114 skills · sorted by relevance
Learn to examine compiled programs through one interactive lesson per session. Labs and quizzes cover file formats, machine instructions, program behavior, and analysis tools, while recorded observations provide evidence for completing each lesson and resuming later.
Analyze Android packages by decompiling them into readable code. Identify app structure, list API endpoints—the addresses used for network requests—and trace how screen actions reach those requests, producing source files and structured documentation.
Make AI truly understand large codebases: for multi-repository, multi-microservice projects that have evolved over years, run architecture reverse-engineering + a Graph RAG graph + multi-language AST to compress a huge codebase into a structured knowledge base, where every conclusion traces back to a code line and every relation carries a confidence label. Suited to projects with 10+ repositories or microservices that AI cannot understand globally by reading the code directly. Triggers: architecture analysis, architecture reverse-engineering, codebase knowledge base, code-to-knowledge, architecture wiki, large multi-repo codebase. Loaded on demand by the teamai discovery stub.
The English summary is being prepared. Showing the original description.
Decompile Android APK, XAPK, JAR, and AAR files using jadx or Fernflower/Vineflower. Reverse engineer Android apps, extract HTTP API endpoints, trace call flows from UI to network layer, and analyze runtime behavior with Frida, network capture, JNI/SO inspection, and signature generation. Use when the user wants to decompile, analyze, hook, inspect network traffic, bypass SSL pinning for analysis, locate crypto or signing logic, or follow call flows in Android packages.
The English summary is being prepared. Showing the original description.
Binary analysis, assembly interpretation, disassembly, decompilation, firmware RE, and protocol reverse engineering
The English summary is being prepared. Showing the original description.
Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days
The English summary is being prepared. Showing the original description.
Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.
The English summary is being prepared. Showing the original description.
Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.
The English summary is being prepared. Showing the original description.
Reverse engineers malware written in less-common compiled languages (Nim, Crystal, V, Zig, D) by detecting language-specific runtime signatures, name-mangling, and runtime strings to orient analysis. Activates for requests to reverse Nim malware, identify the source language of an exotic binary, or analyze Crystal/V/Zig/D compiled samples.
The English summary is being prepared. Showing the original description.
Turns reverse-engineering findings into durable YARA detections: selecting stable code constructs and constants over volatile strings, extracting opcode/byte patterns with wildcards, and validating rules for low false positives. Activates for requests to write a YARA rule from reversed code, create a detection signature, or convert RE findings into hunting rules.
The English summary is being prepared. Showing the original description.
Reverses proprietary command-and-control protocols: locating send/recv routines, recovering the message framing and encryption/encoding, and reconstructing the command set to build a decoder or emulator. Activates for requests to reverse a custom C2 protocol, decode beacon traffic, or document a malware command structure.
The English summary is being prepared. Showing the original description.
Analyzes position-independent shellcode: disassembling raw bytes at the right architecture, recognizing PEB-walk API resolution and egg hunters, and emulating execution to recover behavior and payloads. Activates for requests to analyze shellcode, disassemble raw position-independent code, or emulate a shellcode blob.
The English summary is being prepared. Showing the original description.
Reverse engineers ARM/AArch64 malware by identifying the architecture and instruction set state (ARM/Thumb), parsing ELF/Mach-O ARM headers, and orienting analysis around the ARM calling convention. Activates for requests to reverse ARM binaries, analyze AArch64 malware, or handle ARM/Thumb instruction-set decoding.
The English summary is being prepared. Showing the original description.
Uses Ghidra to disassemble and decompile a binary, navigate to key routines via imports and strings, annotate decompiled code, and run headless scripts to automate extraction of C2, crypto, and config. Activates for requests to reverse engineer with Ghidra, decompile a binary, or script Ghidra headless analysis.
The English summary is being prepared. Showing the original description.
Reverse engineers binaries using radare2/rizin interactively, covering analysis initialization, navigation, disassembly and graph views, patching, and the visual mode workflow. Activates for requests to reverse a binary with radare2 or rizin, learn r2 commands, or navigate and disassemble a sample in r2.
The English summary is being prepared. Showing the original description.
Reverse engineers binaries with Binary Ninja using its analysis stack and Python API to enumerate functions, navigate IL levels (LLIL/MLIL/HLIL), and automate annotation and extraction. Activates for requests to reverse a binary with Binary Ninja, script the Binary Ninja API, or work with its intermediate languages.
The English summary is being prepared. Showing the original description.
Analyze compiled .NET and C# programs by identifying managed files, removing obfuscation, inspecting intermediate instructions, and debugging runtime behavior. Save extracted configuration and code changes as evidence for further review.
Investigate how compiled or obfuscated programs work, including binaries, APKs, WASM, and firmware. Combine file inspection, decompilation, and observed execution to understand control flow, validation logic, and mechanisms that hinder analysis.
Capture and analyze network traffic to understand custom protocols, including message boundaries and field meanings. Use the findings to document formats, investigate communication problems, and validate behavior through replay and tests with unusual inputs.
Analyze how ransomware encrypts files and manages keys to assess whether decryption is feasible. Examine implementation weaknesses, check existing decryptors, and document recovery options with technical reasons for the assessment.
Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.
Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
Analyze Cobalt Strike communication profiles and Beacon payload configurations to extract request paths, headers, timing, and process injection settings. Turn these indicators into a JSON report and network detection rules for Suricata or Snort.