Reverse Engineering With a Local, Uncensored Model: REA as a Plugin for Your Agent
REA, short for Reverse Engineer Anything, is an open source MCP server that lets an AI agent look inside apps and files: what an Electron app sends and where, how a .NET program is put together, what a binary calls. Its analysis runs on your machine. The model that reads the results and decides the next step usually does not. Locally Uncensored 3.0.7 closes that gap: REA is a plugin you switch on for the agent, and the agent can run on a local model, including an uncensored one.
A full analysis with an answer has run on one Mac, with stock Qwen 3.8 27B on Ollama and LU's tool code outside the app. On Windows, the built app has started REA and handed its tools to a model. The uncensored builds named below have not been run with REA yet. Use REA on software you own or are allowed to examine.
Where Your Findings Go
REA itself is local in every setup. The difference is the model that drives it:
| REA with a cloud agent | REA in LU with a local model | |
|---|---|---|
| The analysis | On your machine | On your machine |
| Tool results the model reads | Sent to the cloud model | Stay on your machine |
| Your questions about the app | Sent to the cloud model | Stay on your machine |
| Setup | npx rea-agents setup writes into your agent's settings | One switch under Plugins |
For a closed program from your employer, a client's app under audit or your own unreleased build, that second column is the reason to do it locally. The strings, endpoints and code fragments REA pulls out never leave the computer.
Why an Uncensored Model
Reverse engineering talk is full of words that safety training reacts to: decompile, bypass, patch, crack the format. A model with its refusals removed answers the question you asked instead of judging the vocabulary. That matters most in long agent runs, where one refusal in step seven ends the whole analysis.
We have not measured how often a stock model refuses REA tasks. On our test app, stock Qwen 3.8 27B did not refuse and finished the job. An uncensored build is the safer bet when your questions sound rougher than "how does search work".
Which Local Models Fit
REA works best with a model of about 27B and a context window of 64K or more. Smaller models often stop before they write an answer: Qwen 3.5 9B at 32K ran out of context in our run. These Qwen 3.8 27B builds are in LU's model catalog, all marked for agents:
| Model in the catalog | What it is | Size |
|---|---|---|
| Qwen 3.8 27B | The stock model, tools and switchable thinking. Our tested run used this base on Ollama | 16 GB (UD-Q4_K_M) |
| Qwen 3.8 27B Abliterated (Ollama) | huihui's abliterated build, one-command pull, vision, tools and thinking | 18 GB |
| Qwen 3.8 27B Abliterated | The same build as GGUF, from Q2_K for 12 GB cards up to Q8_0 | 11 to 29 GB |
| Qwen 3.8 27B HauhauCS Aggressive | An uncensored build with vision, tool calling and thinking, recommended quant IQ4_XS | 16 GB (IQ4_XS) |
Give the model enough memory for a 64K context on top of its file size. The Context window menu in the composer sets it, and the model reloads when you change it.
How LU Makes a Local Model Finish
Plugging REA into a local model is not enough on its own. In the first real runs, Qwen 3.8 27B picked the right steps in the right order and never wrote an answer. LU now does three things for REA's tools:
- Only the tools a turn points at. REA has 207 tools. A turn gets the ones its words point at, so an Electron question does not carry the .NET tools.
- References instead of copies. Some tools take an earlier result either whole, some 7,000 characters, or as a short reference. LU offers the model the reference only, as REA's own guide recommends.
- Facts instead of provenance. One analysis of a four file app came back with 343,583 characters, mostly hashes. LU hands the model the facts, 32,792 characters in that case, with the id of the full record.
With that, stock Qwen 3.8 27B at 64K took the test app apart in ten steps and 3 minutes 15 seconds, and its answer named the version, both endpoints and both IPC channels.
The Agent Stays on a Leash
Every REA tool sits behind the same confirmation as any external tool in Agent and Code. The model proposes a call, you see it, and it runs once you allow it. LU fetches one pinned REA version, checks it against the checksum the npm registry publishes before every start, and never runs REA's own setup, which would write into other apps' settings.
What REA Reads
By itself: JavaScript and Electron apps, .NET, Go and Rust programs, Flutter, SQLite and WebAssembly. Ghidra, Hopper, JADX and Frida are used where you have them installed. LU installs none of them. The step by step setup is in the guide Reverse engineer an app with a local model.
Limits
- The complete answer came from one Mac with stock Qwen 3.8 27B and LU's tool code outside the app
- On Windows the built app has started REA and passed its tools to a model; a full analysis there, any run on Linux, cloud models and the uncensored builds have not been tried
- REA needs Node.js 22.19 or newer within 22, 24.11 or newer within 24, or 26 and later
- Use it on software you own or are allowed to examine
Questions
Does REA send my app to the cloud?
REA's analysis runs locally. What it finds goes to whatever model drives the agent. With a cloud agent that is a cloud model; in Locally Uncensored with a local model, it stays on your machine.
Which local model works with REA?
A model of about 27B with a 64K context window. Qwen 3.8 27B on Ollama with 64K context took a test app apart and wrote a complete answer in 3 minutes 15 seconds. Qwen 3.5 9B at 32K ran out of context before an answer.
Can I use an uncensored model with REA?
Yes, any local model with tool calling can drive it. The catalog has uncensored builds of Qwen 3.8 27B, such as Qwen 3.8 27B Abliterated and Qwen 3.8 27B HauhauCS Aggressive. Our tested run used the stock model; the uncensored builds have not been run with REA yet.
Is reverse engineering with REA legal?
Use it on software you own or are allowed to examine. The rules depend on your country and the license of the software.
Do I need Ghidra or IDA?
Not for JavaScript and Electron apps, .NET, Go and Rust programs, Flutter, SQLite and WebAssembly. Ghidra, Hopper, JADX and Frida are used where you have them installed; LU installs none of them.