Reverse Engineering with AI Agents: Introducing REI Skills and the REA Workbench
895 validated agent skills. 21 AI development targets. 12 specialized reverse-engineering skills. One open-source engineering toolkit. AI coding agents can generate software surprisingly well. But what happens when the
895 validated agent skills. 21 AI development targets. 12 specialized reverse-engineering skills. One open-source engineering toolkit.
AI coding agents can generate software surprisingly well. But what happens when the source code is missing?
What if you need to inspect an unfamiliar binary, understand an Android APK, investigate embedded firmware, compare WebAssembly modules, or reconstruct an undocumented protocol?
A plausible explanation from an AI model is not evidence.
That's one of the problems we're trying to address with REI Skills and REI REA, developed at Rootcastle Engineering & Innovation.
Explore the Live Developer Hub
The Problem: AI Agents Need Engineering Discipline
Most AI assistants are good at generating plausible explanations. Reverse engineering requires something different.
An investigator needs to establish:
- What can actually be observed in an artifact?
- Which conclusions are inferred rather than verified?
- Which tools produced each finding?
- Can another engineer reproduce the result?
- What remains unknown?
An AI agent that confidently invents a function's purpose is potentially more dangerous than one that simply says, "I don't know."
We wanted to make evidence tracking, repeatability, and explicit uncertainty part of the workflow.
Introducing REI Skills
REI Skills is an open-source registry and management layer for engineering workflows used by AI coding agents.
The current repository contains:
- 895 validated skills across 10 engineering categories.
- 21 AI development targets, including Claude Code, Codex, Gemini CLI, Cursor, and other environments.
- A smart skill router that recommends relevant skills from the task description and workspace context.
- A built-in MCP server for skill discovery, retrieval, and installation.
- Engineering workflows covering development, architecture, security, infrastructure, testing, and data systems.
- REI REA, a specialized reverse-engineering skill suite with an optional executable workbench.
The registry includes original Rootcastle skills alongside curated work from the wider open-source ecosystem, with source attribution and validation.
The goal is not to load hundreds of instructions into every agent conversation. It's to identify and load the right procedures for the problem.
Install REI Skills
npx rei-skills
Or install specifically for an AI assistant:
npx rei-skills --claude
npx rei-skills --codex
npx rei-skills --gemini
Explore the available tools:
npx rei-skills search firmware
npx rei-skills targets
npx rei-skills doctor
REI REA: Reverse Engineering as a Verifiable Workflow
This is the part of the project I'm particularly interested in developing further.
REI REA (Reverse Engineering Workbench) integrates 12 specialized agent skills:
| Investigation area | Focus |
|---|---|
| Native binaries | PE, ELF, Mach-O, COFF |
| Android applications | APK, AAB, DEX, JNI |
| Firmware and IoT | Embedded Linux, MCU, UEFI, telemetry |
| Electron and JavaScript | ASAR packages, IPC, preload scripts |
| WebAssembly and managed code | WASM, .NET, JVM |
| Network protocols | HAR, PCAP, telemetry frames |
| Digital forensics | Evidence indexing and case records |
| Reconstruction | Behavioral specifications and differential testing |
These skills guide the investigation. They do not imply that every format has a fully automated executable analyzer.
The optional Python workbench provides the actual local analysis capabilities.
Install the Reverse Engineering Skills
For Codex:
npx rei-skills add rei-rea --codex
For Claude Code:
npx rei-skills add rei-rea --claude
For Cursor:
npx rei-skills add rei-rea --cursor
The bundled skills provide investigation procedures, tool selection guidance, and evidence requirements.
Optional: Install the Python Workbench
The executable component is maintained separately:
REI Reverse Engineering on GitHub
git clone https://github.com/rootcastleco/Rei-Reverse-engineer.git
cd Rei-Reverse-engineer
python -m pip install -e .
rei-rea --version
rei-rea tools doctor
The workbench targets Python 3.10+ and does not require third-party Python runtime dependencies.
Its built-in capabilities include bounded PE, ELF, and WebAssembly v1 parsing, structural comparisons, SHA-256 artifact identification, and evidence case management.
External static analysis tools require installation and explicit permission.
