A native investigation should separate lightweight file metadata from provider-backed function analysis. REA can coordinate focused reads of instructions, references and pseudocode through a configured provider such as Ghidra. Identify the binary format and architecture, trace one relevant function, and verify important interpretations against the underlying bytes or a controlled run.
Find a stable starting point
Record the executable hash, format and architecture. Follow a relevant string or import reference into a function, keeping the original address and instruction view beside any renamed symbol. Confirm the provider is installed before asking for deep native analysis.
Check the reconstruction
Read callers and constants when pseudocode omits an input or simplifies a conversion. An authorized test can check selected behavior, but a few runs cannot cover every path. Record both REA and provider versions.
Requirements & evidence
- Resource type
- Guide
- Category
- Unknown
- Host platforms
- Unknown
- Targets
- native
- Level
- Intermediate
- Source checked
- 2026-11-03T10:04:47.114247+00:00
Primary sources
- https://raw.githubusercontent.com/morluto/rea/main/docs/native-investigation.md
- https://raw.githubusercontent.com/nationalsecurityagency/ghidra/master/README.md
Source descriptions establish documented scope. They do not establish that every workflow has been reproduced by AI Craft Pad.