The SNES runs a 65816. Two status flags, M and X, switch the accumulator and the index registers between 8 and 16 bits while the game is running. The same bytes decode to different instructions depending on those flags, so a static disassembler has to guess. Guess wrong once and everything after it is garbage.
A cartridge is laid out as LoROM or HiROM, code jumps between 64 KB banks, and a single address can mean different things depending on the bank register. Experienced disassemblers split the ROM bank by bank and set the right flags for each one before they read any code.
Star Fox runs on the Super FX, Super Mario RPG on the SA-1, and Mega Man X2 and X3 on the Cx4. Each one is a separate processor with its own instruction set. Understanding a game can mean reverse engineering a second CPU too.
The zelda3 project rebuilt A Link to the Past as roughly 80,000 lines of C. It was built on top of an existing community disassembly, and the result still borrows the PPU and audio code from an emulator. The navigation work is what takes so long: following a jump, working out which bank you are in, figuring out what a RAM address stores, and doing that thousands of times.
REA stands for Reverse Engineer Anything. It does not include its own decompiler. It drives the tools you already have, Ghidra, Hopper or IDA for native code, and exposes them as MCP tools such as search_strings, xrefs, procedure_callers, procedure_pseudo_code and trace_feature. npx rea-agents setup registers the server with Claude Code, Codex, Cursor, Gemini CLI and a few others, and installs a skill that tells the agent how to run an investigation. The repository was created in April 2026 and shipped its first release in July. It then sat at a few hundred stars until October.
The project hit #1 on GitHub trending on 7 October. Coverage that week reported about 13,000 stars on 8 October and almost 59,000 a day or two later. Eleven releases shipped between 3 and 11 October, taking it from version 3.2 to 6.4.
Show data
| Date | Stars |
|---|
Each tool call becomes a record with the target's hash, the provider version, the exact parameters, the raw result and its limitations. When the agent says "this routine handles horizontal speed", there is a record with the address and the instructions behind it, and you can check it yourself.
REA's own case studies include DX-Ball, a 1996 Windows game, where a sound-pan helper was rebuilt in C that reproduces all 63 compiled bytes. Another is Touhou 4 on the PC-98, where the 16-bit bullet ring angle code was recovered. Neither is a SNES game, but both are the same kind of work: one small routine in an old binary, explained and rebuilt.
snesrecomp is a static recompiler that translates 65816 machine code into C and links it against a shared SNES hardware runtime. Only the game logic becomes native code. Graphics, audio, DMA and bank mapping still run through emulation, and any function without a verified translation falls back to an interpreter running the original ROM. Super Metroid is the fourth game on the framework. Its default build boots, plays the attract demo, starts a new game, goes through doors and saves at Samus's ship. The repository ships a CLAUDE.md, and the project belongs to R.A.I.D., a Discord community for AI-assisted retro reverse engineering.
$0998.Listed as fully playable, with Windows, macOS and Linux builds and an experimental true widescreen mod.
Believed playable end to end, with 4:3, fixed 16:9, an adaptive view and MSU-1 audio.
Playable through the early dungeon. The project calls itself alpha software, and the status table says the same.
The 65816 is an extended 6502, the CPU in the NES. LLMario is a matching decompilation of Super Mario Bros. produced end to end by an LLM agent, DeepSeek V4.1 Flash running in OpenCode. Its 6502 listing reassembles byte for byte into the original 32 KB program ROM. The C translation passed 10,910 differential trials against a separate reference interpreter with zero mismatches.
Ghidra on its own found about 1,067 instructions. The agent had to write its own traversal that follows the game's jump table before coverage reached 66.6%. The first verification round failed because five reachable entry points were missing and the differential test could not see the gaps. It passed on the third round. It is not playable yet: there is no sound and no rendering PPU.
This week momo5502 published a write-up on letting a fleet of Claude Code and Codex agents decompile a PC shooter using 500+ billion tokens. After a month, 80% of the game was "decompiled" and it ran, but the code was semantically wrong. Things only improved once a script compared every function byte for byte against the original compiler output. The agents then tried to edit that script, so CI started checking its hash. The conclusion: "Correctness should be defined and machine-checkable."
Ghidra ships with 6502 support but not 65816. There is a community processor module, achan1989/ghidra-65816, that has not been updated since 2024 and may need a rebuild for current Ghidra. REA can force a Ghidra language with REA_GHIDRA_LANGUAGE_ID and checks the value against the languages your install knows. REA's documentation does not cover SNES ROMs, and I have not tested a raw .sfc file. Expect setup work before the first useful answer.
The SNES projects above each built their own tooling: custom traversals, trace scripts, symbol importers. REA gives an agent the generic part for free, meaning cross references, callers, pseudocode and assembly, behind one MCP server and with an evidence record for every call. The project-specific part is still yours to build: the bank map, the M/X state, and the emulator that checks the result.
A small one. "In this Super Mario World ROM, find the routine that caps Mario's horizontal speed while running. Show the instructions, the RAM addresses it reads and writes, and the constants it compares against. Label each claim as observed or inferred. Then check it in an emulator: hold right with run held and log Mario's X speed for 120 frames." One routine, one question, and a way to check the answer against the real game. That is the same shape as REA's DX-Ball and Touhou showcases, and it is how the larger projects started too.
npx rea-agents setup export REA_ANALYSIS_PROVIDER=ghidra export REA_GHIDRA_LANGUAGE_ID=<the 65816 language id from your Ghidra module> rea --help
REA gives an agent the disassembler work that used to take years. The SNES projects show the other half: pinned ground truth, a machine-checkable oracle, and rules that stop the agent from taking shortcuts. If you have a cartridge you always wanted to understand, pick one routine, write down how you will check the answer, and then run npx rea-agents setup.