rev-dynamic

Execute binary samples in a pinned Docker toolkit to capture runtime traces.

Updated Mar 5, 2026
One-click install
npx skills add https://github.com/Xerrion/opencode --skill rev-dynamic
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rev-dynamic
Source: https://github.com/Xerrion/opencode/tree/main/skills/rev-dynamic
Command: npx skills add https://github.com/Xerrion/opencode --skill rev-dynamic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dynamic reverse engineering enables safe runtime analysis of binaries by running samples in an isolated sandbox and collecting execution traces, without impacting the host system.

Core Features & Use Cases

  • Sandboxed execution with a pinned Docker toolkit image and network isolation.
  • Real-time tracing and instrumentation via strace, ltrace, Frida, and qemu-based emulation.
  • Debugging recipes for cross-architecture targets, and per-run trace management under .rev/traces/.
  • Practical use cases include malware analysis, vulnerability research, and software behavior investigation across architectures.

Quick Start

Start by loading a sample into the toolkit's working directory and run the sandbox in Docker with the default isolation to begin dynamic tracing.

Frequently Asked Questions about rev-dynamic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely perform dynamic reverse engineering on suspicious binaries?

Dynamic reverse engineering is performed safely by executing binaries inside a pinned Docker toolkit that enforces sandbox isolation and network isolation, preventing host system impact while observing runtime behavior.

Can I use Frida hooks and qemu emulation for cross-architecture debugging?

Yes, Frida hooks and qemu-based emulation are supported for cross-architecture debugging, allowing real-time tracing and instrumentation across multiple target architectures within the isolated environment.

What do I need to set up before tracing malware samples in a sandbox?

You need to build the Docker-based toolkit image from the provided Dockerfile.example and load your sample into the working directory to begin isolated dynamic tracing.

Where are execution traces and per-run metadata stored during runtime analysis?

Execution traces and per-run metadata are captured and stored under the .rev/traces/ directory, ensuring organized trace management for each dynamic analysis run.

Does this sandbox approach work for vulnerability discovery and software behavior investigation?

Yes, the sandbox approach works for vulnerability discovery and software behavior investigation by isolating tracing, debugging, and emulation to safely observe runtime execution.

What tracing tools are included for runtime binary analysis?

The toolkit includes strace, ltrace, and Frida for real-time tracing and instrumentation, enabling comprehensive observation of binary execution within the isolated sandbox.