Glossary
Every term we use, in one place. $ grep away.
A
- Agent
- An AI system that plans and chains tool calls (disassemble, decompile, search) to answer a question about a binary.
B
- Binary
- A compiled executable — machine code plus metadata, the artifact reverse engineers study.
C
- Cross-reference (xref)
- A record of every place a symbol, string, or address is referenced. The primary navigation map in RE.
D
- Decompiler
- A tool converting machine code back into readable pseudo-source. Ghidra ships one; quality varies by architecture.
- Disassembly
- Translating machine code into assembly mnemonics. The raw listing every analysis starts from.
- Disassembler
- The tool producing disassembly: Ghidra, Binary Ninja, Hopper, objdump…
- DRM
- Digital Rights Management — technical protection on media/software. Circumventing it is unlawful in many jurisdictions regardless of intent.
- Dynamic analysis
- Studying a program by running it under observation (debugger, tracer).
E
- ELF
- Executable and Linkable Format — the binary format on Linux. PE is the Windows counterpart.
- Entry point
- Where execution begins. Finding main() or the real start orients the whole analysis.
- Evidence contract
- REA design: every result carries a content-addressed evidence ID, subject sha256, and provider versions — auditable by construction.
F
- Fail-closed
- Refusing an operation with a precise diagnosis when prerequisites (e.g. an analysis engine) are missing, instead of guessing.
G
- Ghidra
- Open-source disassembler/decompiler suite from NSA, widely used in security research.
- Ghidra MCP
- A bridge exposing Ghidra operations over the Model Context Protocol so AI agents can drive it.
J
- JADX
- Open-source decompiler for Android dex/APK files.
L
- Lawful use
- Analyzing only software you own or are licensed to inspect: open source, official demos, authorized targets.
M
- MCP
- Model Context Protocol — an open standard letting AI applications connect to external tools like disassemblers.
P
- PE
- Portable Executable — the Windows binary format (.exe/.dll).
- pwntools-elf
- REA's free pure-Python analysis provider (pwntools + pyelftools + unicorn); covers ELF layout inspection without Ghidra/Hopper/IDA.
R
- REA
- ReverseEngineeringAgent — an open-source CLI/MCP agent that orchestrates binary analysis with an evidence contract.
S
- Static analysis
- Studying a binary without executing it.
- Strip
- Removing the symbol table from a binary. Labels vanish; code and constants remain — anchor constants still work.
- Symbol
- A name attached to an address (function, variable). Present in unstripped binaries; gold for readability.
- System V ABI
- The x86-64 calling convention on Linux: first integer argument travels in rdi/edi, return value in rax.
X
- x86-64
- The 64-bit instruction architecture on most desktops; the assembly you will most often read.