REA: Reverse Engineer Anything Tutorial with Hands-on Demo

Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.

Original language: English

Original video: REA: Reverse Engineer Anything Tutorial with Hands-on Demo · Channel: Fahd Mirza · 08:56 · Watch on YouTube

Topics: AI agents, Cybersecurity and software security, Software engineering with AI

Summary

The video introduces Ria, an MCP server that gathers evidence from binaries, Electron apps, and websites for an AI agent to interpret. After outlining prerequisites and demonstrating installation with OpenCode, the presenter uses Ria with Ghidra to investigate why the Linux calendar command skips 11 days in September 1752. The agent identifies relevant code and provides evidence, while the presenter checks its findings with another calendar setting. The presenter stresses that Ria is not a substitute for human judgment and that its results should be verified.

Key points

Ria connects to AI agents through MCP and gathers evidence for the agent to interpret.
For native programs, the presenter says Ghidra is also required, along with Node and Java.
The demonstration installs and verifies Ria in OpenCode using its setup wizard and doctor checks.
The example investigates the missing 11 days in September 1752 in the Linux calendar command.
The presenter finds that cal is a shortcut to the actual ncal program and uses its path for analysis.
The agent searches and decompiles likely functions, finding a hard-coded date: year 1752, month 9, day 2.
The presenter notes that the explanation of why 11 days were skipped came from the agent’s knowledge, not the code.
A test with Italy’s calendar or the old Julian calendar shows all 30 days, indicating the skip depends on a setting in the code.
Ria can help locate relevant code quickly, but users should verify findings and only analyze software they own or are allowed to examine.

Chapters

Start	Chapter	Summary
00:01	What Ria does and what it requires	The presenter explains Ria’s role as an MCP evidence-gathering tool, its limitations, and the software needed to use it.
02:09	Installing and checking Ria	The presenter runs the setup wizard, integrates Ria with OpenCode, and checks that its dependencies and tools are available.
03:15	Investigating the missing days	The presenter introduces the September 1752 calendar example, identifies the program path, and asks the agent to find the code behind the jump.
06:54	Reviewing the findings and limitations	The presenter walks through the agent’s code evidence, tests another calendar setting, and emphasizes verification and authorized use.

Quotes

It inspects binaries, electron apps, and websites, and hands your agent the findings along with the evidence. — 00:01

Ria only gathers evidence. — 00:33

use r.e. with Ghidra, find only the code that handles the missing days. — 05:22

That 11 days came from its own knowledge, not from the code. — 07:54

It gets you to the right code fast, and then you verify. — 08:56

Concepts and entities

REA, MCP, Ghidra, OpenCode, Claude Sonnet 5.5, OpenRouter, ncal, Fahd Mirza

Full transcript (original language)

00:01 This is Ria, reverse engineer anything. It’s an MCP server, MCP, the model context protocol, a standard way to plug tools into an AI agent, like a USB port for AI. Ria is the tool that plugs in. It inspects binaries, electron apps, and websites, and hands your agent the findings along with the evidence. It runs on your system, and you just ask questions in plain English. But, there

00:33 is one limitation, too. Ria only gathers evidence. Your agent’s model does the interpreting, so the answers are only as good as the model. For native programs, you also need a separate tool, which is called as a Ghidra. Now, one of the prerequisites which you would need to install before you do anything else is this Ghidra plus Node and Java, and maybe your code harness. I’m going to use OpenCode as my agent with a model

01:06 through an API key. Ria also works with Claude Code, CodeX, Cursive, Gemini CLI, and others. So, if you’re also following along, make sure you install all of these things on your system. Once you have them installed, then let me quickly show you that this is OpenCode, which is already configured with Claude Sonnet 5.5, and I’m using the key from OpenRouter, but as I said, you can use any model from anywhere.

01:37 Next up, let me quickly show you the versions which I’m using. So, for Java, for Node, and for Ghidra, I’m using these versions. Again, make sure you have either these versions or higher, otherwise this tool is not going to work. So, now you know what this tool is, what needs to be installed, let me do a very quick demo of this tool. And for that, I’m going to use NPX after setting the path to Java and Git repo.

