RE-Agent is a local-first toolkit for authorized maintenance, compatibility repair, and independent porting of discontinued software and games. A connected coding agent combines focused skills with RE-Agent’s existing static/runtime analysis, evidence, checkpoints, and bounded build/test/repair workflows. Maintainers can add modular skills without creating a separate platform.

Source repository: heaven-hm/re-agent. Package name: re-agent. See installation for supported CLI commands and MCP setup.

Legacy maintenance is the product goal; not every existing benchmark is a legacy-support case study. The strongest binary-only example currently recorded in this repository is the Project IGI 2 GConv toolchain: the supplied 2003 Windows PE files now have a hash-bound static inventory, with a separately implemented QVM inspection tool. This is still a partial investigation: no vendor bug fix, full QVM engine, DLL ABI replacement, or complete game port has been verified. The currently retained Calculator, managed-game, and recent open-source samples validate narrower pipeline components; they do not demonstrate maintenance of a discontinued closed-source product. See the GConv evidence and limits and rights-screened target catalog.

Architecture at a glance

REA Engine extends the existing REA analysis ecosystem with a bounded investigation and reconstruction layer. The diagrams below distinguish inherited providers from engine-specific orchestration. They describe supported workflows, not a promise of fully automatic reconstruction for arbitrary binaries.

flowchart TB
    U["Developer / coding agent"] --> I["CLI · MCP · local dashboard"]
    I --> C["Autonomous investigation controller"]
    C --> S["Durable workspace · checkpoints · stop/resume"]

    subgraph EXISTING["Existing REA analysis capabilities"]
        P["Static analysis providers<br/>Ghidra · managed assemblies · artifacts"]
        R["Runtime and process evidence<br/>capture · instrumentation"]
    end

    subgraph ENGINE["REA Engine extensions"]
        D["Evidence-led discovery"]
        T["Owned Frida trace correlation"]
        A["Bounded affine recovery"]
        V["Conditional Z3 equivalence checks"]
        B["Build · test · bounded repair"]
    end

    C --> D
    D --> P
    D --> R
    R --> T
    P --> A
    T --> A
    A --> V
    V --> B
    B --> S
    B --> O["Scoped evidence · reports · benchmark results"]
    O --> I

    classDef entry fill:#1e293b,stroke:#64748b,color:#ffffff
    classDef control fill:#1d4ed8,stroke:#60a5fa,color:#ffffff
    classDef upstream fill:#f1f5f9,stroke:#94a3b8,color:#0f172a
    classDef extension fill:#ecfeff,stroke:#0891b2,color:#164e63
    classDef output fill:#ecfdf5,stroke:#059669,color:#065f46
    class U,I entry
    class C,S control
    class P,R upstream
    class D,T,A,V,B extension
    class O output

Bounded investigation and repair workflow

Each iteration works from collected evidence and explicit constraints. Verification is conditional and target-dependent; an unsupported recovery or exhausted budget produces a recorded result rather than an equivalence claim.

flowchart TD
    START["Select authorized target and investigation plan"] --> BASE["Collect baseline static/runtime evidence"]
    BASE --> H["Form a candidate hypothesis"]
    H --> REC["Recover or implement a bounded candidate"]
    REC --> TEST["Build and execute declared tests"]
    TEST --> MATCH{"Declared checks pass?"}
    MATCH -- "Yes" --> VERIFY["Run applicable independent / Z3 checks"]
    VERIFY --> OUT{"Evidence supports claim?"}
    OUT -- "Yes" --> DONE["Record scoped result and artifacts"]
    OUT -- "No" --> LIMIT{"Repair budget available?"}
    MATCH -- "No" --> LIMIT
    LIMIT -- "Yes" --> REPAIR["Record mismatch · checkpoint · repair or roll back"]
    REPAIR --> TEST
    LIMIT -- "No" --> STOP["Stop with limitations and preserved evidence"]
    classDef start fill:#1e293b,stroke:#64748b,color:#ffffff
    classDef step fill:#dbeafe,stroke:#2563eb,color:#1e3a8a
    classDef decision fill:#fef3c7,stroke:#d97706,color:#78350f
    classDef success fill:#dcfce7,stroke:#16a34a,color:#14532d
    classDef stopped fill:#fee2e2,stroke:#dc2626,color:#7f1d1d
    class START start
    class BASE,H,REC,TEST,VERIFY,REPAIR step
    class MATCH,OUT,LIMIT decision
    class DONE success
    class STOP stopped

