# OpenBSD netcat: static REA and Ghidra investigation

> A REA/Ghidra report studies the Ubuntu netcat-openbsd 1.234-1 ELF binary and publishes evidence envelopes, decompiled functions and a function inventory. Its output is a static investigation, rather than a rebuilt netcat application.

- Type: Case study
- Targets: Binary
- Category: Community REA investigations
- Relationship: Author-reported mixed workflow
- Sources reviewed: 2026-11-01
- Added to the catalog: 2026-11-01
- Original resource: <https://github.com/NullLabTests/OpenBSD_netcat_REA>
- Primary source: <https://github.com/NullLabTests/OpenBSD_netcat_REA/blob/cc1870d34e83bad0b8a6ca2489f6fa177efa6a2a/README.md>
- Catalog page: <https://awesomerea.org/resources/netcat-openbsd-rea-static-case/>
- Record JSON: <https://awesomerea.org/resources/netcat-openbsd-rea-static-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/netcat-openbsd-rea-static-case/index.md)

## Requirements & limits

- **Prerequisites:** Reproducing the documented analysis needs the target package binary, REA, Ghidra 12.1.x and JDK 21; the README records additional pwntools tooling.
- **Limits:** The author explicitly reports no target execution or dynamic analysis. Function roles remain inferred, and compiler inlining or hot/cold splitting obscures boundaries.
- **Scope:** Upstream netcat.c was consulted for function naming; recovered pseudocode is not an independently reconstructed or behaviorally validated program.
- **License:** Analysis and documentation use MIT; upstream BSD attribution is retained in NOTICE.

## Primary sources

1. <https://github.com/NullLabTests/OpenBSD_netcat_REA/blob/cc1870d34e83bad0b8a6ca2489f6fa177efa6a2a/README.md>

## More in Native binaries

- [m0rph: tracing an obfuscated ELF flag checker](https://awesomerea.org/resources/m0rph-ctf-analysis-case/index.md) · Case study
- [CPQ IO Scheduler: reconstructing Xiaomi's block scheduler](https://awesomerea.org/resources/cpq-iosched-case/index.md) · Case study
- [Malware Analysis: njRAT and Casdet behavior investigation](https://awesomerea.org/resources/malware-analysis-njrat-casdet-case/index.md) · Case study
- [Ghidra](https://awesomerea.org/resources/ghidra/index.md) · Tool
- [radare2](https://awesomerea.org/resources/radare2/index.md) · Tool
- [Cutter](https://awesomerea.org/resources/cutter/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.