Agent-assisted reverse engineering for protected code

Devirt adds a recovery step to agent-assisted reverse engineering. Use REA or another MCP-compatible reversing agent for local inspection, then hand only the blocked scope to Devirt. Devirt assesses the authorized binary, confirms what is feasible, and returns the agreed IDA database, pseudocode or structured evidence with a coverage ledger. The connector is read-only: the user uploads and approves work in Devirt before an agent reads its status or result.

Assess an obfuscated file Read the reverse engineering MCP guide

Create an account first, then upload in your workspace. If your file needs manual review, we email a written quote before paid work begins. Devirt is independent and is not affiliated with or endorsed by REA, IDA, Ghidra, Binary Ninja or any model provider. Read the authorization rules before submitting a file.

For authorized analysis · Updated 28 October 2026

What is agent-assisted reverse engineering?

Agent-assisted reverse engineering is reverse engineering in which an LLM agent drives the analysis tools, such as Ghidra, IDA Pro or REA through the Model Context Protocol, while an analyst sets the question and checks the evidence. A 2026 review of agentic reverse-engineering systems found that they still fail in complex cases that involve obfuscation. Devirt fits at that point: the agent hands over the protected scope, and Devirt returns a recovered result with a proof state for every in-scope function.

How does an MCP reversing workflow use Devirt?

Start with the agent you already use. REA and other MCP-compatible tools can inspect local binaries, follow calls and return assembly, pseudocode, strings and references. When a VMProtect, Themida or other protected function remains unreadable, record the function and the question it must answer, then upload the authorized file in your Devirt workspace.

Where each tool fits
Step	Local agent	Devirt
Inspect	Reads the local target and traces behavior	Receives the file and requested scope
Decide	Identifies the blocked functions	Checks family, build, complexity and feasibility
Recover	Waits for the accepted result	Runs the agreed devirtualization or analysis
Continue	Uses the returned evidence in the investigation	Returns artifacts, coverage and proof metadata

The Devirt MCP server only reads assessments, jobs and completed results. It does not silently upload a binary, accept an offer or start payment. A signed result URL is returned only when the user explicitly asks for the result and it has not expired.

How do you connect the read-only MCP server?

Create a read-only API key in your Devirt workspace and register the local server beside your existing agent. The REA setup guide explains the agent side; Devirt provides the account-scoped result side. Keep the key in the MCP client environment and revoke it from the workspace when it is no longer needed.

What does Devirt add to agent-assisted reverse engineering?

A reversing agent is useful for prioritizing functions and connecting evidence, but it cannot make an interpreter loop readable merely by asking for a better summary. Devirt addresses that protected boundary with a defined analysis scope and a result that states what was proven, what depends on runtime behavior, what stayed unresolved and what was permanently bounded.

Diagram: in-scope functions counted, then each placed in one of four states: proven, runtime-dependent, unresolved or permanently bounded. — Every in-scope function in a Devirt result ends in exactly one of four states, and the four states always add up to the functions counted. Illustration, not a measured result.

This is a handoff between tools, not a claim that an agent or a devirtualizer recovers original source code. Names, comments and structure removed by compilation or protection may not return, and complex or unfamiliar files can require manual review, a separate quote or a decline.

Questions about REA, MCP and Devirt

Is Devirt an official REA integration?

No. Devirt is independent. The workflow is compatible with REA or another MCP-compatible reversing agent through a separate read-only connector; there is no affiliation or endorsement claim.

Does the agent upload my binary automatically?

No. Upload, authorization and scope approval happen in your Devirt account. The first connector release reads status and results after you have submitted and approved the work.

Can Devirt recover original source code?

No service can promise original source. Devirt returns the agreed analysis artifacts and evidence boundary for the accepted scope, which the agent can use for continued investigation.