{"enrichment":{"faq":[{"a":"Reverse Engineering with Ghidra begins by loading your binary into the tool's project manager, then using the auto-analysis feature to generate a control-flow graph and decompiled pseudocode. Navigate functions via the symbol tree, examine cross-references (xrefs) to trace data and control flow, and use the decompiler pane to read high-level reconstructed code. For stripped binaries, Reverse Engineering workflows combine Ghidra's function signature analysis with manual annotation to recover intent. Headless scripting via Ghidra's Python API automates batch analysis across multiple binaries.","q":"How to use Ghidra for binary decompilation?"},{"a":"Reverse Engineering with radare2 starts with `r2 <binary>` to enter the interactive shell, then `aaa` to auto-analyze all functions. Use `VV` to open visual graph mode for control-flow inspection, `pdf` to print disassembly of the current function, and `s <address>` to seek to specific locations. Reverse Engineering practice includes using `axt` to find cross-references, `iz` to list strings, and `e asm.syntax=att` to switch assembly dialects. Combine radare2 with `strings`, `xxd`, and `checksec` for initial triage before deep analysis.","q":"What is radare2 tutorial for analyzing unknown binaries?"},{"a":"Reverse Engineering stripped ELF files requires pattern matching and heuristics since symbol tables are removed. Start with `strings` and `xxd` for initial reconnaissance, then load the binary into Ghidra or radare2 and use function prologue detection to identify entry points. Reverse Engineering workflows use cross-reference analysis to map callers and callees, then manually annotate high-confidence functions. For C++ binaries, demangle vtable patterns and RTTI structures. Binary diffing tools like Diaphora compare your stripped binary against unstripped versions or similar firmware to infer symbol names and function boundaries.","q":"How do I reverse engineer stripped binaries to recover symbols?"},{"a":"Reverse Engineering recognizes C++ constructs by spotting vtable pointers (typically at object offset 0), virtual method dispatch sequences, and RTTI metadata. In Ghidra, use the decompiler to spot `this` pointer usage and method calls through function pointers. Reverse Engineering analysis looks for exception handling frames, name mangling (e.g., `_ZN...`), and constructor/destructor patterns. Tools like `c++filt` demangle symbol names. Radare2's `afl` lists all functions; filter for mangled names and cross-reference them with vtable structures to map class hierarchies and inheritance chains.","q":"How can Reverse Engineering identify C++ patterns in disassembly?"},{"a":"Reverse Engineering uses binary diffing tools like Diaphora to identify security patches between firmware versions. Load two binaries (old and new) into Diaphora, which performs function-level and byte-level comparison to highlight added, removed, or modified code. Reverse Engineering workflows use diffing results to isolate patched vulnerabilities, then analyze the changes in Ghidra or radare2 to understand the fix. This accelerates vulnerability research by focusing effort on changed functions rather than re-analyzing entire binaries.","q":"What is binary diffing for comparing firmware versions?"},{"a":"Reverse Engineering leverages Ghidra's Python API and radare2's r2pipe for batch automation. Write Ghidra scripts to iterate over all functions, extract metadata, and generate reports without manual GUI interaction. Radare2 scripting uses r2pipe (Python bindings) to send commands and parse output programmatically. Reverse Engineering automation handles tasks like finding all calls to a specific function, extracting strings and cross-references, or applying signatures across multiple binaries. Combine scripts with `checksec` to audit binary protections (NX, PIE, ASLR) at scale.","q":"How does Reverse Engineering automate analysis with scripting?"}],"shadow_tags":["static-analysis","binary-disassembly","malware-investigation","firmware-analysis","symbol-recovery","code-decompilation","vulnerability-diffing","anti-reversing","executable-inspection"],"summary_rewrite":"Reverse Engineering equips you to analyze unknown binaries through structured workflows using Ghidra, radare2, and Binary Ninja. Master initial triage with standard tools, decompilation and scripting, C++ pattern recognition in stripped binaries, and binary diffing for vulnerability analysis."},"files":[{"bytes":6104,"path":"skills/security/reverse-engineering/SKILL.md","sha256":"38726e18aba30e3bed0ac357eb2440d2969158c3b4bfe51b604237b7e8c48b1d","url":"https://skillfed.io/files/mohitmishra786/low-level-dev-skills/reverse-engineering/597f77fc/SKILL.md"}],"id":"mohitmishra786/low-level-dev-skills/reverse-engineering","links":{"html":"https://skillfed.io/mohitmishra786/low-level-dev-skills/reverse-engineering","md":"https://skillfed.io/mohitmishra786/low-level-dev-skills/reverse-engineering.md","repo":"https://github.com/mohitmishra786/low-level-dev-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":19,"language":"JavaScript","last_updated":"2026-06-27","license":"MIT","name":"reverse-engineering","publisher":"mohitmishra786","stars":148},"relations":{"similar":[{"id":"ljagiello/ctf-skills/ctf-reverse"},{"id":"hypnguyen1209/offensive-claude/reverse-engineering"},{"id":"mohitmishra786/low-level-dev-skills/elf-inspection"},{"id":"gmh5225/awesome-game-security/reverse-engineering"},{"id":"mohitmishra786/low-level-dev-skills/binary-hardening"},{"id":"blacklanternsecurity/red-run/unknown-vector-analysis"},{"id":"trailofbits/skills/dwarf-expert"},{"id":"FrancescoStabile/numasec/forensics-kit"},{"id":"mohitmishra786/low-level-dev-skills/binutils"},{"id":"mohitmishra786/low-level-dev-skills/dynamic-linking"}]},"slug":{"owner":"mohitmishra786","repo":"low-level-dev-skills","skill":"reverse-engineering"},"version":"597f77fc"}