native · 17
Native binaries
Identify binary formats, architectures and platform signatures, then use REA and its Ghidra backend for strings, decompilation, cross-references and feature tracing. Guides cover Windows EXE/DLL files, macOS app bundles, hardening flags and universal binaries. REA workflows also connect IDA Pro through ida-pro-mcp and tune headless Ghidra for stripped or unusual binaries; check each guide for its versions and limits.
Analyze a Go Binary with REA: Go Version, Modules and VCS
Read the Go version, module list, replacements and VCS revision from a Go executable with REA 6.7.0, cross-checked against go version -m on real builds.
Analyze a Rust Binary with REA: Crates, Versions and the Compiler
List the crate dependencies, versions and sources embedded by cargo-auditable in a Rust executable with REA 6.7.0, and see exactly what REA can and cannot read from a Rust binary.
Check Binary Hardening Flags: NX, PIE, RELRO, ASLR and CFG
Check whether your own ELF, PE and Mach-O builds have NX, PIE, full RELRO, stack canaries, ASLR, CFG and hardened runtime, with real tool output and flags.
Check if an EXE or DLL Is 32-bit, 64-bit or ARM64 (Incl. .NET)
Tell whether a Windows EXE or DLL is x86, x64 or ARM64 without running it, and why a .NET AnyCPU assembly looks 32-bit until you read its CLI flags.
ELF, PE and Mach-O Viewer Online: Is Your Binary Stripped?
Identify an ELF, PE or Mach-O file in the browser: architecture, sections with entropy, imports, exports and strings, and whether the binary is stripped.
Free Native Binary Analysis with REA and Ghidra, Step by Step
Use REA with free Ghidra to analyze a native binary you compiled: analyze, search strings, decompile, follow xrefs and trace a feature from CLI or AI agent.
Frida Instrumentation with REA: Hook Your Own Native Program
Hands-on Frida with REA 6.7.0: spawn and attach to a C program you compiled, hook a function, read the JSON evidence, and check the results against frida-trace.
Ghidra Headless MCP: Tune REA for Stripped and Unusual Binaries
Tune REA's headless Ghidra provider: stripped binaries, language overrides, analysis seeds, MIPS limits, startup timeouts, JVM heap and snapshot reuse.
IDA Pro MCP with REA: Connect Claude Code and Codex to IDA
Connect IDA Pro to Claude Code and Codex through REA 6.7.0 and ida-pro-mcp: attached, native and headless modes, the 1.4.0 vs 2.0.0 limit, prompts and fixes.
Inspect a SQLite Database Snapshot with REA
Inspect SQLite tables, indexes and views, then sample selected columns with REA using a reproducible offline database snapshot.
Inspect an NSKeyedArchiver Object Graph with REA
Read a keyed archive's roots, object IDs and references without instantiating its classes, and page through the object table with REA.
Inspect PE Icons, Version Resources and Embedded Data with REA
Map a Windows EXE's resource types, icon groups and embedded payload hashes without running it, then cross-check the offsets with pefile.
Is This Mac App Universal? Check Apple Silicon and Intel Slices
Check if a Mac app or dylib is a universal binary, list its arm64 and x86_64 slices, and compare minimum macOS, signature and dependencies per slice, on any OS.
Reverse Engineer a macOS App with REA: Mach-O, Swift and NIBs
Analyze a macOS .app with REA: map bundle anatomy, read Info.plist, Mach-O and signing metadata, trace dylib loads, demangle Swift, decode NIBs, then decompile.
Reverse Engineer a Windows EXE or DLL with AI, Ghidra and REA
Analyze a Windows EXE or DLL you built with REA, Ghidra and an AI agent: exports, imports, PE resources, strings, decompilation and Windows host limits.
Trace macOS Dylib Paths with REA
Trace @rpath and @executable_path in a Mach-O dependency graph, and distinguish a missing bundled dylib from an unevaluated system library.
What's Inside a .mobileprovision, and How to Check It
Decode an iOS provisioning profile with security cms, openssl and plutil: entitlements, team, UDIDs, expiry and certificates, checked against the signed app.