55 skills · sorted by relevance
Analyze compiled programs without running them by recognizing branches, loops, data structures, and common instruction patterns. Use disassembly and decompilation, which translate machine code into readable representations, to reconstruct program logic and document findings.
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.
The English summary is being prepared. Showing the original description.
Inspect authorized Android APKs by unpacking files, reading decompiled Java, and observing runtime behavior with Frida. The skill also guides smali bytecode changes, rebuilding and signing packages, and deciding when native .so libraries need further analysis.
Guide an authorized Android security assessment from app inventory and APK acquisition to decompilation, embedded secret checks, exposed component review, runtime inspection, and network traffic analysis. The skill provides documentation and examples rather than bundled executable helpers.
Analyze binaries with Ghidra to locate important functions, follow references, and inspect decompiled code, a readable approximation of the original program. Support both interactive investigation and automated batch analysis without a graphical interface.
Inspect Android APKs from the command line to understand app logic, permissions, and components. Supports Java decompilation, low-level code edits, rebuilding and signing, plus Frida observation of running methods and routing to native code analysis.
Understand compiled Go and Rust programs even when function names have been removed. Use runtime clues, recovered metadata, and error strings to identify important functions and trace application logic with language-specific reverse engineering methods.
Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
The English summary is being prepared. Showing the original description.
Domain routing and boundary guidance for authorized reverse engineering analysis, including decompilation, debugging, protocol reversing, firmware extraction, and deobfuscation. Use when a task belongs to the reverse engineering domain and needs scope, evidence, pivot, or exit criteria.
The English summary is being prepared. Showing the original description.
Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains. Handles executable analysis, library inspection, protocol extraction, and vulnerability research. Use PROACTIVELY for binary analysis, CTF challenges, security research, or understanding undocumented software.
The English summary is being prepared. Showing the original description.
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
The English summary is being prepared. Showing the original description.
Use for reverse engineering stripped Go and Rust binaries including runtime recognition, pclntab/moduel data recovery, panic strings, and idiomatic decompilation recovery.
The English summary is being prepared. Showing the original description.
Deep Mobile Security Red Team persona. Executes OWASP MASTG procedures including APK/IPA decompilation, Frida dynamic hooking, biometric bypasses, and local database decryption.
The English summary is being prepared. Showing the original description.
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
The English summary is being prepared. Showing the original description.
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"
The English summary is being prepared. Showing the original description.
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
The English summary is being prepared. Showing the original description.
Android APK reverse engineering: unpacking, Java decompilation, smali modification, repacking and signing, Frida dynamic hooking, and native .so analysis with jadx, apktool, adb, and related tools.
The English summary is being prepared. Showing the original description.
Use when users request Android competitor research, systematic feature or interface mapping, evidence screenshots, interaction coverage, comparison-ready product dossiers, or Android system-boundary verification without APK decompilation.
The English summary is being prepared. Showing the original description.
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow, session and address discipline, mutation and transaction rules, headless.run, task and error recovery, raw ghidra.call/ghidra.eval/ghidra.script escape hatches, and a sleep/timing-gate bypass recipe.
The English summary is being prepared. Showing the original description.
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
The English summary is being prepared. Showing the original description.
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
The English summary is being prepared. Showing the original description.
Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by inventorying the archive, reading the manifest entry point, detecting obfuscators and string encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates for requests to analyze a malicious JAR, inspect Java malware, or identify a Java RAT.
The English summary is being prepared. Showing the original description.