30 skills · sorted by relevance
Inspect executable files from the command line with radare2, starting with file details, strings, and imported functions. Trace code through disassembly, compare binaries, automate inspections, or apply explicitly requested patches with verification.
Analyze compiled programs without running them by recognizing branches, loops, data structures, and common instruction patterns. Use disassembly and decompilation, which translate machine code into readable representations, to reconstruct program logic and document findings.
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
The English summary is being prepared. Showing the original description.
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.
The English summary is being prepared. Showing the original description.
Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate and disassemble a sample in r2.
The English summary is being prepared. Showing the original description.
Learn to examine compiled programs through one interactive lesson per session. Labs and quizzes cover file formats, machine instructions, program behavior, and analysis tools, while recorded observations provide evidence for completing each lesson and resuming later.
Transfer known function and variable names from an older binary to a newer version. Compare disassembly and pseudocode with an LLM, produce structured mappings, and apply names and comments in IDA.
Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.
Analyze Go malware binaries in Ghidra by extracting build metadata, function names, dependencies, and relevant strings. Use GoResolver to help recover obscured names and organize functions so analysts can focus their reverse engineering work.
Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains. Handles executable analysis, library inspection, protocol extraction, and vulnerability research. Use PROACTIVELY for binary analysis, CTF challenges, security research, or understanding undocumented software.
The English summary is being prepared. Showing the original description.
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
The English summary is being prepared. Showing the original description.
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
The English summary is being prepared. Showing the original description.
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow, session and address discipline, mutation and transaction rules, headless.run, task and error recovery, raw ghidra.call/ghidra.eval/ghidra.script escape hatches, and a sleep/timing-gate bypass recipe.
The English summary is being prepared. Showing the original description.
Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
The English summary is being prepared. Showing the original description.
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
The English summary is being prepared. Showing the original description.
Assembly programming and low-level debugging skill for reading, writing, explaining, optimizing, and reviewing assembly across x86, x86-64, ARM, AArch64, RISC-V, calling conventions, ABI boundaries, inline assembly, disassembly, stack frames, registers, and binary-level behavior. Use for .s/.asm files, compiler output, reverse-engineering snippets, low-level performance, and crash analysis.
The English summary is being prepared. Showing the original description.
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.
The English summary is being prepared. Showing the original description.
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
The English summary is being prepared. Showing the original description.
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
The English summary is being prepared. Showing the original description.
Carves injected PE images and position-independent shellcode from a memory dump or carved region, identifies the payload type, and prepares it for disassembly or emulation. Activates for requests to recover injected code, carve shellcode from memory, or reconstruct a dumped payload for analysis.
The English summary is being prepared. Showing the original description.
Uses capa to identify malware capabilities from a binary: running rule-based detection over disassembly, mapping matched capabilities to MITRE ATT&CK and MBC, and interpreting results to focus deeper analysis. Activates for requests to run capa, generate a capability report, or map a sample's behaviors to ATT&CK automatically.
The English summary is being prepared. Showing the original description.
Plan and run safe reverse engineering, decompilation, disassembly, instrumentation, de-obfuscation, and anti-analysis countermeasures for binaries, firmware, mobile apps, WebAssembly, JavaScript bundles, and .NET assemblies. Use for behavior reconstruction, cross-layer Electron tracing, REA, reversing strategy, decompiler selection, binary analysis, malware-style triage, unpacking, deobfuscation, defeating anti-debug or anti-VM checks, Wakaru, Ghidra, IDA, RetDec, radare2, Rizin, Frida, angr, YARA, or command scripts that capture analysis stats.
The English summary is being prepared. Showing the original description.
Reverse-engineers and debugs macOS and iOS binaries with Hopper Disassembler and LLDB: ObjC/Swift symbols, dyld loading, framework internals, and crash investigation from disassembly. Use when private API behavior or a runtime crash needs to be understood at the binary level.
The English summary is being prepared. Showing the original description.
Implement or extend a CPU architecture, processor variant, instruction set, addressing modes, registers, interrupts, bus transactions, disassembly, timing, and processor tests in EMULATORS. Use when adding a processor not yet emulated, deriving a CPU from F6500, FZ80, or another family, filling missing opcodes, correcting instruction semantics or cycles, or creating exhaustive instruction and interrupt tests.
The English summary is being prepared. Showing the original description.