reverse-engineering

Name: reverse-engineering
Author: hypnguyen1209

320stars55forks

How to install reverse-engineering?

hypnguyen1209/offensive-claude/reverse-engineering

$npx -y skills add hypnguyen1209/offensive-claude --skill reverse-engineering

Installs into the current project.

Summary

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering
2
3	## When to Activate
4
5	- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
6	- Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
7	- Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
8	- Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
9	- Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
10	- Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
11	- Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.
12
13	## Technique Map
14
15	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
16	\|-----------\|--------\|-----\|-----------\|--------\|
17	\| Binary triage (format/arch/mitigations/strings/imports) \| T1592.002, T1518.001 \| CWE-1395 \| references/static-triage-decompilation.md \| scripts/triage.py \|
18	\| Headless decompilation (Ghidra 11.4 / r2 / IDA) \| T1592.002 \| CWE-noinfo \| references/static-triage-decompilation.md \| scripts/triage.py \|
19	\| AI/MCP-assisted RE (Sidekick / GhidrAssistMCP / LLM4Decompile) \| T1592.002 \| CWE-noinfo \| references/static-triage-decompilation.md \| - \|
20	\| Dynamic debugging (GDB/GEF, x64dbg, conditional bps) \| T1622 \| CWE-noinfo \| references/dynamic-instrumentation.md \| - \|
21	\| Frida 17 instrumentation + SSL-pin/JNI hooking \| T1622, T1562.001 \| CWE-noinfo \| references/dynamic-instrumentation.md \| scripts/frida_universal.js \|
22	\| Symbolic / concolic execution (angr, Triton) \| T1480.001 \| CWE-noinfo \| references/dynamic-instrumentation.md \| scripts/deflatten_triton.py \|
23	\| Anti-debug detection & bypass (PEB/ptrace/HW-bp/timing) \| T1622, T1497.001 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
24	\| Anti-VM / sandbox-evasion neutralization \| T1497, T1497.003 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
25	\| Packer unpack → OEP dump (UPX/runtime packers) \| T1027.002, T1620 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
26	\| String / API-hash deobfuscation (Unicorn emulation) \| T1027.013, T1140, T1027.007 \| CWE-noinfo \| references/deobfuscation.md \| scripts/string_decrypt_emu.py \|
27	\| OLLVM control-flow-flattening de-flattening \| T1027.009, T1027 \| CWE-noinfo \| references/deobfuscation.md \| scripts/deflatten_triton.py \|
28	\| VM-protector devirtualization (VMProtect 3.x / Themida) \| T1027.009 \| CWE-noinfo \| references/deobfuscation.md \| scripts/deflatten_triton.py \|
29	\| Firmware extraction (binwalk/squashfs/QEMU emulation) \| T1542.001 \| CWE-1263 \| references/firmware-uefi.md \| scripts/uefi_triage.py \|
30	\| UEFI/BIOS RE + Secure Boot bypass research \| T1542.001, T1542.003 \| CWE-347 \| references/firmware-uefi.md \| scripts/uefi_triage.py \|
31	\| Patch diffing → n-day root cause (BinDiff/Diaphora/ghidriff) \| T1203, T1592.002 \| CWE-noinfo \| references/patch-diffing-protocol.md \| scripts/patchdiff_fetch.py \|
32	\| Protocol / file-format inference (Netzob/Kaitai) \| T1592

People who liked this also viewed

6 picks

Type

reverse-engineering

320stars55forks

View on GitHub

How to install reverse-engineering?

hypnguyen1209/offensive-claude/reverse-engineering

$npx -y skills add hypnguyen1209/offensive-claude --skill reverse-engineering

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering
2
3	## When to Activate
4
5	- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
6	- Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
7	- Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
8	- Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
9	- Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
10	- Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
11	- Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.
12
13	## Technique Map
14
15	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
16	\|-----------\|--------\|-----\|-----------\|--------\|
17	\| Binary triage (format/arch/mitigations/strings/imports) \| T1592.002, T1518.001 \| CWE-1395 \| references/static-triage-decompilation.md \| scripts/triage.py \|
18	\| Headless decompilation (Ghidra 11.4 / r2 / IDA) \| T1592.002 \| CWE-noinfo \| references/static-triage-decompilation.md \| scripts/triage.py \|
19	\| AI/MCP-assisted RE (Sidekick / GhidrAssistMCP / LLM4Decompile) \| T1592.002 \| CWE-noinfo \| references/static-triage-decompilation.md \| - \|
20	\| Dynamic debugging (GDB/GEF, x64dbg, conditional bps) \| T1622 \| CWE-noinfo \| references/dynamic-instrumentation.md \| - \|
21	\| Frida 17 instrumentation + SSL-pin/JNI hooking \| T1622, T1562.001 \| CWE-noinfo \| references/dynamic-instrumentation.md \| scripts/frida_universal.js \|
22	\| Symbolic / concolic execution (angr, Triton) \| T1480.001 \| CWE-noinfo \| references/dynamic-instrumentation.md \| scripts/deflatten_triton.py \|
23	\| Anti-debug detection & bypass (PEB/ptrace/HW-bp/timing) \| T1622, T1497.001 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
24	\| Anti-VM / sandbox-evasion neutralization \| T1497, T1497.003 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
25	\| Packer unpack → OEP dump (UPX/runtime packers) \| T1027.002, T1620 \| CWE-noinfo \| references/anti-reversing-bypass.md \| scripts/antidebug_unhook.py \|
26	\| String / API-hash deobfuscation (Unicorn emulation) \| T1027.013, T1140, T1027.007 \| CWE-noinfo \| references/deobfuscation.md \| scripts/string_decrypt_emu.py \|
27	\| OLLVM control-flow-flattening de-flattening \| T1027.009, T1027 \| CWE-noinfo \| references/deobfuscation.md \| scripts/deflatten_triton.py \|
28	\| VM-protector devirtualization (VMProtect 3.x / Themida) \| T1027.009 \| CWE-noinfo \| references/deobfuscation.md \| scripts/deflatten_triton.py \|
29	\| Firmware extraction (binwalk/squashfs/QEMU emulation) \| T1542.001 \| CWE-1263 \| references/firmware-uefi.md \| scripts/uefi_triage.py \|
30	\| UEFI/BIOS RE + Secure Boot bypass research \| T1542.001, T1542.003 \| CWE-347 \| references/firmware-uefi.md \| scripts/uefi_triage.py \|
31	\| Patch diffing → n-day root cause (BinDiff/Diaphora/ghidriff) \| T1203, T1592.002 \| CWE-noinfo \| references/patch-diffing-protocol.md \| scripts/patchdiff_fetch.py \|
32	\| Protocol / file-format inference (Netzob/Kaitai) \| T1592

People who liked this also viewed

6 picks

Type