sgi-indy/docs/rea-setup.md

REA setup used for this project

REA is the reverse-engineering MCP server and CLI used to analyze the Indy PROM. This note records the exact environment so the analysis can be reproduced.

Installed components

Component	Version	Location
Node.js	22.23.4	/opt/node-v22.23.4 (node, npm, npx symlinked into /usr/local/bin)
REA	6.8.0	global npm install; rea in /usr/local/bin
Ghidra	12.1.2	/opt/ghidra
JDK	OpenJDK 21.0.13	/usr/lib/jvm/java-21-openjdk-amd64

REA requires Node ^22.23.4 || ^24.22.1 || >=26.12.1. Debian 13 ships Node 20.19, so the official Node 22 tarball was installed under /opt instead of the distribution package.

Registration

The setup was applied for OpenCode only:

export GHIDRA_INSTALL_DIR=/opt/ghidra
export JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64

rea setup --client opencode --dry-run --json   # reviewed plan
rea setup --client opencode --yes

The plan had two actions and no provider installation:

• update /home/arti/.config/opencode/opencode.json with an MCP server entry whose launcher is /usr/local/bin/rea mcp;
• install the bundled reverse-engineer-anything skill under ~/.agents/skills/reverse-engineer-anything.

Setup preserved the existing kagi MCP entry and wrote opencode.json.rea.backup. OpenCode must be restarted before the MCP server is available in a session; the CLI (rea ...) works immediately.

rea doctor after setup reports the Ghidra provider as available with GHIDRA_INSTALL_DIR=/opt/ghidra.

The machine's SSH key is not authorized on the Gitea host, so the git remote uses HTTPS with the configured tea credential helper:

https://git.wut.ee/opencode.energia.arti.ee/sgi-indy.git

The MIPS problem

REA 6.8.0's --target-format raw-binary lane accepts x86, x86_64, arm, arm64, 6502 and m68k only. There is no raw MIPS architecture. MIPS is supported through the Ghidra ELF lane (docs/ghidra-mips.md upstream).

The Indy PROM is a headerless 512 KiB dump, so the analysis uses tools/make-elf-wrapper.py to build a load-image-only ELF32 big-endian MIPS file:

• e_type = ET_EXEC, e_machine = EM_MIPS;
• e_flags = 0x50000000 (EF_MIPS_ARCH_32, no ABI bits);
• no PT_MIPS_ABIFLAGS record;
• one PT_LOAD mapping file offset 0x1000 to virtual address 0x1FC00000;
• entry point 0x1FC00000.

That combination hits REA's "recordless legacy" admission. REA records that o32 is an analysis assumption, not a declared ABI fact, and pins Ghidra to MIPS:BE:32:default. The import log confirms:

Using Language/Compiler: MIPS:BE:32:default:default

What was collected

The MCP session performed:

• binary_overview (segments, counts);
• list_procedures (1,074 functions);
• list_strings (1,418 defined strings);
• batch_decompile of the reset path, main entry and exception handlers;
• read_function_instructions for the reset handler and a cache/HPC3 stub;
• export_evidence_bundle to evidence/rea-bundle.json.

The bundle is a local, git-ignored artifact. tools/rom-map.py reads it to produce the checked-in JSON map and CSV function index.