REA Let Codex Rebuild 1996's DX-Ball From the .exe, and All 270 Functions Compile Back Byte for Byte

Pixel-art Chris Pirillo peering through a magnifying glass at a floppy disk while a beige CRT beside him shows a brick-breaker game. — Illustration: LockerGnome

Somebody fed a 30-year-old brick-breaker to a coding agent and asked for the source code back. They got it.

The DX-Ball reconstruction is the work of GitHub user Ysopwnable (@r00tth3w0r1d). “Codex uses REA to inspect the program through Ghidra, recover its functions, and compare code compiled with Visual C++ 4.0 against the original,” the repo says. As of October 22, “all 270 authored functions and 84,968 authored code bytes are exact.” The rebuilt game runs under Wine, and a 15-minute session reached the third board without a crash.

The trick is the compiler. The project rebuilds each function, compiles it with the same Visual C++ 4.0 that shipped in 1996, and compares the output to the original executable. Any byte that doesn’t match is a clue about a wrong type, a missed write or a loop in the wrong order.

The sound code shows how small the clues get. REA’s DX-Ball case study starts from one prompt: “Use REA to find how DX-Ball calculates sound panning. Explain the calculation and show the code.” The decompiler’s first guess, longlong FUN_00406400(void), said the function took no input at all. The raw instructions showed it did: a brick’s horizontal position, multiplied by 1.5625, minus 500, times a stored pan scale. A brick at the left edge of the 640-pixel screen plays from the left speaker, one at the right edge from the right. REA’s README says the rebuilt function “passes 3,205 original-x86 cases,” every position from 0 to 640 at five pan scales, run against the original code.

DX-Ball was created by Michael P. Welch, with 3D graphics by Seumas McNally, and the reconstruction credits both. What’s still open is the full 50-board campaign, every power-up in live play, and the MIDI music, none of it verified yet.

Why it matters

It’s a shareware game today, an app you depend on tomorrow. REA’s own pitch on rea.tools is “See a feature you like. Understand how it works, down to the binary level.” Its README tells you to ask your agent to inspect an app “without its source code, explain how the feature works, show the evidence, and build a version for your project.”

The evidence is what makes it usable. An agent that guesses at assembly sounds just as sure of itself when it’s wrong. REA answers with “the evidence and limitations behind each conclusion,” and the case studies print their limits right on the page. The Notion one traces a copy from the page through Notion’s preload script to the notion:clipboard:write IPC channel, then admits the link between two wrappers came “by reading their wrapper implementations in the package,” not one automated trace.

It works on stranger targets than you’d think. The TH04 case study pulls the bullet-ring math out of Touhou 4: Lotus Land Story, a 16-bit PC-98 game. A full turn there is 256 angle units, and for 16 bullets “each index adds 16 units.” The rebuilt code, compiled with Turbo C++ 4.0J, “matches a 2,139-byte section of the original executable,” and the same user’s TH04 reconstruction is chasing the rest of the game.

Steal this

Before you point REA at anything, check the license on the binary and on your disassembler. REA’s README covers “lawful research, education, interoperability, software preservation, and analysis of software you own or are authorized to examine,” and says it grants no IDA, Hopper or JEB license. It’s like borrowing a locksmith’s kit: the kit is legal, the door still has to be yours.
When an agent explains a binary, ask for the address and the instruction behind each claim, then spot-check one in Ghidra yourself. DX-Ball’s first decompile said the pan function took no input; the instructions said otherwise. Kind of like checking the itemized receipt before you pay the total.
If you rebuild old code, keep a test that runs the original next to yours. The 3,205-case harness is what turned “looks right” into “matches.” This is like tuning a guitar with a clip-on tuner on the headstock.
Mind where the output goes. REA “analyzes targets locally,” but the README adds that your agent’s “model provider has its own data policy.” Before you analyze a client’s app, check what your agent’s provider keeps.

Byte-matching decompilation used to be a years-long hobby for a handful of people per game. An agent that grinds through compile, compare and fix all night changes that math, and the easy prediction is a wave of old shareware and DOS games coming back as readable source. The harder question is what happens when the same loop gets pointed at software that’s still for sale.

More Software