04-reverse-engineering

Name: 04-reverse-engineering
Author: Masriyan

190stars37forks

How to install 04-reverse-engineering?

masriyan/claude-code-cybersecurity-skill/04-reverse-engineering

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 04-reverse-engineering

Installs into the current project.

Summary

Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering & Binary Analysis
2
3	## Purpose
4
5	Enable Claude to assist with reverse engineering tasks including binary analysis, assembly interpretation, decompilation, firmware reverse engineering, and protocol analysis. Claude directly reads and interprets disassembled code, identifies patterns, reconstructs logic, and helps navigate complex binaries using RE tool output.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Analyzing an ELF, PE (exe/dll), Mach-O, or raw binary
13	- Interpreting x86, x64, ARM, MIPS, or RISC-V assembly code
14	- Reverse engineering firmware from embedded/IoT devices
15	- Reverse engineering a network protocol
16	- Using Ghidra, IDA Pro, radare2, or Binary Ninja output
17	- Identifying what a binary or function does
18	- Finding vulnerabilities in disassembly
19	- CTF binary challenges (pwn, reversing categories)
20	- Anti-debugging or anti-analysis technique identification
21	- Unpacking or deobfuscating binaries
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install capstone pyelftools pefile lief
29	```
30
31	Recommended RE tools:
32	- `Ghidra` — NSA open-source RE framework (free)
33	- `radare2` / `Cutter` — Open-source RE framework
34	- `Binary Ninja` — Commercial RE platform with scripting
35	- `IDA Pro / Free` — Industry standard disassembler
36	- `GDB + GEF/PEDA/pwndbg` — Dynamic debugging
37	- `Binwalk` — Firmware extraction and analysis
38	- `strings, file, objdump, readelf` — Standard Linux utilities
39
40	---
41
42	## Core Capabilities
43
44	### 1. Initial Binary Triage
45
46	When the user provides a binary or asks what a file is:
47
48	Run these commands and share output with Claude for analysis:
49
50	```bash
51	# File type identification
52	file suspicious_binary
53
54	# Strings extraction (often reveals C2, keys, paths)
55	strings -a suspicious_binary \| grep -E "(http\|/etc\|password\|key\|secret\|flag)"
56
57	# ELF analysis
58	readelf -a suspicious_binary
59	objdump -d suspicious_binary \| head -100
60
61	# PE analysis
62	python scripts/binary_analyzer.py --file malware.exe --strings --imports
63
64	# Entropy analysis (high entropy = packed/encrypted)
65	python scripts/binary_analyzer.py --file binary --entropy
66	```
67
68	Binary Triage Checklist:
69	```
70	[ ] File type and format (magic bytes): ELF / PE / Mach-O / raw
71	[ ] Target architecture: x86 / x64 / ARM32 / ARM64 / MIPS / RISC-V
72	[ ] Endianness: little-endian / big-endian
73	[ ] Linking type: statically linked / dynamically linked
74	[ ] Security features: PIE / ASLR / NX/DEP / Stack Canary / RELRO
75	[ ] Packing detected: UPX / Themida / custom (high entropy sections)
76	[ ] Compiler identified: GCC / MSVC / Clang / Rust / Go
77	[ ] Interesting strings: URLs, IPs, credentials, file paths
78	[ ] Import/Export table: suspicious API calls
79	[ ] Entry point and sections mapping
80	```
81
82	Security feature detection:
83	```bash
84	# Linux: checksec (from pwntools)
85	checksec --file=./binary
86
87	# Or check manually:
88	readelf -l binary \| grep GNU_STACK # NX bit
89	readelf -d binary \| grep RELRO # RELRO
90	```
91
92	### 2. Assembly Code Interpretation
93
94	When the user pastes disassembled code or Ghidra decompilation:
95
96	Claude will:
97	1. Identify the architecture from instruction syntax
98	2. Trace execution flow from the provided entry point
99	3. Identify function calls (call/bl/jal instructions)
100	4. Reconstruct high-level logic from the assembly
101	5. Annotate each block with a comment explaining its purpose
102	6. Flag security-relevant patterns
103
104	Common x86-64 Patterns:
105
106	\| Pattern \| Instructions \| Meaning \|
107	\|---------\|--------------\|---------\|
108	\| Function prologue \| `push rbp; mov rbp, rsp; sub rsp, N` \| Stack frame setup \|
109	\| Function epilogue \| `leave; ret` or `pop rbp; ret` \| Stack frame teardown \|
110	\| Local variable \| `mov [rbp-N], rax` \| Store value on stack \|
111	\| Loop counter \| `cmp rax, N; jl/jge loop_top` \| Loop with counter \|
112	\| Buffer on stack \| `sub rsp, 0x100` \| 256-byte local buffer \|
113	\| String copy \| `rep movsb` \| Memory copy \|
114	\| Memset \| `rep stosb` \| Memory zero/fill \|
115	\| Switch-case \| Indirect jump: `jmp [rax*8 + table]` \| Jump table \|
116	\| System call (Linux) \| `mov rax, N; syscall` \| Direct system call \|
117	\| Printf/format string \| `lea rdi, [rip+str]; call printf@plt` \| Print statement \|
118	\| Heap allocation \| `call malloc` / `call operator new` \| Dynamic memory \|
119
120	Common ARM64 Patterns:
121	\| Pattern \| Instructions \| Meaning \|
122	\|---------\|--------------\|---------\|
123	\| Function prologue \| `stp x29, x30, [sp, #-N]!` \| Save frame pointer & LR \|
124	\| Return \| `ret` (uses x30) \| Return from function \|
125	\| Load/store pair \| `ldp/stp` \| Load/store two registers \|
126	\| Branch + link \| `bl func` \| Call function \|
127	\| Conditional branch \| `b.eq / b.ne / b.lt` \| Conditional jump \|
128	\| System call \| `svc #0` \| System call \|
129
130	Crypto constant detection:
131	```python
132	# Common crypt

