REA and analysis engines
REA comes with Synoec: there is nothing to install or connect. Each
new investigation’s first thread starts it and reports which analysis engines
are ready. Lysis finds Ghidra and a Java runtime in the usual places on its own
(Homebrew, Applications, your home folder). If one is missing, the agent says
so and offers to install it; nothing is installed unless you agree. To use a
different copy, set it with synoec lysis engines (see below).
| Engine | Needed for |
|---|---|
| Ghidra (with a Java home) | Native decompilation |
| Hopper | Native decompilation |
| IDA | Native decompilation, when installed and reported by REA |
| JADX engine JAR (with a JDK) | Static Android APK analysis |
Engines are installed separately under their own licenses. Which engines are actually available comes from REA’s live session; the first thread reports it.
REA labels each of its tools, and Lysis follows those labels. Read-only tools run without asking. Tools that only record evidence in REA’s session ask like an edit under Strict and run without asking under Approve for me. Tools that launch programs, use the network or can discard data always ask, one tool at a time.