The Repository Without an Author: Reading REA as Forensic Evidence

On the ninth day of its existence, the repository passed one hundred thousand stars. It had no author. No license file. No commit older than a week. The growth curve was vertical in a distribution that is, without exception, logarithmic.

I have spent twenty-nine years reading systems that were built to be read, and systems that were built not to be. A star count is a ledger. The ledger does not lie, it only waits to be read. GitHub's most viral artifact — AutoGPT, the reference case from 2023 — required two to three weeks to reach the same threshold. A nine-day ascent to one hundred thousand stars would not merely be fast. It would sit outside the platform's recorded distribution. Unprecedented outcomes are not impossible. They are, however, the first thing an auditor verifies, because they are also the first thing a marketing narrative fabricates.

The source material in front of me carries its own anomalies before it carries any technical ones. Six factual claims. Five annotated "source: none." No author. No date. No direct quotation. And a distribution channel that describes itself as Web3 media, publishing a document with zero Web3 content. I do not begin with the tool. I begin with the document, because the document is the only artifact I can currently audit.

REA is described as an artificial-intelligence tool that reverse-engineers software. The claim is not that it assists a human analyst. The claim is that it produces portable, runnable source from compiled binaries, and that its outputs include Grand Theft Auto V executing on an iPhone and a free functional equivalent of Adobe Photoshop. The supporting evidence is a star count and a set of screenshots.

To evaluate that claim, one has to know what the existing stack can and cannot do. The professional toolchain — Ghidra, IDA Pro, Binary Ninja, RetDec — is mature, and in Ghidra's case free and open source. All of it produces pseudocode. Pseudocode is an approximation of control flow, not a compilable program. The academic frontier is narrower still. Projects such as LLM4Decompile and DeGPT use language models to improve a human-readable surface: variable naming, type recovery, comment generation. They do not restore semantic equivalence. They do not reconstruct the original engineering.

The second piece of missing context is that "GTA V running on a phone" is not a new phenomenon and never required decompilation. Winlator, Wine, and the Box86/Box64 translation layers have executed x86 Windows binaries on ARM Android hardware for years. The mechanism is emulation and instruction translation, not source recovery. "Free Photoshop" has an equally prosaic precedent: Photopea has offered a browser-based image editor since 2013, with GIMP and Krita as open-source analogues. These are three distinct technical phenomena — emulation, interface cloning, and format compatibility — and the source narrative compresses them into a single output attributed to one AI.

I read this through an on-chain lens for a specific reason. The distribution layer for a tool of this kind is the same layer that now hosts tokenized intellectual property, licensing registries, and provenance records. Reverse engineering and on-chain provenance are opposing forces operating on the same substrate. That collision is the real story, and it is the story the source declines to tell.

Decompilation has a ceiling that no model has crossed. A compiler discards information — symbol names, macro expansion, inlining decisions, type annotations — and that information cannot be recovered because it no longer exists inside the binary. What a decompiler produces is a reconstruction of behavior, not a recovery of authorship. The distinction matters because the claims in question are authorship-level claims: a source tree that can be rebuilt, recompiled, and shipped.

Even a perfect decompiler would not close the gap. Modern game and application binaries depend on assets — textures, audio, meshes, shaders — stored in proprietary container formats and compressed with proprietary codecs. Those are not code. They are not decompiled. They are decrypted, if the keys are available, or they are not obtained at all. Beyond the assets sit the platform bindings: DirectX calls, Metal calls, hardware-acceleration paths, and the shader pipeline, none of which has an automatic translation layer that a single tool invocation produces.

The honest boundary is therefore this: AI-assisted decompilation automates the clerical portion of reverse engineering. It does not generate a shippable cross-platform port. Any claim that it does is either a category error or a sales document. The ledger does not lie, it only waits to be read — and what the decompilation ledger records is readability gains, not equivalence.

Porting is a multi-year team discipline, not an inference call. Assume, for the sake of argument, that a complete GTA V source tree existed. The porting problem would remain. The reference platform is x86-64, Windows, and DirectX 11. The target is ARM64, iOS, and Metal. Between those two points lie a graphics API translation layer, a full shader rewrite, a rebuilt asset pipeline, and mobile-specific performance work bounded by thermal and memory constraints the desktop build never faced.

That is not a task measured in inference calls. It is a task measured in team-years, and it has been performed before by large studios holding full source access with no licensing ambiguity. Rockstar itself has ported its own engine across three console generations and multiple architectures, and every transition was a multi-year engineering program. The proposition that an AI agent collapses that program into an automated output is not a technical claim. It is a narrative claim wearing technical clothing.

My own audit history makes me allergic to this genre. When I reverse-engineered the EtherDelta order-matching engine in early 2018, the value was never in producing something runnable. The value was in documenting fourteen discrete logical flaws at the level of integer-overflow behavior under specific gas-price conditions. Reverse engineering produces understanding, and understanding is not a binary artifact you can compile. The confusion between the two is the core deception here.

Star velocity is a lagging indicator, and this one is historically anomalous. GitHub stars measure attention, not usage. They are one-directional and effectively permanent — a star earned in a viral week is never withdrawn when the project is abandoned. A repository can hold one hundred thousand stars and zero active contributors.

The velocity claim is the more falsifiable element, and it is where the source is most exposed. The fastest documented viral repositories on the platform required two to three weeks to cross one hundred thousand stars. A nine-day ascent would sit outside the historical distribution. Such an outcome is not impossible, but it is precisely the kind of outcome that requires primary-source verification before it is repeated as fact.

