RIP Reverse Engineer Anything! This 8 KB Skill Outperforms REA (38% Faster)

0:02Hi. Welcome to another video. Before starting the video, I have been posting many tutorials of open source projects that I like in members only videos as well. I am posting more regularly. So, if you want to support the channel, please hit the join button and the videos are available on all tiers from bronze and up. So, please go ahead and

0:21check them out. Now, back to the video. So, in my last video I talked about REA. REA means reverse engineer anything. It is a very popular project on GitHub. In that video, I said that REA is not that useful. I said that models can already do this work with the normal tools on your machine and I said that a

0:40small skill file can do the same job. Some people asked me to prove it, so I built it. I call it lean REA. It is one skill file. It is about 8 kilobytes. And in my benchmark, it was 38% faster than REA and 35% cheaper with the same accuracy. So, let's get right into it.

0:58First, let's remember what REA is. REA is an MCP server and a CLI. It puts 207 tools into your agent. The NPM package is about 25 megabytes and the skill files with all the reference docs are about 72 kilobytes. Under the hood, REA mostly calls tools that you already have. For an electron app, it uses the ASAR package. For a Mac binary, it uses Otool and NM. For a Go binary, it reads the same build info that Go version {dash} M reads. For Android, it uses Jadx and APKTool. So, REA is a layer on top of the same tools. Lean REA removes that layer. There is no MCP

1:36server. There are no extra tools. The agent uses its normal shell and it runs the real tools directly. Now, let's talk about what is inside the skill file. To make it, I went through the REA source code. I mapped each REA feature to the plain command that does the same thing. Then I kept only the fastest command for each target. The first part is a short list of rules. Work on a copy of the target. Check the file type first. Do not read a big minified file, search inside it and read only the part that you need and put many small checks into

2:03one shell call. The second part is a router. It is a table. On the left, you have the type of target. On the right, you have the fastest command for It covers electron apps, minified web bundles, and Mac, Linux, and Windows binaries. It covers Go, Rust, .NET, Android APKs, and Flutter. And it also covers WASM, SQLite files, packet captures, firmware, and

2:25websites. The third part is what I call first moves. These are ready commands that the agent can paste and run. For a Mac binary, one command gets the linked libraries, the exports, the imports, the strings, and the full list of functions. All of it in one call. And this matters a lot because with agents, each turn costs time. A turn is one round trip between the model and a

2:47tool. Fewer turns means a faster answer. The skill also keeps the useful tricks that are inside the REA code. For example, how to read the electron fuses, how to find the Go build info in a binary, how to find the Flutter snapshot hash. These are small details, but the model can miss them. So, they are in the

3:03file. And it has simple evidence rules. The model marks each claim as seen, inferred, or unknown. If it did not find a fact, it says unknown. It does not say that the thing is absent. That is the whole skill. The REA skill docs are about nine times bigger. Now, let's talk about the benchmark because this is the important part. I used Claude code in headless mode with

3:24Sonic 5.5. I made three setups. The first setup is no skill and no MCP, just the model and its normal tools. The second setup is Lean REA. The third setup is REA. That means the REA MCP server plus the official REA skill. Then, I made four tasks. The first task uses a real electron desktop app. The model must

3:43trace one feature through the app code. It must find the native function, the class that controls it, and the IPC channels. IPC is how the parts of an electron app talk to each other. The second task uses the native add-on from that same app. It is a small Mac binary. The model must list the exports, explain one permission check, and explain how

4:00the single instance lock work. The third task is a Go binary. I used the GitHub CLI. The model must find the Go version and the versions of two dependencies. The fourth task is the hard one. It uses the same native add-on, but this time the model must read the disassembly. It must find the exact path of a socket file, the wire protocol, and how the app checks who is connecting. Each setup did each task three times. So, that is 36 runs in total. I checked every answer against an answer key that I made by

4:30hand. And here are the results. Lean REA finished all the runs in 388 seconds. With no skill, it took 479 seconds. And REA took 627 seconds. For cost, Lean REA was $2.17. No skill was $2.21. And REA was $3.36. For turns, Lean REA used 55 turns. No skill used 81. And REA used 124. So, compared to REA, Lean REA was 38% faster. It was 35% cheaper. It used 56% fewer turns. And it used 60% fewer

