binary-triage
Binary Triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use this when you need a fast overview before diving into detailed reverse engineering.
Binary Triage quickly surveys a program's memory, strings, imports, and functions to identify what it does and flag suspicious behavior.
AI-generated summary based on this skill's SKILL.md
Install
cyberkaida/reverse-engineering-assistant/binary-triage · repository language: Java
git clone https://github.com/cyberkaida/reverse-engineering-assistant
cp -r reverse-engineering-assistant/ReVa/skills/binary-triage ~/.claude/skills/binary-triagenpx skillfed install cyberkaida/reverse-engineering-assistant/binary-triageFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What is binary-triage and what does it do?
Binary-triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use binary-triage when you need a fast overview before diving into detailed reverse engineering.
How does binary-triage help analyze executable files quickly?
Binary-triage streamlines the initial phase of binary analysis by automating the survey of executable structure. It extracts suspicious strings, catalogs imports and functions, and analyzes memory layout to identify packed or encrypted code. This lets you understand what an unknown binary does and spot red flags without manual inspection, creating an actionable task list for deeper investigation.
Can binary-triage examine PE and ELF executables?
Yes, binary-triage is designed to examine both PE (Windows) and ELF (Linux) executable formats. It surveys the binary structure of these formats, analyzes their memory layout and sections, and extracts key metadata like imports, functions, and embedded strings to help you quickly understand program behavior across different platforms.
How does binary-triage detect suspicious behavior in binaries?
Binary-triage identifies suspicious imports, strings, and behaviors by systematically cataloging all imports and functions, then cross-referencing them against known red flags. It surfaces anomalies in memory layout that suggest packed or encrypted code, helping you spot malicious indicators early and prioritize which areas need deeper reverse engineering attention.
What is the typical reverse engineering workflow using binary-triage?
Binary-triage serves as your starting point in the reverse engineering workflow. First, run it on an unknown executable to get a rapid overview of structure, imports, strings, and potential red flags. This initial triage creates a prioritized task list for further investigation, letting you decide whether to proceed with deeper analysis and where to focus your efforts.
Is binary-triage suitable for malware analysis?
Yes, binary-triage is well-suited for malware triage workflows. It quickly identifies suspicious imports, strings, and behaviors that indicate malicious code, helping you assess whether a program is a threat before committing to detailed reverse engineering. Its systematic approach to surveying executable structure makes it an efficient starting point for security analysis.
SKILL.md
rendered from the published skill — quoted content, verbatim
Binary Triage
Instructions
We are triaging a binary to quickly understand what it does. This is an initial survey, not deep analysis. Our goal is to: 1. Identify key components and behaviors 2. Flag suspicious or interesting areas 3. Create a task list of next steps for deeper investigation
Binary triage with ReVa
Follow this systematic workflow using ReVa's MCP tools:
1. Identify the Program
- Use
get-current-programto see the active program - Or use
list-project-filesto see available programs in the project - Note the
programPath(e.g., "/Hatchery.exe") for use in subsequent tools
2. Survey Memory Layout
- Use
get-memory-blocksto understand the binary structure - Examine key sections:
.text- executable code.data- initialized data.rodata- read-only data (strings, constants)
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
ReVa/skills/binary-triage/SKILL.md