vm-and-bytecode-reverse
This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations.
vm-and-bytecode-reverse helps you reverse engineer custom virtual machines and bytecode interpreters used in CTF challenges and protected software.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
vm-and-bytecode-reverse helps you reverse engineer custom virtual machines and bytecode interpreters used in CTF challenges and protected software. This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations.
Use it when
- vm-and-bytecode-reverse covers multiple bytecode analysis approaches: writing custom disassemblers tailored to your target ISA.
- vm-and-bytecode-reverse provides a complete playbook for CTF reverse engineering, including techniques for identifying dispatcher loops.
Verify before relying
Read SKILL.md below before installing (1 file). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/vm-and-bytecode-reverse · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse engineer custom virtual machines?
vm-and-bytecode-reverse teaches systematic techniques for analyzing custom VMs by first identifying the dispatcher loop—the core control structure that fetches and executes opcodes. Start by locating the main loop in the binary, map each opcode handler to its operation, and trace the execution flow. The skill covers both stack-based and register-based architectures, helping you understand fetch-decode-execute patterns and extract bytecode programs from protected binaries for deeper analysis.
What methods does vm-and-bytecode-reverse use for bytecode disassembly?
vm-and-bytecode-reverse covers multiple bytecode analysis approaches: writing custom disassemblers tailored to your target ISA, using Ghidra Sleigh processors to define custom instruction sets, and applying dynamic instrumentation for runtime tracing. The skill teaches opcode mapping and ISA reconstruction techniques, enabling you to convert raw bytecode into human-readable mnemonics and understand the semantic meaning of each instruction in stack-based, register-based, and esoteric VM designs.
How does vm-and-bytecode-reverse help solve CTF VM challenges?
vm-and-bytecode-reverse provides a complete playbook for CTF reverse engineering, including techniques for identifying dispatcher loops, extracting bytecode from binary data sections, and solving maze-style components embedded in VM implementations. The skill teaches automated maze solving using BFS algorithms and symbolic execution through virtual machines, allowing you to navigate complex challenge structures and recover hidden flags from custom VM implementations.
Can vm-and-bytecode-reverse analyze commercial protectors?
Yes. vm-and-bytecode-reverse covers analysis of commercial VM protectors like VMProtect and Themida, teaching deobfuscation techniques specific to their architectures. The skill addresses anti-debugging mechanisms in custom VMs, nested VM structures, and polymorphic handler analysis—advanced patterns used by commercial protectors to defend against reverse engineering. These methods apply to both CTF challenges and real-world protected binaries.
What tools and techniques does vm-and-bytecode-reverse recommend?
vm-and-bytecode-reverse integrates multiple approaches: static analysis using Ghidra and custom disassemblers, dynamic instrumentation for runtime VM tracing, symbolic execution to explore VM behavior, and pattern recognition for fetch-decode-execute loops. The skill teaches both manual analysis workflows and automated techniques like BFS-based maze solving, enabling you to choose the right tool for stack-based VMs, register-based architectures, brainfuck-like esoteric designs, and polymorphic protector implementations.
Is vm-and-bytecode-reverse suitable for beginners?
vm-and-bytecode-reverse is structured for learners with reverse engineering fundamentals. It progresses from identifying basic dispatcher patterns and mapping simple opcodes to advanced topics like nested VMs, anti-debugging, and commercial protector analysis. The skill emphasizes systematic methodology—start with pattern recognition, extract bytecode, build a disassembler, then apply symbolic execution—making complex VM analysis approachable through step-by-step techniques applicable to CTF challenges and real binaries alike.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: VM & Bytecode Reverse Engineering — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert techniques for reversing custom virtual machines and bytecode interpreters. Covers dispatcher identification, opcode mapping, custom ISA reconstruction, disassembler/decompiler writing, maze challenges, and real-world VM protector analysis. Base models often fail to recognize the fetch-decode-execute pattern or attempt to analyze VM bytecode as native code.
0. RELATED ROUTING
- code-obfuscation-deobfuscation when the VM is a commercial protector (VMProtect/Themida)
- symbolic-execution-tools when using angr to solve VM-based challenges
- anti-debugging-techniques when the VM includes anti-debug checks
Quick identification
| Binary Pattern | Likely VM Type | Start With
(truncated - see the full file via the links below)
File tree — 1 file
skills/vm-and-bytecode-reverse/SKILL.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Reverse engineer custom virtual machines and bytecode interpreters”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Master techniques for analyzing and defeating code obfuscation in protected binaries. Learn to identify junk code, opaque predicates, self-modifying code, control flow flattening, movfuscator, VM protectors like VMProtect and Themida, string encryption, and import hiding. Covers both static analysis patterns and dynamic deobfuscation strategies using symbolic execution, emulation, and trace-based recovery.
ctf-reverse equips you with techniques for analyzing compiled, obfuscated, packed, and virtualized targets in CTF competitions. It covers static analysis tools like GDB and Ghidra, dynamic approaches with Frida and angr, emulation frameworks, anti-analysis bypass strategies, and language-specific reversing for Python bytecode, WASM, Android, and compiled languages. Use this when understanding the target's behavior is the blocker before exploitation.
Hermes Dec extracts and analyzes Hermes VM bytecode from React Native Android applications. It provides three core utilities: a file parser for inspecting HBC metadata, a disassembler that converts bytecode to assembly-like representation, and a decompiler that generates pseudo-JavaScript output.
Identify and solve classical ciphers encountered in CTF challenges through systematic analysis. The skill covers cipher identification via character set, frequency distribution, and index of coincidence, then applies targeted attacks for monoalphabetic substitution, Caesar/ROT variants, polyalphabetic ciphers like Vigenere, and transposition methods. Includes Kasiski examination for key-length recovery and known-plaintext techniques.
ctf-pwn equips you with techniques to weaponize memory corruption vulnerabilities in CTF challenges. From buffer overflows and format strings to advanced heap exploitation, ROP chains, and kernel attacks, it covers the full spectrum of low-level privilege escalation and code execution paths. Use it when you have a vulnerable target and need to convert corruption primitives into shell access.
ctf-rev guides you through reverse engineering CTF challenges using structured methodologies for program comprehension. Learn to identify critical code paths, trace input transformations, recognize standard algorithms, and extract hidden flags through static analysis, dynamic observation, or hybrid approaches tailored to each challenge type.
More skills symbolic-execution-tools (MIT)