How to Install REA in Termux and Reverse Engineer Android Apps Using AI

Hey Guys, It's me SaadMaqsood. Have you ever wanted to understand how an Android application works internally and use AI to help recreate some of its features? REA, which stands for Reverse Engineer Anything, is an open source project that connects AI coding agents with reverse engineering tools. It can help inspect application files, investigate how specific features work, and provide evidence that an AI assistant can use to explain the software and help develop a separate implementation.

In this tutorial, we will start with a fresh Termux installation and work through the setup process step by step. We will install Node.js and npm, install REA, run its setup command, check the installation, and explore the commands used to analyse an Android APK. We will also cover the additional requirements for connecting an AI coding agent and analysing Android application code. One important limitation is that REA's documented Android analysis provider requires a supported desktop environment, so installing the CLI in Termux alone does not guarantee that the complete workflow will run directly on your phone.

What Is REA?

REA is a reverse engineering toolkit designed to help AI coding agents investigate software. It exposes analysis tools through a command line interface and the Model Context Protocol, commonly known as MCP. Once connected to a supported coding agent, you can ask questions about an application and use the analysis results to understand its structure, dependencies, and behaviour.

For Android applications, REA provides commands for inspecting APK metadata, searching for classes, examining methods, and tracing references. Its Android analysis functionality relies on a compatible JADX integration and a full Java Development Kit. Other REA capabilities have their own requirements, so the tools you need depend on the type of application you want to investigate.

Official REA repository: https://github.com/morluto/rea

Step 1: Update Termux

Open Termux on your Android device. Before installing anything, update your package lists and existing packages. Run the following command and allow the process to finish.

pkg update && pkg upgrade

If Termux asks you to confirm an installation or upgrade, review the prompt and continue when appropriate. Keeping your environment updated can help prevent package installation problems later.

Step 2: Install Node.js and npm

REA is distributed through npm, the package manager used by Node.js. Start by installing the Node.js LTS package available through your Termux repositories.

pkg install nodejs-lts

If that package is unavailable in your configured repository, search for the available Node.js packages using the following command.

pkg search nodejs

After installing Node.js, check whether both Node.js and npm are available.

node --version
npm --version

Both commands should return version numbers. However, having Node.js installed is not enough by itself. REA requires a supported Node.js release. Its current installation requirements specify Node.js 22.23.4 or newer within the 22.x series, 24.22.1 or newer within the 24.x series, or 26.12.1 and newer. Check the official installation documentation for the latest requirements before continuing.

If your Termux repository provides an incompatible version, do not assume that installing REA anyway will fix the problem. You will need a supported Node.js environment before proceeding. Termux is also not a documented supported host for REA's complete workflow, which can affect later setup steps.

Step 3: Install REA Using npm

Once you have a compatible Node.js and npm installation, you can install REA globally. This makes the REA command available from your terminal without needing to specify the package name each time.

npm install --global rea-agents

Wait for npm to finish downloading and installing the package. If the command completes successfully, verify that the REA CLI is available.

rea --help

The help output should display the available commands and usage information. If Termux reports an unsupported platform, an incompatible Node.js version, or a native dependency error, read the error carefully. The npm package may be installable even though particular REA features cannot run in the current environment.

You can also run REA without a global installation by using npm's package runner. The following command launches the setup process directly.

npx rea-agents@latest setup

Choose either the global installation method or the npx method for initial setup. You do not need to install the package globally and run npx merely to accomplish the same setup task.

Step 4: Configure REA

After installing the global CLI, run the setup command.

rea setup

The setup wizard is designed to connect REA to supported AI coding agents. Follow the prompts, select the coding agent you intend to use, and review the proposed configuration changes before approving them. REA can register its MCP server and install matching workflow instructions for supported agents.

If you are using the npx method instead, run the following command.

npx rea-agents@latest setup

When the setup process finishes, restart your coding agent so that it can discover the newly registered tools. If your agent does not show REA, check its MCP configuration and review the setup output for errors.

Important: REA's documented host environments are primarily desktop operating systems. Termux runs on Android, which is not listed as a supported host environment. The setup wizard or some dependencies may therefore fail on a phone. If that happens, use a supported desktop Linux environment to complete the setup rather than assuming that a successful npm installation means everything is ready.

Step 5: Connect an AI Coding Agent

REA provides analysis tools, but you also need a compatible AI coding agent if you want to ask questions about the results and use AI to help develop new features. OpenCode is one option for AI assisted development. It can work with project files and help explain or modify code, subject to the capabilities of the configured model and environment.

Visit the official OpenCode website to review the current installation instructions.

https://opencode.ai/

Install a supported coding agent in an environment where its requirements are satisfied. Do not assume that an installation command for desktop Linux or macOS will work directly in Termux. You may also need to configure authentication or an AI provider before the coding agent can respond to requests.

Once the agent is installed, run the REA setup process and select that agent if it is supported. Restart the agent after setup and verify that REA's tools are available. REA can also be used through its CLI for supported operations, but an AI coding agent is what enables the conversational investigation workflow described in this tutorial.

Step 6: Prepare the Android Analysis Dependencies

Before analysing an APK with REA, you need to configure the appropriate Android analysis provider. The documented provider uses a headless JADX integration to inspect compiled Android code. It requires a full JDK version 17 or newer, including the Java compiler module, and the compatible jadx-headless-mcp JAR.

REA does not automatically install every Android analysis dependency. You must obtain the required integration, verify it according to the official instructions, and configure its path. The supported host requirements for this provider do not include a normal Termux Android environment, so this stage should be completed on a supported computer.

