REA GitHub and Ghidra: Native Binary Analysis for Ethical Research

Native binary analysis is becoming easier to connect with coding-agent workflows, but the safeguards matter as much as the tooling. The REA GitHub project, published by morluto, links local reverse-engineering tools with agents through an MCP and command-line interface. With Ghidra support, authorized researchers can examine compiled software while keeping analysis on their own machine.

Area	What REA currently supports	Important limitation
Analysis output	Pseudocode, assembly, strings, symbols, calls and references	Results include evidence and stated limitations
Ghidra platforms	macOS and Linux; experimental Windows support	Requires an existing compatible Ghidra installation
Local setup	Configured provider, REA setup command and a target binary	Users must have authorization to examine the file

What REA GitHub changes for Ghidra workflows

Traditional Ghidra work involves moving between project views, decompiler output, symbol lists and cross-references. REA provides an agent-facing layer that can request those artifacts and use them as evidence during an investigation. That does not turn reverse engineering into a one-click answer: analysts still need to validate hypotheses against instructions, callers, constants and other observable evidence.

The official native-analysis guide says Ghidra support requires Ghidra 12.1.x and a 64-bit JDK 21 or newer. REA does not install or update Ghidra, so environment preparation remains the researcher’s responsibility. Current Ghidra development documentation references JDK 25, making version verification especially important before setup. Platform behavior and provider support may also vary by release.

A practical starting point for ethical research

After confirming authorization and prerequisites, users can begin with npx rea-agents setup, configure a supported provider and test the workflow on a suitable binary. The project’s project consultation services can also help teams define requirements, access controls and review steps for responsible technical investigations.

What the latest REA release adds

The project is still moving beyond a basic bridge between an agent and a decompiler. GitHub lists rea-agents v6.7.0 as the latest release, published on October 18, 2026. Earlier v6.6.0 changes expanded Ghidra analysis for Windows ARM PE targets and added explicit support for raw m68k images. Those additions matter because native investigations often begin with files that do not fit a standard desktop executable workflow.

REA’s useful distinction is between generated interpretation and inspectable evidence. An agent may suggest what a function does, but the researcher can check the underlying instructions, callers, strings, symbols and references. This makes the workflow better suited to documenting a hypothesis than accepting an unexplained summary. It also helps teams record where the available evidence is incomplete or ambiguous.

How to structure a responsible investigation

A practical workflow should begin with a narrowly defined question, such as identifying a file format routine or tracing how a configuration value is consumed. Researchers can then preserve the original binary, record its hash, work from a copy and keep notes showing which conclusions are directly observed. Access permissions should be confirmed before any analysis, especially when a sample comes from a client, employer or third party.

For organizations, the same discipline can be built into delivery planning. A team reviewing an internal tool may benefit from documenting provider configuration, local data handling, approval checkpoints and retention rules before connecting an agent. Guidance on project consultation and technical planning can help frame those requirements alongside testing and rollout decisions.

Where human review remains essential

Native analysis can accelerate navigation through unfamiliar code, but it cannot establish intent from incomplete evidence alone. Obfuscation, stripped symbols, compiler optimizations and unusual architectures may all reduce confidence. Analysts should therefore compare agent output with disassembly and cross-references, test competing explanations and mark conclusions as confirmed, probable or unresolved.

Using evidence instead of assumptions

The strongest REA GitHub workflow treats agent output as a research aid rather than a final verdict. Start by asking a focused question, such as where a configuration value is read or which routine handles a particular input. Then compare the proposed explanation with assembly, callers, referenced constants and strings. This approach makes it easier to separate directly observed behavior from an interpretation that still needs testing.

The project’s official DX-Ball guide illustrates this method through evidence-based reconstruction. It reports a comparison involving 3,205 inputs and 63 reproduced function bytes, but that result is a project case study, not a general benchmark for every binary or architecture. Researchers should therefore reproduce relevant checks on their own authorized samples and document the conditions under which their findings were obtained.

Preparing binaries and review records

Before analysis, preserve the original file, record a cryptographic hash and work from a controlled copy. Note the target architecture, file format, compiler clues and whether symbols or debugging information are present. These details affect how much confidence can be placed in decompiler output. A stripped or optimized binary may require more cross-reference tracing and manual inspection than a richly annotated build.

Teams can also define review checkpoints before an agent accesses sensitive material. Record who approved the investigation, which provider is configured, where analysis data is processed and how temporary artifacts will be retained or deleted. Broader technical consultation and project planning can help organizations formalize those controls alongside testing, deployment and support requirements.

