skills.rest
magnus919
magnus919COMMUNITY
Explore all skills by this author →
WebsiteGitHub

binary-analysis

Analyze PE, ELF, and Mach-O binaries with Ghidra static analysis.

40|6|Updated Jul 11, 2026
Search Tags:#security#static-analysis#reverse-engineering#ghidra#binary-analysis#malware-analysis
One-click install
npx skills add https://github.com/magnus919/agent-skills --skill binary-analysis-magnus919
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-analysis
Source: https://github.com/magnus919/agent-skills/tree/main/binary-analysis
Command: npx skills add https://github.com/magnus919/agent-skills --skill binary-analysis-magnus919

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires pyghidra, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This skill solves the challenge of analyzing unknown binary files (PE, ELF, Mach-O) without source code, allowing agents to safely identify capabilities, suspicious APIs, and logic without executing the file.

Core Features & Use Cases

  • Automated Triage: Quickly identify suspicious API imports and potential security risks using a rule-based engine.
  • Deep Analysis: Perform function-level decompilation, disassembly, and call-graph exploration to understand binary behavior.
  • Use Case: When presented with a suspicious executable or legacy firmware, use this skill to generate a structured, evidence-backed report detailing its capabilities and call paths.

Quick Start

Use the binary-analysis skill to create a new project and perform a full triage on the suspicious file located at /path/to/binary.

Frequently Asked Questions about binary-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform static analysis on an unknown binary without executing it?▼

Static analysis on an unknown binary can be performed using a deterministic CLI that wraps Ghidra's engine to decompile functions and explore call graphs without executing the file. This allows agents to safely identify suspicious APIs and capabilities.

Can I analyze Mach-O and ELF files with Ghidra for malware triage?▼

Yes, you can analyze Mach-O and ELF files for malware triage. The analysis supports PE, ELF, and Mach-O formats, identifying suspicious API imports and generating evidence-backed reports detailing potential security risks.

What do I need to run PyGhidra for binary reverse engineering?▼

To run PyGhidra for binary reverse engineering, you need Python 3.12+, Java JDK 21+, Ghidra 12.1+, and PyGhidra 3.1+. These dependencies are required for the full functionality of the static-analysis engine.

What's the best way to decompile functions and explore call graphs in unknown executables?▼

The best way to decompile functions and explore call graphs in unknown executables is using a rule-based engine that performs deep analysis. This approach generates structured, evidence-backed reports detailing binary capabilities and call paths.

Does automated binary triage work for legacy firmware analysis?▼

Automated binary triage works for legacy firmware analysis by generating a structured, evidence-backed report detailing its capabilities. It quickly identifies suspicious API imports and potential security risks without requiring the original source code.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

reverse-engineering

Reverse-engineer closed-source binaries and firmware via static and dynamic analysis.

Community
Advanced
guaidao2guaidao2
81

ghidra

Automate headless analysis and decompilation of executable binaries and firmware.

Community
Intermediate
hypnguyen1209hypnguyen1209
338

reverse-engineering

Reverse-engineer binaries and firmware through static and dynamic analysis.

Community
Advanced
JameZUKJameZUK
39

arkana-analyze

Analyze malware binaries with Arkana to produce structured digests and IOCs.

Community
Advanced