DEV Community

Batuhan AYRIBAS
Batuhan AYRIBAS

Posted on Edited on

Reverse Engineering with AI Agents: Introducing REI Skills and the REA Workbench

#ai #security #opensource #agents

895 validated agent skills. 21 AI development targets. 12 specialized reverse-engineering skills. One open-source engineering toolkit.

AI coding agents can generate software surprisingly well. But what happens when the source code is missing?

What if you need to inspect an unfamiliar binary, understand an Android APK, investigate embedded firmware, compare WebAssembly modules, or reconstruct an undocumented protocol?

A plausible explanation from an AI model is not evidence.

That's one of the problems we're trying to address with REI Skills and REI REA, developed at Rootcastle Engineering & Innovation.

Explore the Live Developer Hub

View REI Skills on GitHub

The Problem: AI Agents Need Engineering Discipline

Most AI assistants are good at generating plausible explanations. Reverse engineering requires something different.

An investigator needs to establish:

  • What can actually be observed in an artifact?
  • Which conclusions are inferred rather than verified?
  • Which tools produced each finding?
  • Can another engineer reproduce the result?
  • What remains unknown?

An AI agent that confidently invents a function's purpose is potentially more dangerous than one that simply says, "I don't know."

We wanted to make evidence tracking, repeatability, and explicit uncertainty part of the workflow.

Introducing REI Skills

REI Skills is an open-source registry and management layer for engineering workflows used by AI coding agents.

The current repository contains:

  • 895 validated skills across 10 engineering categories.
  • 21 AI development targets, including Claude Code, Codex, Gemini CLI, Cursor, and other environments.
  • A smart skill router that recommends relevant skills from the task description and workspace context.
  • A built-in MCP server for skill discovery, retrieval, and installation.
  • Engineering workflows covering development, architecture, security, infrastructure, testing, and data systems.
  • REI REA, a specialized reverse-engineering skill suite with an optional executable workbench.

The registry includes original Rootcastle skills alongside curated work from the wider open-source ecosystem, with source attribution and validation.

The goal is not to load hundreds of instructions into every agent conversation. It's to identify and load the right procedures for the problem.

Install REI Skills 

npx rei-skills
Enter fullscreen mode Exit fullscreen mode

Or install specifically for an AI assistant:

npx rei-skills --claude
npx rei-skills --codex
npx rei-skills --gemini
Enter fullscreen mode Exit fullscreen mode

Explore the available tools:

npx rei-skills search firmware
npx rei-skills targets
npx rei-skills doctor
Enter fullscreen mode Exit fullscreen mode

REI REA: Reverse Engineering as a Verifiable Workflow

This is the part of the project I'm particularly interested in developing further.

REI REA (Reverse Engineering Workbench) integrates 12 specialized agent skills:

Investigation area Focus
Native binaries PE, ELF, Mach-O, COFF
Android applications APK, AAB, DEX, JNI
Firmware and IoT Embedded Linux, MCU, UEFI, telemetry
Electron and JavaScript ASAR packages, IPC, preload scripts
WebAssembly and managed code WASM, .NET, JVM
Network protocols HAR, PCAP, telemetry frames
Digital forensics Evidence indexing and case records
Reconstruction Behavioral specifications and differential testing

These skills guide the investigation. They do not imply that every format has a fully automated executable analyzer.

The optional Python workbench provides the actual local analysis capabilities.

Install the Reverse Engineering Skills

For Codex:

npx rei-skills add rei-rea --codex
Enter fullscreen mode Exit fullscreen mode

For Claude Code:

npx rei-skills add rei-rea --claude
Enter fullscreen mode Exit fullscreen mode

For Cursor:

npx rei-skills add rei-rea --cursor
Enter fullscreen mode Exit fullscreen mode

The bundled skills provide investigation procedures, tool selection guidance, and evidence requirements.

Optional: Install the Python Workbench

The executable component is maintained separately:

REI Reverse Engineering on GitHub

git clone https://github.com/rootcastleco/Rei-Reverse-engineer.git
cd Rei-Reverse-engineer

python -m pip install -e .

rei-rea --version
rei-rea tools doctor
Enter fullscreen mode Exit fullscreen mode

The workbench targets Python 3.10+ and does not require third-party Python runtime dependencies.

Its built-in capabilities include bounded PE, ELF, and WebAssembly v1 parsing, structural comparisons, SHA-256 artifact identification, and evidence case management.

External static analysis tools require installation and explicit permission.

