One free engine, three targets

The setup guide lit up REA's zero-cost engine on one target. This lesson runs the same provider — pwntools-elf, the pwntools-elf engine — across three very different binaries, so you can see what "ELF layout analysis" actually covers: your own build, a stripped build, and a 4.5MB system library. Every output below is from our lab machine, run 2026-10-12.

Prerequisites: finish setup steps 4 (the pwntools venv + REA_PWNTOOLS_PYTHON variable). Nothing else needed for pwntools-elf — no Ghidra, no paid tools.

pwntools-elf target 01 — your own build (unstripped)

The hello-world ELF from lesson 2. Its layout result can be cross-checked against manual readelf output — that is the whole point:

$ npx rea inspect-binary-layout /root/projects/realearn/lab-env/hello
evidence_id: ev_6e479c83fba06374c38ab8f9fa3876e561d28d3515aa68473598e9f94dcb556c
subject: hello / sha256 36cdabb6…4207352 / elf / x86_64
provider: pwntools-elf @ pwntools 4.15.0;pyelftools 0.33;unicorn 2.1.2
normalized_result: 31 sections, entry_point 0x400320
(与 lab 01 手工 readelf 结果一致 —— 交叉验证通过)

Read the evidence contract line by line: a content-addressed evidence_id, the exact bytes analyzed (sha256), the provider and its three pinned library versions, and a normalized pwntools-elf result your own binutils can confirm.

pwntools-elf target 02 — the stripped build

Same source, symbol table deleted (lesson 3). Layout analysis does not care about names — sections and segments are structural:

$ npx rea inspect-binary-layout /root/projects/realearn/lab-env/hello-stripped
evidence_id: ev_a2ba32af…
subject: hello-stripped / sha256 7dda4d05…

Different evidence ID, different sha256 — the tool is hashing what it actually read, not what it expects. That is the pwntools-elf audit trail working.

pwntools-elf target 03 — a 4.5MB system library

OpenSSL's libcrypto (lesson 1's target), via the CLI with JSON output:

$ npx rea inspect-binary-layout /usr/lib64/libcrypto.so.3.0.12 --format json
evidence_id: ev_424ee8d3…
normalized_result: 30 sections / 11 segments
(MCP 通道同目标: resource_constraint —— 不截断，提示改走 evidence bundle)

Note the last line: over the MCP channel, this large result is refused with resource_constraint rather than silently truncated, with a pointer to the evidence-bundle path. pwntools-elf fail-closed applies to output size too.

what the pwntools-elf engine is — and is not

Three pwntools-elf targets in, the boundary is concrete: pwntools-elf covers ELF layout inspection (sections, segments, entry point) plus the full evidence lifecycle — everything in this track. analyze and decompile stay fail-closed without Ghidra/Hopper/IDA: forcing the free provider explicitly returns capability_unavailable ("Choose one of: ghidra, hopper, ida"). We show that refusal, verbatim, in setup step 6.

Where to next: the tools hub lays out what the paid engines add — or continue with the boundary lesson to see exactly where the free tier ends, and why that is a feature.