reverse-engineering

Name: reverse-engineering
Author: transilienceai

423stars74forks

How to install reverse-engineering?

transilienceai/communitytools/reverse-engineering

$npx -y skills add transilienceai/communitytools --skill reverse-engineering

Installs into the current project.

Summary

Static and dynamic reverse engineering — ELF/PE analysis, custom-VM bytecode, packed binaries, anti-debug bypass, Frida hooking.

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering
2
3	## Scope
4
5	Reverse engineering compiled binaries (ELF, PE, Mach-O) and bytecode artifacts to recover algorithms, validate inputs, or build static solvers. Focused on the recurring CTF / malware-analysis pattern of a host binary that loads a "program" file under a custom ISA — recognising the dispatcher loop, mapping opcodes to Python lambdas, and inverting the transformation chain in pure Python without executing the host. Also covers callfuscation (control-flow chunking), MBA (mixed boolean-arithmetic) operator obfuscation, encrypted-handler tricks, and three-layer deobfuscation pipelines.
6
7	## When to use
8
9	- A binary plus a "program data" file are delivered together and the binary appears to be an interpreter (themed opcode names, dispatcher switch / jump table).
10	- Disassembly reveals a `while(true){ op = mem[pc++]; switch(op){...}; }` style loop or jump-table indexed by opcode.
11	- The binary is heavily obfuscated (callfuscation, MBA wrappers, encrypted handlers in `.data` decrypted to RWX at startup).
12	- You need to recover an algorithm or check function from native code without dynamic execution (anti-debug, wrong arch, no TTY).
13	- Static-first reverse engineering is preferred (faster, more reliable than emulator chains).
14
15	## References
16
17	- [reference/custom-vm-bytecode.md](reference/custom-vm-bytecode.md) — recognising and inverting custom stack/register/tape VMs; callfuscation linearization; MBA operator identification; encrypted-handler decryption.

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

reverse-engineering

423stars74forks

View on GitHub

How to install reverse-engineering?

transilienceai/communitytools/reverse-engineering

$npx -y skills add transilienceai/communitytools --skill reverse-engineering

Installs into the current project.

Summary

Static and dynamic reverse engineering — ELF/PE analysis, custom-VM bytecode, packed binaries, anti-debug bypass, Frida hooking.

Files · 1

View on GitHub

SKILL.md

1	# Reverse Engineering
2
3	## Scope
4
5	Reverse engineering compiled binaries (ELF, PE, Mach-O) and bytecode artifacts to recover algorithms, validate inputs, or build static solvers. Focused on the recurring CTF / malware-analysis pattern of a host binary that loads a "program" file under a custom ISA — recognising the dispatcher loop, mapping opcodes to Python lambdas, and inverting the transformation chain in pure Python without executing the host. Also covers callfuscation (control-flow chunking), MBA (mixed boolean-arithmetic) operator obfuscation, encrypted-handler tricks, and three-layer deobfuscation pipelines.
6
7	## When to use
8
9	- A binary plus a "program data" file are delivered together and the binary appears to be an interpreter (themed opcode names, dispatcher switch / jump table).
10	- Disassembly reveals a `while(true){ op = mem[pc++]; switch(op){...}; }` style loop or jump-table indexed by opcode.
11	- The binary is heavily obfuscated (callfuscation, MBA wrappers, encrypted handlers in `.data` decrypted to RWX at startup).
12	- You need to recover an algorithm or check function from native code without dynamic execution (anti-debug, wrong arch, no TTY).
13	- Static-first reverse engineering is preferred (faster, more reliable than emulator chains).
14
15	## References
16
17	- [reference/custom-vm-bytecode.md](reference/custom-vm-bytecode.md) — recognising and inverting custom stack/register/tape VMs; callfuscation linearization; MBA operator identification; encrypted-handler decryption.

People who liked this also viewed

6 picks

Type