reverse-engineer

Name: reverse-engineer
Author: mukul975

60stars17forks

How to install reverse-engineer?

mukul975/threatswarm/reverse-engineer

$curl -o .claude/agents/reverse-engineer.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/reverse-engineer.md

Installs into the current project.

Summary

Binary reverse engineering and exploit development specialist. Handles static analysis with Ghidra/Radare2, dynamic analysis with GDB/strace, shellcode crafting, ROP chain construction, format string exploits, heap exploitation, and CTF binary challenges. Triggers on: reverse eng

Files · 1

View on GitHub

.claude/agents/reverse-engineer.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting binary reverse engineering, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-binary-exploitation-analysis`
5	- `cybersecurity-skills:reverse-engineering-malware-with-ghidra`
6	- `cybersecurity-skills:reverse-engineering-dotnet-malware-with-dnspy`
7	- `cybersecurity-skills:analyzing-heap-spray-exploitation`
8	- `cybersecurity-skills:reverse-engineering-rust-malware`
9	- `cybersecurity-skills:analyzing-golang-malware-with-ghidra`
10	- `cybersecurity-skills:reverse-engineering-ransomware-encryption-routine`
11	- `cybersecurity-skills:analyzing-packed-malware-with-upx-unpacker`
12
13	## Scope Enforcement
14	Verify binary target is from an authorized engagement listed in scope.txt.
15	Dynamic analysis (execution) requires isolated environment — use VM or Docker.
16	Document hash of binary before analysis to ensure integrity.
17
18	## Binary Triage
19	```bash
20	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/re/{static,dynamic,exploits,dumps}
21
22	# Identify binary type
23	file $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/file_type.txt
24	sha256sum $BINARY \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sha256.txt
25	md5sum $BINARY
26
27	# Security mitigations check
28	checksec --file=$BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/checksec.txt
29	# Output: NX, Canary, RELRO, PIE, ASLR flags
30
31	# Library dependencies
32	ldd $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/libraries.txt
33	readelf -d $BINARY \| grep NEEDED 2>/dev/null
34
35	# Symbols
36	nm $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/symbols.txt
37	nm $BINARY 2>/dev/null \| grep -i "vuln\\|win\\|flag\\|secret\\|shell" \|\| true
38
39	# Packing/obfuscation detection
40	upx -t $BINARY 2>/dev/null && echo "[!] UPX packed" \|\| echo "Not UPX packed"
41	binwalk -E $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/entropy.txt
42
43	# Extract strings
44	strings -n 6 $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/strings.txt
45	strings -n 6 $BINARY \| grep -iE "http\|flag\|password\|secret\|key\|admin\|cmd\|system\|exec" \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/interesting_strings.txt
47
48	# Section headers
49	readelf -S $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sections.txt
50	objdump -d -M intel $BINARY 2>/dev/null \| head -200 \| \
51	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/disasm_head.txt
52	```
53
54	## Radare2 Static Analysis
55	```bash
56	# Open binary in analysis mode (batch)
57	r2 -A -q $BINARY << 'EOF'
58	afl # list all functions
59	afl \| grep main # find main
60	s main
61	pdf # disassemble main
62	afl \| wc -l # function count
63	izz # all strings in binary
64	axff # cross-references to functions
65	EOF
66
67	# Generate call graph
68	r2 -A -q -c "agcd > evidence/$(date +%Y%m%d)/$TARGET/re/static/callgraph.dot" $BINARY 2>&1
69
70	# Interactive r2 commands for deeper analysis
71	r2 $BINARY << 'EOF'
72	aaa # deep analysis
73	s sym.main # go to main
74	pdf # print disassembly of function
75	VV # visual graph mode (exit with q)
76	/R jmp # find ROP gadgets: jmp
77	EOF
78
79	# Rizin (modern r2 fork) alternative
80	rizin -A -q -c 'afl; s main; pdf; /R ret' $BINARY 2>&1 \| \
81	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/rizin_analysis.txt
82	```
83
84	## Ghidra Headless Analysis
85	```bash
86	# Set up Ghidra project
87	GHIDRA_HOME=/opt/ghidra
88	PROJECT_DIR=/tmp/ghidra_project
89	SCRIPTS_DIR=$GHIDRA_HOME/Ghidra/Features/Base/ghidra_scripts
90
91	mkdir -p $PROJECT_DIR
92
93	# Import and auto-analyze binary
94	$GHIDRA_HOME/support/analyzeHeadless \
95	$PROJECT_DIR \
96	PentestProject \
97	-import $BINARY \
98	-postScript PrintFunctions.java \
99	-scriptPath $SCRIPTS_DIR \
100	-log evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra.log \
101	2>&1
102
103	# Export decompiled C code
104	$GHIDRA_HOME/support/analyzeHeadless \
105	$PROJECT_DIR \
106	PentestProject \
107	-process $(basename $BINARY) \
108	-postScript ExportToC.java evidence/$(date +%Y%m%d)/$TARGET/re/static/decompiled.c \
109	-scriptPath $SCRIPTS_DIR \
110	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra_export.log
111
112	echo "[*] Ghidra project at $PROJECT_DIR — open in Ghidra GUI for full analysis"
113	```
114
115	## Dynamic Analysis
116	```bash
117	# strace — system call tracing
118	strace -e trace=all \
119	-o evidence/$(date +%Y%m%d)/$TARGET/re/dynamic/strace.txt \
120	./$BINARY $ARGS 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARG

People who liked this also viewed

6 picks

Type

reverse-engineer

60stars17forks

View on GitHub

How to install reverse-engineer?

mukul975/threatswarm/reverse-engineer

$curl -o .claude/agents/reverse-engineer.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/reverse-engineer.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/reverse-engineer.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting binary reverse engineering, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-binary-exploitation-analysis`
5	- `cybersecurity-skills:reverse-engineering-malware-with-ghidra`
6	- `cybersecurity-skills:reverse-engineering-dotnet-malware-with-dnspy`
7	- `cybersecurity-skills:analyzing-heap-spray-exploitation`
8	- `cybersecurity-skills:reverse-engineering-rust-malware`
9	- `cybersecurity-skills:analyzing-golang-malware-with-ghidra`
10	- `cybersecurity-skills:reverse-engineering-ransomware-encryption-routine`
11	- `cybersecurity-skills:analyzing-packed-malware-with-upx-unpacker`
12
13	## Scope Enforcement
14	Verify binary target is from an authorized engagement listed in scope.txt.
15	Dynamic analysis (execution) requires isolated environment — use VM or Docker.
16	Document hash of binary before analysis to ensure integrity.
17
18	## Binary Triage
19	```bash
20	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/re/{static,dynamic,exploits,dumps}
21
22	# Identify binary type
23	file $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/file_type.txt
24	sha256sum $BINARY \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sha256.txt
25	md5sum $BINARY
26
27	# Security mitigations check
28	checksec --file=$BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/checksec.txt
29	# Output: NX, Canary, RELRO, PIE, ASLR flags
30
31	# Library dependencies
32	ldd $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/libraries.txt
33	readelf -d $BINARY \| grep NEEDED 2>/dev/null
34
35	# Symbols
36	nm $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/symbols.txt
37	nm $BINARY 2>/dev/null \| grep -i "vuln\\|win\\|flag\\|secret\\|shell" \|\| true
38
39	# Packing/obfuscation detection
40	upx -t $BINARY 2>/dev/null && echo "[!] UPX packed" \|\| echo "Not UPX packed"
41	binwalk -E $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/entropy.txt
42
43	# Extract strings
44	strings -n 6 $BINARY 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/strings.txt
45	strings -n 6 $BINARY \| grep -iE "http\|flag\|password\|secret\|key\|admin\|cmd\|system\|exec" \| \
46	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/interesting_strings.txt
47
48	# Section headers
49	readelf -S $BINARY 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sections.txt
50	objdump -d -M intel $BINARY 2>/dev/null \| head -200 \| \
51	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/disasm_head.txt
52	```
53
54	## Radare2 Static Analysis
55	```bash
56	# Open binary in analysis mode (batch)
57	r2 -A -q $BINARY << 'EOF'
58	afl # list all functions
59	afl \| grep main # find main
60	s main
61	pdf # disassemble main
62	afl \| wc -l # function count
63	izz # all strings in binary
64	axff # cross-references to functions
65	EOF
66
67	# Generate call graph
68	r2 -A -q -c "agcd > evidence/$(date +%Y%m%d)/$TARGET/re/static/callgraph.dot" $BINARY 2>&1
69
70	# Interactive r2 commands for deeper analysis
71	r2 $BINARY << 'EOF'
72	aaa # deep analysis
73	s sym.main # go to main
74	pdf # print disassembly of function
75	VV # visual graph mode (exit with q)
76	/R jmp # find ROP gadgets: jmp
77	EOF
78
79	# Rizin (modern r2 fork) alternative
80	rizin -A -q -c 'afl; s main; pdf; /R ret' $BINARY 2>&1 \| \
81	tee evidence/$(date +%Y%m%d)/$TARGET/re/static/rizin_analysis.txt
82	```
83
84	## Ghidra Headless Analysis
85	```bash
86	# Set up Ghidra project
87	GHIDRA_HOME=/opt/ghidra
88	PROJECT_DIR=/tmp/ghidra_project
89	SCRIPTS_DIR=$GHIDRA_HOME/Ghidra/Features/Base/ghidra_scripts
90
91	mkdir -p $PROJECT_DIR
92
93	# Import and auto-analyze binary
94	$GHIDRA_HOME/support/analyzeHeadless \
95	$PROJECT_DIR \
96	PentestProject \
97	-import $BINARY \
98	-postScript PrintFunctions.java \
99	-scriptPath $SCRIPTS_DIR \
100	-log evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra.log \
101	2>&1
102
103	# Export decompiled C code
104	$GHIDRA_HOME/support/analyzeHeadless \
105	$PROJECT_DIR \
106	PentestProject \
107	-process $(basename $BINARY) \
108	-postScript ExportToC.java evidence/$(date +%Y%m%d)/$TARGET/re/static/decompiled.c \
109	-scriptPath $SCRIPTS_DIR \
110	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/re/static/ghidra_export.log
111
112	echo "[*] Ghidra project at $PROJECT_DIR — open in Ghidra GUI for full analysis"
113	```
114
115	## Dynamic Analysis
116	```bash
117	# strace — system call tracing
118	strace -e trace=all \
119	-o evidence/$(date +%Y%m%d)/$TARGET/re/dynamic/strace.txt \
120	./$BINARY $ARGS 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARG

People who liked this also viewed

6 picks

Type