Extension boundary and provenance

flowchart LR
    subgraph UP["Upstream morluto/rea"]
        REA["CLI / MCP and agent workflows"]
        PROVIDERS["Ghidra · Frida · native / managed / web analysis"]
    end
    subgraph EXT["heaven-hm/re-agent additions"]
        AUTO["Persistent autonomy controller"]
        PROOF["Affine recovery · constrained verification"]
        TOOL["Verified tool bootstrap · offline bundle builder"]
        UI["Investigation dashboard · reconstruction evidence"]
    end
    REA --> AUTO
    PROVIDERS --> AUTO
    AUTO --> PROOF
    AUTO --> UI
    TOOL -. "Optional local dependencies" .-> PROVIDERS
    classDef inherited fill:#f1f5f9,stroke:#64748b,color:#0f172a
    classDef added fill:#eff6ff,stroke:#2563eb,color:#1e40af
    class REA,PROVIDERS inherited
    class AUTO,PROOF,TOOL,UI added

For implementation details, see the investigation controller, autonomous discovery, Frida correlation adapter, affine recovery, conditional proof implementation, and dependency packaging limits.

What differs from upstream REA

Area	Reverse Engineering Engine addition	Source / reproducible evidence
Autonomous reconstruction	Persistent checkpoints, bounded build/test/repair, rollback, mismatch regression inputs	Controller, 25/25 fixture report
Unknown function investigation	Existing static providers feed runtime hypotheses and independent bounded affine reconstruction	Discovery, recovery
Runtime/static correlation	Owned Frida Gadget profile checks binary identity, ASLR and instruction prefix, records arguments/returns and cleanup	Adapter, five-call report
Conditional verification	Z3 checks extracted scalar expressions under explicit assumptions	Proof implementation, verification guide
Tool installation and bundles	Reuse installed tools; pinned official downloads, hashes, health checks, offline wheel/source bundle builder	Bootstrap and license limits
Coding-agent integration	Existing CLI/MCP plus autonomous investigation operations and packaged skill instructions; host Codex/Claude can operate them	Agent workflow, workflow guide
Interface	Local evidence/status dashboard with pause/resume/stop	Dashboard

These are additions to the upstream tool ecosystem. Ghidra, native UI, browser analysis and general Frida capabilities already exist upstream and are not claimed as inventions of this fork.

Binary-only legacy case study: IGI 2 GConv

The GConv record starts from locally supplied 2003 Windows PE32 binaries, not vendor source. A fresh offline radare2 6.2.0 scan hash-bound gconv.exe, gconvapi.dll, and vqdll.dll; it recorded 487 heuristic function entries in the EXE, enumerated the DLL's gc* exports and the codec's VqCalc export, and retained raw function/import/export records. That scan used radare2 directly. The current CLI deep-analysis selector still rejects --provider radare2 (it offers Ghidra, Hopper, and IDA); RE-Agent's new radare2 MCP operations have not yet been exercised end to end on this target. This is a concrete integration gap to close. The binary evidence points to a useful next behavior slice: connect one exported API/native call to an independently implemented test, while keeping unknown semantics unresolved.

Status: partial static analysis; no confirmed vendor bug or repair yet. The checkout also retains a 120-script error-parity receipt, but the private original corpus and a replay harness are not present, so this turn did not reproduce that historical result. Full QVM execution, native-call semantics, DLL ABI/codec compatibility, a Windows runtime trace, and a full game port remain unverified. The supplied Windows files are not committed; their SHA-256 values and local-only status are documented. A supported release scope is also unresolved: the target catalog records why public modification/redistribution is not currently cleared.

Current genuine evidence is the machine-readable radare2 function inventory, static analysis note, retained imports/exports, and existing differential receipt. GConv is a console tool, and no runtime screenshot is claimed. The documented terminal records are the appropriate evidence until a reproducible runtime capture is added.

Engineering validation fixtures (not legacy-support case studies)

The following earlier comparisons help validate specific analysis and comparison plumbing, but are weak evidence for maintenance of unsupported proprietary applications: the Calculator is an actively supported Apple app; TicTacToe and Luhn are managed examples; and the Batch 1/Batch 2 native samples are open-source projects. They remain in the repository as transparent engineering fixtures and their original reports are preserved. Do not present them as proof that RE-Agent found and repaired a defect in closed-source legacy software.

Software and game: exact measured fixture comparisons

Target	Result	Proof
LTRData Luhn utility, reconstructed from its published .NET binary	5/5 suites: identical terminal bytes, 230 numeric/Unicode lines plus mode, usage and termination cases	Report, complete execution evidence, reconstructed executable
Published TicTacToe-AI Windows managed game, rebuilt from recovered code/resources	19,683/19,683 board configurations: identical observed state bytes; 6/6 frames: identical PNG bytes	Report, complete execution evidence, original executable, rebuilt executable and source
Native branch validation fixture	25/25 declared cases after repair	Report
Installed Apple Calculator	10/10 final numeric-display comparisons in the recorded smaller suite	Report; complete UI and expanded suite remain unverified

These results prove exact equality of the listed captured bytes, not byte-identical executable files or universal equivalence. Every original/replica executable hash differs. The game comparison exhausts the defined board input space for its win/draw function; AI, RNG, all menus, timing and whole-game behavior remain unverified. The Windows managed artifacts ran on macOS .NET/Mono; this is not proof of native Windows OS execution or native AppKit port fidelity.