What REA does not replace

REA does not replace Ghidra installation, architecture knowledge or human judgment. It also does not establish that a function’s apparent purpose is the developer’s original intent. Obfuscation, unusual calling conventions, missing symbols and incomplete program context can all produce misleading interpretations. Analysts should label findings as confirmed, probable or unresolved, preserve the supporting evidence and escalate important conclusions for independent review.

Checking prerequisites before native analysis

Before connecting an agent to Ghidra, verify the environment against REA’s current native-analysis guide. The documented workflow requires an existing Ghidra 12.1.x installation and a 64-bit JDK 21 or newer. REA does not install or update Ghidra, so those components remain the researcher’s responsibility. Support is documented for macOS and Linux, while Windows support is described as experimental. Because Ghidra’s own development documentation now points to JDK 25, confirm the versions that work together before changing a production workstation.

Setup begins with npx rea-agents setup, followed by provider configuration and a local test. Keep the first test deliberately small: load an authorized sample, request basic metadata, inspect a single function and compare the response with Ghidra’s own view. If the provider, architecture or file format is unsupported, the limitation should be recorded rather than hidden behind a confident explanation. Teams planning a wider rollout can use technical consultation and project planning to define approval, access and retention requirements.

Making findings reproducible

A useful investigation record should identify the sample, hash, operating system, Ghidra version, JDK version, REA release and provider used. Save the prompts or questions that shaped the analysis, then preserve relevant pseudocode, assembly excerpts, strings and cross-references. This makes later review possible when an agent’s interpretation changes after new evidence is discovered.

For sensitive binaries, separate exploratory work from confirmed reporting. Mark each statement as directly observed, strongly supported or unresolved, and explain which evidence supports it. That distinction is especially important when comparing multiple builds, tracing an input across callers or assessing a routine whose symbols have been removed.

Interpreting architecture-specific results

Native analysis becomes more useful when the target architecture and file format are treated as part of the evidence. REA’s current release notes document expanded Ghidra coverage for Windows ARM PE targets and explicit raw m68k images, but that does not mean every binary will produce equally complete results. Confirm the architecture before asking an agent to explain a routine, and check whether the loaded program matches the assumptions used during analysis.

When a function appears unusual, compare several evidence types: its instruction sequence, callers, return values, referenced constants and nearby strings. Agreement across these views can strengthen an interpretation, while a disagreement is a reason to investigate further. Avoid treating a readable pseudocode label as proof of behavior, especially when compiler optimizations or indirect calls obscure the original structure.

Managing provider and data boundaries

REA connects coding agents to local reverse-engineering tools, but the configured provider may affect how questions and returned evidence are handled. Before examining confidential or proprietary binaries, establish whether prompts, metadata or excerpts leave the workstation. Document the approved provider, account, retention settings and access permissions, then limit experiments to the smallest sample that answers the research question.

Authorization should be equally explicit. Analyze only software, firmware or memory images that the researcher owns or is permitted to examine. Preserve the scope of that permission in the project record, particularly when a sample originates from a customer, incident-response engagement or third-party repository. Teams that need help defining a controlled delivery process can review technical consultation and project planning as a starting point for governance discussions.

Turning observations into testable hypotheses

A practical report should connect each claim to an observable artifact. For example, a suspected configuration parser can be documented with its entry point, callers, string references and input-output behavior. If execution testing is permitted, add carefully selected test cases; if it is not, state that the conclusion is static-only. This structure lets another analyst challenge or reproduce the finding without relying on the agent’s confidence alone.

What REA and Ghidra change for ethical research

REA GitHub native binary analysis with Ghidra is most useful when it shortens the distance between a researcher’s question and the evidence needed to evaluate it. The agent can help locate relevant routines, summarise relationships and organise observations, while Ghidra remains the local analysis environment that exposes instructions, references and program structure. That division keeps the workflow practical without treating generated explanations as final conclusions.

The strongest results come from narrow, evidence-led questions. Instead of asking an agent to explain an entire executable, begin with a known entry point, a suspicious string, a caller chain or a specific input path. Ask for the supporting instructions and references, then compare the response with the underlying Ghidra view. This approach makes mistakes easier to detect and gives another analyst a clear path for review.

A responsible adoption checklist

• Confirm that the binary, firmware image or sample is within the researcher’s legal scope.
• Record the file hash, architecture, operating system, Ghidra version, JDK version, REA release and configured provider.
• Keep confidential samples within an approved data boundary and document whether prompts or excerpts can leave the workstation.
• Separate directly observed evidence from interpretations, hypotheses and unresolved questions.
• Recheck important findings manually or through independent review before publishing or acting on them.

Readers should also verify current compatibility before installation. REA’s documented Ghidra workflow depends on local prerequisites, platform support varies, and the project does not manage the Ghidra installation for the user. Release notes can change the supported target set, but they do not guarantee complete analysis for every compiler, architecture or file format.

Final takeaway