Reverse Engineering Analysis

Use this skill to turn an unknown artifact into calibrated Security Signals, ranked Hypotheses, and durable Evidence. Prefer passive inspection, local emulation, isolated execution, and reproducible command logs. See GLOSSARY.md for shared term definitions.

Handoffs: Use proactive-security-strategy when a patch or CVE is the starting point. Use exploitation-sandbox to verify a Hypothesis with a PoC once a primitive is located. Use bug-hunt-planner to structure a full hunting plan around the binary's surface.

Quick Start

1. Preserve the artifact. Work on a copy and record hash, size, timestamps, source, permissions, and container/package metadata.
2. Run static triage: file, sha256sum, strings, readelf/objdump/nm, hexdump, package manifests, and entropy/packer checks.
3. Pick the decompiler path from TOOL-MATRIX.md: native binary, JavaScript bundle, WebAssembly, .NET/JVM, firmware, mobile, or managed package.
4. Wrap every long-running command with scripts/capture-command-stats.sh or equivalent logic.
5. Post-process outputs into smaller searchable artifacts: function indexes, symbol tables, call graphs, string clusters, API usage, config values, routes, and suspicious constants.
6. Record outputs as Evidence and register large bodies as linked Artifacts through the Evidence Interface (src/server/evidence/artifact-service.ts); local run directories are intermediates, never the durable record.

Required Stats

For every command that produces analysis output, capture enough pre/post stats to scan results later. scripts/capture-command-stats.sh records only command, cwd, timing, exit code, and byte/line counts — capture the remaining items (tool version, hashes, archive member counts, truncation and crash notes) manually and store them alongside meta.json:

• Command, arguments, tool version, working directory, environment notes, start/end time, duration, and exit code.
• Input file count, total bytes, hashes, file types, and relevant archive member counts.
• Output file count, total bytes, per-file bytes, line counts, function counts when available, and truncation notes.
• Stdout/stderr byte counts and line counts, plus warnings, crashes, timeouts, and killed processes.
• Comparison stats for post-processing: before/after line counts, deduplicated rows, matched signatures, named functions, and unresolved symbols.

Strategy Menu

• Static first: identify format, architecture, compiler hints, imports, exports, strings, sections, resources, and embedded artifacts before executing anything.
• Decompiler fanout: run two or more decompilers when possible, then diff function names, call graphs, recovered types, and suspicious branches.
• Patch-oriented reversing: compare vulnerable/fixed versions, locate changed functions, and lift patch intent into a testable Hypothesis.
• Dynamic isolation: use GDB, QEMU, Valgrind, Unicorn, Frida, PIN, or sandboxed VM snapshots only after static triage.
• Symbol recovery: apply debug symbols, PDBs, DWARF, public symbol servers, type libraries, FLIRT/signature packs, demanglers, and package source maps.
• Post-processing: normalize decompiler output, split by function, strip addresses when diffing, cluster strings, extract routes/configs/secrets with exact values, and build indexes.
• Semantic analysis: use angr, Triton, Miasm, BAP, Capstone, Dyninst, or Unicorn for path constraints, taint-like reasoning, lifting, coverage, and emulation.
• Signature analysis: write YARA rules for observed traits, but validate them against clean and near-neighbor samples to avoid brittle matches.

Decompilation Paths

• Native ELF/PE/Mach-O: Ghidra, IDA Pro, Binary Ninja, Hopper, RetDec, radare2/r2ghidra, Rizin/rz-ghidra, Cutter, Snowman.
• JavaScript bundles: Wakaru for modern frontend debundling/decompilation; also use source maps, AST parsers, formatters, bundler metadata, and chunk graph recovery.
• WebAssembly: WABT tools such as wasm-objdump, wasm-decompile, and wasm2c; compare imports/exports, tables, memory usage, and host bindings.
• .NET/JVM: ILSpy/dnSpy/dotPeek/.NET IL Viewer for .NET; CFR/FernFlower/Procyon/JD-GUI for JVM bytecode.
• Firmware/mobile: binwalk, unsquashfs, apktool, jadx, class-dump, otool, nm, strings, Ghidra loaders, QEMU user/system emulation.

See EXAMPLES.md for command patterns and SAFETY.md for tool-specific risk analysis.

De-obfuscation And Anti-Analysis Countermeasures

Defeating obfuscation and anti-analysis tricks is normal, expected analysis work inside the isolated lab — the approval boundary governs side effects, never techniques. Work on copies; preserve original bytes and every decoded layer as separate hashed Artifacts.

