{"enrichment":{"faq":[{"a":"vm-and-bytecode-reverse teaches systematic techniques for analyzing custom VMs by first identifying the dispatcher loop\u2014the core control structure that fetches and executes opcodes. Start by locating the main loop in the binary, map each opcode handler to its operation, and trace the execution flow. The skill covers both stack-based and register-based architectures, helping you understand fetch-decode-execute patterns and extract bytecode programs from protected binaries for deeper analysis.","q":"How to reverse engineer custom virtual machines?"},{"a":"vm-and-bytecode-reverse covers multiple bytecode analysis approaches: writing custom disassemblers tailored to your target ISA, using Ghidra Sleigh processors to define custom instruction sets, and applying dynamic instrumentation for runtime tracing. The skill teaches opcode mapping and ISA reconstruction techniques, enabling you to convert raw bytecode into human-readable mnemonics and understand the semantic meaning of each instruction in stack-based, register-based, and esoteric VM designs.","q":"What methods does vm-and-bytecode-reverse use for bytecode disassembly?"},{"a":"vm-and-bytecode-reverse provides a complete playbook for CTF reverse engineering, including techniques for identifying dispatcher loops, extracting bytecode from binary data sections, and solving maze-style components embedded in VM implementations. The skill teaches automated maze solving using BFS algorithms and symbolic execution through virtual machines, allowing you to navigate complex challenge structures and recover hidden flags from custom VM implementations.","q":"How does vm-and-bytecode-reverse help solve CTF VM challenges?"},{"a":"Yes. vm-and-bytecode-reverse covers analysis of commercial VM protectors like VMProtect and Themida, teaching deobfuscation techniques specific to their architectures. The skill addresses anti-debugging mechanisms in custom VMs, nested VM structures, and polymorphic handler analysis\u2014advanced patterns used by commercial protectors to defend against reverse engineering. These methods apply to both CTF challenges and real-world protected binaries.","q":"Can vm-and-bytecode-reverse analyze commercial protectors?"},{"a":"vm-and-bytecode-reverse integrates multiple approaches: static analysis using Ghidra and custom disassemblers, dynamic instrumentation for runtime VM tracing, symbolic execution to explore VM behavior, and pattern recognition for fetch-decode-execute loops. The skill teaches both manual analysis workflows and automated techniques like BFS-based maze solving, enabling you to choose the right tool for stack-based VMs, register-based architectures, brainfuck-like esoteric designs, and polymorphic protector implementations.","q":"What tools and techniques does vm-and-bytecode-reverse recommend?"},{"a":"vm-and-bytecode-reverse is structured for learners with reverse engineering fundamentals. It progresses from identifying basic dispatcher patterns and mapping simple opcodes to advanced topics like nested VMs, anti-debugging, and commercial protector analysis. The skill emphasizes systematic methodology\u2014start with pattern recognition, extract bytecode, build a disassembler, then apply symbolic execution\u2014making complex VM analysis approachable through step-by-step techniques applicable to CTF challenges and real binaries alike.","q":"Is vm-and-bytecode-reverse suitable for beginners?"}],"shadow_tags":["binary-analysis","bytecode-disassembly","ctf-techniques","code-protection","dynamic-analysis","instruction-set","handler-extraction","constraint-solving","obfuscation-removal","emulation-tools"],"summary_rewrite":"This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations."},"files":[{"bytes":14951,"path":"skills/vm-and-bytecode-reverse/SKILL.md","sha256":"4da387769cea8a3c17ba2fa919771c24d122cc52eb58be3e95e666e4916886b1","url":"https://skillfed.io/files/yaklang/hack-skills/vm-and-bytecode-reverse/e8e3d4b0/SKILL.md"}],"id":"yaklang/hack-skills/vm-and-bytecode-reverse","links":{"html":"https://skillfed.io/yaklang/hack-skills/vm-and-bytecode-reverse","md":"https://skillfed.io/yaklang/hack-skills/vm-and-bytecode-reverse.md","repo":"https://github.com/yaklang/hack-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":196,"language":"CSS","last_updated":"2026-06-16","license":"MIT","name":"vm-and-bytecode-reverse","publisher":"yaklang","stars":1480},"relations":{"similar":[{"id":"yaklang/hack-skills/code-obfuscation-deobfuscation"},{"id":"Aradotso/hermes-skills/hermes-dec-bytecode-reverse-engineering"},{"id":"mohitmishra786/low-level-dev-skills/interpreters"},{"id":"ljagiello/ctf-skills/ctf-reverse"},{"id":"PlamenTSV/plamen/execution-client-hardening"},{"id":"gmh5225/awesome-game-security/reverse-engineering"},{"id":"mohitmishra786/low-level-dev-skills/baremetal-startup"},{"id":"mohitmishra786/low-level-dev-skills/assembly-arm"},{"id":"ljagiello/ctf-skills/ctf-pwn"},{"id":"ricardoquesada/regenerator2000/coding"}]},"slug":{"owner":"yaklang","repo":"hack-skills","skill":"vm-and-bytecode-reverse"},"version":"e8e3d4b0"}