reacher-z/Awesome-REA: Curated tools, case studies and papers for reverse engineering websites, games, apps, binaries, f

Cursor, Claude Code, and the Awesome-REA Stack: A Practical Reverse Engineering Workflow

TL;DR

The reacher-z/Awesome-REA repository indexes 400+ curated tools, case studies, and research papers for reverse engineering websites, apps, games, and binaries — one of the more complete open-source indices in the space. Cursor and Claude Code can turn this static reference list into an active workflow pipeline. The productivity gains are real, but they depend entirely on prompt structure and tool chaining, not on the models doing autonomous magic.

Key Takeaways

• reacher-z/Awesome-REA catalogues tools across binary analysis, web protocol analysis, app decompilation, and game modding — making tool discovery no longer the slowest phase of a RE workflow, according to the repository README
• Cursor's Composer mode supports 100k–200k token context windows when backed by Claude 3.7 Sonnet or GPT-4o, enabling it to process decompiled source files that overflow standard chat interfaces, according to Cursor's model documentation
• Anthropic documented Claude Code's ability to run agentic, multi-file coding tasks from the terminal without manual copy-pasting between steps, according to Anthropic's Claude Code release announcement
• Levo auto-generates API contracts from live traffic capture, eliminating the manual documentation phase of API reverse engineering, per Levo.ai's platform documentation
• Self-reported developer community figures consistently cite meaningful reductions in orientation time on unfamiliar codebases when using AI-assisted analysis — no peer-reviewed RE-specific benchmarks exist as of late 2025
• The workflow gap in this stack is not tooling — Cursor, Claude Code, Levo, Testhive, and Operum have existed in roughly their current forms since mid-2024; the gap is prompt structure

What reacher-z/Awesome-REA Is and Why It Matters Right Now

Most RE tool lists are either outdated or domain-narrow. The reacher-z/Awesome-REA repository is different in one specific way: it covers five distinct RE domains in a single maintained index — web protocol analysis, binary and firmware analysis, mobile app decompilation, game modding, and static/dynamic analysis tooling. It is updated actively, which matters because tooling in this space moves faster than most written guides can track.

Here is the shift that makes this relevant in 2025: Cursor's context window and Claude Code's agentic mode have crossed a threshold where they can hold enough of a decompiled codebase in memory to reason about it coherently. That was not true 18 months ago. The Awesome-REA list was always a good reference. It becomes a workflow blueprint when paired with AI tooling that can actually process what RE tools output.

The old model: pick a tool, run it, interpret output manually, pick another tool. The new model: pick a tool, pipe output into Cursor or Claude Code, let the model structure the interpretation, then decide the next step.

You can query the Awesome-REA list itself with this prompt inside Cursor's chat panel:

``` You are a reverse engineering assistant. Given this list of tools: [paste the relevant Awesome-REA section here]

My target: [describe the binary / app / API / website] My goal: [extract API schema / understand obfuscation / map data flow] My constraints: [OS, open source only, no network access]

Recommend the 3 most relevant tools. For each: one-line rationale, and the first concrete step I need to take before I can use it. ```

This prompt runs identically in Cursor, Claude, ChatGPT, or Gemini. The model returns a prioritized shortlist. Reading 400 entries manually is no longer the first step.

The Evidence Behind the Stack

Here is where the evidence is solid — and where it is not.

Well-documented: Cursor's context capacity. As of its 2024–2025 release cycle, Cursor routes to Claude 3.5/3.7 and GPT-4o backends, giving Composer mode access to 100k–200k tokens, per Cursor's model documentation. That is enough to hold a decompiled Android APK's Java output or a medium-sized C binary disassembly in a single session.

Documented but platform-scoped: Claude Code's performance on structured code tasks. Anthropic's internal SWE-bench results demonstrate strong performance on software engineering tasks — finding and fixing bugs in known repositories. The transfer to RE work is plausible but not formally benchmarked. Decompiled output is not clean source code. It is noisier, the identifier names are often stripped or mangled, and the calling conventions may be inferred rather than explicit.

Self-reported: Productivity gains on unfamiliar codebases. Developer communities across GitHub discussions and reverse engineering forums consistently report meaningful time savings during initial triage when using Cursor or Claude Code as an explanation layer. The numbers vary and are not from controlled studies.

Not measured at all: AI hallucination rates in RE-specific contexts. This is the real gap. When a model reasons over decompiled code, it generates plausible but incorrect function names, calling conventions, and data type inferences. No systematic study of this failure mode exists for RE workflows as of November 2025. That is not a reason to avoid the stack. It is a reason to verify model outputs against actual execution before treating them as ground truth.

What This Changes for AI Tool Builders, Power Users, and Workflow Automators

The five-tool stack covers distinct workflow phases with no redundancy:

Three tools handle the heaviest cognitive load: Cursor for comprehension, Claude Code for automation, Levo for capture. The others handle pipeline glue and output persistence.

The Prompt Template That Covers Most of the Initial Triage

This is the core template for Cursor's Composer mode on unknown code:

