re-dynamic

Trace system and library calls of binaries in an isolated sandbox.

Updated Jul 30, 2026
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill re-dynamic
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: re-dynamic
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/re-dynamic
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill re-dynamic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured, safe, and isolated environment for performing dynamic reverse engineering on binaries, ensuring that potentially malicious code is analyzed without risking the host system or violating security policies.

Core Features & Use Cases

  • Isolated Sandbox Execution: Executes binaries within a controlled, network-disabled environment with snapshot-based recovery.
  • Comprehensive Tracing: Automates system-call (strace) and library-call (ltrace) monitoring to identify suspicious behaviors like credential access or unauthorized network connections.
  • Exploit Mitigation Analysis: Automatically runs checksec to evaluate binary security posture and provides a workflow for GDB/pwndbg debugging and symbolic execution with angr.

Quick Start

Use the re-dynamic skill to perform a full dynamic analysis on the binary located at /tmp/target_binary within the current isolated sandbox environment.

Frequently Asked Questions about re-dynamic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely execute and analyze a potentially malicious binary?

Dynamic analysis safely executes potentially malicious binaries within an isolated, network-restricted sandbox environment. This prevents unauthorized access to the host system while monitoring behavior through system-call and library-call tracing.

What is dynamic reverse engineering and when do I need it?

Dynamic reverse engineering involves running authorized local artifacts in a controlled environment to observe runtime behavior. You need it for security assessments to identify suspicious behaviors like credential access or unauthorized network connections.

How do I trace system calls and library calls during binary analysis?

Automate system-call tracing with strace and library-call monitoring with ltrace during sandbox execution. This comprehensive tracing identifies suspicious runtime behaviors like credential access or unauthorized network connections.

Can I check binary exploit mitigations like ASLR or stack canaries?

Exploit mitigation analysis automatically runs checksec to evaluate the binary security posture. This identifies active exploit mitigations before proceeding with interactive debugging or symbolic execution.

Does dynamic binary analysis require network isolation and snapshot recovery?

Strict adherence to sandbox isolation, network-disabled execution, and snapshot-based recovery is required. These authorization-gated execution policies ensure behavioral analysis does not violate security boundaries or risk the host.

What's the best way to debug a binary interactively after checksec analysis?

Use GDB with pwndbg for interactive debugging and angr for symbolic execution after checksec analysis. This workflow provides comprehensive exploit mitigation detection and runtime behavioral analysis within the isolated sandbox.