AI Rebuilt 10 Paid Apps in 18 Days: 20 Open-Source Repositories and an Easily Overlooked Boundary

Movez posted a list on X with a provocative title: 'the final nail in the coffin for closed-source.' The list contains 20 GitHub repositories, claiming that by hooking Claude Opus 5.5 up to REA, you can rebuild a paid app in an afternoon. First, look at the image.

In this framing, the term most easily misread is 'rebuild.' It does not mean cracking, nor does it mean renaming someone else's installer package. In the long post, Movez divides reverse engineering into two categories: binary reverse engineering, using Claude plus Ghidra/IDA over MCP for analysis and security; and product reverse engineering, studying what a product does and then cleanly rebuilding it. The article mainly discusses the second category.

REA is an MCP server, officially described as 'an MCP that reverse engineers across binaries, applications, and runtime behavior.' The install command is npx rea-agents setup; it registers with agents such as Claude Code, Codex, Cursor, and Gemini CLI, and installs a workflow description. It does not open the decompiler for you; the agent calls tools through MCP, and results carry an evidence_id, making it easy to cite evidence in MAP.md. Unknown items are recorded separately to prevent the agent from continuing to build on guesses.

Craft Anything is the other leg, pure Rust, with a four-step loop: Study, Build, Check, Ready. By default it uses clean room mode, without reading the original app's internal code and files, learning only from the visible interface, screenshots, page measurements, and menu behavior; only Deep mode reads code and files. It strings research, rebuilding, comparison, and fixing into a pipeline; building requires a local coding agent, with Claude Code supported first.

The tools Movez lists fall into five layers: analysis core REA, Craft Anything, Ghidra, GhidraMCP; mobile jadx, Apktool, Frida, ILSpy; binary radare2, x64dbg, ImHex, angr; network and runtime mitmproxy, dnSpy, rizin, raddebugger; reconstruction and validation awesome-ai-reverse-engineering, awesome-reverse-engineering. For developers, this is a ready-made toolbox map; for ordinary users, the focus is on the process that follows, not on memorizing commands.

There is one sentence in Movez's article worth more than the list: 'The code is now the easy part; the hard part is the pipeline.' In the 9-step pipeline he gives, what really takes time is: first choose a paid product with a price tag and an annoying limitation; write the original app's behavior, bundle, binary, and evidence into MAP.md; collect visual references; have Opus create 9 design concepts before writing code; write a contract specifying shared types and IDs that cannot be changed; split the agent into files by module to avoid stepping on each other; run the packaged app on a real device and screenshot every screen with Chrome DevTools Protocol; finally make the installer, landing page, and release. Cleanly clicked through 9 concepts in 50 minutes, with 24 typed IPC methods written into shared/types.ts; DuoDesk kept the bundle ID, URL scheme, and ports 47800/47801, and after renaming 370 files, old devices could still pair. These are all process details, not one-click cracking.

Movez gives these numbers: 10 apps, 18 days, 13K+ installs, about 850 stars, 0 lines of handwritten code; Cloudflare used AI to rebuild Next.js, spending about $1,100 in tokens, with builds 4x faster and bundles 57% smaller; DuoDesk's landing page brought 977 views to the repo, more than X; the repo peaked at 2,151 views in one day and 29 stars in a single hour. Some commenters in the replies questioned: installs are cheap, but how many people will still be using it a month later. Movez says users use it every day and give him feedback. Others also pointed out that REA can only map surface behavior, and static analysis struggles to cover business logic and data models; 'making any app free' is likely to get DMCA notices. These criticisms are valid. What the tools can do is research and rebuild; they cannot automatically grant you authorization.

REA's README is very clear: use it only for lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to inspect. Craft Anything's responsible use section also says not to bypass DRM, logins, or anti-cheat, and not to copy logos, photos, or text when rebuilding unless you confirm you have the right to use them. So 'making any app free' is a phrase that spreads well but is also a promise with high legal risk. A more realistic use is: choose a small tool you pay for and that allows analysis, break down one feature, write a spec, clean-room rebuild, validate, and then decide whether to release it.

If you really want to try it, start with REA's 'Trace one feature': one feature, with evidence, producing a spec for your own version. Then run Study, Build, Check, Ready with Craft Anything. Don't start with 'make XX free'; start with 'why does this feature work this way.' The usual point of failure is not unpacking, but validation and release.

References: Movez's X article (https://x.com/i/article/2118687784806260737), REA (https://github.com/morluto/rea), Craft Anything (https://github.com/storytold/craft-anything).