REA on Fedora-based Linux: setup notes, gotchas and my test queue

[CassieFox23]

TL;DR: I tested REA on a Fedora-based Linux box (Nobara 44). Ghidra, Chromium, pwntools, the Android lane and the installer all work. Every Linux fix named here shipped in 6.4.0 or earlier, and this page is the one place for the Linux notes.

My test queue is in a comment below. Dated results are in two changelog comments. Startup timing has its own page, REA startup benchmark.

Each note links to where I first posted it. Thanks, ylwl1997, for your checklist. Six of its seven points match what I saw, and they are folded in below.

Setup that worked

• Ghidra and a JDK.
  • Ghidra 12.1.4 (Apache-2.0), from the official archive.
  • It ran on Temurin JDK 21 (GPL-2.0-only WITH Classpath-exception-2.0).
  • Export GHIDRA_INSTALL_DIR and JAVA_HOME. Then npm run verify:ghidra passed. (#1280, #1419)
• Chromium.
  • Chromium 154 (BSD-3-Clause), the Fedora 44 package.
  • Set REA_BROWSER_EXECUTABLE=/usr/bin/chromium-browser. Then npm run verify:browser passed. (#1384)
  • Set it before you blame REA for "no browser". (ylwl1997's checklist)
• pwntools.
  • pwntools (mostly MIT) lives in a venv, because REA wants exact versions.
  • Point REA_PWNTOOLS_PYTHON at the venv's Python. Never install into the distro Python. (#1404)
• Node 22, 24 and 26 side by side.
  • CI uses 24.18.0, from .nvmrc.
  • REA's engines field allows 22.19 and up, 24.11 and up, and 26 and up.
  • An old Fedora 43 build of Node 22.22.2 aborted on one bad source map path ([Bug] Malformed UNC source-map path aborts REA on Node builds its engines field allows #1367). Node 22.23.1 was fine, and REA now handles that path (fix(javascript): decline source-map UNC references with an unusable host #1372, in 6.3.0).
• Android. A Java JDK and the JADX decompiler jar are the only needs. The Android lane section below has the two settings.
• Installer. A real install.sh run worked on Node 22 and 24, and put rea in ~/.local/bin. (#1417)

Where Linux differs

• Keep TMPDIR short.
  • Linux limits a socket path to 108 bytes. A long temp folder broke Chromium in verify:browser ("Socket path too long"). (#1384)
  • It also broke 43 Hopper socket tests in the full suite. Hopper is one of the native analysis engines REA can use. The socket path came out at 120 bytes.
  • With a short TMPDIR, all 69 tests in the 9 files that had failed passed. (#1390)
  • A path like /tmp/rea works. (ylwl1997's checklist)
• A locked desktop keyring.
  • A headless Chromium browser may ask the keyring for a key. If the keyring is locked, nobody answers. The page then sits on about:blank with an empty URL. That was the cause behind the frame URL bug in [Bug] inspect_web_page rejects every target on Chromium 150: Page.getFrameTree reports the opaque placeholder URL #1384, which is closed. (cause, found by BaaRai)
  • REA's browser verify scripts pass --password-store=basic since c57e759. Playwright already adds that flag by default, which avoids the stall too. (ylwl1997's checklist)
  • On KDE, Chromium asks KWallet (KDE's password store) instead of the Secret Service. The Secret Service is the generic Linux keyring interface.
  • I faked a locked keyring on a private test bus (a separate D-Bus session). Without the flag, verify:browser failed. With the flag, it passed. (#1432)
• KDE: KWallet and Electron.
  • Stock Electron 44.7.0 (MIT) never asks the keyring at startup.
  • An app's own safeStorage call does ask. On KDE 6, that call froze the main process until I killed it. The same flag avoids the freeze.
  • REA's Electron capture drops the D-Bus variables, so it is safe either way. The verify:electron script keeps them. (#1432)
• Typecheck memory. The TypeScript 7 tsc --noEmit peaks near 2.4 GiB, which is over a 2 GiB cap. With --singleThreaded, tsc passed at 1.49 GiB. This was one run, on Node 24, and I have not rerun it. (#1402)
• Docs in an npm install. The package's files list in package.json has no docs/ folder. So the README's Android guide link is dead after an install. The bundled skill's references/android-applications.md has the same steps. I re-checked this on main today.
• Older builds said unsupported_host. 6.1.0 and 6.2.0 did this on Nobara 44. I filed [Bug] Nobara 44 (Fedora-based) reported as unsupported_host #1335, which is closed, and 6.3.0 reports the host as healthy. (ylwl1997's checklist, point 7)