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

04-reverse-engineering

190stars37forks

View on GitHub

How to install 04-reverse-engineering?

masriyan/claude-code-cybersecurity-skill/04-reverse-engineering

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 04-reverse-engineering

Installs into the current project.

Summary

Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering & Binary Analysis
2
3	## Purpose
4
5	Enable Claude to assist with reverse engineering tasks including binary analysis, assembly interpretation, decompilation, firmware reverse engineering, and protocol analysis. Claude directly reads and interprets disassembled code, identifies patterns, reconstructs logic, and helps navigate complex binaries using RE tool output.
6
7	---
8
9	## Activation Triggers
10
11	This skill activates when the user asks about:
12	- Analyzing an ELF, PE (exe/dll), Mach-O, or raw binary
13	- Interpreting x86, x64, ARM, MIPS, or RISC-V assembly code
14	- Reverse engineering firmware from embedded/IoT devices
15	- Reverse engineering a network protocol
16	- Using Ghidra, IDA Pro, radare2, or Binary Ninja output
17	- Identifying what a binary or function does
18	- Finding vulnerabilities in disassembly
19	- CTF binary challenges (pwn, reversing categories)
20	- Anti-debugging or anti-analysis technique identification
21	- Unpacking or deobfuscating binaries
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install capstone pyelftools pefile lief
29	```
30
31	Recommended RE tools:
32	- `Ghidra` — NSA open-source RE framework (free)
33	- `radare2` / `Cutter` — Open-source RE framework
34	- `Binary Ninja` — Commercial RE platform with scripting
35	- `IDA Pro / Free` — Industry standard disassembler
36	- `GDB + GEF/PEDA/pwndbg` — Dynamic debugging
37	- `Binwalk` — Firmware extraction and analysis
38	- `strings, file, objdump, readelf` — Standard Linux utilities
39
40	---
41
42	## Core Capabilities
43
44	### 1. Initial Binary Triage
45
46	When the user provides a binary or asks what a file is:
47
48	Run these commands and share output with Claude for analysis:
49
50	```bash
51	# File type identification
52	file suspicious_binary
53
54	# Strings extraction (often reveals C2, keys, paths)
55	strings -a suspicious_binary \| grep -E "(http\|/etc\|password\|key\|secret\|flag)"
56
57	# ELF analysis
58	readelf -a suspicious_binary
59	objdump -d suspicious_binary \| head -100
60
61	# PE analysis
62	python scripts/binary_analyzer.py --file malware.exe --strings --imports
63
64	# Entropy analysis (high entropy = packed/encrypted)
65	python scripts/binary_analyzer.py --file binary --entropy
66	```
67
68	Binary Triage Checklist:
69	```
70	[ ] File type and format (magic bytes): ELF / PE / Mach-O / raw
