What problem does it solve?
Reverse engineering native binaries requires coordinating many specialized steps—triage, unpacking, anti-debug bypass, decompilation, data recovery, and diffing—across different formats and architectures. This skill provides a complete, methodology-grounded workflow that guides analysts from initial triage through artifact recovery without having to manually piece together tools and references for each phase.
Core Features & Use Cases
- End-to-end workflow: Covers triage, packer identification and unpacking, anti-analysis bypass, decompilation with Ghidra or radare2, data recovery including crypto and shellcode patterns, and binary diffing for patch analysis.
- Cross-format support: Handles PE, ELF, Mach-O, and raw shellcode with format-specific quick references and canonical specification mirrors.
- Use case: A malware analyst triages a suspicious Windows executable, identifies UPX packing, unpacks it, bypasses anti-debug checks with Qiling emulation, decompiles the validation routine in Ghidra, and recovers the hardcoded license key using a dump-at-API pattern.
Quick Start
Use the binary-analysis skill to triage the suspicious executable, identify any packers or anti-debug checks, and recover the protected artifact such as a hardcoded key or configuration string.