Official Android analysis guide: https://github.com/morluto/rea/blob/main/docs/android-analysis.md

The official guide explains how to configure the environment variable REA_JADX_MCP_JAR. The following illustrates the format of that configuration.

export REA_JADX_MCP_JAR="/absolute/path/to/jadx-headless-mcp-0.7.1-all.jar"

Replace the example path with the actual path to the downloaded and verified JAR file. Do not copy the example path literally. You must also have a compatible JDK available and correctly configured. On Linux, the provider has an additional requirement for a compatible ps command used for process management.

Follow the official guide for the exact download procedure, integrity verification, and environment setup. If any dependency is missing, the provider may not start even though REA itself is installed correctly.

Step 7: Transfer Your APK to the Analysis Environment

Once your analysis environment is ready, prepare an APK that you own or have permission to examine. For example, you can use an application you developed yourself or an intentionally vulnerable training application designed for security testing.

If the APK is in the Downloads folder on your Android device and Termux already has shared storage access, list the available files using the following command.

ls ~/storage/downloads

To copy an APK into the Termux home directory, replace your-app.apk with the actual filename.

cp ~/storage/downloads/your-app.apk ~/
cd ~
ls

This only copies the file. It does not decompile the application. If REA is running on another computer, transfer the APK to that computer and use the actual path to the file on that system.

Step 8: Inspect the APK with REA

When REA and its Android analysis provider are configured correctly, you can use the CLI to inspect the package. The following examples use the documented Android analysis commands. Run them in the environment where the required provider is installed, and replace the example APK path with the location of your file.

Start by inspecting the package metadata and general information.

rea inspect-android-package /absolute/path/to/your-app.apk

Next, search for classes that match a particular name. For example, the following command searches for classes containing MainActivity.

rea search-android-classes /absolute/path/to/your-app.apk MainActivity

If the search returns a relevant class, inspect it by providing its fully qualified class name.

rea inspect-android-class /absolute/path/to/your-app.apk com.example.MainActivity

Replace com.example.MainActivity with the actual class name returned by your search. To inspect a specific method, use the documented method command.

rea inspect-android-method /absolute/path/to/your-app.apk com.example.MainActivity onCreate

You can also trace references associated with a class.

rea trace-android-references /absolute/path/to/your-app.apk com.example.MainActivity

These commands are examples of the documented CLI workflow. They require a working Android analysis provider; they will not become functional merely because you installed the REA npm package. If a command reports that a capability is unavailable, check the Android analysis setup guide and verify that the required provider is configured.

Step 9: Ask AI to Explain the Findings

Once your coding agent can access REA and the analysis provider is working, ask it to investigate a specific feature. Starting with one small question makes it easier to understand the results and verify the evidence.

For example, you can use the following prompt with your configured coding agent.

Use REA to investigate this Android application.

Explain how the selected feature appears to work.
Identify the relevant classes, methods, and dependencies.
Show the evidence supporting your conclusions.
Separate confirmed findings from assumptions.
Identify anything that cannot be established from static analysis.

Do not modify the original application.

The agent can use the available analysis tools to gather evidence and explain the results. If you want to implement a similar feature, ask it to create a separate project using your own code and design. Always review the generated code and test the implementation rather than assuming the AI's explanation is necessarily correct.

Can You Run the Entire Workflow Directly in Termux?

You can use Termux for compatible command line operations, file management, and certain development tools. However, REA's complete Android reverse engineering workflow has additional host and dependency requirements. The official Android analysis provider is documented for supported desktop environments, not as a fully supported native Termux workflow.

For a more reliable setup, use Termux to manage files on your phone and complete REA installation, AI agent configuration, and Android APK analysis on a supported computer. If you experiment with the CLI directly in Termux, verify each component independently and expect that some steps may not work.

Common Problems

npm cannot install REA: Check your Node.js version, npm availability, network connection, and the error output. The latest REA release has specific Node.js version requirements.

The setup wizard does not work: Check whether the required coding agent is installed and whether the current operating system is supported. Restart the agent after setup and verify its MCP configuration.

Android analysis commands fail: Check the JDK installation, the JADX integration path, and the Android analysis provider requirements. The main REA installation does not automatically install every dependency.

The AI cannot find a feature: Search for relevant classes first, then inspect individual classes and methods. Obfuscation and incomplete code can make some features difficult to understand.

The recreated application does not work: Review the generated code, dependency versions, build errors, and external services. The original application may rely on server-side logic or private APIs that are not included in the APK.

Legal and Ethical Considerations

Reverse engineering can be useful for learning, debugging, and authorised security research. Always consider the application's licence, privacy requirements, and applicable laws. Use applications you own, software intended for training, or applications you have explicit permission to analyse.

If you plan to publish your own implementation, use original code and assets unless you have permission to reuse third-party material. Analysing an application does not automatically give you permission to copy or redistribute its source code, branding, or resources.

Conclusion

REA connects AI coding agents with software analysis tools and can help investigate application structures, classes, methods, and dependencies. The initial installation process involves updating Termux, installing a compatible Node.js and npm environment, installing the REA CLI, and running its setup command. Android APK analysis requires additional configuration, including the documented JDK and JADX integration.

The most important point is to verify the environment before expecting the entire workflow to run. Termux can be useful for command line work, but REA's documented Android analysis provider requires a supported host environment. Once everything is configured correctly, you can use REA to investigate software you are authorised to examine and use the findings to develop your own applications.

Stay Ethical.