Analyze and exploit CTF binary challenges using Ghidra, pwntools, and dynamic debugging.
npx skills add https://github.com/yhy0/CHYing-agent --skill binary
Please help me install this Agent Skill. Skill: binary Source: https://github.com/yhy0/CHYing-agent/tree/main/agent-work/.claude/skills/binary Command: npx skills add https://github.com/yhy0/CHYing-agent --skill binary
Solving PWN and reverse engineering challenges in CTF competitions requires deep expertise across static analysis, dynamic debugging, heap exploitation, ROP chains, and shellcode development. This Skill provides a systematic workflow that guides an AI agent through reconnaissance, vulnerability identification, and exploit development for binary targets.
Analyze the attached binary challenge file, identify the vulnerability type, and write a working pwntools exploit script to capture the flag.
High-intent search queries and answers about installing and using this skill.
First run checksec to identify protections, then use a cyclic pattern to calculate the exact offset to the return address. Depending on protections, apply ret2text for binaries with a backdoor function, ret2libc when NX is enabled, or shellcode injection when the stack is executable.
Load the binary with analyzeHeadless, then use Ghidra MCP tools to list functions, search strings for flag or key references, and decompile suspicious functions to C pseudocode. Follow cross-references from input functions to validation logic to understand the algorithm before writing any solver script.
Tcache poisoning corrupts the fd pointer of a freed chunk so the next malloc returns an arbitrary address. On glibc 2.27-2.31 it works directly, while glibc 2.32+ adds safe-linking, requiring a heap leak to compute the mangled fd value as target XOR (heap address shifted right by 12).
Yes, angr performs symbolic execution to find inputs that reach a success state while avoiding failure states. Define the input as a symbolic bitvector, explore toward the success address, and evaluate the model to recover the valid input, which works well for constraint-based flag checkers.
The most common cause is stack alignment: many libc functions like system crash if rsp is not 16-byte aligned at the call. Insert a single ret gadget before the system call in your ROP chain, and ensure you pass the /bin/sh address through pop rdi rather than pushing arguments on the stack.
Skip Ghidra when the flag appears directly in strings output, when strace fully reveals the relevant data flow, or when the challenge is purely dynamic and solvable with gdb or angr. Ghidra is essential for stripped binaries with custom encryption, C2 protocols, or algorithms you must reimplement.
jd-opensourceAnalyze binary files to identify memory corruption vulnerabilities and develop exploits.
salmanabdurrahmanGenerate structured Capture The Flag writeups from authorized lab and competition evidence.
KongGithubDevCoordinates CTF skills across categories to analyze files and exploit services.
SnailSploitGenerate a week-by-week exploit development curriculum with fuzzing and crash analysis.
