Case study
OpenBSD netcat: static REA and Ghidra investigation
A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. Its output is a static investigation, rather than a rebuilt netcat application.
- Targets
- Binary
- Category
- Community REA investigations
- Relationship
- Author-reported mixed workflow
- Sources reviewed
Requirements & limits
- Prerequisites: Reproducing the documented analysis needs the target package binary, REA, Ghidra 12.1.x and JDK 21; the README records additional pwntools tooling.
- Limits: The author explicitly reports no target execution or dynamic analysis. Function roles remain inferred, and compiler inlining or hot/cold splitting obscures boundaries.
- Scope: Upstream netcat.c was consulted for function naming; recovered pseudocode is not an independently reconstructed or behaviorally validated program.
- License: Analysis and documentation use MIT; upstream BSD attribution is retained in NOTICE.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · NullLabTests/OpenBSD_netcat_REA · Revision cc1870d
More in Native binaries
- m0rph: tracing an obfuscated ELF flag checker · Case study
- CPQ IO Scheduler: reconstructing Xiaomi's block scheduler · Case study
- Malware Analysis: njRAT and Casdet behavior investigation · Case study
- Ghidra · Tool
- radare2 · Tool
- Cutter · Tool
All 269 entries in Native binariesNative binaries case studies (7)