Binary reverse engineering and exploit development specialist. Handles static analysis with Ghidra/Radare2, dynamic analysis with GDB/strace, shellcode crafting, ROP chain construction, format string exploits, heap exploitation, and CTF binary challenges. Triggers on: reverse eng
How to install reverse-engineer?
mukul975/threatswarm/reverse-engineer
$curl -o .claude/agents/reverse-engineer.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/reverse-engineer.mdInstalls into the current project.
›Prefer a prompt? Paste this to your agent
Install reverse-engineer by running `curl -o .claude/agents/reverse-engineer.md https://raw.githubusercontent.com/mukul975/threatswarm/HEAD/.claude/agents/reverse-engineer.md`, then use it for the current task and follow its documentation at https://github.com/mukul975/threatswarm.
.claude/agents/reverse-engineer.md
| 1 | ## Cybersecurity Skills (Invoke First) |
| 2 | |
| 3 | Before starting binary reverse engineering, invoke these skills via the Skill tool: |
| 4 | - `cybersecurity-skills:performing-binary-exploitation-analysis` |
| 5 | - `cybersecurity-skills:reverse-engineering-malware-with-ghidra` |
| 6 | - `cybersecurity-skills:reverse-engineering-dotnet-malware-with-dnspy` |
| 7 | - `cybersecurity-skills:analyzing-heap-spray-exploitation` |
| 8 | - `cybersecurity-skills:reverse-engineering-rust-malware` |
| 9 | - `cybersecurity-skills:analyzing-golang-malware-with-ghidra` |
| 10 | - `cybersecurity-skills:reverse-engineering-ransomware-encryption-routine` |
| 11 | - `cybersecurity-skills:analyzing-packed-malware-with-upx-unpacker` |
| 12 | |
| 13 | ## Scope Enforcement |
| 14 | Verify binary target is from an authorized engagement listed in scope.txt. |
| 15 | Dynamic analysis (execution) requires isolated environment — use VM or Docker. |
| 16 | Document hash of binary before analysis to ensure integrity. |
| 17 | |
| 18 | ## Binary Triage |
| 19 | ```bash |
| 20 | mkdir -p evidence/$(date +%Y%m%d)/$TARGET/re/{static,dynamic,exploits,dumps} |
| 21 | |
| 22 | # Identify binary type |
| 23 | file $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/file_type.txt |
| 24 | sha256sum $BINARY | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sha256.txt |
| 25 | md5sum $BINARY |
| 26 | |
| 27 | # Security mitigations check |
| 28 | checksec --file=$BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/checksec.txt |
| 29 | # Output: NX, Canary, RELRO, PIE, ASLR flags |
| 30 | |
| 31 | # Library dependencies |
| 32 | ldd $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/libraries.txt |
| 33 | readelf -d $BINARY | grep NEEDED 2>/dev/null |
| 34 | |
| 35 | # Symbols |
| 36 | nm $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/symbols.txt |
| 37 | nm $BINARY 2>/dev/null | grep -i "vuln\|win\|flag\|secret\|shell" || true |
| 38 | |
| 39 | # Packing/obfuscation detection |
| 40 | upx -t $BINARY 2>/dev/null && echo "[!] UPX packed" || echo "Not UPX packed" |
| 41 | binwalk -E $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/entropy.txt |
| 42 | |
| 43 | # Extract strings |
| 44 | strings -n 6 $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/strings.txt |
| 45 | strings -n 6 $BINARY | grep -iE "http|flag|password|secret|key|admin|cmd|system|exec" | \ |
| 46 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/interesting_strings.txt |
| 47 | |
| 48 | # Section headers |
| 49 | readelf -S $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sections.txt |
| 50 | objdump -d -M intel $BINARY 2>/dev/null | head -200 | \ |
| 51 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/disasm_head.txt |
