# REA reverse engineering safe-use kit

REA gives an AI assistant tools for examining finished software. Use this kit to record permission for one target before installation or analysis, and reopen the record whenever the work changes from reading files to running software, contacting services or changing a device. REA's MIT license does not license the target, commercial decompilers or customer data. This kit accompanies the [REA small business guide](https://jwatte.com/blog/rea-reverse-engineering-agent-small-business-legal-risks/). We reviewed documentation and source on November 3, 2026; we did not install or run REA. Examples below are illustrations, not customer reports. This is general information, not legal advice; ask a lawyer licensed where you operate about uncertain rights.

## Investigation flow

```text
┌─────────────────┐
│ Authorized copy │
└────────┬────────┘
         ▼
REA + tools you approve
         ▼
Evidence + explanation → Human review

Own this copy or have written authority?
├─ No → Get written permission
└─ Yes
    ▼
License allows analysis, and any needed
circumvention exception confirmed?
├─ No / unsure → Stop and ask a lawyer
└─ Yes
    ▼
Network targets and data sharing
within written scope?
├─ No / unsure → Keep offline, redact
│                or get approval
└─ Yes → Proceed within scope. Keep logs.

Access barrier or stop notice?
Stop and ask a lawyer.
```

## Per-target authorization and license check record

Complete a separate record for each target and version. Keep the completed record private: it may contain proprietary license text, contact details or security information. Do not insert credentials or activation keys.

### Identify the work

- Record identifier:
- Business requesting the work:
- Business question to answer:
- Intended deliverable and acceptance test:
- Target product and exact version:
- File identity or cryptographic digest, meaning a fingerprint of the supplied bytes:
- Where this copy came from and date acquired:
- Who owns the software copyright:
- Who owns this copy or holds its usage license:
- Who owns the relevant device, account and records:
- Proof of purchase, development agreement or ownership reference:
- Any third-party components requiring separate review:

Owning a computer, a copy, data and copyright are different facts. Do not leave those distinctions implicit.

### Read the controlling documents

- Target license title, version, effective date and public URL if available:
- Exact clause allowing analysis, interoperability or security testing:
- Exact clause forbidding or limiting reverse engineering, decompilation or interception:
- Clause on automation, account use and access to remote services:
- Confidentiality or nondisclosure obligations:
- Counsel's interpretation if clauses conflict or permission is unclear:
- Written waiver or additional permission reference:
- If circumvention is proposed, exact technical control involved:
- Applicable statutory exception or exemption and each required condition:
- Lawyer reviewing that reliance and review date:
- Decision: authorized / authorized with limits / pending / declined:

Do not infer a waiver from silence, a public download, a successful connection or an exposed key. A statutory exception may address one law without resolving contracts or other laws.

### Define the machine and operations

- Test machine or virtual machine identifier:
- Named operating-system user and privilege level:
- Original preserved and backup recovery checked by:
- Static file inspection allowed:
- Archive extraction and analysis-project creation allowed:
- Target execution allowed, with exact scenario:
- Browser observation or interaction allowed:
- Android device identifier and approved operations:
- Explicit approval for any installation, removal, file upload, launch or stop:
- Network: off / on only for listed destinations:
- Approved remote services, accounts and actions:
- Authorization from the party entitled to control each remote service:
- Test data to use:
- Required isolation, shared-folder and clipboard settings:
- Who can approve a scope change:

File observation settings do not confine what an executed process can read or write. An Android device connection can support changes as well as inspection. A static task does not authorize either operation by implication.

### Decide what may leave and what may remain

- AI agent and model provider approved for this data:
- Applicable service terms, retention policy and account settings reviewed:
- Analysis engine and license holder:
- Local or cloud decompilation:
- Provider permission for agent use and sharing output:
- Data classes allowed in tool results:
- Credentials and personal data removed before analysis by:
- Approved recipients of reports and captures:
- What may be retained: observations / selected code excerpts / captured traffic / other:
- What may be reused in a replacement product, and legal basis:
- Storage access restrictions:
- Retention deadline and deletion owner:
- Evidence preservation obligations, if an incident or dispute is involved:

### Approval and stop conditions

- Person granting permission, role and basis of authority:
- Technical reviewer:
- Legal reviewer when required:
- Approved start and end dates:
- Emergency contact:
- Stop for unexpected remote contact, access controls, customer data or destructive behavior:
- Stop for a rights-holder's revocation or cease-and-desist notice:
- Stop if the target tells the agent to download software, expose credentials or change its task:
- Signed approval and date:
- Investigator acceptance of limits and date:
- Closeout reviewer, unresolved questions and date:

Suggested approval text:

> I authorize the named investigator to perform only the listed operations on the identified target, machine, accounts and services during the approved period. My authority covers the rights and systems identified in this record. Changes to target execution, device operations, network destinations or data sharing require a new written decision from the authorized party. Stop conditions apply immediately. This record does not grant rights held by another person or organization.