Android lane

I pointed released 6.3.0 at Coffee 2.27 (Apache-2.0), a small F-Droid app. Its SHA-256 (a file fingerprint) matched F-Droid's signed index. It needed two settings:

export JAVA_HOME=<Temurin JDK 21>
export REA_JADX_MCP_JAR=<jadx-headless-mcp-0.7.1-all.jar>

Five Android commands all worked, at about 4 s and 550–650 MiB each.

The five Android commands

Command	Result	Time	Peak memory
inspect-android-package	worked	3.7 s	561 MiB
search-android-classes	worked, 1,641 classes	3.7 s	554 MiB
inspect-android-class	worked	3.9 s	555 MiB
inspect-android-method	worked	4.2 s	648 MiB
trace-android-references	worked	3.9 s	569 MiB

The command project-android-application-graph failed on 6.3.0. The cause was two zip names that differ only in case, like res/2f.xml and res/2F.xml (#1470). Five more F-Droid apps hit it too. The fix, #1480, shipped in 6.4.0. (#1480)

Ghidra lanes

Six verify:ghidra lanes run on Linux with Ghidra 12.1.4. The longest take about 6 minutes each. Four more need macOS, Windows or extra files. Three breaks I hit are fixed: #1382, #1527 and 162f9bf (#1419), and all three are in 6.4.0.

A glibc quirk with gcc builds

One glibc quirk to know. With gcc -O2, glibc's header makes some error() calls look like they never return. (glibc is the standard C library on Linux.) Ghidra then marks the error stub as no-return. So code after a plain warning error(0, …) gets cut off. Clang builds don't hit this. (#1419)

Node timing

Startup timing for Node 22, 24 and 26 now lives on REA startup benchmark. I update it each release. My older 6.3.0 timings of one real app are in the first changelog comment. The short version: Node 26 was fastest on long analyses, and Node 22 was slowest.

From ylwl1997, not tested here

• Their doctor --provider ghidra command. I used verify:ghidra instead.
• The Ghidra and JDK pairing "Temurin 21 or newer". I only used Temurin 21.
• Setting the browser path from which chromium. I used /usr/bin/chromium-browser.
• A "non-hidden" temp path. I only checked that a short one works.

Not run

• Windows, macOS and Hopper.
• The Android round trip inside Waydroid (GPL-3.0). The container was frozen.
• More apps and more rounds for the Android and Node timings.

Thanks, morluto, for REA. Thanks also to BaaRai, N0zoM1z0, zeynelacikgoez and everyone whose PRs I got to test.

Edit: 12 October. Rewritten as the one Linux reference. Startup timing moved to #1998. Dated results moved to two changelog comments.

Handy for testing PRs on Linux

• git archive gives a clean copy of any commit. Your clone stays on main. Checks that call git ls-files need a workaround. (#1404)
• A fake HOME with env -i keeps setup tests off your real config. (#1415, #1417)
• ulimit -c 0 plus timeout around crash-prone runs. No core files, and no runs that hang. (#1387)
• taskset -c 2,3 pins a timing run to two cores. (#1065)

Commands

# A clean tree from one commit
git archive <sha> | tar -x -C <dir>

# pwntools with the exact versions REA checks for
uv venv --python /usr/bin/python3 venv
uv pip install --python venv/bin/python 'pwntools==4.15.0' 'pyelftools==0.33' 'unicorn==2.1.2'
export REA_PWNTOOLS_PYTHON=$PWD/venv/bin/python

# Browser check on Fedora's Chromium, with a short temp folder
REA_BROWSER_EXECUTABLE=/usr/bin/chromium-browser TMPDIR=<short dir> npm run verify:browser

