Connect application analysis tools through MCP or CLI

Analyze JavaScript, Electron and native binaries with evidence, coverage and unknowns. Static JavaScript analysis does not need a native engine; deeper native analysis still depends on the selected provider.

  • MCP
  • CLI
  • Electron

Rank 02

zhaoxuya520/reverse-skill

reverse-skill

Identify the scenario before choosing methods and tools

Organize analysis through rules, routing, task scope and a tool index. Produce a timeline, evidence and conclusions; optional client adapters still require the complete local repository.

  • Scenario routing
  • Tool index
  • Evidence reports

Rank 03

SimoneAvogadro/android-reverse-engineering-skill

android-reverse-engineering-skill

Identify APK types, decompile packages and collect API clues

Use tools such as jadx to analyze APK, XAPK, JAR and AAR files and map call chains and code structure. Kotlin class-name suggestions depend on retained metadata and decompiled text; they cannot guarantee recovery of every name.

  • Android
  • jadx
  • Kotlin

Rank 04

Jakeschincariol/replica-skill

replica-skill

Independently rebuild functionality and UX from public behavior

Connect research on public pages and flows to a new product's architecture, implementation, tests and difference analysis. Data models are inferences with confidence labels; branding, assets and backend design require independent work.

  • Public product research
  • UX
  • Independent implementation

Rank 05

aicodeking/leanrea

leanrea

Direct existing command-line tools with one skill document

Identify the file type, then use the agent's shell and local analysis tools. The pinned skill file is 8,374 bytes; it starts no MCP server, but still requires tools and execution permissions for the target.

  • CLI
  • Local tools
  • Method document

Rank 06

ctf-skills

ctf-skills

A CTF skill collection with an unresolved repository identity

Both ljagiello and Huoxing999 have projects with this name, with different challenge categories and dependencies. The original post has no owner link; select a candidate before reading its category and installation documentation.

  • CTF
  • Same-name candidates
  • Challenge routing

Rank 07

P4nda0s/reverse-skills

reverse-skills

Infer symbols and structures from decompiled data

Includes rev-symbol, rev-struct and guidance for observing with Frida and emulating snippets with Unicorn. Some skills read IDA exports or a connected IDA Pro MCP; tool requirements depend on the module.

  • Native analysis
  • Frida
  • Unicorn

Rank 08

WhiteNightShadow/hello_js_reverse_skill

hello_js_reverse_skill

Analyze frontend behavior with versioned evidence

Provides problem routing, Cookie attribution, signature clues and comparison methods. Check generation, acceptance, target success and continued usability separately; a single HTTP 200 does not establish success.

  • JavaScript
  • Browser evidence
  • Layered validation

Rank 09

LING71671/open-reverselab

Open-ReverseLab

A workspace with a knowledge base, MCP and evidence directories

Manage Web, Android and Windows analysis in separate areas. The source declares more than a hundred MCP tools; actual availability requires starting the server and checking each tool's local dependencies.

  • Knowledge base
  • MCP
  • Workspace

Rank 10

Fausto-404/js-reverse-automation--skill

js-reverse-automation--skill

Browser evidence and JSRPC artifact delivery

The actual skill name is js-reverse-automation; it connects Chrome MCP, JSRPC, Flask and Burp artifacts. The pinned version lacks the requirements.txt required by its installation documentation, so resolve the missing dependency list before startup.

  • Chrome MCP
  • JSRPC
  • Installation blocker

03Mappings to confirm first

Same-name sources and description differences

ItemSources readSelection guidance
Android skillSimoneAvogadro original; CreditTone derivativeUse the original for the APK, Kotlin class-name and API guidance here; the derivative focuses on Codex and dynamic scripts, so keep their installation steps separate
ctf-skills candidate Aljagiello/ctf-skillsSeparates Reverse, Pwn, Crypto, Forensics and other categories, with a central tool installation process
ctf-skills candidate BHuoxing999/ctf-skillsCenters on six modules, Web, Crypto, Reverse, Stego, SQLi and Misc; prepare each environment from its own documentation

The CreditTone derivative's README supports version comparison but cannot replace the current original documentation. The module counts, installers and Python requirements of the two CTF candidates must also remain separate.

