case-study 2026-10-12 case-studywindowsghidralabauthorizedevidence

rea-lab: Windows REA × Ghidra verification lab

Windows is where REA×Ghidra setups fail silently. **rea-lab** turns verification into a teachable repo: get `doctor --provider ghidra` green, register MCP per project, then work seeded challenges — not arbitrary commercial binaries.

Source meta

1 GitHub stars (snapshot)

Language: TypeScript

License: MIT

Updated: 2026-10-11

GitHub source ↗

rea.run rating

5/5 — Windows verification lab

Quality. Pins rea-agents 6.4.0 + Ghidra 12.1.4; doctor-green narrative; portable per-project MCP.

Evidence. Seeded challenges + writeups (WinHelloCPP / Wallace / own XOR); benchmark harness intent.

Limits. Spanish-first README; targets limited to exercises / own builds / allowed crackmes.

For. Windows builders verifying REA×Ghidra before real authorized work.

What it is. A MIT (+ CC-BY text) TypeScript lab by @pablodiazjorge created 2026-10-11. It pins rea-agents 6.4.0 and Ghidra 12.1.4, with a Spanish README that still maps cleanly to English ops: verify → measure → visualize.

Why it matters for operators. Community Windows wiring often dies at JAVA_HOME / GHIDRA_INSTALL_DIR / cold-start. This lab’s narrative is doctor-green first, then portable per-project MCP registration so agents do not inherit a broken global config.

Workflow you can copy. (1) Install Ghidra + JDK outside REA. (2) Export absolute paths; run doctor --provider ghidra --json. (3) Register MCP for the project. (4) Analyze only seeded challenges / own builds / allowed crackmes (WinHelloCPP, Wallace, own XOR writeups). (5) Optional benchmark harness for timing — not a crack leaderboard.

Related on rea.run. Deepen wiring with /docs/windows-ghidra/. For 6.4.0 deltas (ADB, compact schema, Evidence views) see /blog/rea-agents-6-4-0/. Prefer Codespaces/Actions labs when you want a disposable shell without Windows.

How to try (authorized lab only). (1) Clone the repo; read MIT/CC-BY notices. (2) Install Ghidra 12.1.4 + JDK outside REA. (3) Pin [email protected] as the lab documents. (4) Export absolute paths; run doctor --provider ghidra --json until green. (5) Register MCP per-project. (6) Work only seeded challenges / own builds / allowed crackmes — never employer binaries.

Limits table (narrative). Doctor-green ≠ license to analyze arbitrary PE; Spanish-first README may need translation aids; benchmark harness is timing intent, not a crack leaderboard; stars snapshot was 1 on 2026-10-12 fetch.

Compliance

Static-first lab: Ghidra exercises, own builds, allowed crackmes/CTF only — no commercial/employer binaries. Mirror ADR target policy.

Takeaways

Doctor-green before agent demos.
Per-project MCP beats a polluted global registration.
Lab targets stay exercises / own / allowed CTF — never employer binaries.

Related on rea.run