Ghidra is an analysis environment for inspecting native programs, functions and decompiler output. REA can direct a documented workflow through a configured native provider and return structured evidence to a CLI or agent. For a question about a function, the useful choice is often whether to work directly in Ghidra or coordinate selected reads through REA.
When direct Ghidra work fits
Use the analysis environment directly when you want to explore a program interactively, rename symbols, compare cross-references and examine the pseudocode beside instructions. The analyst can make and revise hypotheses as the code graph becomes clearer. Save the project and exact binary version so another person can inspect the same findings.
When REA adds structure
REA's native guide describes choosing an installed provider, finding an exact procedure and asking focused questions about instructions, references or pseudocode. This can make a repeatable investigation easier to record and expose selected results to an agent. It does not mean REA independently replaces the provider's analysis engine or makes the resulting pseudocode ground truth.
Check both the installed REA release and Ghidra configuration. A built-in PE or ELF metadata read has a narrower purpose than a provider-backed function analysis. Include the provider name, target hash and limitations in any published conclusion.
Requirements & evidence
- Resource type
- Comparison
- Category
- Unknown
- Host platforms
- Unknown
- Targets
- native
- Level
- Intermediate
- Source checked
- 2026-11-03T10:04:47.114247+00:00
Primary sources
- https://raw.githubusercontent.com/morluto/rea/main/docs/native-investigation.md
- https://raw.githubusercontent.com/nationalsecurityagency/ghidra/master/README.md
Source descriptions establish documented scope. They do not establish that every workflow has been reproduced by AI Craft Pad.