A Reproducible Example: Comparing Two WebAssembly Binaries

Let's use a practical example.

Suppose an embedded telemetry component is delivered as two WebAssembly modules.

You have version 1 and version 2, but no source-level change log.

What changed?

REI REA includes harmless WebAssembly fixtures and a recorded demonstration of structural analysis.

Clone the skill repository:

git clone https://github.com/rootcastleco/rei-skills.git
cd rei-skills
Enter fullscreen mode Exit fullscreen mode

With the optional REA workbench installed, inspect the first module:

rei-rea inspect \
  examples/rei-rea-demo/fixtures/telemetry-filter-v1.wasm
Enter fullscreen mode Exit fullscreen mode

Then compare both versions:

rei-rea diff \
  examples/rei-rea-demo/fixtures/telemetry-filter-v1.wasm \
  examples/rei-rea-demo/fixtures/telemetry-filter-v2.wasm
Enter fullscreen mode Exit fullscreen mode

The repository's recorded demonstration identifies two structural additions:

New imported function:

env.audit_log_frame

New exported function:

validate_packet_header

These are observable changes in the module structure.

But here's the important distinction:

An added function named validate_packet_header does not prove that packet validation is correct, secure, or even invoked.

Those are separate hypotheses requiring further evidence.

Observed: The exported function exists.

Inferred: The function may relate to packet-header validation.

Unknown: Its complete behavior and whether it is exercised at runtime.

That distinction is central to REI REA's investigation model.

You can inspect the reproducible fixtures and captured output in the demo directory.

Evidence Before Conclusions

REI REA provides a hash-linked evidence workflow intended to make investigations inspectable.

The basic process is:

  1. Identify the target artifact and calculate its SHA-256 hash.
  2. Select the appropriate format-specific analysis workflow.
  3. Record observed structures and findings.
  4. Separate confirmed observations from interpretations.
  5. Preserve evidence and verify recorded case integrity.
  6. Use differential tests to evaluate reconstructed behavior.

This matters particularly when investigating firmware, protocols, and software where an incorrect assumption can propagate into implementation decisions.

MCP Integration

REI Skills also provides a Model Context Protocol server for discovering and managing skills.

Start it with:

npx rei-skills mcp
Enter fullscreen mode Exit fullscreen mode

The optional REI REA workbench has its own local MCP server:

rei-rea mcp
Enter fullscreen mode Exit fullscreen mode

The REA server exposes 14 tools for operations including artifact inspection, structural analysis, comparisons, investigation planning, and evidence verification.

This allows MCP-capable coding assistants to interact with the local workbench through explicit tool boundaries rather than relying entirely on text-based reasoning.

What Works Today, and What Doesn't

I think it's important to distinguish implemented capabilities from planned integrations.

The current REA workbench includes:

  • Built-in bounded parsers for PE, ELF, and WebAssembly v1.
  • Structural diffing.
  • SHA-256 evidence tracking.
  • A local SQLite forensic casebook.
  • 14 MCP tools.
  • 11 optional static external-tool adapters.

The tool discovery catalog lists 124 tools, but cataloged does not mean installed or executable.

Live Ghidra, IDA, JADX, and Frida automation remains on the roadmap.

We are also not positioning the project as an autonomous exploitation framework. The current workbench emphasizes authorized, read-only investigation.

Why Open Source?

Reverse engineering benefits from independently verifiable findings.

If a tool identifies an import, an export, or a binary difference, another engineer should be able to inspect the relevant artifact and reproduce that observation.

The same principle applies to agent skills.

A reusable engineering procedure should have defined inputs, limitations, and verification steps—not just an impressive prompt.

That's the direction we're pursuing with REI Skills.

Try It and Help Shape the Next Release

The project is public, and contributions are welcome.

Live Developer Hub:
https://rootcastleco.github.io/rei-skills/

REI Skills GitHub:
https://github.com/rootcastleco/rei-skills

REI Reverse Engineering Workbench:
https://github.com/rootcastleco/Rei-Reverse-engineer

If you work with firmware, embedded systems, Android internals, binary analysis, protocols, or AI agent infrastructure, I'd be interested in your feedback.

In particular:

Which reverse-engineering workflow would you actually trust an AI agent to perform, and what evidence would you require before accepting its conclusions?

That's a more interesting engineering question than whether an AI can produce a convincing answer.

Built by Rootcastle Engineering & Innovation. Open source, reproducible workflows, and an engineering-first approach to AI tooling.

Top comments (0)