# Android lane
export JAVA_HOME=<Temurin JDK 21>
export REA_JADX_MCP_JAR=<jadx-headless-mcp-0.7.1-all.jar>

# Setup test in a fake home, as run for #1415
env -i PATH="$NODE24/bin:/usr/bin:/bin" HOME="$FAKE" TMPDIR="$FAKE/tmp" \
  XDG_CONFIG_HOME="$FAKE/.config" XDG_DATA_HOME="$FAKE/.local/share" \
  XDG_CACHE_HOME="$FAKE/.cache" XDG_STATE_HOME="$FAKE/.local/state" \
  npm_config_cache="$FAKE/.npm" npm_config_prefix="$FAKE/.npm-global" \
  npm_command=exec \
  timeout 60 node scripts/rea.mjs setup --client qwen_code --dry-run --format json

# A crash-prone or timed run
( ulimit -c 0; timeout 1200 taskset -c 2,3 node <script> )

npm_command=exec is what npx sets. Setup output changes without it.

pyelftools is in the public domain. Unicorn is GPL-2.0.

Software we used, with links and licenses

Every tool behind these notes and the linked comments. Licenses are from each project's license file or Fedora's package data.

Runtimes and build tools

Tool	Written in	Version	License
Node.js	JavaScript, C++	22.23.1, 24.18.0, 26.11.1	MIT
npm	JavaScript	10.9.8, 11.16.0	Artistic-2.0
Eclipse Temurin JDK	Java, C++	21	GPL-2.0-only WITH Classpath-exception-2.0
Clang and LLD	C++	22.1.8	Apache-2.0 WITH LLVM-exception
GCC	C++, C	16.2	GPL-3.0-or-later
Bash	C	5.3.9, and 3.2.57 in a container	GPL-3.0-or-later, GPL-2.0-or-later
Podman	Go	5.8.7	Apache-2.0
uv	Rust		MIT or Apache-2.0

Analysis back ends

Tool	Written in	Version	License
Ghidra	Java, C++	12.1.4	Apache-2.0
Chromium, Fedora 44 build	C++	154.0.8037.57	BSD-3-Clause
Playwright, the one REA pins	TypeScript	1.58.2	Apache-2.0
pwntools	Python	4.15.0	Mostly MIT
pyelftools	Python	0.33	In the public domain
Unicorn	C	2.1.2	GPL-2.0
Frida	C, Vala	17.23	wxWindows
jadx-headless-mcp, the jar REA pins	Kotlin, Java	0.7.1	Apache-2.0
Electron, for the keyring check	C++, TypeScript	44.7.0	MIT

Checks and test tools

Tool	Written in	Version	License
ShellCheck	Haskell	0.11.0	GPL-3.0
Vitest	TypeScript	5.0.3	MIT
TypeScript 7	Go	7.0.2	Apache-2.0
oxlint	Rust	1.87.0	MIT
MCP TypeScript SDK	TypeScript	2.3.1	MIT, moving to Apache-2.0
dbus-python	C, Python	1.4.0	MIT

Apps we pointed REA at

App	Written in	License
Hermes Desktop	Python, TypeScript	MIT
Qwen Code	TypeScript	Apache-2.0
OpenCode	TypeScript	MIT
Pi	TypeScript	MIT
Beyond All Reason launcher	JavaScript	Code: MIT. Flathub package: GPL-2.0-or-later
Coffee, the Android lane app	Kotlin	Apache-2.0
Amethyst Mod Manager	Python, Rust	GPL-3.0-or-later

Google's test build was also used as a second browser.

Some tests also used closed-source apps. We describe those but don't name them. We kept to REA's disclaimer: lawful use, with permission where it is needed.

