Agent skill · security · aiskillstore
binary-re-dynamic-analysis
Use when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary", "execute", "debug", "trace syscalls", "set breakpoint", "qemu", "gdb", "frida", "strace", "watch memory
Why this skill is useful
Adds executable scripts for dynamic binary analysis using QEMU, GDB, and Frida that aren't commonly found in public documentation.
What it needs
Requires docker, frida, gdb, qemu installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Dynamic Analysis (Phase 4) Purpose Observe actual runtime behavior. Verify hypotheses from static analysis. Capture data that's only visible during execution. Human-in-the-Loop Requirement CRITICAL: All execution requires human approval. Before running ANY binary: 1. Confirm sandbox configuration is acceptable 2. Verify network isolation if required 3. Document what execution will attempt 4. Get explicit approval Platform Support Matrix Host Platform Target Arch Method Complexity --------------- ------------- -------- ------------ Linux x8664 ARM32/64, MIPS Native qemu-user Low Linux x8664 x86-32 Native or linux32 Low macOS (any) ARM32/64 Docker + binfmt Medium macOS (any) x86-32 Docker --platform linux/i386 Medium Windows Any WSL2 → Linux method Medium macOS Docker Setup (One-Time) Docker Mount Best Practices CRITICAL: On Colima, /tmp mounts often fail silently. Always use home directory paths: --- Analysis Options Method Isolation Granularity Best For -------- ----------- ------------- ---------- QEMU -strace High Syscall level Initial behavior mapping QEMU + GDB High Instruction level Detailed debugging Docker High Process level Cross-arch on macOS Frida Medium Function level Hooking without recompilation On-device Low Full system When emulation fails Option A: QEMU User-Mode with Syscall Trace Safest approach - runs in isolation with syscall logging. Setup Sysroot Selection Binary ABI Sysroot Path QEMU Flag ------------ -------------- ----------- ARM glibc hard-float /usr/arm-linux-gnueabihf -L ARM glibc soft-float /usr/arm-linux-gnueabi -L ARM64 glibc /usr/aarch64-linux-gnu -L ARM musl Custom extraction needed -L Environment Control Syscall Analysis Strace output patterns to watch: Option B: QEMU + GDB for Deep Debugging Attach debugger for instruction-level control. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/binary-re-dynamic-analysis