Closed Source Is No Longer a Moat (REA Explained)

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: Closed Source Is No Longer a Moat (REA Explained) · Channel: Rob Shocks · 09:06 · Watch on YouTube

Topics: AI agents, Cybersecurity and software security, Software engineering with AI

Summary

REA is an open-source tool that connects AI coding agents to established reverse-engineering tools, helping them inspect binaries and explain how software features work. It does not recover original source code; instead, it produces evidence-backed findings such as pseudocode, call paths, and module maps that an agent can use to build a new implementation. A demonstration on the creator’s own stripped-down app shows the agent recovering the logic for a valid unlock code. The video argues that reverse-engineering friction is no longer a dependable moat for client-side software, while emphasizing legal, security, and sandboxing risks.

Key points

REA stands for “reverse engineer anything” and works with agents that support MCP.
It can inspect native binaries and other targets, including desktop apps, Android APKs, firmware, websites, and smart contract bytecode.
REA does not restore an app’s original source code; it provides artifacts such as pseudocode, assembly, module maps, call paths, and network activity.
The project wraps established tools such as Ghidra, Hopper, and IDA Pro, making their capabilities easier for agents to use.
In the demonstration, an agent used Ghidra to inspect a stripped binary and identify the logic for a valid unlock code.
The creator argues that client-side software should be assumed inspectable, but says code was never the only or strongest moat.
Data, users, cloud security, shipping speed, product taste, and server-side systems are presented as stronger advantages.
Reverse engineering can raise legal issues, especially where terms of service, DRM, or encryption are involved.
The video warns that runtime capture is not a sandbox and recommends caution with unknown binaries and agent permissions.
Suggested uses include auditing apps on your own machine, learning from feature designs, and recovering logic from your own builds.

Chapters

Start	Chapter	Summary
00:00	What REA does	The video introduces REA and explains how agents can investigate software without access to its source code.
02:09	How REA works—and important cautions	REA is described as a layer of agent-friendly tools over existing reverse-engineering software, followed by a sponsored testing segment and a warning to use caution.
04:16	Testing REA on a sample app	The creator uses a self-built, stripped binary to demonstrate an agent finding the logic behind its unlock code.
05:54	What changes for software developers	The video considers how lower reverse-engineering friction affects client-side software and argues that other advantages matter more than obscured code.
07:28	Legal risks, safe uses, and advice	The creator outlines legal and security cautions, suggests responsible uses for REA, and closes with a warning against cloning competitors.

Quotes

It doesn’t just hand you the original source code. Nothing can do that. — 01:36

It understood the logic and then wrote something completely new — 05:22

Code was never really the moat in the first place. — 06:54

I am not a lawyer. This isn’t legal advice — 07:28

What you want to do is understand the idea and build something better — 08:35

Concepts and entities

REA, Ghidra, Hopper, IDA Pro, MCP server, CLI, Test Right, Rob Shocks

Full transcript (original language)

00:00 Okay, so there’s a new open-source repo that lets your code the agent that might be Claude Code, Cursor, Codex, whatever you use, look inside an app that it has no source code for, figure out how a feature works, show you the evidence, and then build you a version. People are doing this for games, for software. They’re cracking desktop applications that have been closed source for the last 20 years. So, it’s called REA, which stands for reverse engineer anything. And it’s one of the fastest rising repos on GitHub right now, something like 7 or 8 thousand stars in a single day and growing by the minute.

