Field guide / Practical workflows

REA and Ghidra graphs with Dotdog

Use Dotdog to navigate saved native call relationships. SolidState/REA owns Ghidra analysis; Dotdog imports the evidence and answers bounded graph questions.

Try the public fixture Query a path Use your own analysis Interpret coverage

What each tool does

Tool	Responsibility
Ghidra through SolidState/REA	Select the target, analyze functions, produce native-call evidence and manage the analysis session.
Dotdog	Import a saved NativeCallGraph body, preserve provenance and query paths, context and impact.
You	Choose the correct artifact and producer direction, review coverage and decide which conclusions the evidence supports.

Dotdog is not another decompiler and never launches the analyzed binary. Importing a saved graph does not require a running Ghidra session.

1. Download a versioned, public export

The release fixture records a resolved call from _dotdog_validate to _dotdog_scale. Its original static-analysis check preserved the binary digest and did not execute it.

mkdir rea-guide
cd rea-guide
curl -fsSL https://raw.githubusercontent.com/specdog/dotdog/v1.0.0/examples/native/callgraph-ghidra.json -o native-calls.json
shasum -a 256 native-calls.json

The export SHA-256 must be 5fc1e4c996fa5608b4ea4fedb000c6be5b9afc0fe78bf79749e9553b863c7ad2. That identifies the JSON export, not the binary. The separate binary digest below belongs to the recorded build.

2. Import with explicit direction and identity

npx dotdog@1.0.0 graph import native-calls.json --format rea-callgraph --project native --rea-direction forward --artifact-sha256 472ee07be89864cb67ded8c7cd1de7f211bfdc34bb04968f417d4801c5e1b201

Expect two imported nodes and one edge in .doghouse/imported/native.dag. Use --rea-direction backward only for a backward producer request. The bare export does not encode direction, and guessing can reverse call meaning.

3. Ask a bounded graph question

npx dotdog@1.0.0 path '0x100000340' '0x100000328' --dag .doghouse/imported/native.dag --json
npx dotdog@1.0.0 context '0x100000340' --dag .doghouse/imported/native.dag --json
npx dotdog@1.0.0 impact '0x100000328' --dag .doghouse/imported/native.dag --json

The path is one caller → callee hop. Addresses and identities refer to this exact build, not every recompilation. Imported projects are also available through the existing dotdog serve stdio MCP server.

4. Bring your own saved REA analysis

Select a binary you are authorized to analyze and record its SHA-256.
Use your configured solidstate reverse workflow for Ghidra analysis. Select a function, direction and depth; save the returned NativeCallGraph body and the request settings.
Keep raw provider responses private until reviewed: they can contain local paths and unrelated evidence. An arbitrary REA Evidence envelope is not a supported import body.
Import the reviewed body with its actual direction and binary digest. If no binary digest is available, Dotdog scopes identities to export bytes and reports binary identity as unknown.
Check identifiers, coverage, unresolved/external calls and truncation before drawing conclusions. Re-import new evidence after changing the target or analysis.

For the configured-host Ghidra reproduction and recorded evidence, see the public native fixture. This guide does not install a provider or create a second REA integration.

What the graph does not prove

Ghidra exposes function and call-reference APIs, but the export's resolved references are not complete runtime behavior. Indirect calls, unresolved functions, thunks and external targets need explicit interpretation.

A bounded no_path means no connection was found in the supplied graph within the search bounds. It does not prove two procedures are independent. Preserve maxHops, truncated, coverage and limitations in any report.

There is no automatic source-to-binary join or requirement proof. Use explicit reviewed mappings if you connect native evidence to specs, source code or tests.