rea.run

2026-10-16

Eleven: a visual REA workbench for agents

Eleven workbench: code view with AI agent chat and review panel side by side on a reverse-engineering project.
Hosted screenshot of the Eleven desktop workbench (photo1, 2048×1280). Product: eleven.chizi.app · repo Zfinix/eleven. Authorized teaching targets only.

Eleven is an open-source, agent-first reverse-engineering visual IDE / workbench. It puts code views, AI chat, and change review in one desktop window. It is not a new decompiler engine: analysis still rides engines such as Ghidra, Rizin, and jadx (via the REA stack and Eleven’s own setup). Product site: eleven.chizi.app. Repo: Zfinix/eleven. REA toolbox: morluto/rea. Chinese twin: /zh/blog/eleven-rea-workbench/.

On rea.run the teaching pin for the MCP/CLI layer remains [email protected] (/blog/rea-agents-6-5-0/). If you are new to REA itself, start with /blog/rea-beginner-guide/ and the install demo /docs/install-demo/, then come back here for the GUI workbench path.

Eleven workbench UI: pseudocode / agent chat side by side.
Eleven workbench UI: pseudocode / agent chat side by side.

Snapshot (re-verified 2026-10-16)

ItemValueSource
Producteleven.chizi.appLive site
RepositoryZfinix/elevenGitHub
LicenseApache-2.0GitHub license.spdx_id
Version0.1.8Site install section + release tag v0.1.8
Stars / forks (snapshot)503 / 78GitHub API 2026-10-16
PlatformsmacOS Apple silicon; Windows x64; Linux x64 (Ubuntu 24.04 / Fedora 40+)Site FAQ
Android example61 MB debug build → 73,471 methods; reopen ~1 sSite Android section
REA teaching pin (this site)[email protected]/blog/rea-agents-6-5-0/

Stars move. Re-fetch before you quote. Stars ≠ doctor-green on your box and ≠ permission to analyze arbitrary store binaries (/blog/evaluating-rea-claims/).

What Eleven is (and is not)

ClaimOperator reading
Visual workbench: code + agent + review in one windowYes
New standalone decompiler that replaces Ghidra/Rizin/jadxNo — engines still do the heavy lift
Drop-in replacement for REA CLI/MCPNo — complementary GUI; REA remains the tool/MCP layer for many agent hosts
Free / open source desktop appYes — Apache-2.0 upstream
License to reverse any commercial appNo — own / authorized / clean-room only (/compliance/)
Short demo of the Eleven workbench (~50s): open a binary, browse views, agent chat beside code.

REA CLI/MCP vs Eleven GUI

Operators often ask: “Do I need Eleven if I already run REA?” Use both when the job needs eyes on decompiled text and a human-in-the-loop accept/skip loop; use CLI/MCP alone when you already have a strong agent host and Evidence-first scripts.

DimensionREA CLI / MCP (rea-agents)Eleven GUI workbench
Primary UXTerminal + MCP inside Claude Code / Codex / Cursor / …Desktop window: views + chat + review
RoleToolbox / Evidence layer for agentsVisual IDE around those tools
Teaching pin herenpx -y [email protected]Product v0.1.8 (separate pin)
First proofdoctor --json + engine-free JS/Electron jobOpen an authorized binary / APK; watch agent steps
ViewsAgent requests Evidence / dumpsPseudocode, assembly, CFG, hex in-app
Renames / notesVia MCP tool resultsSuggestions you accept or skip; undo
PatchesFollow REA / provider rules; never invent cracksByte patches → copy in Downloads, not the original
ShareScripts, Evidence JSON/MD.eleven project (binary + notes + chats)
Offline readingLocal analysis once engines are presentReading / rename / patch / debug offline after first downloads; agent Q&A needs provider
Best forCI, runbooks, headless labs, MCP-native hostsInteractive teaching, side-by-side review, GUI-first operators

Install / demo for REA on this site: /docs/install-demo/ · lab: /lab/ · beginner guide: /blog/rea-beginner-guide/.

Supported formats

From the product “What it opens” / FAQ pages (2026-10-16 fetch):

Format familyExamplesNotes
Mach-OMac / iOS apps & frameworksUniversal binaries open on your Mac’s slice
ELFLinux programs; native libs inside Android apps
PEWindows EXE / DLL
Android.apk / .dexDecompiled to Java/Kotlin with jadx
GPU shaders.metallib / .air / .spvLinked to loaders; CUDA/HIP PTX path on site
ML.gguf / .safetensors / .onnx / .ptRead without running weights

Four views of every native function (site copy): pseudocode, assembly, control-flow graph, hex — from Ghidra or Rizin.

Second Eleven workbench screenshot: agent suggestions and code review in one frame.
Second Eleven workbench screenshot: agent suggestions and code review in one frame.

