skills.rest
chenchunrun
chenchunrunCOMMUNITY
Explore all skills by this author →
GitHub

binary-reverse-engineering

Analyze native, .NET, Go, and ARM binaries for structure and threats.

1|1|Updated Apr 25, 2026
Search Tags:#reverse-engineering#frida#binary-analysis#malware-analysis#pwn#rop#shellcode
One-click install
npx skills add https://github.com/chenchunrun/onyx-soc --skill binary-reverse-engineering
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-reverse-engineering
Source: https://github.com/chenchunrun/onyx-soc/tree/main/skills/binary-reverse-engineering
Command: npx skills add https://github.com/chenchunrun/onyx-soc --skill binary-reverse-engineering

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires lief, yara, pwntools, and includes scripts (resource) components.

What problem does it solve?

This Skill provides a structured toolkit to reverse engineer binaries, uncovering hidden payloads, embedded resources, and potentially malicious behaviors that impede quick threat assessment.

Core Features & Use Cases

  • Static analysis: parse PE/ELF/Go binaries to reveal headers, sections, and imports.
  • Embedded content extraction: locate embedded PE files, shellcode, and base64 payloads for further inspection.
  • Injection technique detection: identify common process injection patterns and potential ROP chains.
  • IOC aggregation: collect strings-based indicators such as URLs, domains, and hashes for incident response. Use cases include malware triage, vulnerability research, and post-breach forensics.

Quick Start

Run the toolkit against a sample binary to begin extracting structure, embedded payloads, and suspicious patterns.

Frequently Asked Questions about binary-reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform static analysis on PE and ELF binaries to extract headers and imports?▼

Static analysis on PE and ELF binaries parses headers, sections, and imports using lief. It reveals the binary structure and dependencies needed to understand its behavior and potential threats.

How can I detect embedded shellcode and base64 payloads inside a binary?▼

Embedded content extraction locates hidden shellcode, base64 payloads, and embedded PE files within a binary. This process exposes concealed payloads for further inspection and malware triage.

Can I identify process injection techniques and ROP chains in native and Go binaries?▼

Injection technique detection identifies common process injection patterns and potential ROP chains in native and Go binaries. It highlights suspicious execution flows used in exploit research.

How do I collect URLs and domains as IOCs for incident response from malware?▼

IOC aggregation collects strings-based indicators such as URLs, domains, and hashes from binaries. These extracted indicators support incident response and post-breach forensics.

Does YARA-based malware matching work with ARM and .NET binaries?▼

YARA-based malware matching supports ARM and .NET binaries alongside native formats. It cross-references extracted binary content against known threat signatures for malware analysis.

What is the best way to analyze suspicious binaries using pwntools for exploit research?▼

Analyzing suspicious binaries with pwntools supports exploit research by identifying ROP chains and shellcode. The toolkit structures the reverse engineering process for vulnerability analysis.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

malware-analysis

Analyze suspicious binary files with static and dynamic analysis, YARA rules, and MITRE ATT&CK mapping.

Community
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-dast-debugger

Integrate debuggers, instrumentation, and crash replay for binary dynamic analysis.

Community
Advanced
utsavthakurutsavthakur

stack-overflow-and-rop

Construct ROP chains and bypass protections in Linux binaries.

Community
Advanced