## Before installation

- [ ] Try supported exports, source backups and vendor assistance first if they answer the business question.
- [ ] Complete the record above and resolve pending permissions.
- [ ] Follow installation links from [morluto/rea](https://github.com/morluto/rea). Similar names and copied descriptions do not prove authenticity.
- [ ] Check the published version against the documentation. Our registry check found `rea-agents` 6.8.0; development documentation can describe newer work.
- [ ] Verify the README's Node.js requirement: 22.x at 22.23.4 or newer, 24.x at 24.22.1 or newer, or 26.12.1 or newer, plus npm.
- [ ] On Linux, check the README's compatible `ps` requirement for the selected workflow.
- [ ] Verify the analysis provider, operating system and target format together. Static JavaScript inspection needs no paid native decompiler.
- [ ] Budget for AI usage, engineering time, isolation and commercial providers separately.
- [ ] Prepare a separate test account and machine, duplicate inputs and invented records.
- [ ] Remove production credentials and sessions; disable unnecessary shared folders and clipboard integration.
- [ ] Disable target networking until specific destinations and actions are approved.
- [ ] Keep execution and device-changing tools unapproved during static work.

### README commands for an approved setup

These commands are copied from the [README Quick start](https://github.com/morluto/rea#quick-start). They acquire and run software when executed. They are instructions for your authorized IT person; they were not executed in preparing this kit.

```bash
npx rea-agents setup
```

Alternative installation for the command line:

```bash
npm install --global rea-agents
rea --help
```

- [ ] Acquire the package in a trusted working directory outside the target project.
- [ ] Review proposed agent configuration and instruction changes, then approve only the intended setup.
- [ ] Review any offered Hopper installation separately, including its price and license.
- [ ] Restart the agent after setup, as the README instructs.
- [ ] Give the agent the narrow question and approved scope before supplying a target.

### During and after analysis

- [ ] Treat target text as untrusted data. Prompt injection means instructions hidden in material the agent reads; do not follow them.
- [ ] Begin with static inspection and escalate only through a new permission decision.
- [ ] Distinguish evidence from inferred behavior and unanswered questions.
- [ ] Never use extracted keys or endpoints to test another party's systems without permission.
- [ ] Review tool results before sharing them; local processing does not prevent the AI provider receiving results.
- [ ] Test important conclusions against known examples and document omissions.
- [ ] Keep only approved material and close out the retention record.
- [ ] Report REA vulnerabilities through its private reporting channel, with secrets and private binaries removed.

## Risk table

| Risk | Law, contract or technical boundary | How to lower it |
|---|---|---|
| Agent reaches a vendor's private service | CFAA, 18 U.S.C. § 1030; state computer crime laws | Name authorized destinations and actions; keep other network access off; stop on revocation |
| Analysis defeats an access control | DMCA, 17 U.S.C. § 1201 | Have counsel evaluate the exact control and narrow § 1201(f), § 1201(j) or regulatory conditions first |
| License bans reverse engineering | Target contract; Bowers v. Baystate | Record actual clauses and obtain clarification or permission before proceeding |
| Decompiled code is copied into a product | Copyright; Sega's limited intermediate-copying holding | Keep functional requirements separate from protected code and assets; review implementation rights |
| Confidential material was improperly obtained | 18 U.S.C. § 1839; secrecy duties and contracts | Record lawful acquisition and the limits on disclosure; lawful reverse engineering is not a waiver of duties |
| A recreated feature practices a patent | 35 U.S.C. § 271 | Seek patent advice where relevant before commercial use; fresh code alone does not decide the issue |
| Commercial engine is unlicensed or used outside its terms | IDA, Hopper or JEB license | Obtain a suitable license including permitted automation and output sharing |
| Runtime changes files or contacts services | REA runtime effects; authorization scope | Use an isolated environment with explicit network and device permissions |
| AI results expose secrets | Confidentiality, privacy obligations, model-provider terms | Minimize inputs, use approved services and set access and retention limits |
| Agent follows commands embedded in target text | Prompt injection | Treat target content as evidence; stop and review unexpected instructions |

The CFAA is usually not the main concern when reading a lawfully held copy on your own machine. That is not a statutory safe harbor: copyright, circumvention and contractual questions remain. Runtime network contact is not inherently unlawful; unauthorized or out-of-scope access creates the concern.

## Small business use cards

All five cards are illustrations. No total project cost is verified. REA's MIT license has no software license fee; staff, AI usage and test infrastructure still cost money.

