Agent skill · research science · wshobson
binary-analysis-patterns
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
Why this skill is useful
Provides detailed patterns and techniques for binary analysis that the AI wouldn't reliably generate on its own.
What it needs
About 5k tokens when loaded. Last updated 2026-08-05. 38,570 stars on the source repository.
What this skill does
Binary Analysis Patterns Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic. When to Use This Skill Reverse-engineering an unknown executable to understand its behavior Analyzing malware or obfuscated binaries with Ghidra / IDA Pro / Binary Ninja Recognizing common assembly idioms (function prologues, switch tables, vtable dispatch) Reconstructing high-level control flow from compiled code Identifying compiler-introduced patterns (stack canaries, PIC trampolines) Detailed section: Disassembly Fundamentals Originally a 2047-byte section in this SKILL.md. Moved to references/details.md to fit Codex's 8 KB skill body cap. Control Flow Patterns Conditional Branches Loop Patterns Switch Statement Patterns Data Structure Patterns Array Access Structure Access Linked List Traversal Common Code Patterns String Operations Arithmetic Patterns Bit Manipulation Decompilation Patterns Variable Recovery Function Signature Recovery Type Recovery Ghidra Analysis Tips Improving Decompilation Pattern Matching Scripts IDA Pro Patterns IDAPython Analysis Best Practices Analysis Workflow 1. Initial triage: File type, architecture, imports/exports 2. String analysis: Identify interesting strings, error messages 3. Function identification: Entry points, exports, cross-references 4. Control flow mapping: Understand program structure 5. Data structure recovery: Identify structs, arrays, globals 6. Algorithm identification: Crypto, hashing, compression 7. Documentation: Comments, renamed symbols, type definitions Common Pitfalls Optimizer artifacts: Code may not match source structure Inline functions: Functions may be expanded inline Tail call optimization: jmp instead of call + ret Dead code: Unreachable code from optimization Position-independent code: RIP-relative addressing
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills wshobson/binary-analysis-patterns