Where the free engine ends — and why that is the lesson

Most tool tutorials hide the boundaries. This one is about the boundary, because REA's behavior at its limit is the best introduction to its design — and to judging agent decompile claims in general.

analyze vs decompile: the vocabulary first

• Layout inspection — reading the ELF's structure: sections, segments, entry point, symbols. No code is interpreted. REA's free pwntools-elf provider does this.
• Analysis (analyze) — interpreting code: building function boundaries, following calls, summarizing what a routine does — no decompile involved.
• Decompilation (decompile) — lifting machine code back toward pseudo-source. The heaviest operation — decompile — requiring a full decompiler engine (Ghidra, Hopper, or IDA).

what happens when you ask decompile anyway

Run decompile and the refusal is explicit — no plausible substitute, just a diagnosis. with no engine installed. A silent tool would guess, or hang, or return garbage. REA refuses — precisely:

$ npx rea analyze ./hello
error: Analysis failed
code: provider_unavailable
candidate_ids[3]: ghidra,hopper,ida
rejections[3]: ghidra(not_configured) / hopper(executable_missing) / ida(not_configured)

Read that rejection list carefully — it is per-candidate and per-reason. Ghidra is not configured; Hopper's executable is missing; IDA is not registered. Three different problems, three different fixes, all named. When we forced the free provider explicitly (--provider pwntools-elf), the answer was capability_unavailable: "The requested analysis provider is unknown. Choose one of: ghidra, hopper, ida."

And it is not just the CLI. Over MCP, asking for a result too large to return produced resource_constraint — with a redirect to the evidence bundle, not a truncated answer. The pattern generalizes: when REA cannot produce evidence, it says so instead of producing a plausible substitute.

why the decompile engine gap is stated so precisely

REA does not decompile anything itself — no decompile engine ships in the free tier. It is an orchestration layer: it drives engines you install and license. That is why its failures are configuration failures, not analysis failures — and why the fix is always "install/configure the engine", never "wait for a better model". Our own lab proved this the direct way: without Ghidra, deep analysis stayed closed (this lesson); with the free pwntools engine, layout analysis ran fully (previous lesson).

the transferable skill: auditing decompile claims

Whatever decompile-capable agent tool you use next, ask the three questions this lesson teaches:

1. What does it do when it cannot know? (Guess = red flag. Refuse-with-diagnosis = green.)
2. Can you trace a claim to evidence? (Content-addressed IDs + input hashes beat "trust me".)
3. Are the boundaries documented or discovered? (We hit REA's boundary by running it — and the refusal message documented it for us.)

That is the end of the beginners track. From here: wire REA to your agent, or compare the engines that unlock the decompile engine tier.

$ subscribe --to=realearn

One email per new lab-verified guide. No spam, unsubscribe anytime.

subscribe ↵