rev-static

Analyze binaries via deterministic static reverse engineering across native, managed, JavaScript, and WebAssembly targets.

Updated Mar 5, 2026
One-click install
npx skills add https://github.com/Xerrion/opencode --skill rev-static
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rev-static
Source: https://github.com/Xerrion/opencode/tree/main/skills/rev-static
Command: npx skills add https://github.com/Xerrion/opencode --skill rev-static

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static reverse engineering is essential to understand binary behavior without executing code, enabling analysts to extract strings, imports, architecture details, and structure for security reviews and vulnerability assessment.

Core Features & Use Cases

  • Deterministic disassembly and decompilation across native, managed, JavaScript, and WebAssembly targets.
  • Language fingerprinting, packer detection, and capability-ID work for rapid threat profiling.
  • Use Case: When assessing a malware sample, run deterministic analysis to produce reproducible reports under .rev/disasm and .rev/decompiled.

Quick Start

Run a static analysis workflow on a sample to generate reproducible disassembly and decompiled outputs.

Frequently Asked Questions about rev-static

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform deterministic static reverse engineering on multiple binary formats?

Deterministic static reverse engineering applies consistent disassembly and decompilation across native, managed, JavaScript, and WebAssembly targets to generate reproducible outputs. It enforces a structured project layout to standardize analysis results for auditing and reporting.

Can I use Ghidra headless for automated malware decompilation and disassembly?

Yes, automated malware decompilation and disassembly use Ghidra headless alongside rizin and radare2. This approach processes binaries deterministically, creating reproducible disassembly and decompiled files under structured project directories for threat profiling.

What's the best way to detect packers and identify language fingerprints in binary analysis?

Binary analysis detects packers and identifies language fingerprints by applying compiler fingerprinting and capability-ID detection across native, managed, JavaScript, and WebAssembly targets. This process extracts strings and imports to rapidly profile potential threats.

Does static binary analysis work with WebAssembly and managed code targets?

Static binary analysis works with WebAssembly and managed code targets by applying deterministic disassembly and decompilation techniques. It extracts architecture details, strings, and imports across these formats to support security reviews without executing code.

How do I extract strings and cross-references for a malware sample reproducibly?

To extract strings and cross-references reproducibly for a malware sample, apply deterministic static analysis to generate structured outputs in designated directories. This records language fingerprints, detected packers, and imports for consistent audit and reporting.

When should I not use static reverse engineering for binary vulnerability assessment?

Static reverse engineering should not be used when assessing heavily obfuscated packed binaries requiring runtime unpacking, or when code behavior depends entirely on dynamic runtime state that static disassembly and decompilation cannot execute or observe.