skills.rest
SanketAdlak
SanketAdlakCOMMUNITY
Explore all skills by this author →
Website𝕏@devsanket14GitHub

binary-analysis-patterns

Analyze compiled binaries using disassembly, decompilation, and control flow pattern recognition.

Updated Apr 23, 2026
Search Tags:#reverse engineering#arm64#ghidra#decompilation#disassembly#ida pro#x86-64
One-click install
npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill binary-analysis-patterns-sanketadlak
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-analysis-patterns
Source: https://github.com/SanketAdlak/PDMProjectDesign/tree/main/.agents/skills/binary-analysis-patterns
Command: npx skills add https://github.com/SanketAdlak/PDMProjectDesign --skill binary-analysis-patterns-sanketadlak

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reverse engineering compiled executables requires recognizing low-level assembly patterns, calling conventions, and compiler-generated code structures, which is slow and error-prone without a systematic reference. ## Core Features & Use Cases - Assembly Pattern Reference: Covers x86-64, ARM64, and ARM32 calling conventions, function prologues/epilogues, and register usage for both System V AMD64 and Microsoft x64. - Control Flow & Data Structure Recognition: Identifies loops, switch jump tables, struct field access, linked list traversal, and string operations in disassembled code. - Decompilation & Tooling Guidance: Provides variable, type, and function signature recovery techniques plus Ghidra scripting and IDAPython analysis examples. - Use Case: When statically analyzing an unknown Linux executable, use the calling convention and loop pattern sections to reconstruct the original C logic of a suspicious function, then apply the Ghidra tips to fix types and rename symbols. ## Quick Start Analyze this disassembled function and identify its calling convention, loop structure, and likely original C source logic.

Frequently Asked Questions about binary-analysis-patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I identify calling conventions in disassembled x86-64 code?▼

Check which registers hold arguments before a call: System V AMD64 on Linux and macOS uses RDI, RSI, RDX, RCX, R8, R9, while Microsoft x64 on Windows uses RCX, RDX, R8, R9 with 32 bytes of shadow space. Return values come back in RAX for both conventions.

How to recognize loops and switch statements in assembly?▼

Loops appear as a compare-and-conditional-jump back to an earlier address, often with an incrementing counter register. Switch statements appear either as a jump table indexed by the switch variable or as sequential compare-and-jump chains for small case counts.

What is the difference between signed and unsigned comparisons in assembly?▼

Signed comparisons use jumps like jge, jl, and jle after a cmp instruction, while unsigned comparisons use jae, jb, and jbe. Choosing the wrong interpretation when reading disassembly leads to incorrect reconstructed conditions.

Can Ghidra and IDA Pro scripts automate binary analysis?▼

Yes, Ghidra scripts can fix function signatures, create structure types, and find calls to dangerous functions like strcpy. IDAPython can enumerate function calls, follow cross-references, and rename functions based on referenced strings.

Why does decompiled code not match the original source structure?▼

Compilers apply optimizations such as inlining, tail call replacement of call plus ret with jmp, dead code elimination, and strength reduction like replacing multiplication with lea. Position-independent code also uses RIP-relative addressing that obscures data references.

Related Skills

Explore More Software Engineering Skills→
drupadsachaniadrupadsachania

reverse-engineering

Map MITRE ATT&CK techniques and extract IOCs from malware samples.

Community
Advanced
starwreckntxstarwreckntx

Vulnerability Management Agent

Track vulnerabilities across assets using CVE/CVSS standards and CVSS scoring.

Community
Basic
Liberty91LTDLiberty91LTD
15

malware-analysis

Identify malware samples and extract static and dynamic indicators from reports.

Official
Intermediate
sayseven7sayseven7
11

code-obfuscation-deobfuscation

Analyze obfuscated binaries to recover control flow, strings, and imports.

Community
Advanced