The Formula NSA's Decompressor Missed, Found by an AI Agent with 209 Tools

A mathematical formula that even the NSA's own decompressor failed to recover was dug out of an old game's EXE file by an AI agent—and it proved its correctness with 3,205 test cases. This sounds like science fiction, but it's a real demonstration from the open-source project REA (Reverse Engineering Agent).

Event Recap: The Hidden Formula in an Old Game

According to a YouTube video description, a classic DOS game called DX-Ball had only its EXE file and no source code. Working purely from the binary, REA successfully extracted the exact mathematical formula used in the game. The video claims that the NSA's decompressor failed at this task, while the AI agent not only found the formula but validated its accuracy with 3,205 test cases, all of which passed.

What makes this case notable is that it demonstrates the potential of AI agents in the field of reverse engineering. Traditional decompressors typically rely on pattern matching and heuristic rules, and may be powerless when faced with obfuscated or non-standard compiled binary code. REA appears to take a different approach, possibly combining symbolic execution, dynamic analysis, or machine learning techniques.

Symbolic execution and dynamic analysis are two complementary technical approaches in reverse engineering. Symbolic execution treats program inputs as symbolic variables and explores all possible paths through a constraint solver, making it suitable for handling code with complex branching; dynamic analysis runs the program in a real or simulated environment, recording execution traces and memory states. Traditional decompressors (such as general-purpose unpackers) mostly rely on static feature matching and heuristic rules, and tend to fail when faced with non-standard compilation, code obfuscation, or custom compression algorithms. REA may combine symbolic execution to enumerate the computation paths related to the formula, and use dynamic analysis to verify intermediate results, thereby recovering the exact mathematical expression in the absence of source code.

What Is REA: An MCP Server with 209 Tools

REA is essentially an MCP (Model Context Protocol) server that integrates 209 tools, designed to support a variety of AI programming environments such as Claude Code, Codex, and Cursor. It can handle multiple platforms and formats, including Android, Electron, iPhone, WebAssembly, smart contracts, firmware, and even DOS games.

MCP is a protocol that lets AI models interact with external tools and data sources, proposed by Anthropic. By providing a rich toolset, REA extends the capabilities of AI agents in reverse engineering and security analysis. These tools may include disassemblers, debuggers, symbolic execution engines, code emulators, and more.

The video also mentions that REA was able to trace the behavior of the Notion clipboard step by step, reconstruct the authenticator's login code, and that all 133 tests matched. Each conclusion comes with "receipts" (evidence), confidence levels, and unknowns.

Model Context Protocol (MCP) is an open protocol proposed by Anthropic in 2024, aimed at standardizing the way AI models interact with external tools and data sources. MCP adopts a client-server architecture: AI applications (such as Claude Code and Cursor) act as clients and communicate with MCP servers via JSON-RPC, while servers expose a series of tools, resources, and prompt templates. This allows AI agents to dynamically discover and invoke specialized tools such as disassemblers, debuggers, and symbolic execution engines without writing separate integration code for each tool. As an MCP server, REA uniformly wraps its 209 reverse engineering tools, so any AI environment that supports MCP can plug and play, significantly lowering the integration barrier for AI agents entering the field of reverse engineering.

Technical Highlights: Verifiable Reverse Engineering

A standout feature of REA is its verifiability. It doesn't just give answers; it also provides chains of evidence and confidence levels, which is crucial for security analysis and reverse engineering. In traditional reverse engineering, analysts' conclusions often depend on personal experience and intuition, making them difficult to reproduce and verify. REA's approach attempts to standardize and automate this process.

Support for smart contract and firmware analysis is also noteworthy. Smart contract security auditing is a hot topic in the blockchain space, while firmware analysis is particularly important in IoT security. REA claims to handle these areas, and if true, it would greatly lower the barrier to security analysis.

However, the video does not detail REA's specific performance in these areas, nor does it provide an independent third-party evaluation. Therefore, these capabilities still require further verification.

Smart contract security auditing and firmware analysis are two high-value scenarios in reverse engineering. Smart contracts are deployed on blockchains, with bytecode public but source code not necessarily open source; auditors need to recover logic from EVM bytecode and discover reentrancy or overflow vulnerabilities. Firmware is commonly found in IoT devices, which often lack debugging interfaces, requiring extraction of file systems from binary images and identification of hardcoded credentials or backdoors. These two types of targets typically use non-standard architectures (such as EVM, MIPS, ARM Thumb) and custom compression/encryption, posing challenges to general-purpose toolchains. REA's claimed support for these formats implies that its toolset may include disassemblers and emulators for specific instruction sets, but the actual depth of coverage still needs independent testing to confirm.

Open Source and Local Operation: Lowering the Barrier, but Challenges Remain

REA is free, open source, and runs locally. This means users can review the code themselves, modify the tools, and ensure that sensitive data does not leave the local environment. For security researchers, this is a significant advantage.

However, the quality of open-source projects varies, and REA's actual effectiveness may differ depending on the use case. The demonstration in the video may have selected cases favorable to REA. To fully evaluate its capabilities, more independent testing and community feedback are needed.

Significance for the Development of AI Agents

REA's emergence reflects that AI agents are expanding from simple task automation to complex professional domains. Reverse engineering has traditionally been considered a field highly dependent on expert experience, and AI's involvement may change this landscape.

But it should also be noted that the application of AI agents in reverse engineering is still in its early stages. Legal and ethical issues cannot be ignored either: using AI for reverse engineering may involve software license agreements and copyright issues. The video does not discuss these aspects, but they must be considered in practical applications.

Conclusion

REA's demonstration is impressive, especially the fact that all 3,205 test cases passed, which shows the rigor of AI in code analysis. However, a single video case is not enough to prove its generality. Subsequent testing and practical applications by the open-source community will determine whether REA can become a practical tool in the field of reverse engineering. For the development of AI agents, REA is a direction worth watching, but there is still a long way to go before maturity.

One-line Summary

Open-source AI agent REA extracted a mathematical formula from a DOS game EXE that the NSA's decompressor failed to recover, and validated it with 3,205 test cases.

Paragraph Summary

Open-source project REA (Reverse Engineering Agent) demonstrates the potential of AI agents in reverse engineering: it extracted the exact mathematical formula from the EXE file of the classic DOS game DX-Ball, a task at which the NSA's decompressor failed, and the extracted formula passed all 3,205 test cases. REA is essentially an MCP server integrating 209 tools, supporting multiple platforms such as Android, WebAssembly, smart contracts, and firmware, and can collaborate with AI programming environments such as Claude Code and Cursor. Its standout feature is verifiability—each conclusion comes with a chain of evidence, confidence level, and unknowns. REA is free, open source, and runs locally, but the video demonstration may have selected favorable cases; its actual generality and performance in various domains still require independent evaluation.