Browse projects/Developer tools/Inspect an application's code/REA
Inspect programs with REA
Recover native functions and pseudocode locally, with saved evidence and REA tools in your agent.
Bring a native program and let REA inspect it through Ghidra. The first run saves a recovered function inventory, a selected function’s pseudocode, an analysis bundle and a readable report. Choose a function for that first report, or continue investigating through REA’s real command line and MCP tools.
Your agent can follow references, annotate the recovered analysis and query retained evidence. Ghidra checkpoints preserve the recovered Program and normal-close metadata edits when you reconnect. These static workflows do not execute or modify the input program.
Basic JavaScript directories and ASAR archives are also supported. Bundled React applications currently hit an upstream analysis bug and are not qualified by this setup; an empty parse is rejected rather than reported as a completed result.
This builds an exact upstream source commit newer than the 6.8.0 npm release. Ghidra and Java are supplied for both Linux architectures. Other disassemblers, desktop automation and live process instrumentation need their own native setup.
You bring
- a native program, a JavaScript application folder or an ASAR archive; the staging suffix also supports upstream archive detection
target.asar
You get
- REA's complete saved evidence bundle for later investigation
analysis.json - an authenticated compact view of the saved analysis
summary.json - a readable first result, including native pseudocode when selected
report.txt - REA's command line, with Ghidra available and the current folder accessible
- REA's real analysis and investigation tools; your staged target is at /work/inputs/target.asar and saved evidence is at /work/outputs/analysis.json
Make it yours
UGT guides you through these settings.
- auto, native or javascript; auto uses JavaScript for folders and native analysis for files
Choose javascript for an ASAR archive. Choose native with REA_ENTRY to inspect a program inside a supplied folder.
- optional relative path to the target inside the supplied folder
Keep the app's other files and source maps together. Leave empty to inspect the supplied file or the whole application folder.
- native function name or address to decompile in the first report
Leave empty to use main when present, otherwise the first recovered local function. The MCP tools let your agent choose other functions afterward.
- maximum time for each analysis request, in seconds; defaults to 600
Choose 10–1800. REA's live analysis-settings tools control its individual engine and representation budgets; a failed or empty analysis is not a completed result.
Good to know
- Production React 19 bundles fail in upstream JavaScript semantic analysis at this pinned source. Basic JavaScript directories and ASAR archives pass; bundled React analysis is not qualified. Its timeout or empty partial result must not be interpreted as a completed analysis. Native MCP work remains usable after that failure.
- Static findings describe recovered observations, not runtime behavior or the original source. Read coverage and limitations, especially for packed, obfuscated, stripped or dynamically generated code.
More setup notes
- The container has a 6 GB memory limit. Ghidra starts with a 2 GB Java heap and a 60-second per-function decompilation limit. REA's analysis-settings tools can adjust supported per-operation budgets.
- One REA session owns a given native checkpoint at a time. Close it normally before opening that same target from another independent client. Saved evidence bundles preserve investigation records; native checkpoints preserve the recovered Program.
- Ghidra and provider-free static tools are supplied. Hopper, IDA, Kuna, host desktop access, Frida, browser execution and device instrumentation are not configured by this setup. No host agent configuration is rewritten.
Your files & access
Processing has no network access. The recipe can use only the files you give it. UGT downloads the software during setup.
Licences & source
REA MIT and its bundled third-party notices; Ghidra Apache-2.0 and bundled notices; JDK and Node retain their distribution licences. UGT's driver and fixtures are Apache-2.0.
What UGT sets up for you
- REA at commit
cb4e5cfbff25
How was it tested?
Run on clean x86-64 (Intel/AMD) and ARM64 machines on 10 Nov 2026. Its check passed on a known sample and rejected deliberately broken results.
This checks the job this page describes, not every feature of the original project.
Developer tools
Run tools and services for the software you build.
