43 skills · sorted by relevance
Analyze binaries with Ghidra to locate important functions, follow references, and inspect decompiled code, a readable approximation of the original program. Support both interactive investigation and automated batch analysis without a graphical interface.
Analyze Go malware binaries in Ghidra by extracting build metadata, function names, dependencies, and relevant strings. Use GoResolver to help recover obscured names and organize functions so analysts can focus their reverse engineering work.
Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.
Operate the Ryuumonbuchi MCP server for headless Ghidra reverse engineering. Use when driving decompilation, disassembly, patching, type and symbol recovery, memory edits, transactions, and Ghidra project analysis through a Ryuumonbuchi server (stdio or streamable HTTP). Covers the safe read-only-first workflow, session and address discipline, mutation and transaction rules, headless.run, task and error recovery, raw ghidra.call/ghidra.eval/ghidra.script escape hatches, and a sleep/timing-gate bypass recipe.
The English summary is being prepared. Showing the original description.
Automates batch reverse engineering by generating Ghidra analyzeHeadless commands and post-analysis script skeletons to import, auto-analyze, and export results for many samples without the GUI. Activates for requests to script Ghidra headless analysis, batch-analyze samples with Ghidra, or generate an analyzeHeadless command and post-script.
The English summary is being prepared. Showing the original description.
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
The English summary is being prepared. Showing the original description.
Analyze compiled programs without running them by recognizing branches, loops, data structures, and common instruction patterns. Use disassembly and decompilation, which translate machine code into readable representations, to reconstruct program logic and document findings.
Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.
Inspect game code, data files, live memory, and graphics captures to understand the internals needed for a mod. Choose tools for the game’s technology, document findings, and validate unknown file formats by decoding and re-encoding them.
Use for free/open reverse engineering with Ghidra (headless or GUI), including decompile, cross-refs, and optional Ghidra MCP workflows when IDA is unavailable.
The English summary is being prepared. Showing the original description.
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.
The English summary is being prepared. Showing the original description.
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
The English summary is being prepared. Showing the original description.
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
The English summary is being prepared. Showing the original description.
Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction, and type reconstruction in stripped Go binaries.
The English summary is being prepared. Showing the original description.
Compare software binaries before and after a security patch to identify the underlying flaw. Guide creation of a proof of concept, a small vulnerability demonstration, and compare its behavior across patched and unpatched versions.
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"
The English summary is being prepared. Showing the original description.
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu missing", "tool not installed", "configure gdb", "cross-compiler"
The English summary is being prepared. Showing the original description.
ELF binary statik analiz — file, strings, objdump, readelf, nm, Ghidra workflow
The English summary is being prepared. Showing the original description.
Investigate crashes, hangs, incorrect responses, and other failures by testing hypotheses against observed runtime behavior. Confirm the cause, verify the fix with a reproducing test, check the real workflow, and remove temporary debugging artifacts.
Support authorized hardware security research by locating debug interfaces, recording pin assignments and voltage levels, and collecting boot logs. Assess interface locks and firmware extraction options, then hand extracted images to firmware analysis tools.
Understand compiled Go and Rust programs even when function names have been removed. Use runtime clues, recovered metadata, and error strings to identify important functions and trace application logic with language-specific reverse engineering methods.
Analyze authorized macOS applications and Mach-O binaries, the executable format used on macOS. Examine signatures, dependencies, Objective-C and Swift symbols, and runtime behavior to produce findings tied to specific addresses or symbols.
Analyze suspected malware through code inspection and behavior observed in an isolated environment. Extract indicators of compromise, such as suspicious domains and file paths, and create YARA file-matching rules or Sigma behavior-detection rules from the findings.
Test desktop application security across local storage, communication between processes, network traffic, and update channels. Map where trust and permissions change, then investigate weaknesses in credentials, access checks, and update verification.