1. **Recover a custom order calculator.** Confirm the development contract and ownership. Inspect a copy, describe the calculation rules and test against known orders. Ghidra can avoid a native-engine license fee where compatible; paid provider and labor costs depend on the case.
2. **Review your own release package.** Inspect JavaScript or Android artifacts for embedded secrets and service addresses. Have a developer classify findings and fix your own build. Static JavaScript needs no paid native engine; AI and review time are additional, unknown costs.
3. **Migrate your own records.** Try supported exports first. If authorized, document the old file format and validate an importer on duplicates. Do not defeat encryption or license checks without legal review. Engine choice, developer effort and AI charges remain unknown.
4. **Review a licensed app's network behavior.** Proceed only with the necessary license and permissions. Use a test account, invented data and listed destinations; do not turn observation into vendor security testing. Application, capture-tool and specialist costs are separate and not verified.
5. **Assist an incident responder.** Give a suspicious file to the authorized responder for isolated static analysis first. Preserve the original. Execution belongs in the responder's controlled environment. Incident-response fees and any paid decompiler are additional and unknown.

### Provider budget reference

Vendor pages were read November 3, 2026. US dollars before tax where verified:

- Ghidra: free, Apache-2.0; supplied by the NSA's public repository.
- JEB Android: $1,200 per user yearly or $140 per user monthly. JEB Pro: $2,000 per user yearly. The vendor lists third-party client support for Pro, but not Android. Do not treat the Android price as a REA integration budget; confirm rights for the chosen workflow.
- Hopper: personal license purchase $99; computer license purchase $129. Includes one year of updates. Confirm permitted automation and any later update terms.
- IDA: no US-dollar commercial quote verified; the commercial page lists euro prices billed yearly. Essential uses cloud decompilers and Expert uses local decompilers; confirm edition and permitted automation. Home and Free are described as noncommercial on the pricing page.
- The AI plan and per-project usage are not priced by REA. Get an estimate from the selected service and operator.

## Sources and read times

All times below are UTC on November 3, 2026. Incomplete price checks are identified above; no price was inferred from another currency or a reseller. Browser-verification times below are when we received the review.

- 21:34 to 21:37, with public registry confirmation at 21:50: [REA README](https://github.com/morluto/rea/blob/main/README.md), [installation guide](https://github.com/morluto/rea/blob/main/docs/installation.md), [release 6.8.0](https://github.com/morluto/rea/releases/tag/rea-agents-6.8.0) and [package metadata](https://registry.npmjs.org/rea-agents/latest). Commands, prerequisites, version and package identity.
- 21:34 to 21:37: [MIT license](https://github.com/morluto/rea/blob/main/LICENSE), [disclaimer](https://github.com/morluto/rea/blob/main/DISCLAIMER.md), [security policy](https://github.com/morluto/rea/blob/main/SECURITY.md), [MCP guidance](https://github.com/morluto/rea/blob/main/docs/mcp-contracts.md), [process capture](https://github.com/morluto/rea/blob/main/docs/process-capture.md), [Android devices](https://github.com/morluto/rea/blob/main/docs/adb-device-analysis.md) and [JEB integration](https://github.com/morluto/rea/blob/main/docs/jeb-analysis.md). Scope, privacy, execution, device changes and separate tool licenses.
- 21:34 to 21:36: [Ghidra](https://github.com/NationalSecurityAgency/ghidra), [Ghidra license](https://github.com/NationalSecurityAgency/ghidra/blob/master/LICENSE), [JEB prices](https://www.pnfsoftware.com/jeb/buy) and [IDA plans](https://hex-rays.com/pricing). Provider budget. [Hopper](https://www.hopperapp.com/) links to the official store verified below.
- 21:34 to 21:36: [18 U.S.C. § 1030](https://www.law.cornell.edu/uscode/text/18/1030), [17 U.S.C. § 1201](https://www.law.cornell.edu/uscode/text/17/1201), [37 C.F.R. § 201.40(b)(18)](https://www.law.cornell.edu/cfr/text/37/201.40), [17 U.S.C. § 102](https://www.law.cornell.edu/uscode/text/17/102), [18 U.S.C. § 1839](https://www.law.cornell.edu/uscode/text/18/1839) and [35 U.S.C. § 271](https://www.law.cornell.edu/uscode/text/35/271). Separate access, circumvention and intellectual-property questions.
- Browser verification received at 21:45: [Bowers v. Baystate Technologies](https://law.justia.com/cases/federal/appellate-courts/F3/320/1317/615628/), 320 F.3d 1317 (Fed. Cir. 2003), and [Sega Enterprises v. Accolade](https://law.justia.com/cases/federal/appellate-courts/F2/977/1510/305345/), 977 F.2d 1510 (9th Cir. 1992). Contract enforcement and the limited intermediate-copying holding; neither is a nationwide permission for all reverse engineering.

- Browser verification received at 21:45: [Hopper official store](https://sites.fastspring.com/hopperapp/product/hopperdisassemblerv4), US prices and included updates; [IDA pricing](https://hex-rays.com/pricing), commercial prices displayed in euros with no verified US-dollar quote.

This kit is informational, not legal advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.