REA examples and case studies
- The project publishes three headline case studies: DX-Ball, Notion and TH04.
- An independent tester traced an Electron export feature end to end in about 1.3 seconds of analysis.
- All results are narrow and feature-level. None shows a full application being cloned.
Project-reported case studies
| Target | What was recovered | Reported result |
|---|---|---|
| DX-Ball (native x86) | Sound-pan (positioning) calculation | Passes 3,205 original-x86 cases and matches all 63 compiled function bytes |
| Notion (Electron) | Clipboard bridge | Traced from the renderer through preload and IPC to the main process |
| TH04 (DOS) | Bullet-ring calculation | Reconstructed C++ compared against historical compiler output |
From the official README. Cyber Security News: “These are project-reported demonstrations, not proof that every target can be fully reconstructed.”
Independent test: tracing an Electron “export to CSV” feature
Kingy AI ran a reproducible test on October 8, 2026 using REA 6.0.0 on macOS (arm64) with Node.js 24.16.0, the project’s notes-example fixture and Codex as the agent. No decompiler was installed and the app was never launched — static analysis only.
- REA parsed 4 JavaScript files and produced 21 findings, with 0 parse failures.
- It found one literal IPC channel,
notes:export, with a paired renderer transmission and main-process handler. - The recovered path: renderer click handler → preload
exportCsv→notes:export→ main-process handler → CSV formatter →notes.csv. - The agent’s reconstructed formatter matched the reference byte-for-byte in 14 declared cases.
- Analysis took about 1.3 seconds including CLI startup.
The two REA subcommands at the heart of that test were analyze-javascript-application <app> --json and trace-application-feature <input.json> --format json; the article lists the full, version-pinned command sequence.
What the tester says it does not prove
- Static relationships are not runtime proof.
- The reimplementation was written after reading the original source, so it is not clean-room.
- Equivalence only holds for the declared test cases; edge cases (for instance an ID containing a comma) fall outside them.
- Nothing here establishes accuracy on opaque binaries or a full application clone.
The same article cites a September 2026 preprint (Liu, Raff and Micinski) finding that decompiled code which passed all shipped tests still diverged on generated inputs in 4.9% of cases overall. That is not a REA benchmark, but it is a good reason to test beyond the happy path.
FAQ
Can REA clone a whole app?
Nothing published so far shows that. The documented wins are single features with testable output.
Is there a sample app to practise on?
Yes, the project hosts a small notes-example Electron fixture, which is what the independent test above used.
Has REA been used for malware analysis?
Cyber Security News links REA to wider coverage of AI-assisted malware analysis, but the REA case studies themselves are about games and desktop apps. Runtime capture executes the target with your permissions, so do not run suspicious samples outside an isolated environment.
Unofficial, independent guide. Not affiliated with the REA project or its author (morluto). The official source is github.com/morluto/rea. Only analyze software you own or are authorized to examine.