binary-triage
Binary Triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use this when you need a fast overview before diving into detailed reverse engineering.
Binary Triage quickly surveys a program's memory, strings, imports, and functions to identify what it does and flag suspicious behavior.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-21
Binary Triage quickly surveys a program's memory, strings, imports, and functions to identify what it does and flag suspicious behavior. Binary Triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use this when you need a fast overview before diving into detailed reverse engineering.
Use it when
- Binary-triage streamlines the initial phase of binary analysis by automating the survey of executable structure.
- Yes, binary-triage is designed to examine both PE (Windows) and ELF (Linux) executable formats.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
cyberkaida/reverse-engineering-assistant/binary-triage · repository language: Java
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is binary-triage and what does it do?
Binary-triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use binary-triage when you need a fast overview before diving into detailed reverse engineering.
How does binary-triage help analyze executable files quickly?
Binary-triage streamlines the initial phase of binary analysis by automating the survey of executable structure. It extracts suspicious strings, catalogs imports and functions, and analyzes memory layout to identify packed or encrypted code. This lets you understand what an unknown binary does and spot red flags without manual inspection, creating an actionable task list for deeper investigation.
Can binary-triage examine PE and ELF executables?
Yes, binary-triage is designed to examine both PE (Windows) and ELF (Linux) executable formats. It surveys the binary structure of these formats, analyzes their memory layout and sections, and extracts key metadata like imports, functions, and embedded strings to help you quickly understand program behavior across different platforms.
How does binary-triage detect suspicious behavior in binaries?
Binary-triage identifies suspicious imports, strings, and behaviors by systematically cataloging all imports and functions, then cross-referencing them against known red flags. It surfaces anomalies in memory layout that suggest packed or encrypted code, helping you spot malicious indicators early and prioritize which areas need deeper reverse engineering attention.
What is the typical reverse engineering workflow using binary-triage?
Binary-triage serves as your starting point in the reverse engineering workflow. First, run it on an unknown executable to get a rapid overview of structure, imports, strings, and potential red flags. This initial triage creates a prioritized task list for further investigation, letting you decide whether to proceed with deeper analysis and where to focus your efforts.
Is binary-triage suitable for malware analysis?
Yes, binary-triage is well-suited for malware triage workflows. It quickly identifies suspicious imports, strings, and behaviors that indicate malicious code, helping you assess whether a program is a threat before committing to detailed reverse engineering. Its systematic approach to surveying executable structure makes it an efficient starting point for security analysis.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Binary Triage
Instructions
We are triaging a binary to quickly understand what it does. This is an initial survey, not deep analysis. Our goal is to: 1. Identify key components and behaviors 2. Flag suspicious or interesting areas 3. Create a task list of next steps for deeper investigation
Binary triage with ReVa
Follow this systematic workflow using ReVa's MCP tools:
1. Identify the Program
- Use
get-current-programto see the active program - Or use
list-project-filesto see available programs in the project - Note the
programPath(e.g., "/Hatchery.exe") for use in subsequent tools
2. Survey Memory Layout
- Use
get-memory-blocksto understand the binary structure - Examine key sections:
.text- executable code.data- initialized data.rodata- read-only data (strings, constants)
(truncated - see the full file via the links below)
File tree — 1 file
ReVa/skills/binary-triage/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Quickly understand what an unknown binary does and identify red flags”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity. Use it after initial triage to drill into suspicious areas or answer targeted questions about binary behavior.
ctf-rev guides you through reverse engineering CTF challenges using structured methodologies for program comprehension. Learn to identify critical code paths, trace input transformations, recognize standard algorithms, and extract hidden flags through static analysis, dynamic observation, or hybrid approaches tailored to each challenge type.
CTF Crypto helps you investigate cryptographic implementations embedded in compiled binaries through systematic detection, algorithm identification, and weakness analysis. Trace key sources, recognize standard algorithms and custom ciphers, and exploit implementation flaws to recover plaintext or extract keys.
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
Reverse Engineering equips you to analyze unknown binaries through structured workflows using Ghidra, radare2, and Binary Ninja. Master initial triage with standard tools, decompilation and scripting, C++ pattern recognition in stripped binaries, and binary diffing for vulnerability analysis.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
More skills ctf-malware (MIT)