Agent skill · data analytics · aiskillstore
binary-re-triage
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary", "identify architecture", "check file type", "rabin2", "file analysis", "quick scan
Why this skill is useful
Provides specific commands and structured metadata extraction techniques for analyzing binary files that the AI wouldn't reliably generate on its own.
What it needs
Requires jq, rabin2 installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Binary Triage (Phase 1) Purpose Quick fingerprinting to establish baseline facts before deeper analysis. Runs in seconds, not minutes. When to Use First contact with an unknown binary Need architecture/ABI info for tool selection Quick capability assessment Before committing to expensive analysis Key Principle Gather facts fast, defer analysis. This phase identifies WHAT the binary is, not HOW it works. Triage Sequence Step 1: File Identification Extract: Architecture (ARM, ARM64, x8664, MIPS) Bit width (32/64) Endianness (LSB/MSB) Link type (static/dynamic) Interpreter path (libc indicator) Step 2: Structured Metadata (rabin2) Step 3: ABI Detection Interpreter → Libc mapping: Interpreter Libc Notes ------------- ------ ------- /lib/ld-linux-armhf.so.3 glibc ARM hard-float /lib/ld-linux.so.3 glibc ARM soft-float /lib/ld-musl-arm.so.1 musl ARM 32-bit /lib/ld-musl-aarch64.so.1 musl ARM 64-bit /lib/ld-uClibc.so.0 uClibc Embedded /lib64/ld-linux-x86-64.so.2 glibc x8664 Step 4: Dependencies Step 5: Entry Points & Exports Step 6: Quick String Scan Step 7: Import Analysis Capability Mapping Import Pattern Capability ---------------- ------------ socket, connect, send Network client bind, listen, accept Network server open, read, write File I/O fork, exec, system Process spawning pthread Multi-threading SSL, EVP Cryptography dlopen, dlsym Dynamic loading mmap, mprotect Memory manipulation Output Format After triage, record structured facts: Knowledge Journaling After triage completes, record findings for episodic memory: Example Journal Entry Decision Points After triage, determine: 1. Sysroot selection - Based on arch + libc 2. Analysis tool chain - r2 vs Ghidra vs both 3. Dynamic analysis feasibility - QEMU viability based on arch 4. Initial hypotheses - What does this binary likely do? Next Steps → Proceed to binary-re-static-analysis for function enumeration → Or binary-re-dynamic-analysis if behavior observation is priority
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/binary-re-triage