Reverse Engineer an App With a Local Model: REA in Locally Uncensored, Step by Step
This guide takes you from nothing to a first answer from REA, the Reverse Engineer Anything plugin in Locally Uncensored 3.0.7, with the model running on your own machine. Why a local and possibly uncensored model is worth it is in Reverse engineering with a local, uncensored model.
REA runs in the desktop app only. A full analysis with an answer has run on one Mac so far; on Windows the built app has started REA and handed its tools to a model. Use REA on software you own or are allowed to examine.
What You Need
- Locally Uncensored 3.0.7, the desktop app
- Node.js 22.19 or newer within 22, 24.11 or newer within 24, or 26 and later
- A model of about 27B with tool calling, and memory for a 64K context on top of it
- The app or file you want to look into, on this computer
Step 1: Install Node.js
Get Node.js from nodejs.org in one of the versions above. LU does not install it. If REA cannot find a fitting version later, its row under Plugins says which one it found and asks you to update.
Step 2: Pick and Download a Model
Open Models and search for Qwen 3.8 27B. Any of these works as a start:
- Qwen 3.8 27B, the stock model, 16 GB. Our tested run used this base on Ollama.
- Qwen 3.8 27B Abliterated (Ollama), an uncensored build with tools, 18 GB, one pull.
- Qwen 3.8 27B HauhauCS Aggressive, an uncensored build with tool calling, 16 GB at IQ4_XS.
The uncensored builds have not been run with REA yet. Smaller models often stop before they answer: Qwen 3.5 9B at 32K ran out of context in our run.
Step 3: Set the Context to 64K
Open Agent or Code, pick the model, and set the Context window menu in the composer to 64K or more. The model reloads when you change it. REA's results are large, and a short context is the most common reason a run ends without an answer.
Step 4: Switch REA On
Open the Plugins menu in the composer and flip the REA switch. The line under it shows each step:
- "Getting the official REA 6.5.0 package…": LU fetches the pinned package and checks it against the checksum the npm registry publishes
- "Starting REA…": the first start installs REA's dependencies. In the built app on Windows it took 62 seconds with an empty cache, a second start 22 seconds
- "207 reverse engineering tools for Agent and Code.": REA is ready
LU starts that exact file and never runs REA's own setup. It checks the package again before every start.
Step 5: Ask a First Question
Name the target by its full path and ask about one thing. For example:
Look at the Electron app in /path/to/TinyNotes. Which version is it,
which servers does it talk to, and which IPC channels does it use?
Show the evidence for each answer.A turn only gets the REA tools its words point at, so "app", "Electron" or ".NET" in the question steer which tools the model sees. That keeps the context free for the results.
Step 6: Approve the Tool Calls
Every REA tool sits behind the same confirmation as any external tool in Agent and Code. You see which tool the model wants to call and with what, and it runs once you allow it. Our test run took ten steps and 3 minutes 15 seconds on a Mac.
Step 7: Check the Answer
REA keeps a full evidence record for every result and hands the model the facts with the id of that record. A good answer names what it found and where: the version, the endpoints, the channels, the file or function they came from. If a claim has no evidence behind it, ask the model to show the record for it.
When It Does Not Work
- The row names a Node.js version. Update Node.js to one of the versions above and switch REA on again.
- The first start takes long. It downloads REA's dependencies once. Let it run; the next start comes from the cache.
- The model stops without an answer. Raise the Context window, use a 27B model, and split the question into smaller ones.
- A native binary gives thin results. REA uses Ghidra, Hopper, JADX or Frida where you have them installed. LU installs none of them.
Questions
Where is the REA switch?
In the Plugins menu of the composer in Agent or Code. It is off by default and only in the desktop app.
The REA row says it needs Node.js. What now?
Install Node.js 22.19 or newer within 22, 24.11 or newer within 24, or 26 and later from nodejs.org, then switch REA on again.
How long does the first start take?
The first start downloads REA's dependencies. In the built app on Windows it took 62 seconds with an empty cache; a second start took 22 seconds.
The model stops without an answer. What helps?
Use a model of about 27B and set the Context window to 64K or more. Ask about one thing at a time and point at the file or folder by its full path.