reverse-engineering
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
Reverse Engineering helps you analyze and decompile unknown binaries to recover source code, identify vulnerabilities, and bypass protections.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Reverse Engineering helps you analyze and decompile unknown binaries to recover source code, identify vulnerabilities, and bypass protections. Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
Use it when
- Reverse Engineering addresses common protections including anti-debug mechanisms, control flow flattening, string encryption.
- Yes.
Verify before relying
Read SKILL.md below before installing (20 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/reverse-engineering · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse engineer a binary with Reverse Engineering?
Reverse Engineering covers both static and dynamic analysis techniques for compiled binaries. Use static tools like Ghidra or IDA Pro for disassembly and decompilation to recover source code structure. For dynamic analysis, employ debuggers like GDB or instrumentation frameworks like Frida to observe runtime behavior, trace execution paths, and identify vulnerabilities without executing untrusted code fully.
What anti-reversing protections can Reverse Engineering defeat?
Reverse Engineering addresses common protections including anti-debug mechanisms, control flow flattening, string encryption, and virtualization obfuscation (VMProtect, Themida, OLLVM). Techniques cover unpacking malware samples, devirtualization strategies, and deobfuscation methods to expose the underlying logic and enable security analysis of protected proprietary software.
Can Reverse Engineering extract firmware and UEFI/BIOS code?
Yes. Reverse Engineering includes firmware extraction and analysis workflows for UEFI, BIOS, and Secure Boot implementations. These techniques help researchers identify low-level vulnerabilities, analyze boot-time protections, and understand firmware-level security mechanisms critical for system hardening and vulnerability disclosure.
How does patch diffing discover vulnerabilities in Reverse Engineering?
Reverse Engineering enables patch diffing analysis to compare security updates and identify n-day exploits. By analyzing differences between patched and unpatched binaries, researchers can isolate the vulnerability fix location, understand the root cause, and develop targeted security assessments before widespread exploitation occurs.
What tools and methods does Reverse Engineering use for protocol analysis?
Reverse Engineering covers protocol reverse engineering from network captures (PCAP) and binary protocol handlers. Techniques include symbolic execution (Angr), emulation-based string decryption, and dynamic instrumentation to infer proprietary protocol structures, file formats, and communication patterns for security testing and interoperability research.
Is Reverse Engineering licensed under MIT?
Yes, Reverse Engineering is released under the MIT license, permitting free use, modification, and distribution for both commercial and non-commercial purposes, subject to license terms.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: reverse-engineering description: Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days metadata: type: offensive phase: analysis tools: ghidra, ida, binary-ninja, radare2, rizin, gdb-gef, frida, x64dbg, x96dbg, triton, angr, unicorn, capstone, scyllahide, titanhide, novmp, bindiff, diaphora, ghidriff, binwalk, uefitool, chipsec, kaitai-struct mitre: TA0042 kill_chain: phase: [weaponize, exploit] step: [2, 4] attck_tactics: [TA0042, TA0002, TA0005] attck_techniques: [T1027, T1027.002, T1027.007, T1027.009, T1027.013, T1620, T1140, T1622, T1497, T1497.001, T1497.003, T1542.001, T1542.003, T1592.002, T1203, T1518.001] depends_on: [recon-osint] feeds_into: [exploit-development, malware-analysis, vulnerability-analysis, mobile-pentest, windows-mitigations] inputs: [binary_samples, firmware_images, packed_malware, patched_binaries, pcap_captures, unknown_file_formats] outputs: [disassembly_report, decompiled_source, vulnerability_details,
(truncated - see the full file via the links below)
File tree — 15 files
skills/reverse-engineering/SKILL.md
skills/reverse-engineering/references/anti-reversing-bypass.md
skills/reverse-engineering/references/coverage-reachability.md
skills/reverse-engineering/references/deobfuscation.md
skills/reverse-engineering/references/dynamic-instrumentation.md
skills/reverse-engineering/references/firmware-uefi.md
skills/reverse-engineering/references/patch-diffing-protocol.md
skills/reverse-engineering/references/rr-time-travel.md
skills/reverse-engineering/references/static-triage-decompilation.md
skills/reverse-engineering/scripts/antidebug_unhook.py
skills/reverse-engineering/scripts/cve_diff.py
skills/reverse-engineering/scripts/deflatten_triton.py
skills/reverse-engineering/scripts/frida_universal.js
skills/reverse-engineering/scripts/ghidra/DecompileToC.java
skills/reverse-engineering/scripts/patchdiff_fetch.py
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Analyze and decompile unknown binaries to recover source code and identify vulnerabilities”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
Reverse Engineering equips you to analyze unknown binaries through structured workflows using Ghidra, radare2, and Binary Ninja. Master initial triage with standard tools, decompilation and scripting, C++ pattern recognition in stripped binaries, and binary diffing for vulnerability analysis.
Rev Ios Dump uses Frida to extract decrypted iOS application binaries from jailbroken devices, bypassing FairPlay DRM encryption for security research. The skill automates the process of dumping live app memory and producing analysis-ready IPA files compatible with disassemblers like IDA and Ghidra.
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Mobile-pentest guides dynamic analysis of Android and iOS applications through Frida-based instrumentation, certificate pinning circumvention, and detection bypass. It covers exported component abuse, deep-link exploitation, WebView attacks, and hybrid app reverse engineering for Flutter and React Native codebases.
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
More skills symbolic-execution-tools (MIT) · mobile-security (MIT) · shellcode-dev (MIT) · incident-response (MIT) · binary-triage (Apache-2.0) · crypto-analysis (MIT)