reap-09-kernel-analysis

REA Investigation Prompts (REAP) — Reverse Engineering with your Coding Agent

A curated collection of prompts for REA (Reverse Engineer Anything) — the toolset that lets your AI coding agent inspect how software works, from native binaries, firmware and kernels to games, Electron apps, APKs and websites.

Prompts are ready to paste into your agent. Replace everything in <angle brackets> and keep each request focused on one feature — narrow questions get evidence-backed answers.

Star History

Install as agent skills (recommended)

setup.sh (macOS/Linux) or setup.bat (Windows) copies every prompt section into your coding agent's skills folder (~/.hermes/skills, ~/.claude/skills or ~/.codex/skills):

./setup.sh          # auto-detect installed agents
./setup.sh hermes   # or: claude-code | codex | all

setup.bat           :: Windows

What you get:

• Skills/ — 26 skill packs, one folder per section (reap-00-install-and-verify … reap-22-go-and-rust-binary-source-recovery, plus reap-prompts index, reap-wildcard and reap-prompt-writing-tips), each a SKILL.md with YAML frontmatter the agent auto-loads when relevant.
• system_prompt.md — the whole library as a single document you can paste into any agent's system prompt / custom instructions instead of installing skills.
• tools/build_skills.py and tools/build_system_prompt.py — regenerate Skills/ and system_prompt.md from readme.md (the setup scripts run them automatically; readme.md stays the source of truth).

Sources & credits

• REA tools & guides: https://rea.tools/
• Official prompt gallery: https://madewithrea.com/prompts
• Intro thread ("REA is the most dangerous thing on the internet right now") by codila — https://x.com/0xCodila/status/2109623431763292649 (quoting Matthew Berman — https://x.com/MatthewBerman/status/2108245653843509415)
• REAP Name by https://x.com/zazencodes?s=11

Table of contents

⚠️ Use responsibly. Only analyze software you own or are explicitly authorized to test. Anti-cheat, DMA, DRM, kernel and vulnerability prompts below are for security research, interoperability, CTFs, bug bounties and testing the protection of your own software. Bypassing protection of software you don't own, cheating in online games, or weaponizing a found vulnerability may violate law and terms of service. Every prompt asks the agent to separate confirmed facts from hypotheses and to cite evidence — treat that as non-negotiable.

---

0. Install & verify

Install REA and connect it to this agent using: npx rea-agents@latest setup

First, show me the installation plan and the configuration changes for my
approval. After the install, verify the connection and list the available
tools and workflows.

---

1. Getting started

First exercise — trace a CSV export

Download https://rea.tools/examples/notes-example.zip into a new folder and
extract the contents.

Use REA to investigate what happens when I click "Export notes". Trace the
flow from the button to the file write.

Show where notes.csv is created, which fields it contains, and the files and
functions that prove each step.

First look at an unfamiliar app

Use REA to give me a map of <program>: its main parts, entry points and the
three features worth investigating first. Keep it short and point to evidence
for each claim.

---

2. Feature tracing (any program)

Explain one feature

Use REA to investigate how <FEATURE> works in <PATH TO APPLICATION>.

Identify the entry point, the functions involved, the data flow, the
dependencies and the observable effects.

For every conclusion, present evidence: file, function, address or relevant
snippet. Separate confirmed facts, inferences and points that remain unknown.

Do not execute the application in this step.

Trace a button to its effect

Use REA on <app>. Start at the <button name> button and trace what happens
until the result is written, sent or shown. Name every module or function on
the path and what each one does.

Recover a rule and rebuild it

Use REA to find the rule that controls <behaviour> in <program>. Write the
rule in plain words, then build a minimal standalone version I can run, and
give me one input that proves it matches the original.

---

3. Native binary exploration

Understand an executable

Analyze <PATH TO EXECUTABLE> with REA.

Identify format, architecture, runtime, libraries, relevant strings and
possible entry points.

Map the main components and explain their responsibilities with evidence.
State which analysis engine is available and its limitations.

Start with static analysis.

Function deep-dive

Use REA on <binary>. Pick the function that handles <operation> and produce:
decompiled pseudocode, its callers and callees, the data structures it reads
or writes, and every string/global it touches. Annotate each finding with the
address range that proves it.

Imports, strings and triage map

Use REA on <binary>. Produce a triage map: file format and architecture,
section layout, linked libraries and imports grouped by capability (network,
filesystem, crypto, process/thread, registry/IPC), interesting strings with
their addresses, and the top candidate entry points for <FEATURE>. Flag any
signs of packing, obfuscation or control-flow flattening.

File-format reverse engineering

Use REA on <program> to work out how it reads and writes <file type>.