Source or promotional wordingVerified limits
Pixel-level replication with replica-skillThe official guidance requires independent branding; the difference tool compares layout edges and ignores color by default, without targeting pixel parity with the original site
Recovering backend architecture from public screensPublic screens support data-model hypotheses and a new architecture, without confirming the original service's private schema or APIs
leanrea's 8 KB size and lower cost8,374 bytes is the skill file size; the README benchmark compares old REA 6.5.0 on one machine and model, with 3 repetitions per cell, and was not rerun here
Hundreds of Open-ReverseLab toolsStatic server declarations do not establish that every tool is installed, connected and tested
Kotlin name recoveryAvailable metadata and annotations support class-name suggestions, without guaranteeing recovery of method, field or pure Java class names

04Prepare skills, servers and tools separately

Installation forms and dependencies

Skill documents supply operating rules, MCP registration gives an agent tool interfaces, and analysis engines process samples. Check all three separately before treating a listed skill as a working environment.

ToolOfficial installation entry pointAdditional environment or limits
REAnpm setup, or the documented plugin/CLI routeNode.js and npm that meet the version requirements; native analysis also needs a provider, and some Linux routes need procps-compatible ps
reverse-skillClone the complete repository and update the local tool indexJava/JDK, Node.js, Python and scenario-specific tools; the Codex adapter does not install external tools automatically
Android originalClaude Code marketplace pluginJava JDK 17+ and jadx; Kotlin mapping scripts use Python 3, with other decompilers selected by route
replica-skillClaude Code plugin, or a copy of the skill directoryBundled offline tools need Python 3.8+; prepare the browser, application framework and deployment services separately
leanreaskills CLI or a manual copy of the skill directoryA working shell and file, rg, asar, jadx or native tools required by the target
ctf-skillsThe selected candidate's READMEljagiello's pyproject requires Python 3.12+; check category-specific tools separately
reverse-skillsskills CLIIDA exports or a working MCP; prepare Frida, Unicorn and other tools by module
hello_js_reverse_skillCopy into the host's skill directory as the README describesCheck the Node, Python, WASM or browser route; the browser route also needs a Camoufox MCP environment
Open-ReverseLabClone the workspace and read the platform's START_HERE entryPython 3.10+, uv and tools for the relevant area; Windows GUI tools are not automatically available across platforms
JS automation skillChrome MCP registration plus the internal skill directoryPython 3.10+, Flask, requests, jsonschema and external JSRPC; the missing requirements.txt remains unresolved

Documented installation entry points

REA setup proposes changes to agent configuration and backs up existing settings; review them, follow the tool's prompts and restart the agent. Running setup is an installation step that can change configuration.

bash
npx rea-agents setup

Each line below is an independent option; choose the one you need. The CTF command explicitly selects the ljagiello candidate, without confirming that the original post intended it.

bash
npx skills add aicodeking/leanrea
npx skills add P4nda0s/reverse-skills
npx skills add ljagiello/ctf-skills

The Android and replica entry points below apply to Claude Code. Other hosts require a project's adapter or manual directory setup; these plugin commands cannot be applied directly.

text
/plugin marketplace add SimoneAvogadro/android-reverse-engineering-skill
/plugin install android-reverse-engineering@android-reverse-engineering-skill
/plugin marketplace add Jakeschincariol/replica-skill
/plugin install replica-skill@replica-skill

05Choose an entry point for the question

Task types and suggested deliverables

Known question or inputEvaluate firstRequired deliverable
Locating functionality in an Electron/JavaScript release you ownleanrea or REAModule and IPC clues, file locations, observations and unknowns
Choosing tools for an APK, JS or native samplereverse-skillScenario identification, tool index, task scope and a minimal analysis plan
Classes and API clues in an Android packageAndroid originalFramework identification, call chains and class-name mappings with sources
Symbols and data structures in native decompiler outputreverse-skillsCheckable hypotheses based on strings, constants, cross-references and offsets
Name mappings in a Unity IL2CPP release you ownrev-u3d-dump in reverse-skillsBinary-to-metadata mappings and symbol artifacts for analysis tools
Designing another product from public product behaviorreplica-skillScreens/flows, inferred models, a new architecture, independent branding and a test plan
Request differences and Cookie origins in a Web interface you ownhello_js_reverse_skillVersions, actions, paired evidence and layered validation results
Local CTF attachments and lab challengesThe selected ctf-skills candidateChallenge routing, dependencies and reproducible records
Shared directories for evidence and tools across areasOpen-ReverseLabSource mappings for samples, exports, notes and reports
JSRPC/Flask/Burp deliverablesJS automation skill, after resolving its installation blockerSeparate checks of artifact contracts and evidence from actual operations

The Unity module and Android analysis can support maintenance and research on game releases, though this list covers general reverse engineering. For game planning, engine implementation and interface skills, see the game development topic.

