Hex-Rays (Vendor): news timeline & CVEs

REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro to Reverse Engineer Anything

Open-source REA connects Claude Code and Cursor to Ghidra and IDA for evidence-backed reverse engineering.

REA (Reverse Engineer Anything) is an open-source bridge that lets AI coding agents query Ghidra, IDA Pro, and Hopper through a local Model Context Protocol server. It covers native binaries plus JavaScript, Electron, .NET, Android packages, firmware, and selected runtime activity, returning pseudocode, assembly, strings, and references with stated limits. Setup via npx supports Claude Code, Cursor, Codex, Gemini CLI, and Grok Build. A project-reported DX-Ball demo matched 63 compiled function bytes and passed 3,205 tests; findings sent to the agent remain subject to the model provider’s data policy.

Cyber Security News08:08 UTC · 12h agoTools4· 2 reads

When LLM Decompilers Recompile More and Preserve Less

Researchers show LLM decompiler outputs can recompile yet diverge behaviorally, proposing the Decompile-Diverge fuzzing oracle to catch hidden changes.

The paper demonstrates that LLM-based decompilers can produce code that recompiles and passes all shipped tests yet diverges on other legitimate inputs—4.9% overall and up to 13% for one system—and can make disclosed vulnerabilities vanish without a visible crash. Across 300 real GitHub functions and 287 CVE-grounded functions, a refinement LLM lifted Ghidra's build rate from 75% to 90% while Matched rate fell from 74% to 62%, with up to one tenth of vulnerabilities showing Crash Absence. Decompile-Diverge detects these gaps by synthesizing drivers, growing fuzzing corpora from the reference, and rerunning decompiled code on identical inputs.

arXiv cs.CRSep 4, 17:16 UTC · Sep 4, 2026Research

Hex-Rays

Timeline2 articles

Appears with

REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro to Reverse Engineer Anything

When LLM Decompilers Recompile More and Preserve Less