What REA can't do: limits and legal use

Every statement on this page comes from REA's own README or DISCLAIMER, linked under each section. This is not legal advice.

What REA does

REA connects your AI agent to existing analysis tools, such as Ghidra, Hopper, IDA and JADX, and to its own built-in static inspectors. It does not decompile on its own, and analysis runs locally. Your agent's model provider still receives the tool results, under that provider's own data policy.

Source: README

What REA doesn't do

• It is not a one-click "export the full source code" tool. Native analysis returns pseudocode and assembly, and JavaScript analysis returns modules and how they relate.
• It does not give you a license, key or activation for IDA, Hopper, JEB or any other commercial tool.
• The project does not support or help with circumventing DRM, license checks, anti-cheat systems or other protections; game cheats; bypassing authentication or access controls on systems you aren't authorized to test; or copying proprietary software or reproducing its protected code and assets.
• How well it handles packed or obfuscated programs is not something we have confirmed. Check the official docs and your own tests.

Sources: README FAQ and License, DISCLAIMER.md

Can you trust the results?

Not blindly. REA's disclaimer says decompilation, reconstruction, heuristics and AI-assisted analysis can be incomplete or wrong. REA attaches evidence and lists limitations with each conclusion. Check that evidence yourself before relying on anything important.

Getting source-like output or a report does not give you any rights to the original program, its data or the output.

Source: DISCLAIMER.md

Uses the project supports

REA is for lawful analysis: security research, malware and incident analysis, vulnerability research and coordinated disclosure, CTFs and education, interoperability, software preservation, and debugging or auditing software you own or are authorized to examine.

Source: DISCLAIMER.md

Risks to keep in mind

• Reverse engineering may be restricted in your country or by the license of the software you analyze. Many end-user agreements limit it.
• Having a file, or the software being publicly available, does not by itself give you permission for every operation on it.
• Some workflows run programs, capture traffic or act on connected devices. Permission to inspect a file is not automatically permission to do those things.
• Studying someone else's commercial software and then building a similar product can lead to IP disputes. Get legal advice for your situation; this site doesn't give it.

Source: DISCLAIMER.md