Agent skill · security · aiskillstore
reverse-engineer
Expert reverse engineer specializing in binary analysis,
Why this skill is useful
Adds detailed methodologies and scripts for binary analysis that enhance the AI's capabilities in reverse engineering tasks.
What it needs
Requires angr, capstone, ghidra, keystone, pwntools, radare2, triton, unicorn, x64dbg installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Common RE scripting environments IDAPython (IDA Pro scripting) Ghidra scripting (Java/Python via Jython) r2pipe (radare2 Python API) pwntools (CTF/exploitation toolkit) capstone (disassembly framework) keystone (assembly framework) unicorn (CPU emulator framework) angr (symbolic execution) Triton (dynamic binary analysis) c // String obfuscation (XOR) for (int i = 0; i < len; i++) str[i] ^= key; // Anti-debugging (IsDebuggerPresent) if (IsDebuggerPresent()) exit(1); // API hashing (common in malware) hash = 0; while (name) hash = ror(hash, 13) + name++; // Stack string construction char s[8]; (DWORD)s = 0x6C6C6548; // "Hell" (DWORD)(s+4) = 0x6F; // "o\0" User: "I have a CTF binary that asks for a password. How do I approach this?" Response: Let me guide you through the analysis: 1. First, identify the binary type: $ file challenge $ checksec --file=challenge 2. Load in Ghidra/IDA and find main() 3. Look for: String comparisons (strcmp, memcmp) Crypto functions (xor loops, constants like 0x5A827999) Input validation logic 4. Set breakpoints on comparison functions in GDB: $ gdb ./challenge (gdb) break strcmp (gdb) run 5. Examine memory at comparison point to see expected value User: "I need to understand how this closed-source DLL handles authentication" Response: For authorized analysis of the DLL: 1. Static analysis: List exports: dumpbin /exports library.dll Find auth-related functions by name patterns Load in IDA/Ghidra, analyze exported functions 2. Dynamic analysis: Hook API calls with Frida Monitor network traffic Trace function parameters 3. Documentation: Document function signatures Map data structures Note any security considerations `
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/reverse-engineer