The analysis used REA's inspect-managed-members, import-managed-reconstruction and capture-process workflows, with ILSpy recovery and real compilation. The host coding agent operated the engine; no model API key was required. Game source was recovered from the binary, not consulted from the original repository. A pinned original source archive was subsequently retained solely for GPL redistribution obligations. The independent software implementation preserves a recovered quirk: checksum parity counts UTF-16 string length, including punctuation.

Software capture proof viewer

This is an actual screenshot of the engine's proof viewer, captured through REA's owned browser scenario after recomputing the supplied terminal-file hashes. It shows recorded original/replica CLI output; it is not an original-app GUI screenshot. Browser evidence and verified cleanup.

Actual original and rebuilt game renders

These are actual Form.DrawToBitmap renders after the same button-handler sequence on the same Mono/X11 runtime. They are not Windows desktop screenshots. Their PNG SHA-256 is identical: 67673e4f3536084732a35c6da809ea5a69ea89afb0f336c3870a9b0baaa855be.

Original compiled game	Rebuilt game

Interactive proof report · Reproduction and scope · artifact SHA-256 inventory

Installed tools versus distributed tools

Development health checks confirmed Frida 17.23.3, LIEF 1.0.0, Z3 5.1.0.0, Capstone 5.0.9 and Pillow 12.3.0. Ghidra/radare2 and native compilers are reused locally. Bundled now: the signature-verified ILSpy package and the built X11 libgdiplus library with source and licenses. The preview release also carries the checksum-verified, unmodified Ghidra 12.1.2 archive; see its manifest. A clone does not contain every installed external tool binary. The installer and offline bundle builder are shipped in source; generated local bundles are not a license-approved public distribution. Frida/LIEF native dependency source and license coverage require further audit. Optional licensed tools and Apple Calculator are not redistributed. See tool profiles and limitations.

Professional maintenance fixtures (utilities and RE tooling)

Independent macOS reconstructions of MIT-licensed native Windows productivity tools, recovered binary-first with REA (no original source consulted). Game ports were removed from this showcase: this repository demonstrates serious legacy-software support — defect finding, maintenance engineering, and cross-platform porting — not game cloning. Windows originals and macOS replicas are committed under benchmarks/native-windows-ports/ with manifests, goldens and reports.

Target	Original (Windows x64)	macOS port	Status
legacy-notepad v1.2.1	`original-binaries/legacy-notepad-x64.exe` (263KB, Win32)	`notepad/replica/notepadmac` (Swift, AppKit)	Unicode window + save-bytes verified
Clipjar v1.2.0	`original-binaries/clipjar.exe` (5.3MB, Rust)	`clipjar/replica/clipjarmac` (Swift, menu-bar)	SQLite capture/persist/dedupe PASS
imgview v0.3	`original-binaries/imgview64.exe` (UPX stub, unpacked upx 5.2.1)	`imgview/replica/imgviewmac` (Swift, AppKit)	PNG render verified
PuTTY plink 0.85	official w64 binary (MIT, 1MB)	`benchmarks/plink/replica/plinkmac` (C, CLI)	help/pgpfp/noargs byte-identical
IGI2 QVM toolchain	2003 PE32 toolchain (user-supplied, unmodified)	`gconv/replica/qvmtool` (C, CLI)	120/120 error-behavior parity

Maintenance evidence

Notepad macOS port, live Unicode window:

Found defect example: the PixelTetris original crashes with a null-deref page fault when its font asset is missing (Could not load font! then wine: Unhandled page fault), instead of exiting cleanly — root-caused to a missing early return in FUN_140019080 and recorded in pixeltetris/DEFECT-missing-font-crash.md.

See benchmarks/native-windows-ports/reports/ (license audit, binary analysis, functional results, limitations). Whole-executable identity is not claimed; unverified items are listed per target, not hidden.

Native Binary Reconstruction — Benchmark Batch 2

Batch 2 also uses published compiled binaries, but its targets are openly licensed projects. They are useful pipeline benchmarks, not evidence of maintaining closed-source legacy products. Their results below remain scoped to the listed features.

The complete app/game inventory across managed examples, Batch 1 and Batch 2 is in the package-checked benchmark catalog, with per-target implementation and evidence links in the benchmark index.

