reverse-engineering
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
Reverse Engineering helps you analyze and decompile unknown binaries to recover source code, identify vulnerabilities, and bypass protections.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/reverse-engineering · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/reverse-engineering ~/.claude/skills/reverse-engineeringnpx skillfed install hypnguyen1209/offensive-claude/reverse-engineeringFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse engineer a binary with Reverse Engineering?
Reverse Engineering covers both static and dynamic analysis techniques for compiled binaries. Use static tools like Ghidra or IDA Pro for disassembly and decompilation to recover source code structure. For dynamic analysis, employ debuggers like GDB or instrumentation frameworks like Frida to observe runtime behavior, trace execution paths, and identify vulnerabilities without executing untrusted code fully.
What anti-reversing protections can Reverse Engineering defeat?
Reverse Engineering addresses common protections including anti-debug mechanisms, control flow flattening, string encryption, and virtualization obfuscation (VMProtect, Themida, OLLVM). Techniques cover unpacking malware samples, devirtualization strategies, and deobfuscation methods to expose the underlying logic and enable security analysis of protected proprietary software.
Can Reverse Engineering extract firmware and UEFI/BIOS code?
Yes. Reverse Engineering includes firmware extraction and analysis workflows for UEFI, BIOS, and Secure Boot implementations. These techniques help researchers identify low-level vulnerabilities, analyze boot-time protections, and understand firmware-level security mechanisms critical for system hardening and vulnerability disclosure.
How does patch diffing discover vulnerabilities in Reverse Engineering?
Reverse Engineering enables patch diffing analysis to compare security updates and identify n-day exploits. By analyzing differences between patched and unpatched binaries, researchers can isolate the vulnerability fix location, understand the root cause, and develop targeted security assessments before widespread exploitation occurs.
What tools and methods does Reverse Engineering use for protocol analysis?
Reverse Engineering covers protocol reverse engineering from network captures (PCAP) and binary protocol handlers. Techniques include symbolic execution (Angr), emulation-based string decryption, and dynamic instrumentation to infer proprietary protocol structures, file formats, and communication patterns for security testing and interoperability research.
Is Reverse Engineering licensed under MIT?
Yes, Reverse Engineering is released under the MIT license, permitting free use, modification, and distribution for both commercial and non-commercial purposes, subject to license terms.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: reverse-engineering description: Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days metadata: type: offensive phase: analysis tools: ghidra, ida, binary-ninja, radare2, rizin, gdb-gef, frida, x64dbg, x96dbg, triton, angr, unicorn, capstone, scyllahide, titanhide, novmp, bindiff, diaphora, ghidriff, binwalk, uefitool, chipsec, kaitai-struct mitre: TA0042 kill_chain: phase: [weaponize, exploit] step: [2, 4] attck_tactics: [TA0042, TA0002, TA0005] attck_techniques: [T1027, T1027.002, T1027.007, T1027.009, T1027.013, T1620, T1140, T1622, T1497, T1497.001, T1497.003, T1542.001, T1542.003, T1592.002, T1203, T1518.001] depends_on: [recon-osint] feeds_into: [exploit-development, malware-analysis, vulnerability-analysis, mobile-pentest, windows-mitigations] inputs: [binary_samples, firmware_images, packed_malware, patched_binaries, pcap_captures, unknown_file_formats] outputs: [disassembly_report, decompiled_source, vulnerability_details,
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/reverse-engineering/SKILL.md
skills/reverse-engineering/references/anti-reversing-bypass.md
skills/reverse-engineering/references/coverage-reachability.md
skills/reverse-engineering/references/deobfuscation.md
skills/reverse-engineering/references/dynamic-instrumentation.md
skills/reverse-engineering/references/firmware-uefi.md
skills/reverse-engineering/references/patch-diffing-protocol.md
skills/reverse-engineering/references/rr-time-travel.md
skills/reverse-engineering/references/static-triage-decompilation.md
skills/reverse-engineering/scripts/antidebug_unhook.py
skills/reverse-engineering/scripts/cve_diff.py
skills/reverse-engineering/scripts/deflatten_triton.py
skills/reverse-engineering/scripts/frida_universal.js
skills/reverse-engineering/scripts/ghidra/DecompileToC.java
skills/reverse-engineering/scripts/patchdiff_fetch.py