Agent skill · security · aiskillstore
binary-re-static-analysis
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl
Why this skill is useful
Adds executable scripts for binary analysis using radare2 and Ghidra that extend the AI's capabilities in static analysis.
What it needs
Requires docker, ghidra, qemu, radare2 installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Static Analysis (Phases 2-3) Purpose Understand binary structure and logic without execution. Map functions, trace data flow, decompile critical code. When to Use After triage has established architecture and ABI To understand specific functions identified as interesting When dynamic analysis is impractical or risky To build hypotheses before dynamic verification Pre-Analysis: Compare Known I/O First CRITICAL: Before diving into disassembly, check if known inputs/outputs exist. ⚠️ REQUIRES HUMAN APPROVAL - Get explicit approval before any execution, even for I/O comparison. This step often reveals the bug category before any code analysis. --- Two-Stage Approach Stage 1 (Light): Function enumeration, strings, imports - fast, broad coverage Stage 2 (Deep): Targeted decompilation, CFG analysis - slow, focused Stage 1: Light Analysis (radare2) Analysis Depth Selection Binary Size Command Tradeoff ------------- --------- ---------- < 500KB aaa Full analysis, may be slow 500KB - 5MB aa; aac Functions + all call targets > 5MB aa + targeted af @addr Fast, manual depth control Session Setup Critical settings: anal.timeout=120 - Prevent runaway analysis anal.maxsize=67108864 - 64MB max function size Use aa; aac for medium binaries, aaa only for small ones Handling Unanalyzed Call Targets If axtj returns empty for known imports: Function Enumeration Cross-Reference Analysis String-Function Correlation Import/Export Mapping Quick Disassembly Stage 2: Deep Analysis r2ghidra Availability Check Before attempting decompilation, verify r2ghidra is installed: If r2ghidra unavailable: Rely on disassembly (pdf) and cross-reference analysis (axt/axf). …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/binary-re-static-analysis