---
title: Native Binary Analysis — REA
url: https://rea.tools/guides/native/
---

[Home](https://rea.tools/) / [Guides](https://rea.tools/guides/) / Native analysis

# Recover DX-Ball's sound-pan calculation.

Inspect the original instructions, identify the input and constants,
then check the recovered C.

## Calculate left/right sound panning

In DX-Ball, a brick hit supplies a horizontal screen position. The
sound code turns it into a left/right panning value.

The starting function, `0x00406400`, has a short
decompiler result: a call to `__ftol()`. REA also
returns its instructions and callers, which give the agent a way
to investigate the missing arithmetic.

New to these terms?

- **Instructions:** the steps the processor runs,
  shown in readable form such as `MOV` or
  `ADD`.
- **Decompiler result / pseudocode:** an analysis
  tool's attempt to turn instructions back into C-like code. It
  can miss parts, as in this example.
- **Caller:** a function that calls this one. It
  shows which values are passed in.
- **Address:** a location in the program, written
  in hexadecimal, such as `0x00406400`.
- **Constants:** fixed numbers stored in the
  program, read as raw bytes and decoded.


Three pieces of evidence, one calculation

1. 01 · Instructions

   An integer input

   A stack read supplies the value used by the floating-point
   instructions.
2. 02 · Caller

   A screen coordinate

   The brick-hit caller passes
   `20 + 30 × tile_x`.
3. 03 · Data bytes

   The numeric constants

   Referenced bytes decode to `1.5625`,
   `500.0` and a scale value.

`pan = (x × 1.5625 − 500.0) × scale`

REA supplies the instructions, call relationship and bytes. The
agent interprets them together.

## Ask about the behavior

After
[connecting REA to your agent](https://rea.tools/get-started/#agent)
and
[setting up a native analysis tool](https://rea.tools/get-started/#native), provide the local executable and a question:

Which analysis tool should I use?

REA needs one of these to read native programs:

- **Hopper** (macOS or Linux): REA's setup detects
  it or offers to install it. On macOS, open Hopper once and
  choose demo mode or activate a license before your first
  analysis. Automated Linux setup requires x86_64; use Ghidra on
  Linux arm64.
- **Ghidra** (macOS or Linux; experimental on
  Windows): free, but needs an existing Ghidra 12.1.x
  installation and a 64-bit JDK 21 or newer.
- **IDA** (Windows; macOS arm64 headless): use an
  existing IDA setup with an MCP registration. The macOS
  headless profile requires a source build or a release that
  includes it.

See
[Set up native analysis](https://rea.tools/get-started/#native)
for the steps.

Your coding agent

Use REA to find how DX-Ball calculates sound panning. Explain
the calculation and show the code.

Example prompt. Give your agent the path to your local DX-Ball
1.07 executable. REA doesn't include DX-Ball, so use your own
copy, or ask the same kind of question about another small Windows
program you have.

How do I get a file's full path?

- **Windows:** in File Explorer, right-click the
  file and choose *Copy as path*. On Windows 10, hold
  Shift while right-clicking.
- **macOS:** in Finder, right-click the file, hold
  Option and choose *Copy "…" as Pathname*.
- **Any system:** drag the file into a terminal
  window and its path appears.

## Read the REA results

### Read the input

REA instruction excerpt · 0x406409

```
MOV EAX, dword ptr [EBP + 0x8]
MOV dword ptr [EBP + -0xc], EAX
FILD dword ptr [EBP + -0xc]
```

The instructions load an integer argument and convert it for
floating-point arithmetic. This is the input absent from the first
pseudocode view.

### Follow the caller

REA caller excerpt · 0x411f5b

```
ADD EAX, 0x14
PUSH EAX
CALL 0x00406400
```

REA identifies the brick-hit caller. Its earlier instructions
multiply the tile coordinate by 30; adding `0x14` (20)
gives the brick's screen position.

### Read the referenced constants

REA byte results · interpreted as little-endian doubles

```
0x420068  000000000000f93f  → 1.5625
0x420070  0000000000407f40  → 500.0
0x4210a0  000000000000f03f  → 1.0
```

The arithmetic references these addresses. Reading the bytes
supplies the actual values; the instruction order tells the agent
how they are used.

## Write and check the recovered function

Recovered C · excerpt

```
pan = (double)x;
pan = pan * 1.5625;
pan = pan - 500.0;
pan = pan * dxball_pan_scale;
return (DxBallInt)pan;
```

With a scale of 1.0, screen positions 0, 320 and 640 map to −500,
0 and 500 before integer conversion. The calculation puts the
center of the screen at the center of the stereo field.

The agent used REA's findings to write the C. Separate checks
compared 3,205 inputs against the original x86 function and
reproduced all 63 compiled bytes of the complete function.

[See the full investigation and assembly-to-C comparison](https://rea.tools/showcase/dx-ball/#sound-pan)

## Try it with your own binary

[Connect a native analysis provider](https://rea.tools/get-started/#native), then give your agent a local executable or library and a
feature to investigate. Useful starting questions include “How is
this file parsed?” or “Which function handles this menu action?”

If you already know a function name or address, you can query it
from the terminal. For a configured Ghidra installation:

Function analysis

```
npx -y rea-agents@latest function /absolute/path/to/program main \
  --provider ghidra --json
```

Replace the target path and `main` with your own
function name or address. Each CLI invocation imports and analyzes
the binary, then closes its session. Your agent's MCP queries
reuse the imported binary while that session is open.

Read the pseudocode alongside instructions and references. When a
result leaves a call or value unresolved, use that location as the
next question.