06Observations, inferences and unknowns

Evidence records and acceptance checks

REA, leanrea and the JS method documents require a distinction between direct observations and inferences. Limit the work to one question, preserve sample identities, tool versions, inputs and outputs, and link every conclusion to an evidence location.

Evidence typeSupported conclusionConclusion not yet supported
Strings, files and decompiled snippetsSpecific content or a candidate call relationship exists in that versionThe path was triggered at runtime
Reproducible execution recordsA specified version behaved a certain way under specified actionsAll versions, accounts or environments behave the same way
Model-proposed architecture and class namesHypotheses for later checkingThe original author's architecture or names have been recovered
Generated code and test artifactsFiles meet the checked contractThe real service, JSRPC action or complete workflow works

hello_js_reverse_skill separates generation, acceptance, target success and continued usability. The JS automation skill also distinguishes port connectivity, artifact contracts and actual actions; timeouts, error responses and evidence from old pages cannot count as passes.

Comparison case for an Electron application you own

This suggested case uses read-only copies of two versions of the same application you own, with one question: "What changed in the modules and IPC calls after search was added?" Establish candidate paths through static analysis, then arrange runtime observation when execution evidence is needed.

  1. Create a separate working directory and preserve the mapping between original samples and output locations.

  2. Inventory modules, imports and IPC clues by file type, keeping the scope limited to search.

  3. Compare candidate call paths across both versions using the same inputs for the same question.

  4. Mark branches lacking execution evidence as unknown and state the next action that could verify them.

  5. Deliver sample versions, tools, commands and output paths so another person can repeat the comparison.

07Check prerequisites first

Limits and troubleshooting

SymptomCheck firstNext action
A skill appears but its tools cannot runHost shell permissions, tool locations and versionsComplete the dependencies for the selected scenario without installing every tool at once
MCP is registered but the analysis engine is unavailableServer status, provider paths and platformValidate the required capability with the same minimal sample
Decompiled names are unreliableMetadata, obfuscation and artifact sourcesPreserve original names and evidence without overwriting facts with inferences
A Unicorn snippet cannot executeExternal functions, memory and system dependenciesReduce the snippet and list the missing environment; do not treat it as full OS emulation
JS returns 200 but the result is wrongApplication content, evidence version and action pairingCheck target success and continued usability separately
Evidence is unavailable for closures, internal WASM functions or cross-origin iframesThe skill's stated capability limitsRecord the unsupported scope and use accessible sources and methods
Code exists without evidence of a real actionContract tests being conflated with execution testsReport file checks, connectivity and actual operation results separately

Analysis output can contain sample content, request data or credentials. Before sharing it, check source paths and export scope, retain versions and steps needed for troubleshooting, and remove private data unrelated to the question.

08Start with your existing environment

Selection guidance and further reading

Local tools already available

Start with leanrea's file identification and inventory

Produce an evidence report for one sample you own, then evaluate REA if you need consistent MCP or CLI output; document size does not establish analysis capability.

Unclassified question

Plan the scenario and tools with reverse-skill

Check the tool index, scope and minimal analysis target before reading the relevant skill; avoid loading the entire tool collection at once.

Native and Android

Choose Android or reverse-skills for the sample

Use the Android route for APK structure and Kotlin clues; select a specific module for symbols and structures in existing decompiled data or Unity mappings.

Public product research

Define an independent product with replica-skill

Separate observations, inferred models and new product design, and keep independent branding; validate functionality and flows without treating inferences as the original service's architecture.

Web and workspaces

Confirm the evidence route and actual dependencies

JS method documents support versioned evidence and layered validation, while Open-ReverseLab manages work across areas; resolve the missing dependency list before taking the JSRPC route.

References