``` Context: I'm analyzing [decompiled Java / C++ / Python bytecode] from [target]. The file is attached. I have no prior knowledge of this codebase.

Task:

1. Identify the top 5 functions by complexity or apparent importance.
2. For each function: probable purpose, inputs and outputs,

notable patterns (crypto, network calls, file I/O, anti-tamper).

1. Flag areas where decompilation artifacts may be obscuring intent.
2. Suggest the most productive entry point for deeper analysis.

Output format: numbered list, function name, 3-sentence description, one flag if applicable. Do not speculate beyond what the code shows. Mark any uncertain conclusions explicitly. ```

The last instruction is not optional. RE work with AI assistance fails predictably when the model presents fabricated function purposes as confident conclusions. Forcing explicit uncertainty flagging catches the majority of that failure mode in practice.

This template runs in Cursor with Claude 3.7 Sonnet as backend. It also pipes directly into Claude Code for batch processing:

```bash claude --print "Analyze the functions in decompiled_output.java. For each function that handles network calls, output: function_name, endpoint_url if identifiable, HTTP method if identifiable, payload structure if identifiable. Output as JSON." ```

Pipe that into a jq filter. Feed the structured result into Levo to cross-reference against captured traffic. This is where the Awesome-REA list transitions from a reading resource to a component catalog — you are connecting tools in a data pipeline, not evaluating them one at a time.

If you're building structured learning paths around AI tool chains like this one, the interactive lab format in Fazmin's AILearningGuide gives a useful reference for sequencing hands-on exercises across interconnected tools.

When NOT to Use This Stack

Do not use cloud-backed Cursor on legally sensitive targets. Cursor sends code to hosted models by default. Decompiled commercial software sits in legal gray territory in most jurisdictions. Use Cursor's local model option via Ollama, or Claude Code's offline configuration. Verify your setup before assuming local execution — the default is cloud.

Do not trust model output on cryptographic routines. This is the highest-risk failure point. Models frequently misidentify encryption algorithms, key schedules, and IV handling in decompiled code. If crypto is in scope, verify every model assertion against a reference implementation. No exceptions, regardless of how confident the output reads.

Do not run Levo on production traffic without explicit scope authorization. Levo captures network traffic. That is the mechanism that generates API contracts. If your authorization covers static analysis only, running Levo on live traffic — even on a personal test device — may exceed your legal scope. Confirm before you capture.

Do not skip documentation between sessions. Kendor or any structured note-taking layer is not optional for multi-session RE work. The model's context resets between sessions. Without structured handoff notes, you re-derive identical analysis in session two.

Checklist: Evaluate Your RE Workflow Before You Commit

• [ ] Is the target within documented legal scope? Written authorization exists.
• [ ] Is Cursor configured for local or cloud model routing? Matched to data sensitivity.
• [ ] Are model versions pinned? Updates change output behavior — pin for reproducibility.
• [ ] Is Levo traffic capture scoped to test endpoints only?
• [ ] Is there a documentation format (Kendor, Obsidian, structured JSON) for session handoffs?
• [ ] Has the Claude Code prompt been validated against known-output samples before new targets?
• [ ] Is Testhive running against modified code paths, not only the original baseline?
• [ ] Is there an explicit verification step before trusting model assertions about crypto or network behavior?

Where This Is Heading

Local model quality is narrowing the cloud gap. Cursor's Ollama integration and Claude Code's offline configuration already exist. As models like DeepSeek-Coder, Mistral, and Llama 3.3 improve on code comprehension tasks, the case for routing RE work through cloud-hosted models weakens. A viable full-local stack that matches current cloud performance for initial triage is likely within 12–18 months.