The licenses in plain words

• MIT and BSD: Use it for anything. Keep the copyright note.
• Apache: Same, plus a patent promise. Mark the files you changed.
• GPL: Use it for anything. If you hand out copies, hand out the source too, under the GPL.
• Only or later: "Only" means that GPL version. "Or later" lets you pick a newer one.
• With an exception: The license plus a carve-out. With Classpath, your own program can use the JDK and stay yours. With LLVM, programs it builds need no LLVM note.
• Artistic: Share it freely. If you change it, rename it or share the changes.
• wxWindows: Like a light GPL for the library. Your own program built on it can ship any way you like.
• Public domain: No rules.
• This or that: Pick whichever of the two suits you.

Test setup

• Box: Nobara 44 (Fedora 44 base), Linux 7.2.9, KDE Plasma 6
• CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
• RAM: 32 GB DDR4-3600
• Node: 22.23.1, 24.18.0, 26.11.1
• REA: the 6.3.0 release, plus main and PR heads at the commits in each linked comment
• Browser: Chromium (BSD-3-Clause), the Fedora 44 build, 154.0.8037.57
• Ghidra: 12.1.4 (Apache-2.0)
• JDK: Temurin JDK 21 (GPL-2.0-only WITH Classpath-exception-2.0)
• JADX: jadx-headless-mcp 0.7.1 (Apache-2.0), the jar REA pins
• pwntools: 4.15.0 (mostly MIT)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

[CassieFox23]

TL;DR: This is a dated changelog of Linux results from 9 and 10 October. Startup got about 20% faster after #1439. Every fix below is in 6.4.0 or earlier. The setup steps and the Linux differences are in the main post.

Timing, 6.3.0 and after

Startup after #1439. PR #1439 loads Playwright (Apache-2.0) and Git code only when a command needs them. It shipped in 6.4.0. The numbers are rea --version, median of 12 runs:

Node	Before #1439 (ms)	After #1439 (ms)	Peak memory before → after (MiB)
22.23.1	1,508	1,181	272 → 236
24.18.0	1,269	1,005	338 → 305
26.11.1	1,106	879	301 → 265

Later startup numbers are on REA startup benchmark.

Node timing of one real app, on 6.3.0. I ran analyze-javascript-application on the Beyond All Reason launcher (code MIT; Flathub package GPL-2.0-or-later). I ran 3 rounds, with the Nodes in turn.

Node	Median time	Peak memory
22.23.1	51.4 s	1.89 GiB
24.18.0	45.0 s	1.60 GiB
26.11.1	42.8 s	2.02 GiB

• The spread between rounds was under 2 s.
• All 9 runs exited 0, and each output file had the same size, to the byte.
• Node 24 was about 12% faster than 22, and 26 was about 5% faster again. But 26 used the most memory.
• On newer main, after fix(javascript): bound member-mutation paths through reassignment loops #1390, the same app took 51.5 s on Node 24. Other tests shared the machine for that run, from 04:50 to 05:00 UTC on 10 October. The 45.0 s run was on a quieter machine. So the two times don't compare cleanly. The output was the same, byte for byte. (#1390)

Fixed since

Item	What happened	Where
#1384	Frame URL bug on Chromium 150. Closed. The cause was a locked keyring.	main post
#1432	Closed unmerged on 10 October. The same flag landed as c57e759, in the browser verify scripts.	6.4.0
#1417	Closed on 10 October. Its fix landed as 60fbb2f, which also adds shell quoting to the printed install line.	6.4.0
#1386	A long run of spaces in an inline source map threw on Node 22 and 24. It passed on Node 26.11.1, and I don't know why. #1386 fixed the throw and the #1380 length limit.	6.4.0
#1372	A bad source map path aborted an old Node 22.22.2 build (#1367).	6.3.0

Details: #1380, #1386, #1417.

Edit: 12 October. Rewritten as a changelog. The setup and Linux notes moved to the main post.

Test setup

• Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
• Node: 22.23.1, 24.18.0, 26.11.1
• REA: the 6.3.0 release, plus main and PR heads at the commits in each linked comment
• The full list of tools and licenses is in the main post.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

[ylwl1997]

Great write-up — the Node 22/24/26 timing table and the license fold are especially useful for anyone reproducing on Fedora-family hosts.

