deep-analysis
Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity. Use it after initial triage to drill into suspicious areas or answer targeted questions about binary behavior.
Deep Analysis performs systematic depth-first investigation of specific binary behaviors through iterative code analysis and Ghidra database improvement.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-21
Deep Analysis performs systematic depth-first investigation of specific binary behaviors through iterative code analysis and Ghidra database improvement. Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity. Use it after initial triage to drill into suspicious areas or answer targeted questions about binary behavior.
Use it when
- Deep Analysis identifies cryptographic operations in reverse-engineered code by systematically examining function calls, constant patterns.
- Yes.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
cyberkaida/reverse-engineering-assistant/deep-analysis · repository language: Java
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does deep-analysis do for reverse engineering?
Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity.
How does deep-analysis detect crypto in malware?
Deep Analysis identifies cryptographic operations in reverse-engineered code by systematically examining function calls, constant patterns, and data transformations. It traces suspicious behaviors through the binary to locate encryption routines, hardcoded keys, and algorithm signatures, then documents findings with evidence-based annotations in your Ghidra database.
Can deep-analysis help investigate suspicious code behavior?
Yes. Deep Analysis performs systematic depth-first investigation of specific binary behaviors by following investigation threads completely rather than surveying broadly. It traces data flow through functions, examines obfuscated logic, and answers targeted questions about what code does—ideal after initial triage to drill into high-risk areas.
Does deep-analysis improve ghidra decompilation?
Deep Analysis improves code readability through variable renaming and type correction within your Ghidra database. As it investigates, it makes incremental improvements to variable names, function signatures, and type annotations, turning cryptic decompiled output into clearer, more maintainable reverse-engineered code.
How can deep-analysis find C2 command and control addresses?
Deep Analysis traces network communication and locates C2 indicators in binaries by systematically examining function calls, string references, and data structures related to network operations. It follows communication threads through the code, identifies hardcoded addresses or domain patterns, and documents findings as evidence within your analysis.
When should I use deep-analysis in my workflow?
Use Deep Analysis after initial triage when you have a specific binary question to answer—whether investigating a suspicious function, confirming encryption usage, or locating network indicators. It excels at focused, depth-first investigation rather than broad surveys, making it ideal for drilling into targeted areas with evidence-based findings.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Deep Analysis
Purpose
You are a focused reverse engineering investigator. Your goal is to answer specific questions about binary behavior through systematic, evidence-based analysis while improving the Ghidra database to aid understanding.
Unlike binary-triage (breadth-first survey), you perform depth-first investigation: - Follow one thread completely before branching - Make incremental improvements to code readability - Document all assumptions with evidence - Return findings with new investigation threads
Core Workflow: The Investigation Loop
Follow this iterative process
(truncated - see the full file via the links below)
File tree — 3 files
ReVa/skills/deep-analysis/SKILL.md
ReVa/skills/deep-analysis/examples.md
ReVa/skills/deep-analysis/patterns.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Perform systematic depth-first investigation of specific binary behaviors”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Binary Triage performs an initial survey of unknown programs to rapidly assess what they do and surface red flags. It systematically examines memory layout, extracts and analyzes strings, catalogs imports and functions, then cross-references findings to prioritize deeper investigation. Use this when you need a fast overview before diving into detailed reverse engineering.
CTF Crypto helps you investigate cryptographic implementations embedded in compiled binaries through systematic detection, algorithm identification, and weakness analysis. Trace key sources, recognize standard algorithms and custom ciphers, and exploit implementation flaws to recover plaintext or extract keys.
ctf-rev guides you through reverse engineering CTF challenges using structured methodologies for program comprehension. Learn to identify critical code paths, trace input transformations, recognize standard algorithms, and extract hidden flags through static analysis, dynamic observation, or hybrid approaches tailored to each challenge type.
CTF Binary Exploitation guides you through discovering and exploiting memory corruption vulnerabilities to read flags. Learn to analyze data flow, identify unsafe APIs, map memory layouts, and chain exploitation primitives—from buffer overflows to ROP chains—adapting core concepts to any pwn challenge.
ctf-crypto is a reference guide for cryptographic attack methods in CTF competitions, covering classical and modern cipher exploits, RSA and ECC vulnerabilities, lattice-based attacks, PRNG state recovery, and zero-knowledge proof breaks. It includes practical one-liners and supporting documentation for techniques like padding oracles, key derivation weaknesses, and Coppersmith attacks, with setup instructions for Python packages and external tools.
ctf-malware equips you with techniques for dissecting malware in CTF competitions, covering obfuscated scripts, binary analysis, network traffic decryption, and evasion detection. It guides you through static analysis with tools like YARA and Capstone, dynamic analysis with strace and ltrace, and memory forensics with Volatility, plus custom crypto protocol identification and malware configuration extraction.