REA uses caller-supplied Binwalk for firmware region inspection and caller-supplied Unblob for explicit extraction on its documented Linux path. The two operations have separate prerequisites and evidence meanings. Record the original image hash, offsets, engine identity, extraction gaps and coverage status, then select a verified executable child for a separate native-analysis workflow.
Separate inspection from extraction
Region signatures help locate candidate containers, while extraction publishes recognized child files to a new destination. Configure the engine required by the chosen operation and keep the producer report. A signature or a completed extractor run does not prove that every partition or encrypted region was recovered.
Continue from verified children
Use content hashes and source ranges when comparing results. Decompressed children may not have a direct original-byte range, and task lineage is not a runtime address map. Choose a supported ELF or other verified child for the next analysis stage and retain every reported gap or missing dependency.
Requirements & evidence
- Resource type
- Guide
- Category
- Unknown
- Host platforms
- Unknown
- Targets
- firmware, native
- Level
- Advanced
- Source checked
- 2026-11-04T05:16:02.091695+00:00
Primary sources
Source descriptions establish documented scope. They do not establish that every workflow has been reproduced by AI Craft Pad.