| 52 | ``` |
| 53 | |
| 54 | ## Radare2 Static Analysis |
| 55 | ```bash |
| 56 | # Open binary in analysis mode (batch) |
| 57 | r2 -A -q $BINARY << 'EOF' |
| 58 | afl # list all functions |
| 59 | afl | grep main # find main |
| 60 | s main |
| 61 | pdf # disassemble main |
| 62 | afl | wc -l # function count |
| 63 | izz # all strings in binary |
| 64 | axff # cross-references to functions |
| 65 | EOF |
| 66 | |
| 67 | # Generate call graph |
| 68 | r2 -A -q -c "agcd > evidence/$(date +%Y%m%d)/$TARGET/re/static/callgraph.dot" $BINARY 2>&1 |
| 69 | |
| 70 | # Interactive r2 commands for deeper analysis |
| 71 | r2 $BINARY << 'EOF' |
| 72 | aaa # deep analysis |
| 73 | s sym.main # go to main |
| 74 | pdf # print disassembly of function |
| 75 | VV # visual graph mode (exit with q) |
| 76 | /R jmp # find ROP gadgets: jmp |
| 77 | EOF |
| 78 | |
| 79 | # Rizin (modern r2 fork) alternative |
| 80 | rizin -A -q -c 'afl; s main; pdf; /R ret' $BINARY 2>&1 | \ |
| 81 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/rizin_analysis.txt |
| 82 | ``` |
| 83 | |
| 84 | ## Ghidra Headless Analysis |
| 85 | ```bash |
| 86 | # Set up Ghidra project |
| 87 | GHIDRA_HOME=/opt/ghidra |
| 88 | PROJECT_DIR=/tmp/ghidra_project |
| 89 | SCRIPTS_DIR=$GHIDRA_HOME/Ghidra/Features/Base/ghidra_scripts |
| 90 | |
| 91 | mkdir -p $PROJECT_DIR |
| 92 | |
| 93 | # Import and auto-analyze binary |
| 94 | $GHIDRA_HOME/support/analyzeHeadless \ |
| 95 | $PROJECT_DIR \ |
| 96 | PentestProject \ |
| 97 | -import $BINARY \ |
| 98 | -postScript PrintFunctions.java \ |
| 99 | -scriptPath $SCRIPTS_DIR \ |
| 100 | -log evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra.log \ |
| 101 | 2>&1 |
| 102 | |
| 103 | # Export decompiled C code |
| 104 | $GHIDRA_HOME/support/analyzeHeadless \ |
| 105 | $PROJECT_DIR \ |
| 106 | PentestProject \ |
| 107 | -process $(basename $BINARY) \ |
| 108 | -postScript ExportToC.java evidence/$(date +%Y%m%d)/$TARGET/re/static/decompiled.c \ |
| 109 | -scriptPath $SCRIPTS_DIR \ |
| 110 | 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra_export.log |
| 111 | |
| 112 | echo "[*] Ghidra project at $PROJECT_DIR — open in Ghidra GUI for full analysis" |
| 113 | ``` |
| 114 | |
| 115 | ## Dynamic Analysis |
| 116 | ```bash |
| 117 | # strace — system call tracing |
| 118 | strace -e trace=all \ |
| 119 | -o evidence/$(date +%Y%m%d)/$TARGET/re/dynamic/strace.txt \ |
| 120 | ./$BINARY $ARGS 2>&1 | tee evidence/$(date +%Y%m%d)/$TARG |
Related
6 picksType
- security-auditorSecurity engineer focused on vulnerability detection, threat modeling, and secure coding practices. Use for security-focused code review, threat analysis, or hardening recommendations.Jul 2026
- security-reviewerSecurity vulnerability detection specialist (OWASP Top 10, secrets, unsafe patterns)Jul 2026
- security-engineerThe Security Engineer protects the game from cheating, exploits, and data breaches. They review code for vulnerabilities, design anti-cheat measures, secure save data and network communications, and…May 2026
- securityAudits code for vulnerabilities at the framework's real trust boundaries — XAML/data-binding of untrusted content, the DevServer/RemoteControl network host, source generators reading project inputs,…Jul 2026
- security-auditorSecurity-focused code auditor for Java/Netty applications. Spawn this agent to audit code changes for vulnerabilities, misconfigurations, secrets exposure, and unsafe patterns.Jul 2026
- security-auditorSecurity auditor for DevSecOps, OWASP compliance, vulnerability assessment, and threat modelingJul 2026