71	[ ] Target architecture: x86 / x64 / ARM32 / ARM64 / MIPS / RISC-V
72	[ ] Endianness: little-endian / big-endian
73	[ ] Linking type: statically linked / dynamically linked
74	[ ] Security features: PIE / ASLR / NX/DEP / Stack Canary / RELRO
75	[ ] Packing detected: UPX / Themida / custom (high entropy sections)
76	[ ] Compiler identified: GCC / MSVC / Clang / Rust / Go
77	[ ] Interesting strings: URLs, IPs, credentials, file paths
78	[ ] Import/Export table: suspicious API calls
79	[ ] Entry point and sections mapping
80	```
81
82	Security feature detection:
83	```bash
84	# Linux: checksec (from pwntools)
85	checksec --file=./binary
86
87	# Or check manually:
88	readelf -l binary \| grep GNU_STACK # NX bit
89	readelf -d binary \| grep RELRO # RELRO
90	```
91
92	### 2. Assembly Code Interpretation
93
94	When the user pastes disassembled code or Ghidra decompilation:
95
96	Claude will:
97	1. Identify the architecture from instruction syntax
98	2. Trace execution flow from the provided entry point
99	3. Identify function calls (call/bl/jal instructions)
100	4. Reconstruct high-level logic from the assembly
101	5. Annotate each block with a comment explaining its purpose
102	6. Flag security-relevant patterns
103
104	Common x86-64 Patterns:
105
106	\| Pattern \| Instructions \| Meaning \|
107	\|---------\|--------------\|---------\|
108	\| Function prologue \| `push rbp; mov rbp, rsp; sub rsp, N` \| Stack frame setup \|
109	\| Function epilogue \| `leave; ret` or `pop rbp; ret` \| Stack frame teardown \|
110	\| Local variable \| `mov [rbp-N], rax` \| Store value on stack \|
111	\| Loop counter \| `cmp rax, N; jl/jge loop_top` \| Loop with counter \|
112	\| Buffer on stack \| `sub rsp, 0x100` \| 256-byte local buffer \|
113	\| String copy \| `rep movsb` \| Memory copy \|
114	\| Memset \| `rep stosb` \| Memory zero/fill \|
115	\| Switch-case \| Indirect jump: `jmp [rax*8 + table]` \| Jump table \|
116	\| System call (Linux) \| `mov rax, N; syscall` \| Direct system call \|
117	\| Printf/format string \| `lea rdi, [rip+str]; call printf@plt` \| Print statement \|
118	\| Heap allocation \| `call malloc` / `call operator new` \| Dynamic memory \|
119
120	Common ARM64 Patterns:
121	\| Pattern \| Instructions \| Meaning \|
122	\|---------\|--------------\|---------\|
123	\| Function prologue \| `stp x29, x30, [sp, #-N]!` \| Save frame pointer & LR \|
124	\| Return \| `ret` (uses x30) \| Return from function \|
125	\| Load/store pair \| `ldp/stp` \| Load/store two registers \|
126	\| Branch + link \| `bl func` \| Call function \|
127	\| Conditional branch \| `b.eq / b.ne / b.lt` \| Conditional jump \|
128	\| System call \| `svc #0` \| System call \|
129
130	Crypto constant detection:
131	```python
132	# Common crypt

People who liked this also viewed

6 picks

Type