native · 12

Native binaries

Identify binary formats, architectures and platform signatures, then use REA and its Ghidra backend for strings, decompilation, cross-references and feature tracing. Guides cover Windows EXE/DLL files, macOS app bundles, hardening flags and universal binaries. REA workflows also connect IDA Pro through ida-pro-mcp and tune headless Ghidra for stripped or unusual binaries; check each guide for its versions and limits.

• Check Binary Hardening Flags: NX, PIE, RELRO, ASLR and CFG

  Check whether your own ELF, PE and Mach-O builds have NX, PIE, full RELRO, stack canaries, ASLR, CFG and hardened runtime, with real tool output and flags.

  7 min read

• Check if an EXE or DLL Is 32-bit, 64-bit or ARM64 (Incl. .NET)

  Tell whether a Windows EXE or DLL is x86, x64 or ARM64 without running it, and why a .NET AnyCPU assembly looks 32-bit until you read its CLI flags.

  7 min read

• ELF, PE and Mach-O Viewer Online: Is Your Binary Stripped?

  Identify an ELF, PE or Mach-O file in the browser: architecture, sections with entropy, imports, exports and strings, and whether the binary is stripped.

  7 min read

• Find the Go Version and Dependencies of a Binary (go version -m)

  go version -m reads the Go version, modules, replace directives and VCS revision from any Go executable, even stripped or cross-compiled. Real gh and cloudflared output.

  6 min read · REA 6.7.0

• Fix "dyld: Library not loaded: @rpath" on macOS

  Reproduce the dyld "Library not loaded: @rpath" crash, read the tried paths, find the rpath with otool and fix it with install_name_tool or by shipping the dylib.

  3 min read · REA 6.8.0

• Frida Hook a Native Function on Android: Spawn vs Attach

  Hook a C function with Frida's Interceptor on an Android emulator: frida-server setup, the -rdynamic export trap, spawn vs attach, frida-trace, and why macOS timed out.

  4 min read · REA 6.7.0

• Ghidra MCP: Headless Decompiling from an AI Agent with REA

  Drive Ghidra's headless analyzer from an AI agent or the CLI with REA: setup and doctor checks, decompile, xrefs and trace commands, plus a sample with its ground truth.

  5 min read · REA 6.7.0

• How to Reverse Engineer a Mac App: Rectangle Step by Step

  Reverse engineer a macOS app without running it: bundle layout, Info.plist, Mach-O slices, signing, dylib loads, NIB menus and Swift classes, tested on Rectangle.

  6 min read · REA 6.7.0

• How to Reverse Engineer a Windows EXE or DLL: A Worked Example

  Reverse engineer an EXE or DLL step by step: tell native from .NET, list exports and imports, decode version and string resources, and read the machine code.

  5 min read · REA 6.7.0

• Is This Mac App Universal? Check Apple Silicon and Intel Slices

  Check if a Mac app or dylib is a universal binary, list its arm64 and x86_64 slices, and compare minimum macOS, signature and dependencies per slice, on any OS.

  5 min read

• What Crates Are in a Rust Binary? Reading cargo-auditable Data

  A Rust binary lists its crates only if built with cargo auditable. Extract and inflate the .dep-v0 section, see why a plain cargo build has nothing, with real output.

  3 min read · REA 6.7.0

• What's Inside a .mobileprovision, and How to Check It

  Decode an iOS provisioning profile with security cms, openssl and plutil: entitlements, team, UDIDs, expiry and certificates, checked against the signed app.

  8 min read