maosasagawa/blackbox-re-agent

Revagent is a conversational reverse engineering assistant built on top of an existing coding agent called pi. Instead of typing individual tool commands, you just ask plain language questions like what a program does, what a crackme's registration code is, or whether an app is secretly sending out data, and the agent drives a whole chain of reverse engineering tools on its own to answer you. It accepts APK files.o object files, Intel HEX firmware images, Windows exe files, ELF, PE, Mach O binaries, and raw firmware images, and only does static analysis, meaning it inspects the file's code without ever running it. Behind the scenes it identifies the file format, unpacks it if needed using tools like apktool and jadx for Android apps, disassembles the machine code, decompiles functions into readable pseudo code with Ghidra, and can even use a tool called angr to symbolically solve for the exact input that reaches a certain point in the program, such as a valid password. Every conclusion in its answers comes with a file path or address as supporting evidence. If a required tool is missing, it installs what it can automatically through a provisioning step rather than asking you to configure anything by hand. The README walks through a detailed example of analyzing supplier-delivered firmware for a car's electronic control unit, where the agent identifies the chip architecture, traces the reset vector and main loop, reviews how it handles CAN bus messages, checks for hardcoded keys or backdoors, and recovers a security access algorithm used to unlock diagnostic functions, all without access to the original source code. The project can be installed by handing its folder to a coding assistant such as Claude Code, pi, Codex, or Cursor along with a short prompt, or by running its own install script, which sets up radare2, Ghidra, angr, and related tools and can skip the heavier ones on a lower disk budget. The author states this is meant only for authorized analysis work such as malware research, CTF competitions, security audits, or your own programs, and that the agent only reconstructs and explains logic rather than producing ready to use malicious tools.