Engines: Ghidra / Rizin / jadx

EngineRole in ElevenOperator note
Built-in fast engineFirst open is immediateSite FAQ: no extra install for first file
Ghidra (+ Java)Deepest pseudocode pathDownloads in background on first launch; Eleven can set it up
RizinFast open without Java“Under a second” path on site FAQ
jadxAndroid dex → Java/KotlinCited example: 61 MB debug APK → 73,471 methods
Hopper / IDA (optional)If already on your MacSettings → Analysis; BYO licensed copies

REA on the CLI still treats Hopper / Ghidra / IDA as bring-your-own for many workflows (/faq/setup-vs-providers/). Eleven’s product FAQ states it can download Java+Ghidra for its own first-run path — that is Eleven’s packaging, not a claim that rea-agents ships those engines.

Platforms and install (v0.1.8)

Host OSPackageInstall hint
macOS (Apple silicon)Signed / notarized download`curl -fsSL https://eleven.chizi.app/install.sh \bash` or site Download
Windows x64zipSite Download · PowerShell: `irm https://eleven.chizi.app/install.ps1 \iex`
Linux x64AppImageUbuntu 24.04+ / Fedora 40+; site Download

Release notes: v0.1.8. Prefer reading the release body before upgrading teaching labs.

Agent surface (ACP)

Site lists agents that speak the Agent Client Protocol, including Claude, Codex, Gemini, Cursor, OpenCode, Aster, plus “any ACP agent.” Eleven runs locally; whatever the agent reads still follows that model vendor’s data policy — same as using the agent elsewhere.

Capability (site)Operator habit
@ picker for functions / strings / notesPass exact name + address with the question
Select lines + ask (⌘L on Mac)Answer under selection; pin as note or continue in chat
Agent renames / notes as suggestionsAccept or skip; history + undo
Safe byte patchesWrite to Downloads copy; never overwrite original
Compare buildsDiff added / removed / changed functions
Debuggerlldb: breakpoints, stack, locals
.eleven project shareBinary + notes + patches + chats in one file

Operator checklist: first authorized session

  • [ ] Confirm the target is own / authorized / clean-room (/compliance/, /faq/legal-boundary/).
  • [ ] Install Eleven v0.1.8 for your OS from eleven.chizi.app (or the curl/irm one-liners above).
  • [ ] Sign in to an ACP agent you already pay for / host; Eleven does not replace that subscription.
  • [ ] Wait for background Java/Ghidra setup if you need deep pseudocode; or use Rizin / jadx paths for speed.
  • [ ] Open a disposable copy of the binary/APK — never your only production artifact.
  • [ ] Ask the agent to explain one function; require Evidence-style specifics (address, name, callers) not vibes.
  • [ ] If patching: verify output landed in Downloads as a new file; keep the original untouched.
  • [ ] Optionally keep REA CLI pinned: npx -y [email protected] doctor --json for MCP hosts outside Eleven (/blog/rea-beginner-guide/).
  • [ ] For guided interactive practice on this site (separate from Eleven): /lab/ · showcase /showcase/dx-ball/.
# REA teaching pin on rea.run (CLI/MCP hosts — complementary to Eleven GUI)
npx -y [email protected] doctor --json

# Eleven Mac install one-liner (from product site)
curl -fsSL https://eleven.chizi.app/install.sh | bash

How this fits the rea.run teaching path

  1. Learn REA vocabulary + Evidence habit: /blog/rea-beginner-guide/.
  2. Pin and understand 6.5.0: /blog/rea-agents-6-5-0/.
  3. Walk install UI: /docs/install-demo/.
  4. Practice in /lab/ on fixtures you may analyze.
  5. Use Eleven when you want a desktop workbench that keeps the agent next to decompiled text — still on authorized targets only.

Compliance

  • Authorized teaching / own software / written rights / clean-room fixtures only. No crack, keygen, or DRM-bypass how-tos (/compliance/, /faq/legal-boundary/).
  • Byte patches in Eleven go to a copy (Downloads), not the original — keep that discipline in labs.
  • Engines (Ghidra, Hopper, IDA, jadx, …) remain subject to their own licenses; BYO where required.
  • rea.run is a community operator guide; footer disclaimer stays low-key. Not affiliated with Zfinix/Eleven authors or morluto beyond documenting public repos.
  • Media under /media/blog/eleven-rea-workbench/ are product-demo stills and a short demo clip hosted for this article.

Sources

FAQ

QuestionShort answer
Is Eleven a new decompiler?No — visual workbench; Ghidra/Rizin/jadx (and optional Hopper/IDA) analyze.
Do I still need rea-agents?For MCP/CLI hosts and this site’s teaching path, yes (pin 6.5.0). Eleven is the GUI companion.
Can patches overwrite my binary?Product FAQ: patches write to a Downloads copy.
What Android number can I cite?Site example: 61 MB debug build, 73,471 methods (2026-10-16).
Which OS builds exist?macOS Apple silicon, Windows x64, Linux x64 (Ubuntu 24.04 / Fedora 40+).
Offline?Read/rename/patch/debug after first downloads; agent chat needs provider.