5:03tokens. And the accuracy was the same. REA got 75 out of 75. Lean REA got 74 out of 75. The one miss was a small one. There are two versions of one IPC channel in the app. And in one run, Lean REA named the older one. The biggest gap was on the electron task. Lean REA took about 35 seconds. REA took about 83 seconds. On the Go task, Lean REA took about 12 seconds. REA took about 26 seconds. And the reason is simple. The

5:28model only needs one command for this. With REA, it first has to find the right tool, call it, and then read a very big result. In one REA run, the tool output was so big that Claude code saved it to a file. Then the model had to open that file in more turns. So, that is extra time for nothing. Now, let's talk about context. Because this was a point in my last video, I sent one simple message, which was reply with okay. Then I measured how many tokens each setup used. With nothing, it was about 31,000 tokens. That is the normal Claude Code system prompt. With Lean REA, it was

5:57about 34,500 tokens. With REA, it depends on your agent. Claude Code has a feature called tool search. It loads the MCP tools only when it needs them. With that turned on, REA adds about 3,500 tokens. So, it is fine there. But, many agents load all the tools at the start. So, I turned tool search off, and then that one okay message used

6:20about 400,000 tokens. It cost $1.60. Just to say okay. So, that is the same problem that I talked about last time. In an agent that loads all the tools, REA fills most of the context before the model reads one line of your target. I also did a small test on the tools themselves. Same file, same job. One time with the REA CLI, one time with the plain command. For the go build info, REA took about half a second. The plain go version command took 600ths of a second. For the Mac binary overview, REA took 3.3 seconds. The plain command took 400ths of a second. And for the electron

6:54app, this one is funny. REA did not work at first. It gave an integrity error on the real app. You have to add an extra flag to make it continue. With that flag, it took about 48 seconds. And it gave back 140 megabytes of JSON. The plain way is to extract the SR file and search it with rip grep. That took about 5 seconds, and the output was 24 kilobytes. And it had the answer. Now, let me be fair here. The model with no skill was already very good. It got almost everything right. Lean REA was about 19% faster than no skill, and it used about 32% fewer turns. But, the

7:27cost was about the same. So, the big win is against REA, not against the plain model. The plain model did refuse one task one time. It thought that the disassembly task could help someone defeat a security check. With the skill, that did not happen. But it was only one run, so take it with a grain of salt. Also, this is a small

7:47benchmark. It is three runs per task, one model, and one Mac. I did not have Ghidra or Jad God installed, so the native tasks used the normal Xcode tools for all the setups. And I found two bugs in my own skill while I tested it. So, I want to tell you about them because they are good

8:05tips. The first one is about Ripgrep. Ripgrep skips hidden folders by default, and many Electron apps keep their code in a hidden folder called .webpack. So, my first search found nothing. Now, the skill tells the model to use Ripgrep with the -u flag. That flag searches hidden files, too. The second one is about ZSH, which is the default shell on a Mac. I used echo with two equal signs as a marker between outputs, but ZSH reads two equal signs in a special way, and the command failed. Now, the markers are in quotes, so

8:35test your skill files. Even a small file can have bugs. Now, let's talk about how to install it. It is on GitHub at aikocoding/leanria. And it works with the skills CLI. Just run NPX skills add aikocoding/leanria. It asks which agents you use. It supports Claude Code, Codex, Cursor, Gemini CLI, Open Code, and more. If you want it in every project, add the -g flag. And if you want to skip the questions, add the -y flag. Then, you

9:01can use it with the /leanria command. For example, /leanria, "How does the search feature in this app work? Show me the evidence." The repo also has the full benchmark, so you can run it yourself. There is a setup script, a script to run all the tasks, and a script for the context test. And all the raw results

9:17are in there, too. So, what do I think? I think this shows the point that I made in the last video. Models are good at this already. You do not need 207 tools. You need the right commands, a few nodes, and a model that can run them. REA is still a good project. The team did a lot of good work, and a lot of the tricks in my skill came from reading their code. So, credit to them. But if you are a programmer, I would use the small skill. It is faster, it is cheaper, and you can read the whole thing in 2 minutes. Overall, it's pretty

9:44cool. Anyway, let me know your thoughts in the comments. If you like this video, consider donating through the Super Thanks option or becoming a member by clicking the join button. Also, give this video [music] a thumbs up and subscribe to my channel. I'll see you in the next one. Until then, bye. [music]

10:11[music]