skills.rest
cyberkaida
cyberkaidaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

binary-triage

Survey binary memory layout, strings, imports, exports, and functions.

797|69|Updated Aug 18, 2023
Search Tags:#MCP#triage#strings#reverse-engineering#binary#memory-layout
One-click install
npx skills add https://github.com/cyberkaida/reverse-engineering-assistant --skill binary-triage
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: binary-triage
Source: https://github.com/cyberkaida/reverse-engineering-assistant/tree/main/ReVa/skills/binary-triage
Command: npx skills add https://github.com/cyberkaida/reverse-engineering-assistant --skill binary-triage

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill provides a structured, rapid survey of a binary to understand its basic behavior, memory layout, strings, imports/exports, and function usage, enabling engineers to quickly identify suspicious activity and plan the next steps.

Core Features & Use Cases

  • Memory layout survey: identify sections like .text, .data, .rodata, and .bss, and flag unusual characteristics.
  • Strings survey: extract strings and scan for indicators such as network indicators, file paths, APIs, and error messages.
  • Import/Export and symbol analysis: enumerate external symbols and categorize potentially suspicious APIs.
  • Function overview: list named and anonymous functions and highlight likely entry points and callers.
  • Task list generation: produce a prioritized set of next steps for deeper analysis.
  • Use Case: When first examining a binary, triage quickly to determine if it is benign or malicious and plan subsequent investigations.

Quick Start

Load a binary in the MCP-enabled environment and run binary-triage to begin the initial survey. Review the resulting summary to identify memory layout, notable strings, and external imports, then follow the generated TODOs to guide deeper analysis.

Frequently Asked Questions about binary-triage

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform initial binary triage for reverse engineering?▼

Initial binary triage surveys memory layout, strings, imports, exports, and functions to quickly determine a binary's purpose and suspicious behavior. It produces a concise report with a prioritized task list for deeper analysis.

What does a memory layout survey reveal during binary analysis?▼

A memory layout survey reveals sections like .text, .data, .rodata, and .bss, flagging unusual characteristics. This helps identify anomalies in how the binary organizes executable code and data.

Can I extract strings and identify suspicious APIs from an unknown binary?▼

Yes, you can extract strings to scan for network indicators, file paths, and error messages, while enumerating external symbols to categorize potentially suspicious APIs for further investigation.

Does this binary triage process work with MCP-enabled environments?▼

Yes, the binary triage process leverages MCP tooling within an MCP-enabled environment to inspect memory sections, extract strings, analyze external symbols, and identify key functions.

What is the best way to plan deeper reverse engineering after an initial binary survey?▼

The best way to plan deeper reverse engineering is to generate a prioritized task list from the triage report, using identified memory layout anomalies, notable strings, and external imports as guided next steps.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl
2

symbolic-execution-tools

Recover CTF reversing inputs using angr, Z3, and Unicorn emulation.

Community
Advanced
bpnrockstarbpnrockstar

malware-analysis

Analyze suspicious binary files with static and dynamic analysis, YARA rules, and MITRE ATT&CK mapping.

Community
Advanced
alicangnllalicangnll

General Reverse Engineering

Analyze binary files to identify functions, imports, exports, and control flow.

Community
Advanced
GhostPWNGhostPWN
4

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

Official
Advanced