skills.rest
th3w1zard1
th3w1zard1COMMUNITY
Explore all skills by this author →
GitHub

deep-analysis

Investigate binaries through evidence-based decompilation workflows and incremental Ghidra improvements.

Updated Aug 27, 2026
Search Tags:#mcp#evidence-based#reverse-engineering#ghidra#binary-analysis#deep-analysis
One-click install
npx skills add https://github.com/th3w1zard1/reverse-engineering-assistant --skill deep-analysis-th3w1zard1
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deep-analysis
Source: https://github.com/th3w1zard1/reverse-engineering-assistant/tree/main/ReVa/skills/deep-analysis
Command: npx skills add https://github.com/th3w1zard1/reverse-engineering-assistant --skill deep-analysis-th3w1zard1

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Focused reverse engineering investigations can be time-consuming and inconsistent; this skill provides a disciplined, evidence-based framework to investigate binary behavior, gather context, and incrementally improve the underlying Ghidra database, reducing guesswork and ensuring traceable conclusions.

Core Features & Use Cases

  • Depth-first investigation workflow that prioritizes completing one thread before branching.
  • Incremental code readability improvements (renaming variables, retyping data, and documenting assumptions) with evidence-backed conclusions.
  • Tracking progress with bookmarks and dedicated investigation threads to surface unanswered questions.

Quick Start

Start by running get-decompilation on a target function, then follow the Investigation Loop (READ, UNDERSTAND, IMPROVE, VERIFY) to collect context, refine the decompilation, and document evidence.

Frequently Asked Questions about deep-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I investigate what a specific binary function does during reverse engineering?▼

To investigate binary functions, apply a depth-first workflow that reads decompilation, gathers cross-references, and incrementally renames variables to produce traceable, evidence-backed conclusions about function behavior.

What is the best way to find C2 addresses or cryptographic routines in a binary?▼

Finding C2 addresses or cryptographic routines requires iterative deep-dives using memory reads and cross-referencing, tracking unanswered questions in dedicated threads to surface hidden artifacts and document evidence.

How do I keep track of unanswered questions when analyzing a complex binary?▼

Track unanswered questions during binary analysis by maintaining dedicated investigation threads and using bookmarks, prioritizing one thread to completion before branching to ensure focused, defensible conclusions.

Can I improve the Ghidra database state while performing evidence-based binary analysis?▼

Yes, you can improve the Ghidra database state by applying actions like renaming variables, changing datatypes, and setting comments directly within the investigation loop to incrementally increase code readability.

Does deep-analysis require specific decompilation tools to extract binary evidence?▼

Yes, deep-analysis requires integration with decompilation tool outputs such as get-decompilation, find-cross-references, and read-memory to gather context and verify assumptions during the reverse-engineering process.

Why should I use an evidence-based approach for reverse engineering investigations?▼

An evidence-based approach reduces guesswork and inconsistency by enforcing a disciplined loop of reading, understanding, improving, and verifying, ensuring every conclusion about binary behavior is fully traceable.

Related Skills

Explore More Software Engineering Skills→
aivos-xieaivos-xie
1

ai-reverse-engineering

Automate binary code decompilation and analysis with IDA Pro and Ghidra.

Community
Advanced
dawsonblockdawsonblock

oss-forensics

Aggregate evidence from GitHub API, GH Archive, Wayback Machine, and git history to identify supply-chain compromises.

Community
Advanced
2389-research2389-research
90

binary-re:static-analysis

Analyze binary structure and decompile functions with radare2 and Ghidra headless.

Official
Advanced
neuro-synapseneuro-synapse
3

cisco-network-diagram

Generate Draw.io network topology diagrams from Cisco router and switch configurations.

Community
Intermediate