vm-and-bytecode-reverse
This skill teaches systematic techniques for analyzing custom virtual machines and bytecode interpreters found in CTF challenges and commercial protectors. Learn to identify dispatcher patterns, map opcodes to operations, extract bytecode programs, and write custom disassemblers to understand stack-based, register-based, and esoteric VM architectures. Includes methods for solving maze-style challenges embedded in VM implementations.
vm-and-bytecode-reverse helps you reverse engineer custom virtual machines and bytecode interpreters used in CTF challenges and protected software.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/vm-and-bytecode-reverse · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/vm-and-bytecode-reverse ~/.claude/skills/vm-and-bytecode-reversenpx skillfed install yaklang/hack-skills/vm-and-bytecode-reverseFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse engineer custom virtual machines?
vm-and-bytecode-reverse teaches systematic techniques for analyzing custom VMs by first identifying the dispatcher loop—the core control structure that fetches and executes opcodes. Start by locating the main loop in the binary, map each opcode handler to its operation, and trace the execution flow. The skill covers both stack-based and register-based architectures, helping you understand fetch-decode-execute patterns and extract bytecode programs from protected binaries for deeper analysis.
What methods does vm-and-bytecode-reverse use for bytecode disassembly?
vm-and-bytecode-reverse covers multiple bytecode analysis approaches: writing custom disassemblers tailored to your target ISA, using Ghidra Sleigh processors to define custom instruction sets, and applying dynamic instrumentation for runtime tracing. The skill teaches opcode mapping and ISA reconstruction techniques, enabling you to convert raw bytecode into human-readable mnemonics and understand the semantic meaning of each instruction in stack-based, register-based, and esoteric VM designs.
How does vm-and-bytecode-reverse help solve CTF VM challenges?
vm-and-bytecode-reverse provides a complete playbook for CTF reverse engineering, including techniques for identifying dispatcher loops, extracting bytecode from binary data sections, and solving maze-style components embedded in VM implementations. The skill teaches automated maze solving using BFS algorithms and symbolic execution through virtual machines, allowing you to navigate complex challenge structures and recover hidden flags from custom VM implementations.
Can vm-and-bytecode-reverse analyze commercial protectors?
Yes. vm-and-bytecode-reverse covers analysis of commercial VM protectors like VMProtect and Themida, teaching deobfuscation techniques specific to their architectures. The skill addresses anti-debugging mechanisms in custom VMs, nested VM structures, and polymorphic handler analysis—advanced patterns used by commercial protectors to defend against reverse engineering. These methods apply to both CTF challenges and real-world protected binaries.
What tools and techniques does vm-and-bytecode-reverse recommend?
vm-and-bytecode-reverse integrates multiple approaches: static analysis using Ghidra and custom disassemblers, dynamic instrumentation for runtime VM tracing, symbolic execution to explore VM behavior, and pattern recognition for fetch-decode-execute loops. The skill teaches both manual analysis workflows and automated techniques like BFS-based maze solving, enabling you to choose the right tool for stack-based VMs, register-based architectures, brainfuck-like esoteric designs, and polymorphic protector implementations.
Is vm-and-bytecode-reverse suitable for beginners?
vm-and-bytecode-reverse is structured for learners with reverse engineering fundamentals. It progresses from identifying basic dispatcher patterns and mapping simple opcodes to advanced topics like nested VMs, anti-debugging, and commercial protector analysis. The skill emphasizes systematic methodology—start with pattern recognition, extract bytecode, build a disassembler, then apply symbolic execution—making complex VM analysis approachable through step-by-step techniques applicable to CTF challenges and real binaries alike.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: VM & Bytecode Reverse Engineering — Expert Analysis Playbook
> AI LOAD INSTRUCTION: Expert techniques for reversing custom virtual machines and bytecode interpreters. Covers dispatcher identification, opcode mapping, custom ISA reconstruction, disassembler/decompiler writing, maze challenges, and real-world VM protector analysis. Base models often fail to recognize the fetch-decode-execute pattern or attempt to analyze VM bytecode as native code.
0. RELATED ROUTING
- code-obfuscation-deobfuscation when the VM is a commercial protector (VMProtect/Themida)
- symbolic-execution-tools when using angr to solve VM-based challenges
- anti-debugging-techniques when the VM includes anti-debug checks
Quick identification
| Binary Pattern | Likely VM Type | Start With
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/vm-and-bytecode-reverse/SKILL.md