The verification is trivial and the source did not perform it. A repository's star history can be plotted. Its fork-to-star ratio can be computed. Its commit cadence, contributor graph, and issue activity can be read directly. None of these were cited. A document that asserts the single most extraordinary data point in its own argument without linking to the instrument that would confirm it has told you what kind of document it is. The ledger does not lie, it only waits to be read. This ledger was left closed.

Three distinct phenomena were collapsed into one narrative. The source folds three unrelated technical events into a single claim of AI-generated output.

The first is emulation. GTA V on ARM hardware is a solved problem through Winlator and the Box86/Box64 translation layers, which interpret x86 instructions and translate Windows API calls at runtime. No source is recovered. The binary is executed as-is.

The second is interface cloning. A tool that reproduces Photoshop's layout and core editing functions is a reimplementation, not a decompilation. Photopea did this in 2013 without any AI. Cloning a user interface is a design exercise. It carries no access to Adobe's color-management engine, its PSD compatibility layer, or its plugin ecosystem.

The third is format compatibility — reading or writing another application's file formats. This is an interoperability problem with decades of documented solutions.

Each of these can be packaged as a demo. Each can be presented, out of context, as evidence of AI reverse engineering. But they are not the same phenomenon, and none of them requires the mechanism the source claims. When a narrative requires you to treat three distinct events as one, the narrative is doing work the evidence is not.

The provenance gap is the exhibit. This is where an on-chain analyst reads a document differently from a technology reporter. Real systems leave traces. A deployed contract leaves an address. A funded wallet leaves a transaction graph. A token leaves a supply schedule and a holder distribution. Even an anonymous project leaves scars on the ledger, and those scars are what I audit.

REA leaves nothing. There is no contract, no treasury, no funding trace, no deployer address, no governance token, no verifiable team entity. That absence is not neutral. In a genuine Web3 project, an absence of on-chain footprint is itself an anomalous signal. The source that promotes REA describes itself as a Web3 outlet while publishing zero Web3 content — no protocol, no chain, no address, no transaction. The metadata is the exhibit.

There is a structural reason this matters beyond the specific tool. The enforcement layer for intellectual property is centralized. DMCA takedowns run through hosting providers. Rights-holder litigation runs through courts. These mechanisms require a jurisdictionally reachable defendant — a repository, a company, a person. A reverse-engineering capability that is genuinely decentralized, genuinely uncensorable, genuinely unhosted, would have no such chokepoint. That is the collision: AI commoditizes reverse engineering at the same moment the industry is trying to put licensing and provenance on-chain, where it cannot be quietly edited.

A tool that can reproduce a proprietary binary and a registry that can attest to provenance are the two ends of the same cord. Pull one and the other tightens. The source mentions neither. It describes a capability without a legal surface and a distribution without an address. The ledger does not lie, it only waits to be read — and this ledger has no entries at all, which is the loudest entry of all.

The cost structure nobody priced. There is a final contradiction the source cannot resolve: economics.

Reverse-engineering a large binary is not a single inference call. It is a long sequence of reasoning steps over an enormous context — a multi-gigabyte artifact that must be loaded, segmented, and iterated upon. Token consumption scales with binary size, and binary sizes are measured in gigabytes. A tool that performs this at scale, for free, is externalizing an inference cost it does not account for. Free is not a price. Free is a subsidy, and subsidies have a source.

I have watched this pattern before, in a different domain. The proving costs of zero-knowledge rollups are structurally high, and operators absorb them only while gas prices justify the arithmetic. When the fee environment compresses, the subsidy becomes a loss and the operators bleed. The same logic applies here. If REA performs as described, its marginal cost per analysis is substantial and its revenue is zero. That is not a business model. It is a burn rate with a narrative attached.

The arithmetic is itself a falsification test. If the cost of a full reverse-engineering pass were truly negligible, the tool would be an economic event. If the cost is high — as the token-to-binary-size relationship suggests — then the free tier cannot be sustained at the volume the source implies. Either the cost is low and the claim is understated, or the cost is high and the claim is unsustainable. There is no third position. The source occupies both simultaneously, which is how narratives work and how ledgers do not.

What the bulls got right, and what the skeptics are missing.

The overstatement is not the same as the absence of a trend. The clerical labor of reverse engineering is genuinely automatable, and the automation is genuinely valuable. Symbol recovery, function-boundary identification, cross-reference analysis, and type reconstruction are the repetitive core of the discipline, and language models are demonstrably competent at improving all four. That is real. It changes the throughput of security research, malware analysis, and vulnerability discovery. It also lowers the barrier to DRM circumvention, which is the same fact viewed from the other side.

The second thing the skeptics miss is that the fabrication, if it is a fabrication, is itself the signal. A Web3 media outlet published a document with six claims, five unsourced, and no on-chain content. That document circulated. Its circulation is a measurable fact about the information layer of this industry, and it is more informative than the tool it describes. Content farms have moved from plagiarizing articles to generating them, and the distribution channels have stopped distinguishing between the two.

The bulls are right that reverse engineering is being commoditized. They are wrong to accept the evidence for it without reading the ledger. The two positions are compatible. The trend is real. The specific artifact is unverified.

Here is what I will be watching, and what will settle this without argument.

If REA is real, its repository will produce a star history that can be plotted, a commit graph that can be read, and a technical write-up that can be independently reproduced. If it is a fabrication, it will produce a DMCA notice, a silence, or a rename. Rights holders do not litigate against nothing, and they do not stay quiet about a working tool that reproduces their assets.

The repository will answer before its authors do. Until it does, the only auditable fact is that the document has no author — and the ledger does not lie, it only waits to be read.