“AI can clone any app without source code”? A reality check on REA
TL;DR
REA (Reverse Engineer Anything, morluto/rea) is a platform AI coding agents call via CLI or MCP to analyse software behaviour — native binaries, Android APKs, Electron apps, WASM, firmware, packet captures and more. It helps understand and reimplement narrow behaviours; it isn’t a “clone AutoCAD” button.
A viral post claimed there's an AI tool that can "clone any application without source code", even to the point of duplicating large commercial software. Look closer and reality is far more modest, and more interesting. REA (Reverse Engineer Anything, morluto/rea) is a platform AI coding agents call via CLI or MCP to analyse software behaviour: binaries, Android APKs, Electron, WASM, firmware, network packets… It helps understand and recreate small pieces of functionality; it isn't a "clone AutoCAD" button.
What can it do?
- Agents (Claude Code, Codex, Cursor…) call REA to gather evidence about how a program works.
- Examples shown: working out the Calculator's percentage rule, or the speed-up rule of Chrome's dinosaur game, then writing a small version.
- Results distinguish what was observed, what was inferred and what's unknown, a very good analytical habit.
Hype versus reality
| The clickbait post | Reality |
|---|---|
| Clone an entire large piece of software | Understand and recreate specific, small-scope behaviours |
| A substitute for buying licences | No: copying commercial software violates terms and intellectual property law |
| Install and go | Needs an isolated environment, understanding of the tool and verification of results |
Legitimate uses
- Understanding legacy systems in your own organisation that no longer have documentation or source code.
- Compatibility work: how a file format or protocol behaves.
- Security analysis of your own software, or software you're authorised to test.
- Learning: recreating a small behaviour to understand the principle.
Legal and ethical considerations
Reverse engineering may be restricted by EULAs and intellectual property law depending on the country. Before analysing someone else's software, read the terms of use and consult legal. A more powerful tool doesn't make copyright infringement legal.
Safety when running analysis tools
- Only install from the official repo and read carefully how it's granted permissions.
- Isolate: run in a VM or sandbox when analysing untrusted binaries; unknown samples may contain malware.
- Limit the agent's permissions: network and files; don't give access to folders holding keys or sensitive data.
- Verify: treat results as hypotheses until tested against the real software.
A lesson in reading AI news
- When you see "AI can do everything" headlines, check what the repo actually describes and how large the examples' scope is.
- Distinguish a demo on a small behaviour from a product that replaces commercial software.
- Evaluate tools with a small experiment of your own instead of trusting the hype.
How to apply it
- Dev: try it on your own software to see what an agent can infer from a binary.
- Tech Lead: set a rule: use only on company assets or with written permission.
- PM: when someone proposes "copying a competitor with AI", check legality before assessing feasibility.