RIP Reverse Engineer Anything! This 8 KB Skill Outperforms REA (38% Faster)

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: RIP Reverse Engineer Anything! This 8 KB Skill Outperforms REA (38% Faster) · Channel: AICodeKing · 09:50 · Watch on YouTube

Topics: AI agents, AI evaluation and benchmarks, Cybersecurity and software security, Claude Code

Summary

The video introduces Lean REA, an approximately 8 KB skill file that uses an agent’s normal shell and existing tools to reverse-engineer software targets. In a benchmark of 36 runs across four tasks, Lean REA matched REA’s accuracy closely while finishing 38% faster, costing 35% less, and using fewer turns and tokens. The creator also compares context use and individual tool performance, while emphasizing that the benchmark was small and that a model without a skill already performed well. The video explains how to install Lean REA and concludes that a few well-chosen commands may be more useful than loading 207 tools.

Key points

Lean REA is a single skill file of about 8 KB, with no MCP server or additional tools.
The skill maps target types to direct commands and includes ready-to-run commands, practical tips, and evidence rules.
The benchmark used Claude Code in headless mode with Sonic 5.5, four tasks, three setups, and three runs per task.
Lean REA completed the benchmark in 388 seconds, compared with 479 seconds without a skill and 627 seconds with REA.
Lean REA cost $2.17 and used 55 turns; REA cost $3.36 and used 124 turns.
REA scored 75 out of 75, while Lean REA scored 74 out of 75; the one miss involved naming an older version of an IPC channel.
With MCP tool search disabled, the creator measured about 400,000 tokens for REA on a simple ‘okay’ message.
The creator reports that the benchmark was limited to one model, one Mac, and three runs per task.
The video identifies two bugs in the skill: Ripgrep needed the -u flag to search hidden folders, and ZSH required output markers to be quoted.
Lean REA can be installed with the skills CLI using npx skills add aikocoding/leanria.

Chapters

Start	Chapter	Summary
00:02	Introducing Lean REA	The creator contrasts REA’s MCP server and large toolset with Lean REA, a small skill file that runs ordinary commands directly.
01:34	What the skill contains	The skill includes target-specific command guidance, ready-to-run first moves, useful REA-derived tricks, and rules for labeling evidence.
03:08	Benchmark setup and results	The creator describes the three test setups and four reverse-engineering tasks, then reports Lean REA’s speed, cost, turn, and accuracy results.
05:44	Context use and tool comparisons	The video compares token use and direct command performance, and notes that Lean REA’s advantage over a model without a skill is more modest.
07:47	Limitations, installation, and conclusion	The creator discusses benchmark limitations and bugs, explains how to install Lean REA, and argues that a small skill can be preferable to a large toolset.

Quotes

It is one skill file. It is about 8 kilobytes. — 00:33

So, compared to REA, Lean REA was 38% faster. — 04:42

Just to say okay. — 06:15

Even a small file can have bugs. — 08:18

You do not need 207 tools. — 09:20

Concepts and entities

REA, Lean REA, Claude Code, Sonic 5.5, aikocoding/leanria, skills CLI, Ripgrep, ZSH

Full transcript (original language)

00:02 Hi. Welcome to another video. Before starting the video, I have been posting many tutorials of open source projects that I like in members only videos as well. I am posting more regularly. So, if you want to support the channel, please hit the join button and the videos are available on all tiers from bronze and up. So, please go ahead and check them out. Now, back to the video. So, in my last video I talked about REA. REA means reverse engineer anything. It is a very popular project on GitHub.

00:33 In that video, I said that REA is not that useful. I said that models can already do this work with the normal tools on your machine and I said that a small skill file can do the same job. Some people asked me to prove it, so I built it. I call it lean REA. It is one skill file. It is about 8 kilobytes. And in my benchmark, it was 38% faster than REA and 35% cheaper with the same accuracy. So, let’s get right into it. First, let’s remember what REA is. REA is an MCP server and a CLI.

