deep-analysis
Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity. Use it after initial triage to drill into suspicious areas or answer targeted questions about binary behavior.
Deep Analysis performs systematic depth-first investigation of specific binary behaviors through iterative code analysis and Ghidra database improvement.
AI-generated summary based on this skill's SKILL.md
Install
cyberkaida/reverse-engineering-assistant/deep-analysis · repository language: Java
git clone https://github.com/cyberkaida/reverse-engineering-assistant
cp -r reverse-engineering-assistant/ReVa/skills/deep-analysis ~/.claude/skills/deep-analysisnpx skillfed install cyberkaida/reverse-engineering-assistant/deep-analysisFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What does deep-analysis do for reverse engineering?
Deep Analysis conducts focused, evidence-based investigation of specific binary questions—such as function purpose, cryptographic usage, or network indicators—through iterative analysis loops. Unlike breadth-first surveys, it follows investigation threads completely, making incremental improvements to variable names, types, and comments within the Ghidra database to enhance code clarity.
How does deep-analysis detect crypto in malware?
Deep Analysis identifies cryptographic operations in reverse-engineered code by systematically examining function calls, constant patterns, and data transformations. It traces suspicious behaviors through the binary to locate encryption routines, hardcoded keys, and algorithm signatures, then documents findings with evidence-based annotations in your Ghidra database.
Can deep-analysis help investigate suspicious code behavior?
Yes. Deep Analysis performs systematic depth-first investigation of specific binary behaviors by following investigation threads completely rather than surveying broadly. It traces data flow through functions, examines obfuscated logic, and answers targeted questions about what code does—ideal after initial triage to drill into high-risk areas.
Does deep-analysis improve ghidra decompilation?
Deep Analysis improves code readability through variable renaming and type correction within your Ghidra database. As it investigates, it makes incremental improvements to variable names, function signatures, and type annotations, turning cryptic decompiled output into clearer, more maintainable reverse-engineered code.
How can deep-analysis find C2 command and control addresses?
Deep Analysis traces network communication and locates C2 indicators in binaries by systematically examining function calls, string references, and data structures related to network operations. It follows communication threads through the code, identifies hardcoded addresses or domain patterns, and documents findings as evidence within your analysis.
When should I use deep-analysis in my workflow?
Use Deep Analysis after initial triage when you have a specific binary question to answer—whether investigating a suspicious function, confirming encryption usage, or locating network indicators. It excels at focused, depth-first investigation rather than broad surveys, making it ideal for drilling into targeted areas with evidence-based findings.
SKILL.md
rendered from the published skill — quoted content, verbatim
Deep Analysis
Purpose
You are a focused reverse engineering investigator. Your goal is to answer specific questions about binary behavior through systematic, evidence-based analysis while improving the Ghidra database to aid understanding.
Unlike binary-triage (breadth-first survey), you perform depth-first investigation: - Follow one thread completely before branching - Make incremental improvements to code readability - Document all assumptions with evidence - Return findings with new investigation threads
Core Workflow: The Investigation Loop
Follow this iterative process
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
ReVa/skills/deep-analysis/SKILL.md
ReVa/skills/deep-analysis/examples.md
ReVa/skills/deep-analysis/patterns.md