Short gotchas checklist (additive to what you already measured):

1. Node floor. Prefer 22.23+ / 24.x / 26.x side-by-side; CI’s .nvmrc (24.18.0) is a good default. Older Node 22 patch lines can still abort on pathological source-map paths.
2. Short TMPDIR. Chromium and Hopper socket paths both hit Linux’s ~108-byte sun_path limit. Use something like /tmp/rea (or another short, non-hidden path) for verify:browser and socket-heavy suites.
3. Browser binary. On Fedora packages, set REA_BROWSER_EXECUTABLE=/usr/bin/chromium-browser (or the absolute path that which chromium resolves) before blaming REA for “no browser”.
4. Keyring / headless Chrome. Locked desktop keyrings can leave pages on about:blank; --password-store=basic (tracked in fix(browser): launch verification Chrome without the desktop keyring #1432) or Playwright’s defaults avoid that stall.
5. Ghidra + JDK. Pair Ghidra 12.x with Temurin 21+, export GHIDRA_INSTALL_DIR + JAVA_HOME, then doctor --provider ghidra.
6. pwntools. Keep exact REA-checked versions in a venv and point REA_PWNTOOLS_PYTHON at that interpreter — do not overwrite distro Python.
7. Nobara / host gate. Older builds could report unsupported_host on Fedora spins; check your REA version before filing a duplicate.

If you want a compact bilingual install card that mirrors this checklist for newcomers, happy to iterate on wording.

Disclosure: I maintain rea.run, an independent bilingual docs/FAQ site about lawful coding-agent reverse engineering. Not affiliated with the REA project.

[CassieFox23]

Thanks, ylwl1997, for the checklist. Point 7 matches what I saw: 6.1.0 and 6.2.0 called Nobara 44 unsupported_host. I filed that as #1335, and 6.3.0 now reports the host as healthy.

🤖 Generated with Claude Code (Opus 5.5) 🦊

[CassieFox23]

TL;DR: This is a dated changelog of Linux results from 10 October. A big speedup came with #1444, and Node 26 again handled long analyses best. The Android lane, KWallet and Ghidra notes are in the main post.

Speedups and fixes

• fix(javascript): stop replaying earlier writes for each object property write #1444. The change stops replaying every earlier write for each new property write. One object with 4,000 writes went from 210 s to 0.24 s on Node 24. Answers stayed the same on all 197 soundness cases. It shipped in 6.4.0. (#1444)
• perf(process): stop padding rendered terminal lines to full width #1450. Terminal captures are 54% to 89% smaller for screens with short lines. Full-width rows like ls -la and top gain 20% or less. It shipped in 6.4.0. (#1450)
• fix(mcp): validate doctor probe against its discovered output contract #1461. The command rea mcp doctor now flags a bad probe reply on Node 22, 24 and 26. It shipped in 6.4.0.
• fix(artifacts): keep case-distinct archive names in inventory #1480. The Android graph command works with case-distinct zip names. It shipped in 6.4.0. (#1480)
• Ghidra lanes. :cross-format failed on an older main, and fix(ghidra): keep the cross-format branch callee multi-block #1382 fixed it. Then [Bug] Ghidra boundary verifier fails on duplicate output schema ids since #1433 #1518 broke the lane's schema check, and fix(verification): reuse validators for shared output schema ids #1527 fixed that. I ran the lanes on the fix(ghidra): clear wrong no-return flags before serving a session #1419 fix. All three are in 6.4.0.

Pings during a long JavaScript analysis

A long analyze-javascript-application blocks MCP pings until a step ends. This is the ping wait after an abort, on the 1,200-function repro from #1462, median of 3 on an idle machine:

Node	Main cbcba29 (#1475)	My first #1462 post, c89c8f5 (#1452)
22.23.1	597 ms	780 ms
24.18.0	427 ms	517 ms
26.11.1	356 ms	501 ms

Newer main is faster, and the machine was less busy. On the Beyond All Reason launcher (code MIT; Flathub package GPL-2.0-or-later), the longest single wait was 4 to 5 s. A CPU profile shows that step builds the whole app graph in one go, after the last file is parsed. (#1462)

The issue #1462 is closed, after #1545 and #1557 merged. Both are in 6.4.0. By their titles, both make the analysis yield during long steps. I have not re-measured these waits.