01:04 It puts 207 tools into your agent. The NPM package is about 25 megabytes and the skill files with all the reference docs are about 72 kilobytes. Under the hood, REA mostly calls tools that you already have. For an electron app, it uses the ASAR package. For a Mac binary, it uses Otool and NM. For a Go binary, it reads the same build info that Go version {dash} M reads. For Android, it uses Jadx and APKTool. So, REA is a layer on top of the same tools. Lean REA

01:34 removes that layer. There is no MCP server. There are no extra tools. The agent uses its normal shell and it runs the real tools directly. Now, let’s talk about what is inside the skill file. To make it, I went through the REA source code. I mapped each REA feature to the plain command that does the same thing. Then I kept only the fastest command for each target. The first part is a short list of rules. Work on a copy of the target. Check the file type first. Do not read a big minified file, search inside it and read only the part that you need and put many small checks into one shell call. The second part is a router.

02:06 It is a table. On the left, you have the type of target. On the right, you have the fastest command for It covers electron apps, minified web bundles, and Mac, Linux, and Windows binaries. It covers Go, Rust, .NET, Android APKs, and Flutter. And it also covers WASM, SQLite files, packet captures, firmware, and websites. The third part is what I call first moves. These are ready commands that the agent can paste and run. For a Mac binary, one command gets the linked libraries, the exports, the

02:37 imports, the strings, and the full list of functions. All of it in one call. And this matters a lot because with agents, each turn costs time. A turn is one round trip between the model and a tool. Fewer turns means a faster answer. The skill also keeps the useful tricks that are inside the REA code. For example, how to read the electron fuses, how to find the Go build info in a binary, how to find the Flutter snapshot hash. These are small details, but the model can miss them. So, they are in the file. And it has simple evidence rules. The model marks each claim as seen,

03:08 inferred, or unknown. If it did not find a fact, it says unknown. It does not say that the thing is absent. That is the whole skill. The REA skill docs are about nine times bigger. Now, let’s talk about the benchmark because this is the important part. I used Claude code in headless mode with Sonic 5.5. I made three setups. The first setup is no skill and no MCP, just the model and its normal tools. The second setup is Lean REA. The third setup is REA. That means the REA MCP server plus the official REA skill. Then, I made four

03:39 tasks. The first task uses a real electron desktop app. The model must trace one feature through the app code. It must find the native function, the class that controls it, and the IPC channels. IPC is how the parts of an electron app talk to each other. The second task uses the native add-on from that same app. It is a small Mac binary. The model must list the exports, explain one permission check, and explain how the single instance lock work. >> The third task is a Go binary. I used the GitHub CLI. The model must find the Go version and the versions of two dependencies.

04:11 The fourth task is the hard one. It uses the same native add-on, but this time the model must read the disassembly. It must find the exact path of a socket file, the wire protocol, and how the app checks who is connecting. Each setup did each task three times. So, that is 36 runs in total. I checked every answer against an answer key that I made by hand. And here are the results. Lean REA finished all the runs in 388 seconds. With no skill, it took 479 seconds. And REA took 627 seconds. For cost, Lean REA

04:42 was $2.17. No skill was $2.21. And REA was $3.36. For turns, Lean REA used 55 turns. No skill used 81. And REA used 124. So, compared to REA, Lean REA was 38% faster. It was 35% cheaper. It used 56% fewer turns. And it used 60% fewer tokens. And the accuracy was the same. REA got 75 out of 75. Lean REA got 74 out of 75. The one miss was a small one. There are two versions of one IPC

05:13 channel in the app. And in one run, Lean REA named the older one. The biggest gap was on the electron task. Lean REA took about 35 seconds. REA took about 83 seconds. On the Go task, Lean REA took about 12 seconds. REA took about 26 seconds. And the reason is simple. The model only needs one command for this. With REA, it first has to find the right tool, call it, and then read a very big result. In one REA run, the tool output was so big that Claude code saved it to a file. Then the model had to open that file in more turns. So, that is extra time for nothing. Now, let’s talk about