00:32 I’m Rob from Suite Dimension, 20 years as a software developer and product manager, and on this channel we build real stuff with AI agents. And I want to do two things in this video. First, show you what REA actually does, because most of the posts that I’m seeing about this are getting it really wrong. And second, explain why I think it changes something really big for anyone who ships software. And I’m going to actually show you working on some source code that I built and threw away the key to see if we can actually get it back again. Is this thing all hype or does it actually work? So, here’s the pitch from the readme, and it’s basically this. You see a feature in an app that you want in

01:04 your own product. You go and ask the agent to investigate it, and it can do that without the actual source code of the app. It’s able to look inside and break it down. Under the hood, it’s basically an MCP server and a CLI, which you can easily plug into Claude Code, Codex, Cursor, whatever you want, basically anything that speaks MCP, and that’s a lot now. And this isn’t just Electron apps where we could see some of the source code before. I’m talking about native binaries on Mac, Windows, and Linux. This is a huge chunk of the desktop apps that you use every day. .NET, Android APKs, firmware, websites,

01:36 even smart contract bytecode. Now, here’s where people are getting a little bit confused. It doesn’t just hand you the original source code. Nothing can do that. When an app is compiled, the original code is gone. What you’re going to get back from this investigation is pseudo code, assembly, module maps, call paths, and network activity with some evidence attached to show you why the agent thinks it’s built this way. And the evidence gives you back is really interesting. Every finding comes back with where it came from, how confident the model is, and what it couldn’t figure out itself. This is the kind of thing you would have spent an awful lot of money on and a huge amount of time to

02:09 do previously. So, the architecture is really simple. So, Riya itself isn’t a decompiler. It’s nothing revolutionary or special. It’s basically wrapping the serious tools reverse engineers already use, which is things like Ghidra, which is free and from the NSA, Hopper on the Mac, and Pro, which is the expensive industry standard. So, all of this reverse engineering was possible before with enough time and enough money. The difference now is the friction has been removed. So, these tools are all incredibly powerful and also notoriously

02:40 hard to learn. What Riya does is give your agent dozens of plain text intent tools on top of them. Things like open this binary, find the strings, follow the function callers, so it can find its way through and understand the code. Setup is super simple. It’s just NPX Riya-agent-setup. It shows you a plan of what it’s going to change. It backs up your config, adds the MCP server, and a skill that teaches your agent how to do the investigation. And then it asks before touching anything critical. Coding agents often finish a session telling you everything is working great, but in reality there

03:13 are multiple issues, particularly when it hits production. This video is sponsored by longtime friends Test Right. It’s an AI testing agent that writes end-to-end tests and then runs them against your real running app. So, an end-to-end test is exactly that. Not just a simple test, it’s actually impersonating a user to see if the app really works. The bit I like is it plugs straight into your coding agent. There’s an open source CLI and an MCP server. So, in Cloud Code I just say, “Hey, help me test the checkout flow.” It writes 12 tests, it runs them in a real browser

03:44 and in the cloud, and I can set this up to run on a schedule. Maybe a test fails, like the promo code isn’t coming off the order total. The failure comes back with the failing step. It gives you a screenshot and the root cause. So, the agent fixes it then reruns and we get 12 out of 12 passing tests. And those tests are kept, so they run on every single change. You can try it for free, link in the description. Install the CLI. Next time your agent finishes and says it’s done, get Test Right to prove it. Now, as always, I’m totally holding my hands up here. Be so careful with this. This is really powerful. You’re going to be

04:16 using this tool to inspect all these binaries and tools that you have no idea what’s inside of. There could be hidden malicious in instructions for your AI. Run this stuff in a sandbox. Be very careful. Okay, so let’s actually use it. And I wanted to do a fair test, not a kind of a, you know, trust me, bro, it worked. So, I built my own app for this. I can’t run this against an existing proprietary app out there or I will get sued. So, I just built my own one so you can see how this works. Okay, so it’s called a vault. You type in an unlock code and it either lets you in or it doesn’t. Somewhere inside I’ve got a rule for what a valid code is. And then this hidden message appears only when

04:49 you get it right. Because it’s my app, there’s no license key to worry about and I’ve got the perfect answer key, the source code, which I am now going to put away. So, I also built this the way a real app ships, which is optimized with every function name stripped out. So, check unlock code is now just a function at this address, which is a lot more realistic. Now for the agent, I’ve got Ghidra set up in my agent here with Ghidra beside it, the free one from the NSA. So, it opens up the binary and it gets back 242 plus functions. Every one of them is just called fun and an