Smaller results

• Report hashing peaks near 377 MB on Node 24, even for a 256 MiB file. (docs(process): verify independent full-report hashing budgets #1440)
• Real Frida 17.23 (wxWindows) on Linux. A cancel at attach, load, resume and observation cleaned up every time. The PR (feat: add Frida instrumentation support #1359) is still open.

Edit: 12 October. Rewritten as a changelog. The Android lane, pings, KWallet, Ghidra lanes and the glibc quirk moved to the main post.

Test setup

• Box: Nobara 44 (Fedora 44 base), Linux 7.2.9, KDE Plasma 6
• Node: 22.23.1, 24.18.0, 26.11.1
• REA: the 6.3.0 release, plus main and PR heads at the commits in each linked comment
• The full list of tools and licenses is in the main post.

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

[CassieFox23]

TL;DR: Six PRs I tested have merged since yesterday. The five Node bug reports, #2020 to #2024, are already fixed on main. My #2212, #2150, #2068 and #2227 results are posted. I'm testing #2144 and the merged kuna memory fix now. Next are #2244, #2280, #2282 and #2283.

If you want a Linux check on something, tag me in that issue or PR.

Updated: 12 October, 18:48 UTC. I keep this one comment up to date. Finish times are rough estimates.

Testing now

• fix(artifacts): bound archive decompression by source size #2144, zip bombs. I'll check that REA refuses the bomb but still opens a big real archive.
• kuna #1034: the fix merged. CrashLogger finishes on the PR head; one DLL does not yet. I'm testing the merged code now.

Next

• fix(browser): honor service worker allow policy in attached scenarios #2244, service workers in an attached browser session.
• fix(cli): report analysis failures as not-ok in full-output envelopes #2280, whether --full-output marks a failure as not ok.
• fix(pwntools): report retained process cleanup identities #2282, pwntools cleanup errors that name the process.
• fix(ghidra): report unapplied PE CodeView PDB limitation #2283, a Windows program with a PDB file beside it, on real Ghidra.
• 6.5.0 (chore(main): release rea-agents 6.5.0 #1693): a smoke test on Node 22, 24 and 26 once it is on npm. Then the startup benchmark gets its rerun.
• feat(ghidra): surface instruction-backed prototype conflicts #1672, Ghidra prototype conflicts, once it leaves draft.

Waiting on others

• feat(ghidra): verify and pin the 32-bit ARM (armhf) lane #1922, the 32-bit ARM lane: results are posted. BaaRai fixed the knip failure. A merge conflict is still open.
• 6.5.0: the release PR chore(main): release rea-agents 6.5.0 #1693 is open, and npm still has 6.4.0.

Done

Recent first. Each link goes to my result comment.

Merged since my tests: #2212, #2026, #2014, #2011, #1359 and #1582. Thanks, everyone.

• #2304, using REA with Claude: what's fine, what needs permission, and where the legal lines are. Corrections welcome.
• #2227, Windows files with a short DOS header. Head reads them as PE, and no DOS-only file is mistaken for one.
• #2068, web workers in real headless Chromium. Each worker keeps its source and owner.
• #2212, logcat byte counts on a real Android 14 tablet. The fix is right on all 8 lines.
• #2150, opening a Ghidra project you already imported. Nothing reaches it yet. Set by hand, it works and keeps your names.
• #2020, #2021 and #2024: fixed on main. Each bug shows on the commit just before the fix.
• #1941 retest: the wrapper chains are fixed. Very deep closure chains still slow down.
• #2254, a stripped bzip2 build on Linux: what REA returned, with steps to repeat it.
• #2231, a question: would you want NE (16-bit Windows) support? I have a fork prototype.
• #1048, what REA keeps when you rename functions today.
• #2018 retest: all three bugs are fixed. Now 76 of 81 names match real Node.
• #2014 retest: same results on its last code change, before it merged.
• #2026, test:fast without a build. Both fixes work on Node 22 and 24.
• #2018, package wildcard exports against real Node. Head matched 69 of 81 names, with three bugs.
• #2014, reopening Ghidra after its process dies. The fix works with real Ghidra.
• #2011, Ghidra launch output, the same cases as fix(ghidra): retain bounded LaunchSupport failure output #2010.
• #2039, my plain-words read of the roadmap. Corrections welcome.
• #2007, WASM named .hop. It now gets the right message.
• #1959, debugger shutdown on real processes. The new head fixes the hang.
• #2010, Ghidra launch output on real Ghidra.
• kuna #1031 follow-up, 170 plugin DLLs through decompile-all.
• #2006 follow-up, a local model driving REA. It finishes now, but it guesses.
• kuna issue 1028: fixed and closed by its maintainer.

