reverse-engineering
Reverse Engineering equips you to analyze unknown binaries through structured workflows using Ghidra, radare2, and Binary Ninja. Master initial triage with standard tools, decompilation and scripting, C++ pattern recognition in stripped binaries, and binary diffing for vulnerability analysis.
Reverse Engineering guides you through decompiling and analyzing unknown binaries with Ghidra, radare2, and Binary Ninja.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-27
Reverse Engineering guides you through decompiling and analyzing unknown binaries with Ghidra, radare2, and Binary Ninja. Reverse Engineering equips you to analyze unknown binaries through structured workflows using Ghidra, radare2, and Binary Ninja. Master initial triage with standard tools, decompilation and scripting, C++ pattern recognition in stripped binaries, and binary diffing for vulnerability analysis.
Use it when
- Reverse Engineering with radare2 starts with `r2 <binary>` to enter the interactive shell, then `aaa` to auto-analyze all functions.
- Reverse Engineering stripped ELF files requires pattern matching and heuristics since symbol tables are removed.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
mohitmishra786/low-level-dev-skills/reverse-engineering · repository language: JavaScript
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to use Ghidra for binary decompilation?
Reverse Engineering with Ghidra begins by loading your binary into the tool's project manager, then using the auto-analysis feature to generate a control-flow graph and decompiled pseudocode. Navigate functions via the symbol tree, examine cross-references (xrefs) to trace data and control flow, and use the decompiler pane to read high-level reconstructed code. For stripped binaries, Reverse Engineering workflows combine Ghidra's function signature analysis with manual annotation to recover intent. Headless scripting via Ghidra's Python API automates batch analysis across multiple binaries.
What is radare2 tutorial for analyzing unknown binaries?
Reverse Engineering with radare2 starts with `r2 <binary>` to enter the interactive shell, then `aaa` to auto-analyze all functions. Use `VV` to open visual graph mode for control-flow inspection, `pdf` to print disassembly of the current function, and `s <address>` to seek to specific locations. Reverse Engineering practice includes using `axt` to find cross-references, `iz` to list strings, and `e asm.syntax=att` to switch assembly dialects. Combine radare2 with `strings`, `xxd`, and `checksec` for initial triage before deep analysis.
How do I reverse engineer stripped binaries to recover symbols?
Reverse Engineering stripped ELF files requires pattern matching and heuristics since symbol tables are removed. Start with `strings` and `xxd` for initial reconnaissance, then load the binary into Ghidra or radare2 and use function prologue detection to identify entry points. Reverse Engineering workflows use cross-reference analysis to map callers and callees, then manually annotate high-confidence functions. For C++ binaries, demangle vtable patterns and RTTI structures. Binary diffing tools like Diaphora compare your stripped binary against unstripped versions or similar firmware to infer symbol names and function boundaries.
How can Reverse Engineering identify C++ patterns in disassembly?
Reverse Engineering recognizes C++ constructs by spotting vtable pointers (typically at object offset 0), virtual method dispatch sequences, and RTTI metadata. In Ghidra, use the decompiler to spot `this` pointer usage and method calls through function pointers. Reverse Engineering analysis looks for exception handling frames, name mangling (e.g., `_ZN...`), and constructor/destructor patterns. Tools like `c++filt` demangle symbol names. Radare2's `afl` lists all functions; filter for mangled names and cross-reference them with vtable structures to map class hierarchies and inheritance chains.
What is binary diffing for comparing firmware versions?
Reverse Engineering uses binary diffing tools like Diaphora to identify security patches between firmware versions. Load two binaries (old and new) into Diaphora, which performs function-level and byte-level comparison to highlight added, removed, or modified code. Reverse Engineering workflows use diffing results to isolate patched vulnerabilities, then analyze the changes in Ghidra or radare2 to understand the fix. This accelerates vulnerability research by focusing effort on changed functions rather than re-analyzing entire binaries.
How does Reverse Engineering automate analysis with scripting?
Reverse Engineering leverages Ghidra's Python API and radare2's r2pipe for batch automation. Write Ghidra scripts to iterate over all functions, extract metadata, and generate reports without manual GUI interaction. Radare2 scripting uses r2pipe (Python bindings) to send commands and parse output programmatically. Reverse Engineering automation handles tasks like finding all calls to a specific function, extracting strings and cross-references, or applying signatures across multiple binaries. Combine scripts with `checksec` to audit binary protections (NX, PIE, ASLR) at scale.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Reverse Engineering
Purpose
Guide agents through reverse engineering binaries: Ghidra project setup and decompilation, radare2 analysis workflow, Binary Ninja scripting, initial triage with strings/file/xxd, identifying C++ patterns (vtables, RAII), analyzing stripped binaries, and diffing with Diaphora or BinDiff.
When to Use
- Analyzing an unknown binary without source code
- Recovering algorithm logic from compiled executables
- Comparing two firmware versions for vulnerability patches
- Understanding malware or CTF challenge binaries
- Recovering symbols from stripped ELF/PE files
- Automating analysis with Ghidra or r2 scripts
Workflow
1. Initial triage
```bash file suspicious_binary strings -n 8 suspicious_binary | head -50 strings -el suspicious_binary # UTF-16 LE xxd suspicious_binary | head -20 readelf
(truncated - see the full file via the links below)
File tree — 1 file
skills/security/reverse-engineering/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Analyze and decompile unknown binaries using Ghidra or radare2”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Reverse Engineering provides techniques and tools for static and dynamic analysis of compiled binaries, firmware, and protected code. Recover decompiled source, unpack obfuscated samples, bypass anti-debugging defenses, and extract vulnerability details through patch diffing and protocol inference.
Binary Analysis guides you through reverse engineering workflows for CTF challenges and vulnerability research. It combines security property checks, static disassembly, firmware extraction, and dynamic debugging to uncover exploitable weaknesses and craft targeted payloads.
Master Linux binary analysis with workflows for examining symbol tables, section layout, dynamic linking, and debug information. Diagnose undefined symbol errors, identify binary bloat, and verify security hardening flags like PIE and RELRO using standard tools.
Binary Hardening guides you through applying and validating security protections for C/C++ executables. Learn compiler and linker flags for RELRO, PIE, stack canaries, FORTIFY_SOURCE, and CFI, plus seccomp-bpf syscall filtering and hardware defenses like Intel CET and ARM BTI. Use checksec to audit existing binaries and confirm mitigations are in place.
Master binary exploitation fundamentals including buffer overflows, return-oriented programming, and format string attacks. This skill covers shellcode generation, NX bypass strategies, and practical pwntools workflows for writing exploits and proof-of-concept code.
More skills binutils (MIT) · dynamic-linking (MIT) · make (MIT) · Rev Ios Dump (unlicensed) · binary-triage (Apache-2.0)