02:09 So you see, this setup command is going to download and then run the setup wizard. Let me run this. Also, for the moment, I’m just going to exit from this Open Code. I will rerun it. So there you go. So once I ran that NPX, it is asking me which harness to use. So you can just scroll through and then from there, I’m going to select my Open Code, which it also detected, by the way. And now it is asking me install the guided area scale for CLI

02:41 use. I’ll just say yes, go for it. And then it is going to walk me through. I’ll just say apply. And that’s it. So Over Area is all installed and integrated with Open Code. You can also verify it from Open Code. So just do Open Code MCP list and it should show us that Area is already integrated. So you can see that we have Over Area running here. Next up, you can run the doctor in Open Code with this Area agent

03:15 just to check that Area can reach Git repo and Java. And the checks are passed. It also tells you which tools this MCP is exposing. There is a lot of information there. But I’m not going to worried about that. Let’s proceed. So for the purpose of demo, I am using this cal command, which is a Linux calendar command, and use AI to find the accept code inside that skips 11 days in September 1752.

03:47 I’m not going to read any source code. I will just ask questions. So this is the um output of cal. And again, for example, if you just want to go with September, um you know, month which is 9th in 1751, I’ll just print it. And then, uh now September 1752, and you will see that it jumps from 2nd to the 14th. There you go. You see? So, 11 days are missing.

04:20 And this is what I’m talking about. And if you There’s a very interesting story behind it where Britain switched calendars in uh September 1752. 11 days were skipped to fix a drift in the old calendar. And cal copies that, by the way. So, the program must have code that knows that exact date, and that is what I’m trying to find out with this reverse engineering by using this area tool. Now, in order to analyze a tool, and this is a very important point, you need

04:51 to have the actual path or name of that program. So, if I do, you know, want to check what is behind cal, I just read the link. And basically, ncal is the actual program, and cal is just a shortcut to it. So, I would need this path to my tool. So, now let me open that open code. And then, with this coding agent, I’m going to ask this AI agent to go and find the

05:22 code behind that jump. For that, I’m just going to do control shift V to paste one line. It is not showing us. I’ll quickly paste that prompt here what I have pasted just here, so that you know, sometime it doesn’t show. Let me do the word wrap. Sorry, I just want to show you the actual stuff here. There you go. So, I’m just asking it that use r.e. with Ghidra, find only the code that handles the missing days. On this date, explain the role and show the evidence. Don’t analyze anything

05:53 else. Let me now run this in open code. Let’s wait for it to come back. And you can see that it is already using that Riya without me telling it explicitly. And now Riya is going very deep into that code. While that happens, let’s talk a bit more around this um you know, very simple investigation flow. And before that, by the way, I have recently

06:23 started this free weekly AI newsletter, which you can subscribe at fahadmirza.substack.com. If you want to help out the channel, please go to the home page of channel and become a member as that helps a lot. Also, if you’re looking to rent a GPU or VM or CPU on very good price, you can find the link to vast compute in video’s description. So, primarily, this diagram just tells us exactly what we are doing at the moment. I asked my agent a question

06:54 about a program on my computer. The agent calls Riya, which uses Ghidra to inspect the program and hands back code and evidence, including what it couldn’t figure out. The agent reads that evidence, explains the answer, and if it needs more, asks a follow-up question. That loop is what you are watching now as it works through it. That is the whole story behind this. And there you go. I asked it only one question and the agent went to work.

07:24 Let me actually go at the top because this is where I want to show you what exactly it did instead of just showing you like a TikTok video. The program is stripped as you can see, right? So, every function name is gone. It searched for 1752 and found nothing. So, it listed the functions, decompiled the likely ones, and checked what references what. Inside the main function, it found a hard-coded date, year 1752,

07:54 month 9, day 2. There you go. How cool is that? That’s the last step before the jump. It also found the older 1582 switch code, and it told me which parts it hadn’t traced. That 11 days came from its own knowledge, not from the code. All of this took about a minute or so, and the cost is very negligible, as you can see here. Just under a dollar, with and I didn’t give it any source code. Every claims

08:25 comes with an evidence, as you can see here. Now, I have just ran these two commands just to show you. The agent said the skip depends on a country table, so I tested it with Italy’s calendar or the old Julian calendar. All 30 days came back. So, the skip is a setting in the code, not magic. And that is what Riya can do for you. Again, it’s a not a silver bullet, it is not magic. There are limitations, as I told you. This doesn’t replace your judgment. That

08:56 is the biggest limitation. It gets you to the right code fast, and then you verify. So, only analyze software you own or allowed to examine, by the way. That’s it. Let me know what do you think about Riya, and if you have used it anywhere, very keen to know that. Again, please help out the channel by becoming a member. Thank you for all the support.