Roadmap items a Linux box can help with

• [Feature] Roadmap: improve MCP usability and performance under bounded resources #1065 (MCP under tight memory), [Feature] Open a pre-imported Ghidra project so import and auto-analysis can happen outside the startup deadline #1048 (a pre-imported Ghidra project) and the verify:ghidra lanes.
• [Feature] Integrate APK analysis tools into REA: research and roadmap #717 (Android): real APKs on JDK 21, and JDK 25 if that helps. I also have a real Android 14 tablet (arm64) with USB debugging on.
• [Feature] Modular native runtime instrumentation through a Frida adapter #968 (Frida) and [Feature] Website reverse engineering roadmap: network evidence, captured assets, and modular adapters #774 (websites): both run here.
• Add Electron shell and IPC instrumentation #64 (Electron): captures on Flathub apps. The docs don't mention Linux.

Not for this machine: Windows, macOS, iOS and Hopper.

All results so far (links only)

• kuna #1031, #1922, rsleigh #19, rsleigh #12, #1998, #2006
• #1986, #1977, #1925 follow-up, #1978, #1987, #1981, #1975, #1974
• [Bug] NE, LE and LX refusals give misleading "check the path" advice #1979: LE, LX and other formats, real files and the rest
• rsleigh: #17, #18, #15, #16, #14, #12, #13, #8, #7
• Discussion #1958, #1951
• #1949, #1941, #1954, #1952 note, #1939, #1919
• feat(ghidra): admit recordless legacy MIPS32 ELFs with a pinned 32-bit language #1898: float code, legacy MIPS32
• #1704 retest and #1359 retest
• #1925, #1887
• feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing #1582, three retests: newest, middle and first
• Also: #1700, #1708, #1715, #1722, #1705, #1719, #1720, #1711
• Also: #1698, #1706, #1704, #1703, #1686, #1707, #1650, #1048
• Also: #1357, #1661, #1668, #1673, #1670, #1669, #1476, #1356
• Also: #1657, #1667, #1666, #1658, #1659, #1665, #1664, #1662
• Also: #1447, #1494, #1620, #1600, #1566, #1608, #1611, #1612
• Also: #1610, #1583, #1065, #1389, #1387, #1417, #1363, #1645
• Also: #1642, #1635, #1629, #1649, #1441, #1607
• Amethyst Mod Manager (GPL-3.0-or-later), a look with REA and Ghidra at its two Rust libraries.
• The 6.4.0 npm smoke test: it installs and runs Ghidra on Node 22, 24 and 26. The MCP tool list grew from 139 tools to 170.

Test setup

• Box: Nobara 44 (Fedora 44 base), Linux 7.2.9
• CPU: AMD Ryzen 9 5900X, 12 cores / 24 threads
• RAM: 32 GB DDR4-3600
• Node: 22.23.1, 24.18.0, 26.11.1
• Ghidra: 12.1.4 (Apache-2.0)

🤖 Generated with Claude Code (Sonnet 5.5, verified by Opus 5.5) 🦊

[elkahtersidi]

سلام عليكم

[CassieFox23]

Moved: this benchmark now has its own page, REA startup benchmark. I update it there each release.

Latest: on Node 24, main (13e03e9) lists its tools in 1.47 s, 16 percent less than 6.4.0 (1.75 s).

🤖 Generated with Claude Code (Opus 5.5) 🦊