AI Reverse Engineering Ignites a Showcase Boom: REA Passes 100K Stars as Studios Reach for Lawyers

Intro: Reverse Engineering Walks Into the Spotlight

In early October, reverse engineering — long a back-alley craft of forums and IRC channels — got shoved into the spotlight by AI. The decompilation tool REA (Reverse Engineer Anything) counted fewer than 10,000 GitHub stars on October 6; a week later it had passed 100,000, with more than 30,000 arriving on October 11 alone. GamerBrowser's October 14 roundup of the scene: 52 reverse-engineered game projects tracked since August, and 40 of them landed in the first 13 days of October. The wave, in other words, erupted in about two weeks.

Zoom out further. The open dataset awesome-decomp-games (CC0) catalogs 2,046 decompilation, recompilation, port, and remake projects covering 1,817 games, with 536,148 GitHub stars between them. In the 30 days to October 13, 363 projects shipped a release and 967 pushed code. This is no longer a few hobbyists amusing themselves — it is an industrializing pipeline.

Chapter 1: What Everyone Is Reversing

Start with the headliners. On October 9, developer C22 (@c22_dev) announced GTA V running natively on an iPhone, smoother than anything Rockstar ever bothered to ship. Developer Brandon Thomas aimed at subscription software instead: using Claude Opus 5.5 he built ArtCraft, a free, open-source, Rust-written replacement for Adobe's suite — Photoshop, Illustrator, Premiere, Lightroom and more. Thomas calls it a clean-room rebuild: code written from scratch against public documentation and observed behavior, never touching original source. He is candid that it is early alpha — one pixel artist called the Photoshop clone "completely unusable" — and he has walked back his pledge to match Adobe's feature set in a month to "it will take months."

The game-port scene is even busier. On October 6, playgta5.com put GTA V inside a Chrome tab: roughly a 700 MB initial download, no launcher, no disc, no cloud streaming. It went offline within hours; nobody has claimed the work and the WHOIS record is privacy-protected. Halo got the browser treatment from developer Mitchell Hynes, with full campaign support and multiplayer for up to 128 players, built on decompilation of the original 2001 Xbox version. The most engineering-flavored case is IW4L: a from-scratch Rust runtime for 2009's Call of Duty: Modern Warfare 2 on the Bevy engine. It reads the player's own MW2 install to load maps, models, textures and weapons, and ships with no Activision code or assets; the project credits Ghidra and public technical references, and says the code itself was written by an LLM. Another MW2 decompilation effort is more extreme: author Maurice Heumann disclosed burning roughly 200 billion tokens in the first month, on a subscription costing about 200 euros. That is not weekend tinkering — that is a production pipeline.

The tooling keeps iterating too. Before REA came reverse-skill, which also topped GitHub Trending for a week with 20,000+ stars, built to route agents like Claude Code and Cursor into reverse-engineering workflows. REA's approach is similar: use MCP (Model Context Protocol) to connect AI coding assistants with professional reversing tools like Ghidra, letting an agent dig from on-screen behavior all the way down to the binary. Its readme is more honest than the hype: it states plainly that it does not claim to recover original source code or automatically clone an application — it does not even ship a decompiler of its own.

Chapter 2: The Lawyers Arrive — Four Takedowns in Twelve Days

As fast as the hype, the pushback. GamerBrowser's roundup lists four publisher takedowns in twelve days:

• September 30: Take-Two shut down an unofficial GTA 5 Switch port, reportedly built from leaked source code.
• October 3: Bethesda issued a cease-and-desist ending the AI-made browser game Fallout: New York; the same day, Activision pulled code access for an AI-assisted MW2 PC decompilation project.
• October 11: Activision sent DMCA notices against two AI-built Call of Duty browser games for using maps and models exported from the PC games.

There is precedent too: in December 2025, Take-Two filed a DMCA takedown against DOS Zone's browser port of GTA: Vice City. Fallout: New York creator Chris First posted on October 4 that he had to take the game down over copyright, promising an updated version soon. Developer Luckey Faraday, DMCA'd over Claude of Duty: Vibe Slops II and Kino der Toten, posted on October 10: "Am I the first vibe coder to get DMCA'd by a major gaming company?"

But the takedown wave hides a clean dividing line. GamerBrowser's finding: publishers are going after projects that hand out their assets for free — browser ports, leaked code, playable copies. None of the 20 native ports it tracks has been taken down, and almost all of them require players to bring their own copy of the game. The studios' aim is precise: every strike lands on "giving our stuff away for free."

Chapter 3: Where Exactly the Gray Zone Is

This is the legally interesting — and unanswered — part. StartupFortune's analysis splits cases into two tiers.

The first tier is barely debatable: projects like playgta5.com, built on Rockstar source code that leaked years ago and redistributing compressed game assets wholesale. No matter how clever the WebAssembly conversion, infringement is hard to wash off.

The second tier is the real gray zone: Halo's decompile reconstructs logic from a binary without necessarily shipping Microsoft's original assets; IW4L's Rust runtime is new code written around reverse-engineered behavior. The defense has a storied name — clean-room reimplementation: the developer never looks at the original code and releases a functionally similar but non-identical alternative. Compaq used exactly this strategy to clone IBM's PC BIOS in the 1980s, and it has sheltered reimplementations like ScummVM for years. But the key question is untested: courts have never ruled whether an LLM-assisted decompile counts as clean-room work or as a derivative copy with extra steps. The case law is empty.

Two more tripwires lurk off the copyright path. One is the DMCA's Section 1201 anti-circumvention rule: bypassing a technical protection measure can itself be unlawful, independent of any copying. The other is the EULA: nearly every commercial software license bans reverse engineering, and breaching it is a contract problem — one publishers usually can't be bothered to litigate, until your project gets big enough that they must.

Even the community is split. The lead of Banjo: Recompiled called an AI-generated Banjo-Tooie recomp "disrespectful" to years of research. Meanwhile Universal Modder's author Rehan Sheikh recreated Terraria overnight with Claude Opus 5.5 in late September, declaring that "all games are open source now" — then clarified under criticism that he would neither release nor monetize it. What the technology can do and what the community thinks it should do are drifting apart.

Chapter 4: Showcasing Reversed Projects? Read These Three Risk Tiers First

Back to the opening question: with so many people reversing programs and showcasing them as projects, how big is the legal risk? The cases above draw three tiers:

Red — expect a takedown notice: using leaked source code; packaging and distributing the rights holder's assets (models, textures, music); shipping a playable copy that runs in a browser. Every one of these hits the bullseye of all four takedowns in twelve days.

Yellow — the gray zone, awaiting case law: LLM-assisted decompilation and reimplementation with no original assets distributed (the IW4L and Halo pattern). Clean-room is a strong defense, but whether AI-assisted decompilation qualifies has never been tested in court — getting targeted means burning money on litigation.

Green — relatively safe: the target is open-source or long-discontinued games; ports require users to supply their own legitimate install (the 20 native ports with zero takedowns are the evidence); or the project is a pure tool rather than a clone (Universal Modder, an AI mashup-building kit at 7,410 stars, is untouched).

One line for showcase platforms: for a site like VibeFix, the sane admission bar is — reject anything built on leaked source or distributing copyrighted assets; demand an evidence chain for clean-room claims (did the author document the method? require a legit copy?); admit pure tooling normally. The duty to remove content after a rights-holder notice cannot be dodged, and front-loaded review is cheaper than post-hoc firefighting.

This is news analysis, not legal advice. Consult a qualified lawyer for specific cases.