I tried REA, the #1 trending repo on GitHub — can AI really reverse-engineer a .NET app?

In a recent development, REA – Reverse Engineer Anything – surged to the top of GitHub's weekly trending list, boasting an astounding 183,000 stars in just one week. The tool claims to reverse-engineer applications, even converting raw machine code back into readable code. This is particularly concerning for .NET developers who rely on obfuscation and Native AOT to safeguard their code and secrets.

To test the tool's capabilities, a small, realistic C# app called Naze Pixel was compiled using three different methods and analyzed by REA.

REA is not a decompiler in itself; it is a coordinator that runs real analysis tools on the program and provides findings with evidence. For .NET, it has its own reader for assembly metadata and CIL (bytecode), while for native machine code, it drives decompilers like Ghidra, Hopper, or IDA. However, REA relies on AI to read the decompiled pseudo-code, guess what each piece does, and rewrite it as clean code.

This is a significant claim, especially for those who believe their code is safe from reverse-engineering due to obfuscation or Native AOT.

The test app, Naze Pixel, is a ~105-line C# program that converts a 24-bit BMP into dithered ASCII art. It includes an upload key, which serves as the secret. The rebuilt app produced the same output as the original, demonstrating the tool's effectiveness. When the same AI was given the raw .dll without REA, it took only 41 seconds to rebuild the C# code, proving that REA is simply a decompiler plus a smart guess, not an undo button for the compiler.

The tool was then tested on an obfuscated version of Naze Pixel, where the classes and methods were renamed to invisible Unicode characters and the strings were encrypted. Despite the obfuscation, REA was able to rebuild the algorithm, crack the encryption, and even deduce the key from the metadata. In the case of Native AOT, the tool managed to reverse-engineer the machine code app within 18 minutes, producing the same output as the original.

This demonstrates the tool's ability to reverse-engineer even the most complex applications, raising concerns about the security of .NET applications and the potential misuse of such a powerful tool.