05:44 context. Because this was a point in my last video, I sent one simple message, which was reply with okay. Then I measured how many tokens each setup used. With nothing, it was about 31,000 tokens. That is the normal Claude Code system prompt. With Lean REA, it was about 34,500 tokens. With REA, it depends on your agent. Claude Code has a feature called tool search. It loads the MCP tools only when it needs them. With that turned on, REA adds about 3,500 tokens. So, it is fine there. But, many agents load all the tools at

06:15 the start. So, I turned tool search off, and then that one okay message used about 400,000 tokens. It cost $1.60. Just to say okay. So, that is the same problem that I talked about last time. In an agent that loads all the tools, REA fills most of the context before the model reads one line of your target. I also did a small test on the tools themselves. Same file, same job. One time with the REA CLI, one time with the plain command. For the go build info, REA took about half a second. The plain go version command took 600ths of a

06:47 second. For the Mac binary overview, REA took 3.3 seconds. The plain command took 400ths of a second. And for the electron app, this one is funny. REA did not work at first. It gave an integrity error on the real app. You have to add an extra flag to make it continue. With that flag, it took about 48 seconds. And it gave back 140 megabytes of JSON. The plain way is to extract the SR file and search it with rip grep. That took about 5 seconds, and the output was 24 kilobytes. And it had the answer. Now,

07:17 let me be fair here. The model with no skill was already very good. It got almost everything right. Lean REA was about 19% faster than no skill, and it used about 32% fewer turns. But, the cost was about the same. So, the big win is against REA, not against the plain model. The plain model did refuse one task one time. It thought that the disassembly task could help someone defeat a security check. With the skill, that did not happen. But it was only one run, so take it with a grain of salt. Also, this is a small

07:47 benchmark. It is three runs per task, one model, and one Mac. I did not have Ghidra or Jad God installed, so the native tasks used the normal Xcode tools for all the setups. And I found two bugs in my own skill while I tested it. So, I want to tell you about them because they are good tips. The first one is about Ripgrep. Ripgrep skips hidden folders by default, and many Electron apps keep their code in a hidden folder called .webpack. So, my first search found nothing. Now, the skill tells the model to use Ripgrep

08:18 with the -u flag. That flag searches hidden files, too. The second one is about ZSH, which is the default shell on a Mac. I used echo with two equal signs as a marker between outputs, but ZSH reads two equal signs in a special way, and the command failed. Now, the markers are in quotes, so test your skill files. Even a small file can have bugs. Now, let’s talk about how to install it. It is on GitHub at aikocoding/leanria. And it works with the skills CLI. Just run NPX skills add aikocoding/leanria. It asks which agents you use. It

08:50 supports Claude Code, Codex, Cursor, Gemini CLI, Open Code, and more. If you want it in every project, add the -g flag. And if you want to skip the questions, add the -y flag. Then, you can use it with the /leanria command. For example, /leanria, “How does the search feature in this app work? Show me the evidence.” The repo also has the full benchmark, so you can run it yourself. There is a setup script, a script to run all the tasks, and a script for the context test. And all the raw results are in there, too. So, what do I think? I think this shows the point that I made

09:20 in the last video. Models are good at this already. You do not need 207 tools. You need the right commands, a few nodes, and a model that can run them. REA is still a good project. The team did a lot of good work, and a lot of the tricks in my skill came from reading their code. So, credit to them. But if you are a programmer, I would use the small skill. It is faster, it is cheaper, and you can read the whole thing in 2 minutes. Overall, it’s pretty cool. Anyway, let me know your thoughts in the comments. If you like this video, consider donating through the Super

09:50 Thanks option or becoming a member by clicking the join button. Also, give this video [music] a thumbs up and subscribe to my channel. I’ll see you in the next one. Until then, bye. >> [music] [music]