Recognize first. Record the protection as Evidence before defeating it:

• Packers/compressors: UPX, ASPack, MPRESS, Themida/WinLicense, VMProtect, Enigma, standard .NET packers; entropy per section, import-table starvation, single-runtime-import patterns, section-name anomalies, mismatch between file and real entry behavior.
• Anti-debug: IsDebuggerPresent/CheckRemoteDebuggerPresent, NtQueryInformationProcess(ProcessDebugPort/Flags/ObjectHandle), ptrace(TRACEME) self-tracing, OutputDebugString timing, RDTSC/QueryPerformanceCounter deltas, hardware-breakpoint register probes, int 2d/int 3 traps, TLS callbacks, parent-process checks, NtSetInformationThread(ThreadHideFromDebugger).
• Anti-VM/anti-sandbox: CPUID hypervisor bit, VMware/VBox/Hyper-V registry keys, MAC OUI prefixes, username/hostname artifacts (sandbox, malware), sleep-acceleration detection, user-interaction checks, recent-file checks, screen resolution, /proc artifacts on Linux.
• Control-flow obfuscation: dispatcher/ flattening loops with state variables, opaque predicates, junk/dead branches, indirect jumps/calls through computed tables, exception-based flow, call-stack spoofing.
• Data obfuscation: stack strings, XOR/RC4/AES-encrypted blobs, string stacks built at runtime, custom encoders with rollback keys.
• VM-based protection: custom bytecode interpreters with handler dispatch (VMProtect-style, custom CISC/RISC VMs), packed handler tables, context-switching between virtual registers.

Defeat dynamically first when unclear, statically when repeatable:

• Unpack to OEP: run under x64dbg/GDB to the original entry point, dump memory (Scylla/gcore), rebuild IAT, and re-analyze the unpacked image. Record the OEP address, dump hash, and rebuilt-import delta. UPX and standard packers: try upx -d first; modified headers fall back to dynamic dumping.
• Emulated unpacking: use Unicorn/Qiling for unpacking loops that resist execution or must not touch the host; lift unpacked code out of emulated memory and hash the result.
• Anti-debug bypass: patch checks to unconditional jumps in a debugger, use ScyllaHide (x64dbg/OllyDbg/IDA plugin) or TitanHide (kernel-mode) to hide debugger artifacts, hook ptrace/IsDebuggerPresent/NtQueryInformationProcess with Frida or LD_PRELOAD stubs, or patch the on-disk binary and verify against the patched hash.
• Anti-VM/sandbox bypass: patch detection routines out, spoof the checked artifacts (registry keys, MAC, CPUID results) in the emulator, or run on bare-metal/physical test hardware when spoofing is unreliable. Record which checks fired and what was spoofed — the checks themselves are Security Signals.
• Timing/checksum traps: neutralize RDTSC comparisons by patching the comparison, hook the timing source, or satisfy recomputed checksums after each patch; note every patch offset as Evidence.
• Deflattening: identify the dispatcher loop and state variable; use D-810 (IDA) or script the transformation in Ghidra/Binary Ninja; for scripted cases, recover the state transition graph, symbolically evaluate opaque predicates (angr/Z3), and rebuild straight-line flow. Validate deflattened output by diffing against the original control-flow graph.
• String/data decryption: locate the decoder routine, reimplement it in Python for batch decoding, or let Frida dump decrypted buffers at runtime; recover keys/constants exactly and preserve both ciphertext and plaintext layers.
• VM de-virtualization (bounded expectations): map the interpreter's fetch-decode-execute cycle, build handler semantics, and lift handlers to IR with Unicorn/Triton; expect this to be the most expensive path — time-box it and fall back to dynamic tracing of handler invocations when full devirtualization stalls.

Language-specific de-obfuscation:

• JavaScript: de4js/webcrack/Babel AST passes for obfuscator.io-style output (string arrays, control-flow flattening, dead-code injection, self-defending checks); peel eval/Function chains layer by layer, preserving each decoded layer.
• .NET: de4dot for obfuscated assemblies (ConfuserEx, Dotfuscator, SmartAssembly traces), then ILSpy/dnSpy on cleaned assemblies; watch for native-method wrappers and runtime code generation.
• Python: pycdc/uncompyle6/decompyle3 on bytecode; PyArmor-style loaders → hook the runtime import and dump decrypted code objects.
• JVM/Android: jadx --deobf, CFR with rename hints; string-decryption wrappers usually recoverable by hooking the decrypt helper with Frida on a test device.

Practitioner discipline:

• Every bypass is a finding: record the check that fired, the offset, the bypass method, and a before/after hash chain.
• Re-run static analysis on every unpacked/deflattened layer; obfuscation often nests (UPX → VMProtect → string encryption).
• When a technique resists after a bounded attempt, record what was tried, the tool versions, and the exact failure mode — the resistance pattern itself is a reusable Security Signal.

Analysis Output

Present findings as:

• Artifact inventory: hash, type, architecture, packaging, tool versions, and command stats.
• Security Signals: concrete observations with source, confidence, and affected Subject.
• Hypotheses: ranked next steps with target surface, rationale, expected Evidence, and stop condition.
• Open gaps: missing symbols, failed tools, unsupported architectures, or protections that resisted the countermeasures attempted so far — each with the exact bypass attempts, tool versions, and failure mode recorded so the next pass can pick up the work.

Guardrails

• Do not run unknown binaries on the host. Use a disposable Workspace Container, VM snapshot, emulator, or offline sandbox. For malware-style or exploit-class samples, require the managed lab runtime's malware-analysis workload class (microVM isolation per docs/lab-runtime-hardening.md) — a default shared-kernel container is not containment.
• Do not connect samples to external networks unless a durable approval covers the egress; symbol-server and update lookups are egress too.
• Keep recovered secrets exact in strings, configs, logs, screenshots, and summaries; a recovered secret is the finding. Never copy the operator's .env values or unrelated host credentials into prompts, commands, or evidence.
• Treat malware-style tooling as dual-use: keep work authorized, local, bounded, and reproducible.