21 KiB
Reverse-engineering tool integrations
REA can call caller-supplied GNU objdump, GDB, and Rizin installations. REA does not install or update these tools. Static objdump/Rizin workflows use the same services from CLI and MCP. GDB's persistent MCP sessions and ephemeral CLI command are available only on Linux. Persistent debugger sessions exist only for the lifetime of the REA MCP server process.
In a shared MCP server, unrestricted Rizin and Cutter commands, GDB console
commands, Rizin debugger start/close, and GDB debugger close retire any active
binary analysis session after the operation. This prevents a fresh analysis
provider from being rebound automatically while command effects may still be
writing. After the command and any background writers have stopped, call
open_binary explicitly before continuing analysis. A successful command
response alone does not prove that background writers have stopped. An active
Ghidra analysis session must be closed explicitly before an external mutation
can run.
GNU objdump
inspect_with_objdump and rea inspect-with-objdump capture stdout and stderr as inline Evidence. Artifact inspection Evidence records SHA-256 digests before and after the provider call and whether those observed digests differ; this cannot prove the exact bytes consumed if the artifact changes during execution. Choose one artifact operation: file_headers, section_headers, symbols, relocations, dwarf, disassemble, or disassemble_all. disassemble maps to -d; disassemble_all maps to -D and has different symbol-boundary semantics. The pathless inspect_with_objdump {"operation":"architectures"} MCP call or rea list-objdump-architectures CLI command maps to -i and produces subjectless provider-capability Evidence describing BFD targets compiled into the installed binary, not a guarantee that a target is supported.
Failure to launch the selected executable reports provider unavailability, the
configured command and the host error under boundary: "provider-launch".
Recovery concerns REA_OBJDUMP_COMMAND, PATH and execution permission, including
for target-free architecture listing. Artifact admission keeps separate input
and filesystem-read diagnostics. Invalid operation/selector combinations retain
their rejected fields in input issues before artifact reads or provider launch.
For DWARF, REA does not follow local debug links by default. Set follow_debug_links to true to pass -WK; external debug-file identities are not bound to Evidence when following links is enabled. The CLI flag is --follow-debug-links; --no-follow-debug-links or --follow-debug-links=false keeps the default. A separate true or false word after the flag is not its value. REA clears DEBUGINFOD_URLS in the objdump child environment to disable debuginfod network access on GNU binutils versions that do not support -WE. The complete raw output is authoritative; REA does not normalize it into a version-independent disassembly schema.
For a known native symbol, use operation: "disassemble", symbol: "my_function" in MCP or --symbol my_function in CLI. REA passes --disassemble=my_function to objdump before collecting output, rather than producing the whole disassembly and filtering it afterward. Omit symbol to keep full code-section disassembly. Other operations reject this selector. Use a nonempty, NUL-free name with well-formed Unicode; unsupported values are rejected before reading the artifact or starting objdump. Symbol names are passed unchanged; matching, versioned symbols, aliases and the end of the disassembly follow the installed GNU objdump's semantics. Evidence records the selector and actual arguments. An empty match does not establish artifact-wide absence, and the selected observation does not contain the omitted disassembly; request the complete operation when needed.
rea inspect-with-objdump ./program disassemble
rea inspect-with-objdump ./program disassemble -