A Reproducible Example: Comparing Two WebAssembly Binaries
Let's use a practical example.
Suppose an embedded telemetry component is delivered as two WebAssembly modules.
You have version 1 and version 2, but no source-level change log.
What changed?
REI REA includes harmless WebAssembly fixtures and a recorded demonstration of structural analysis.
Clone the skill repository:
git clone https://github.com/rootcastleco/rei-skills.git
cd rei-skills
With the optional REA workbench installed, inspect the first module:
rei-rea inspect \
examples/rei-rea-demo/fixtures/telemetry-filter-v1.wasm
Then compare both versions:
rei-rea diff \
examples/rei-rea-demo/fixtures/telemetry-filter-v1.wasm \
examples/rei-rea-demo/fixtures/telemetry-filter-v2.wasm
The repository's recorded demonstration identifies two structural additions:
New imported function:
env.audit_log_frame
New exported function:
validate_packet_header
These are observable changes in the module structure.
But here's the important distinction:
An added function named validate_packet_header does not prove that packet validation is correct, secure, or even invoked.
Those are separate hypotheses requiring further evidence.
Observed: The exported function exists.
Inferred: The function may relate to packet-header validation.
Unknown: Its complete behavior and whether it is exercised at runtime.
That distinction is central to REI REA's investigation model.
You can inspect the reproducible fixtures and captured output in the demo directory.
Evidence Before Conclusions
REI REA provides a hash-linked evidence workflow intended to make investigations inspectable.
The basic process is:
- Identify the target artifact and calculate its SHA-256 hash.
- Select the appropriate format-specific analysis workflow.
- Record observed structures and findings.
- Separate confirmed observations from interpretations.
- Preserve evidence and verify recorded case integrity.
- Use differential tests to evaluate reconstructed behavior.
This matters particularly when investigating firmware, protocols, and software where an incorrect assumption can propagate into implementation decisions.
MCP Integration
REI Skills also provides a Model Context Protocol server for discovering and managing skills.
Start it with:
npx rei-skills mcp
The optional REI REA workbench has its own local MCP server:
rei-rea mcp
The REA server exposes 14 tools for operations including artifact inspection, structural analysis, comparisons, investigation planning, and evidence verification.
This allows MCP-capable coding assistants to interact with the local workbench through explicit tool boundaries rather than relying entirely on text-based reasoning.
What Works Today, and What Doesn't
I think it's important to distinguish implemented capabilities from planned integrations.
The current REA workbench includes:
- Built-in bounded parsers for PE, ELF, and WebAssembly v1.
- Structural diffing.
- SHA-256 evidence tracking.
- A local SQLite forensic casebook.
- 14 MCP tools.
- 11 optional static external-tool adapters.
The tool discovery catalog lists 124 tools, but cataloged does not mean installed or executable.
Live Ghidra, IDA, JADX, and Frida automation remains on the roadmap.
We are also not positioning the project as an autonomous exploitation framework. The current workbench emphasizes authorized, read-only investigation.
Why Open Source?
Reverse engineering benefits from independently verifiable findings.
If a tool identifies an import, an export, or a binary difference, another engineer should be able to inspect the relevant artifact and reproduce that observation.
The same principle applies to agent skills.
A reusable engineering procedure should have defined inputs, limitations, and verification stepsβnot just an impressive prompt.
That's the direction we're pursuing with REI Skills.
Try It and Help Shape the Next Release
The project is public, and contributions are welcome.
Live Developer Hub:
https://rootcastleco.github.io/rei-skills/
REI Skills GitHub:
https://github.com/rootcastleco/rei-skills
REI Reverse Engineering Workbench:
https://github.com/rootcastleco/Rei-Reverse-engineer
If you work with firmware, embedded systems, Android internals, binary analysis, protocols, or AI agent infrastructure, I'd be interested in your feedback.
In particular:
Which reverse-engineering workflow would you actually trust an AI agent to perform, and what evidence would you require before accepting its conclusions?
That's a more interesting engineering question than whether an AI can produce a convincing answer.
Built by Rootcastle Engineering & Innovation. Open source, reproducible workflows, and an engineering-first approach to AI tooling.
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes β full credit and traffic to the original publisher.