05:22 address. And it then it starts to decompile, turning machine code back into something a bit like the language C. So, within a handful of calls it’s actually found the one that matters. So, the big question, does it actually work? Well, it wrote me a little generator and gave me a code, A G N T dash 1 0 0 1. And I’m in. Big thing people are missing here is it’s not pulling out the source code. It’s basically generating itself or breaking it down and reverse engineering it. It didn’t copy the code. It understood the logic and then wrote something completely new, a code generator, which my app doesn’t even

05:54 have. So, I guess the big thing for software development, for years there’s been this kind of unspoken protection that software has been afforded. Sure, you could always reverse engineer app. It’s not that this wasn’t possible before, but it was slow, specialized, and really expensive. So, almost nobody ever bothered doing it. That friction of reverse engineering was the protection and REA and REA basically deletes all that friction. Now, I’ve seen a lot of people post about how planes are going to start falling out of the sky because they can be reverse engineered and hacked. I really don’t think that is the

06:24 case. There are still so many hurdles and layers that you need to get to before you can compromise many systems. But, in this world, if you ship a desktop app, a browser extension, a game, a mobile app, or a big client-side JavaScript bundle, you should now assume that anyone’s agent can map out how it works. We’re going to see some interesting GTA 6 mods coming up in the next few months. And look, I don’t think this is a disaster like so many people are saying on a lot of posts that I’m seeing. I just think it’s a bit of a correction. Code was never really the moat in the first place. Well, not for

06:54 most of us anyway. Your moat really is in your data, your users, your your cloud security, how fast you ship, your taste, and the stuff that runs on your servers, where basically nobody else can inspect it. Good security flip side to this, you can point this at apps on your own machine and ask, “What is this thing actually doing? What is it sending home?” There have been lots of cases where 3D printers and even coffee machines have been compromised under sending tons of data off your network back to some source that you were not aware of. Okay, so the important bits. Three things. One, legal. I am not a lawyer. This isn’t legal advice, but reverse engineering for interoperability

07:28 had generally been protected, so it’s something you’re kind of allowed to do. But, a lot of apps have terms of service that exclusively ban it. And breaking DRM or encryption is a whole separate legal problem. Your own apps, open source binaries, security challenges, and things you’re authorized to test are the safe ground. OREA’s own disclaimer says you are responsible. Second thing is, this isn’t a sandbox. If you run a target through its runtime capture, it runs with your permissions. So, don’t point it at any random binary you downloaded off a forum, and make sure you’re keeping your agent’s approval

08:01 prompts which on, so you know what it’s doing. Who knows Who knows what kind of prompt injection could be in there. And the other thing is, this repo seems to be moving extremely fast. Lots of breaking changes, amazing energy, but expected to change continuously. So, make sure you’re updating it constantly. So, as a software engineer, things that I would find this really useful for. So, learning how great desktop apps handle things like offline sync, clipboards, and search, and then go and build my own version. I’d be using it to audit electron apps on my machine, which I have so many of now, and then recovering logic from my own builds, where that source maybe has gone missing. What I

08:35 wouldn’t do is just point this at a competitor and clone the product. It’s a legally risky thing to do, and it misses the point. What you want to do is understand the idea and build something better, because you’re never going to match that company’s marketing anyway. And now it’s all about distribution. So, I’m curious. If you could point this at one feature in one app, what would it be? So, tell me in the comments. If you want to go deeper on building with agents, MCPs, and things like this, that’s exactly what we do in Switch Dimension, the course and community. It’s closed at the moment, the waitlist is open up, and the link is in the description. And if this was useful, hit subscribe. I cover the agent tools that actually matter, and skip the ones that

09:06 don’t. Next, check this one out on skills.