Performs initial triage of unknown native binaries using Mandiant capa and FLOSS.
npx skills add https://github.com/warterbili/AUTO_REVERSE --skill capa-triage
Please help me install this Agent Skill. Skill: capa-triage Source: https://github.com/warterbili/AUTO_REVERSE/tree/main/skills/native/capa-triage Command: npx skills add https://github.com/warterbili/AUTO_REVERSE --skill capa-triage
Manually identifying capabilities and deobfuscating strings in unknown native binaries before deep reverse engineering is slow and inefficient, wasting valuable analyst time on irrelevant code paths.
Use the capa-triage skill to perform a quick capability and string triage on the unknown native library 'libsuspect.so' extracted from an unpacked Android APK.
High-intent search queries and answers about installing and using this skill.
Obfuscated string recovery uses FLOSS for PE and shellcode samples, alongside native tooling for ELF and .so files, to retrieve hidden stack-built or encoded strings. This triage extracts URLs, encryption keys, and C2 endpoints before deep reverse engineering.
Capability analysis fully supports ARM64 Android binaries alongside x86 and x64 ELF files with platform-specific guidance. It applies Mandiant capa rules and ATT&CK or MBC categorization to map functions in unknown native code extracted from unpacked APKs.
The best way to triage an unknown malicious .so file is running a combined capability and string extraction analysis first. This locates all crypto and network-related functions, allowing you to focus decompiler efforts only on relevant code sections instead of the entire binary.
Capa capability mapping provides exact hit addresses for targeted decompilation in Ghidra or IDA. By categorizing these findings using ATT&CK and MBC frameworks, analysts can quickly prioritize decompilation efforts for unknown native binaries.
Running a binary triage before deep reverse engineering prevents wasting valuable analyst time on irrelevant code paths. It rapidly identifies embedded capabilities and recovers obfuscated strings, directing decompiler efforts only toward the relevant code sections.
AeonDaveInject custom shellcode into Windows PE executables to evade antivirus detection.
nolanvenholaAutomate disassembly, decompilation, and deobfuscation of binaries with Ghidra, IDA Pro, radare2, and angr.
letta-aiReverse engineer ray-tracing binaries to reconstruct pixel-perfect rendering algorithms.
rjonhaasExtract static evidence and map malware capabilities to ATT&CK techniques.
