The vendor of the sales software you have used for eight years has shut down. Nobody has the source code, and nobody knows where your customer records sit inside its database file. Opening it used to be specialist work. Since last week, an AI agent can start on it from your own laptop.
On 7 October 2026 the open-source tool REA (Reverse Engineer Anything) launched, and by 9 October it was at the top of GitHub's trending list. It is not magic, but it breaks an assumption many businesses rely on: that packaged software cannot be read.
What REA does, and what it doesn't
REA connects coding agents such as Claude Code, Codex and Cursor to professional reverse-engineering tools like Ghidra, IDA and Hopper, through MCP, a standard that lets an agent call other software as a tool. According to the project page it can analyse compiled programs, Electron and .NET apps, Android apps, websites, device firmware and SQLite database files. Its code is MIT-licensed, so it is free to use, commercially included.
Two details matter for a business. The analysis runs locally, so the software you inspect is not uploaded anywhere. And the project itself says REA does not recover original source code or clone whole applications: it helps an agent trace a feature, explain what it does, and leaves you to rebuild the part you need.
The upside: getting back what is already yours
Startup Fortune lists the first use cases: rebuilding a feature after the source was lost, checking a vendor's security claims, and making abandoned software work with a new system.
For Vietnamese companies the closest case is the accounting, inventory or timekeeping software written years ago by a small local firm that no longer answers the phone. The data is yours, but it is locked in a format only that program understands. An agent can help work out the file's structure so the data can move to a new system.
The downside: anything inside your app is effectively public
The same tool reads your apps too. If the sales app, dealer app or desktop client you ship contains API keys, database passwords or discount formulas, extracting them just got much cheaper.
The main barrier to reverse engineering was expert time. That barrier just dropped.
Startup Fortune argues that closed-source vendors lose the protection of "hard to read, therefore safe", and should revisit code review, obfuscation and bug bounty scope.
| What people assume | What is true |
|---|---|
| Packaged apps can't be inspected | Anything running on a user's device can be analysed |
| Keeping an API key in the app is fine | A key in the app is a leaked key; keep it on the server |
| AI can clone a competitor's product | Servers, cloud services and data aren't in the installer |
The last row is engineer Fabio Akita's conclusion after reading REA's code: reverse engineering is cheaper, but it is still an engineer's job, and AI-rebuilt code still lags commercial tools on correctness.
What Vietnamese law allows
Vietnam's Intellectual Property Law, as amended by Law No. 07/2022/QH15 (in force since 1 January 2023), has two provisions worth knowing:
- Backup copies are allowed. Under Article 22(1), a lawful user of a copy of a computer program may make one backup copy to replace it if it is deleted, damaged or unusable, but may not transfer it to anyone else.
- The personal research exception does not cover software. Article 25(1)(a) allows making one copy for personal research or study, but Article 25(3) excludes computer programs.
Neither provision mentions reverse engineering directly. The EU, by contrast, has a specific decompilation-for-interoperability exception with conditions attached, and UK courts apply it narrowly. Contracts matter too: many software licences prohibit reverse engineering outright. REA itself says it is for lawful research, interoperability and software you own, not for bypassing licences.
What to do this week
- List your orphaned software: every program holding your data whose vendor no longer supports it.
- Audit your own apps: ask your developers whether anything you ship to customers or dealers contains API keys, passwords or pricing logic. If so, move it to the server.
- Drop the "compiled means safe" assumption: treat everything that runs on a user's device as readable by others.
SIBA does not reverse-engineer third-party software. What we do is help companies move data from old systems to new ones, and build apps that keep secrets where they belong: on the server.
Whose software holds your most important data?
If the answer is "a company we can no longer reach", send SIBA the software's name and the data you need out of it. We will tell you how feasible it is.
Source: REA project page on GitHub · Startup Fortune, 9 Oct 2026 · Fabio Akita, 13 Oct 2026 · Amended IP Law 2022, VCCI · RPC on IBM v LzLabs
For reference only; not a substitute for formal legal advice. Check that the regulation is current before relying on it.