Agentic RE loops are closer than they appear. Claude Code's current agentic mode requires human checkpoints. The next iteration — autonomous iteration through disassembly, hypothesis generation, testing, and update — is technically achievable now but practically unreliable. The reliability curve is improving faster than most practitioners are tracking. Build workflows that can accommodate more automation without requiring a rebuild.

RE tooling will expose LLM-native output formats. Ghidra, Frida, radare2, and most tools in the Awesome-REA catalogue were designed for human-readable output. The next generation will expose structured JSON designed for model consumption. Levo already does this for API RE. Binary analysis tools are behind, but commercial and open-source projects are actively closing that gap.

Multi-model routing will replace single-model dependence. Using GPT-4o for fast initial triage, Claude 3.7 for sustained deep analysis, and Gemini 1.5 Pro for large-context batch passes is already a viable and cost-effective strategy. As model specialization increases — some models better at symbol recovery, others at calling convention inference — optimal workflows will route tasks automatically rather than by default.

FAQ

Is Cursor actually useful for RE, or is it just a code editor with AI features?

Cursor's value in RE is its context window and multi-file reasoning mode, not its autocomplete. If you're using it like a smarter VS Code for writing code, you're not using it correctly for this workflow. The use case is: decompile, dump output into Composer, prompt for structure. That is a different job than writing software.

Why use Claude Code instead of the Claude.ai web interface?

Terminal-native execution. Claude Code reads files, writes files, runs commands, and iterates without manual copy-pasting. For RE workflows that generate dozens of output files per session, the reduction in friction is significant. The web interface is adequate for single-file analysis. Claude Code is for pipeline work.

How accurate are Cursor and Claude Code on decompiled code?

Heavily task-dependent. Clean decompiled Java from tools like jadx, with preserved identifier names: accuracy is high and hallucination rate is low. Heavily obfuscated bytecode with stripped symbols: accuracy drops substantially. The model fills gaps with plausible guesses that read like conclusions. Explicit uncertainty prompting and manual verification steps — not blind trust in output — are the mitigations.

Are Levo, Testhive, Operum, and Kendor open source?

No across the board. Levo offers a free tier with open-source capture agents but runs a commercial platform. Testhive and Operum have commercial licensing. Kendor's availability varies by version. The Awesome-REA repository spans the full license spectrum — filter by license before building production dependencies on any tool from the list.

What is a realistic time saving over a traditional RE workflow?

Heavily context-dependent. For initial orientation on an unfamiliar binary — identifying major subsystems, mapping data flow, understanding structure — AI-assisted analysis consistently reduces triage time. For deep cryptographic analysis or targeted vulnerability research, savings are smaller and hallucination risk is higher. Treat the AI layer as a structured analyst, not an authoritative source.

Does this workflow run offline?

Partially. Cursor with local Ollama models, Claude Code in offline configuration, and locally installed tools from the Awesome-REA list can operate without internet access. Levo requires network connectivity for traffic capture by design. Full offline capability requires explicit configuration — it is not the default state of any tool in this stack.

What is the minimum viable version of this stack for someone starting out?

Cursor, one good decompiler (jadx for Android targets, Ghidra for binary targets), and a disciplined prompt template. Add Levo when working on API-heavy targets where manual traffic documentation is the bottleneck. Add Claude Code when file volume makes copy-pasting the main friction point. Tools like Operum and Testhive are for operationalizing a workflow you have already validated through manual runs — not for building one.