REA Case Studies: Real Reverse Engineering Wins with AI Agents

The famous cases, and what they actually prove

REA went viral in October 2026. Amid the noise, a handful of well-documented case studies show what agent-assisted reverse engineering really delivers today. Each one below names its target, the question asked, what was recovered, how it was verified, and the official source — because a confident explanation is not evidence.

1. DX-Ball: recovering a 1996 game's sound-pan formula

• Target: DX-Ball 1.07 (1996, Windows x86)

• Question: when a brick is hit, how does the game decide where its sound sits between the left and right speaker?

• What was recovered:

  pan = (screen_x × 1.5625 − 500.0) × pan_scale
  

  At the default scale, the left edge maps to −500, the center to 0, the right edge to +500.

• The twist: the decompiler showed the function with no visible input — the argument only appeared in the assembly (loaded via FILD from [EBP+8]). Following the caller revealed the brick's screen coordinate, 20 + 30 × tile_x.

• Verification: the C reconstruction was tested against the original x86 function on 3,205 cases (every position 0–640 at five pan scales) and reproduced all 63 compiled function bytes under a pinned Visual C++ 4.0 toolchain.

• What it doesn't prove: the full playable game is still a work in progress — recovering one function is not rebuilding an app.

• Source: DX-Ball case study on rea.tools

This is the strongest public proof in the REA ecosystem so far: a recovered function checked against the original at the byte level.

2. Notion: tracing the Electron clipboard bridge

• Target: Notion Desktop 7.6.1 (Electron)
• Question: how does Notion copy text and rich content to the system clipboard?
• What was recovered: the full path — the preload script exposes a clipboard API to the page, a wrapper calls ipcRenderer.invoke on the notion:clipboard:write channel, and a main-process handler (with a sender check) writes to Electron's clipboard. The team also found that copied HTML carries a hidden reference to block data stored locally under a custom MIME type, which is how pasting restores Notion's block structure.
• Honesty note: part of this trace required hand-reading the wrapper implementations to connect the channel to its receiver, and the findings come from assets cached on a specific date, not a live desktop session.
• Source: Notion case study on rea.tools

The hat-tip here goes to the sender check: only Notion's own pages can trigger the clipboard write — the correct security pattern for any Electron app, and a nice reminder that real apps contain real defensive code.

3. TH04: PC-98 bullet-pattern math

• Target: TH04 (Touhou 4, PC-98, 16-bit DOS game)
• Question: what do the fixed and aimed bullet-ring calculations actually compute?
• What was recovered: the angle calculations behind the bullet-ring pattern, rebuilt in C++ and compared against the output of the original historical compiler. This case demonstrates REA's Ghidra integration with 16-bit DOS analysis — a niche most modern tools ignore.
• Source: TH04 showcase on rea.tools (see Showcases)

4. Windows Calculator: the two-faced % button

• Target: Windows Calculator 11.2508.4.0 (x64)
• Question: why does 200 + 10% give 220 but 200 × 10% give 20?
• What was recovered: the % button applies two different rules depending on the pending operator — after + it takes 10% of the first number (20, so 200+20=220); after × it converts 10% to 0.1 (so 200×0.1=20). REA reads the actual calc.exe, giving the readable branch and the original instructions behind it.
• Source: rea.tools homepage interactive case

A great example of recovering a small, everyday behavior that documentation never fully explains.

5. Chrome's dinosaur game: the acceleration rule

• Target: the T-Rex runner game bundled with Chromium-based browsers
• Question: why does the dinosaur speed up over time — what's the exact rule?
• What was recovered: the speed schedule — the game starts at a base speed of 6 and accelerates progressively toward 13. REA loaded the game's index.js, located the acceleration logic, and the rule was rebuilt as a playable mini-version with an adjustable speed slider.
• Source: rea.tools homepage interactive case

6. The self-clone: REA reverse-engineers its own website

The official examples include asking an agent to inspect https://rea.tools/ with REA and clone the website — a fun loop where the tool's own marketing page becomes the target. It shows REA handles web targets (page structure, scripts, network observations) alongside binaries.

The viral moment (context for the hype)

• REA sat at single-digit GitHub stars per day through September 2026 — then jumped by ~50,000 stars in a single day (October 12), pushed over the edge by posts from Replit CEO Amjad Masad and AI YouTuber Matthew Berman ("Software is done.", ~3.5M views)
• It passed 200,000 stars within days, making it one of the fastest-growing repositories ever tracked
• The viral wave brought a flood of "I tested the viral reverse engineering repo" videos — mostly testing the hype, not the evidence

How to run your own case study

The pattern from every case above:

1. Pick one narrow question about one feature — not "reverse engineer this app"
2. Pin the target — exact version and hash; a new release can move addresses and break the trace
3. Follow the evidence — ask for addresses, bytes, and instructions behind each claim; treat decompiler pseudocode as a hint, not truth (DX-Ball's decompiler hid the function's input entirely)
4. Rebuild and compare — reimplement in clean code and test against the original, like the 3,205-case DX-Ball check
5. Accept partial results — "could not confirm" is a legitimate finding

Ready to try? Start with our REA setup guide, or browse the tools directory for the engines you'll need.