Eleven: a desktop app where any ACP agent reverse-engineers binaries through REA, with you watching

[Zfinix]

REA gives an agent everything it needs to read a binary. What it does not give you is a window to watch it work in. You start the agent in a terminal, it calls procedure_pseudo_code forty times, and at the end you read a summary and take its word for it.

Eleven is the window. It is a free desktop app for macOS, Windows and Linux where any agent that speaks the Agent Client Protocol (Claude Code, Codex, Gemini, Cursor, Copilot, OpenCode, Aster) reverse-engineers a binary next to you, through REA. You see every function it opens and approve every change it makes.

Repo: https://github.com/Zfinix/eleven

How it uses REA

Eleven bundles REA 6 and runs Ghidra headless through it. The whole workbench (functions, pseudocode, assembly, control-flow graph, cross-references, strings, segments, hex) is read from REA tools, with no otool behind it. Mach-O, ELF and PE all open the same way. Rizin is the other engine, for when you want a file open in seconds instead of minutes.

Agents get REA too, with one filter. Every REA tool passes straight through except the ones that write names, comments and bookmarks (set_address_name, set_comment, set_bookmark and friends). Those are refused with a note pointing at Eleven's own tools, so a rename lands in the project with its author on it and ⌘Z undoes it. A byte patch from an agent arrives as a suggestion you accept or decline. The original file is never written to.

On top of REA, Eleven serves its own MCP server so the agent can drive the window: open a function, switch to the graph, rename, add a note, change a line's type, set a breakpoint and step. The tool list is in docs/mcp-tools.md.

What it adds on top

• Android apps through jadx, with smali from apktool, string resources, and split bundles (.xapk, .apks).
• Source files recovered from the binary. Swift types are read straight from __swift5_types, and the agent can recreate a whole file with each function linked back to its address.
• Select lines in pseudocode or assembly and ask about them. The answer opens under the lines, and a suggested rename comes as a card.
• CUDA and HIP fat binaries as highlighted PTX, with rewrites to CUDA C++, HIP C++ or Metal.
• Metal shaders, ML model files and GPU profiles, linked to the code that loads them.
• A debugger on lldb-dap, diffing two builds by function, and a project saved as one .eleven file.

Two things we changed in REA

Large Mac apps were slow to open. Ghidra's Objective-C Message Analyzer took most of the time, so Eleven skips it per file, then packs the analyzed Program to a .gzf and reimports it with -noanalysis on the next open. Hopper went from 106 s to 4.7 s on reopen. This overlaps with #4439 (streaming progress and cached analysis), which we are waiting on so we can drop our own copy.

Our fork also adds a set_code_type tool to mark bytes as code, a function, data, a string or undefined from the UI. Happy to send it upstream if that is wanted.

Limits

It is one person's project at version 0.1.13. The first Ghidra open of a big app is still slow. The debugger has only been tested on macOS. Hermes bundles in React Native apps show up as a card, not decompiled.

Install on macOS 14 or later on Apple Silicon:

curl -fsSL https://eleven.chizi.app/install.sh | bash

Windows, in PowerShell:

irm https://eleven.chizi.app/install.ps1 | iex

Linux gets an AppImage from the latest release.

If you try it with REA, I would like to hear what breaks.