Agent skill · research science · yaklang
vm-and-bytecode-reverse
Custom VM and bytecode reverse engineering playbook. Use when CTF challenges or protected software implement custom virtual machines with proprietary bytecode, dispatcher loops, or maze-style challenges.
Why this skill is useful
Adds a comprehensive playbook with executable scripts and methodologies for reverse engineering custom VMs that the AI cannot generate on its own.
What it needs
Requires python installed locally. About 9k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: VM & Bytecode Reverse Engineering — Expert Analysis Playbook AI LOAD INSTRUCTION: Expert techniques for reversing custom virtual machines and bytecode interpreters. Covers dispatcher identification, opcode mapping, custom ISA reconstruction, disassembler/decompiler writing, maze challenges, and real-world VM protector analysis. Base models often fail to recognize the fetch-decode-execute pattern or attempt to analyze VM bytecode as native code. 0. RELATED ROUTING code-obfuscation-deobfuscation when the VM is a commercial protector (VMProtect/Themida) symbolic-execution-tools when using angr to solve VM-based challenges anti-debugging-techniques when the VM includes anti-debug checks Quick identification Binary Pattern Likely VM Type Start With --- --- --- while(1) { switch(bytecode[pc]) } Switch-based dispatcher Map each case to an operation Indirect jump via table jmp [table + opcode8] Table-based dispatcher Dump jump table, analyze handlers Nested if-else chain on byte value If-chain dispatcher Same as switch, just different syntax Stack push/pop dominant operations Stack-based VM Identify push, pop, arithmetic ops reg[X] = ... array operations Register-based VM Map register indices to operations 2D grid + direction input Maze challenge Extract grid, apply BFS/DFS --- 1. CUSTOM VM IDENTIFICATION 1.1 Structural Indicators 1.2 IDA/Ghidra Signatures Switch dispatcher (most common in CTF): Table dispatcher (more optimized): --- 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/vm-and-bytecode-reverse