Current result: incomplete; all six application-level results are UNVERIFIED. All six requested official Windows assets were downloaded, publisher SHA-256 verified, and actual native x64 PE executables inventoried. No upstream implementation source was used. Originals and runtime assets stay private.

Target	Windows release and binary	macOS reconstruction	Functional comparison
OpenLieroX — C++ game	20260912.1 ZIP	Unimplemented	UNVERIFIED
SuperTux — C++ game	v0.7.0 portable ZIP	Unimplemented	UNVERIFIED
The Powder Toy — C++ game	v100.1.400 EXE	Unimplemented	UNVERIFIED
ripgrep — Rust utility	15.2.0 ZIP	Independent C++17 macOS subset; 7/8 retained CrossOver observations match after path-separator normalization	PARTIAL feature / application UNVERIFIED
fd — Rust utility	v10.5.0 ZIP	C++ ARM64 candidate; 2 raw, 9 normalized search cases pass	PARTIAL feature / application UNVERIFIED
bat — Rust utility	v0.26.1 ZIP	C++ ARM64 candidate; 8/8 plain-output cases pass	PARTIAL feature / application UNVERIFIED

Original executable SHA-256 values, distinct from release archive hashes:

Target	Original PE SHA-256
OpenLieroX	`0f79c968ab9aabd8cb99e173500fa241e883846fd3e0c9ca2f7f0bf3771fa5c1`
SuperTux	`6249f25a6ac1cc3d27955ca09852b8368618ce58ad9c13e0c5084051c2c02b43`
The Powder Toy	`df32b616b31dabae10b82028731ebdfd6867c872198b81f29d418cbafbf460c3`
ripgrep	`14231169855ec5205cf5a1b6f1db358ff4aed4247c86b69ce8aae647c77f6680`
fd	`d67d27a8e375ed7e9bca2b506a9dd5082bc24547aeba908b863f6f8b8ab0c3b9`
bat	`9ea9f7ab1c27aa5c9390e91543f9f47c6bd17bc53f3e30ac9db762f28f55c4fd`

Actual capabilities used: existing REA MCP/Ghidra workflows and PE resource Evidence, installed compilers, tool health inventory, owned process supervision, and the existing autonomous controller's checkpoint creation/reopening. Deep analysis timed out or was cancelled under host memory/disk pressure. No Batch 2 native function recovery is verified. Original utility probes through CrossOver timed out; actual Windows OS behavior remains unverified. The controller also rejected a compatibility launcher that differed from its hash-bound target.

New extension: a reusable bounded file differential benchmark runner compares exact output-file bytes, diagnostics and exit outcomes in independent workdirs. Its infrastructure tests use actual child processes; they are separate from application fidelity tests. Windows workers, complete native recovery, FLOSS/capa integration and game reconstruction remain future work.

Receipt-derived records currently contain 23 completed utility comparisons: 10 raw byte/exit passes, 13 raw differences, and 9 additional fd search cases that pass only under declared path/order normalization. fd has 2 raw passes among 15 cases; bat has 8/8 raw passes for its declared plain-output cases. These are feature-level results; all six Batch 2 applications remain PARTIAL or UNVERIFIED overall. fd has a completed bounded repair loop, while gameplay, game screenshots, original Windows OS execution, whole-application equivalence and formal proofs remain unavailable. See the receipt-derived Batch 2 summary and target reports.

Full Batch 2 report · binary/import inventory · license audit · native build/execution results · functional cases · measured metrics · visual evidence status · known blockers

Build and use this repository

git clone https://github.com/heaven-hm/re-agent.git
cd re-agent
npm ci
npm run build:cached
node scripts/print-mcp-config.mjs /absolute/path/to/target --local
node scripts/rea.mjs --help

Use the printed local MCP configuration with your host coding agent and the built packaged skill. A published upstream npm package is not this fork. The implementation retains compatible command names while the product identity is Reverse Engineering Engine.

Setup supports configured coding agents. Other MCP clients can use the manual MCP registry instructions.

Documentation

Report issues and contribute at heaven-hm/rea-engine.

Latest validation: the complete managed benchmark command passed again with verified owned-display cleanup. The focused autonomy regression batch passed 37 tests with 2 skipped; type and lint checks passed. Execution logs and checksum inventory. These are scoped development checks, not certification of all REA capabilities.

Reverse Engineering Agent: modular coding-agent skills and evidence-backed static, runtime and memory analysis for authorized legacy software maintenance, compatibility repair and port verification.

binary-analysis binary-ninja cheat-engine decompilation decompiler frida ghidra ida idapro rea reverse-engineering

Readme MIT

78 MiB

0 Stars 1 Watchers 0 Forks

README.md Unescape Escape

RE-Agent