skills.rest
Tgoldi
TgoldiCOMMUNITY
Explore all skills by this author →
GitHub

reverse-engineer

Analyzes binaries through disassembly, decompilation, and dynamic debugging using IDA Pro, Ghidra, and radare2.

1|Updated May 10, 2026
Search Tags:#ctf#reverse engineering#binary analysis#ghidra#disassembly#ida pro#malware analysis
One-click install
npx skills add https://github.com/Tgoldi/claude-skills --skill reverse-engineer-tgoldi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineer
Source: https://github.com/Tgoldi/claude-skills/tree/main/reverse-engineer
Command: npx skills add https://github.com/Tgoldi/claude-skills --skill reverse-engineer-tgoldi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Understanding closed-source binaries, undocumented libraries, and CTF challenges requires specialized tooling and methodology that most developers lack, making binary analysis slow and error-prone. ## Core Features & Use Cases - Four-Phase Methodology: Structured workflow covering reconnaissance, static analysis, dynamic analysis, and documentation for any binary target. - Toolchain Guidance: Practical direction for IDA Pro, Ghidra, radare2, x64dbg, pwntools, angr, and Frida across scripting and debugging tasks. - Pattern Recognition: Reference material for identifying string obfuscation, anti-debugging tricks, API hashing, and calling conventions across x86, x64, and ARM. - Use Case: Given a CTF password-check binary, follow the guided steps to identify the file type, locate comparison logic in a disassembler, break on strcmp in GDB, and recover the expected input. ## Quick Start Ask the assistant to analyze a binary's authentication logic and walk you through static and dynamic analysis step by step.

Frequently Asked Questions about reverse-engineer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a CTF binary that asks for a password?▼

Start by identifying the binary with file and checksec, then load it in Ghidra or IDA to find main. Look for strcmp or memcmp calls, set breakpoints on them in GDB, and inspect memory at the comparison point to reveal the expected value.

IDA Pro vs Ghidra vs radare2 for binary analysis?▼

IDA Pro offers mature decompilation with IDAPython scripting, Ghidra is free with Java/Jython scripting, and radare2 is a scriptable command-line suite with r2pipe for Python. The skill covers workflows for all three toolchains.

How do I analyze a closed-source DLL's authentication logic?▼

List exports with dumpbin, identify auth-related functions by name, then decompile them in IDA or Ghidra. Dynamically, hook API calls with Frida, monitor network traffic, and trace function parameters to document behavior.

What are common anti-analysis tricks in binaries?▼

Common patterns include XOR string obfuscation, IsDebuggerPresent anti-debugging checks, API hashing with ror-13 loops, and stack string construction. Recognizing these patterns helps you bypass obfuscation during static analysis.

Is reverse engineering software legal and authorized?▼

This skill only supports authorized work: security research with permission, CTF competitions, defensive malware analysis, responsible vulnerability disclosure, and interoperability. It explicitly refuses unauthorized access, malware creation, and license bypass.

Related Skills

Explore More Software Engineering Skills→
dslsdzcdslsdzc
64

re-binaryninja

Analyze binaries with Binary Ninja using MLIL views and Python API automation.

Community
Advanced
kaminocorpkaminocorp
1

exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

Official
Advanced
dandyedandye
85

ioc-threat-hunt

Searches SIEM telemetry for indicators of compromise and documents findings in SOAR cases.

Community
Intermediate
lNwNllNwNl

code-obfuscation-deobfuscation

Analyzes and defeats binary code obfuscation including CFF, VM protectors, SMC, and string encryption.

Community
Advanced