Reverse Engineering & Debugging
0This skill focuses on the methodologies of static analysis, dynamic analysis, debugging, and binary exploitation. It is intended for professionals in security and software development.
100Updated Yesterday
Security
Quick InstallView Source
$ npx skills add https://github.com/r00tedbrain-backup/skills --skill reverse-engineeringOverview
About This Skill
This skill provides professional-grade reverse engineering methodology covering static analysis, dynamic debugging, malware analysis, and binary exploitation. It supports all major binary formats—ELF, PE, Mach-O, DEX, APK, firmware, and managed code—with guided workflows for identifying target architecture, establishing analysis scope, and selecting appropriate tools. The skill includes reference modules for platform-specific techniques (Android APK repackaging, iOS Keychain analysis, Windows kernel debugging), specialized tasks (symbol recovery, struct layout inference, protocol reversing, anti-cheat analysis), and advanced scripting approaches via Ghidra Python, IDAPython, and Frida hooking. It ships with bundled utilities including an IDA Pro export plugin, Frida DEX memory dumper, and MCP server integration for live querying of analysis tools.
How to Use
Install using the command provided.
Use Cases
Static analysis of binary files.
Dynamic analysis for runtime behavior inspection.
Debugging applications to identify vulnerabilities.
Binary exploitation techniques for security assessments.
Tags
Setup & Installation
Quick Install
Terminal
$ npx skills add https://github.com/r00tedbrain-backup/skills --skill reverse-engineeringAlternative Install (Git Clone)
git clone https://github.com/r00tedbrain-backup/skillsRequirements
- Claude Code or compatible AI agent
Quick Start Guide
1
Install the Skill
Copy the install command above and run it in your terminal.
2
Open Your AI Agent
Launch Claude Code, Cursor, or your preferred AI coding agent.
3
Try It Out
Use the prompt template or examples below to test the skill.
4
Customize
Adapt the skill to your specific use case and workflow.
Usage Examples
Prompt Template
Act as a reverse engineering expert. Analyze this [FILE_TYPE] file ([FILE_PATH]) for vulnerabilities, obfuscation, or malicious behavior. Focus on extracting [SPECIFIC_GOAL: e.g., API calls, encryption logic, or hidden strings]. Use tools like Ghidra, IDA Pro, or x64dbg if necessary. Provide a detailed breakdown of your findings, including pseudocode, control flow, and potential attack vectors. If the file is packed or encrypted, suggest methods to unpack or decrypt it. Assume I have basic knowledge of assembly and debugging.
Example Output
# Reverse Engineering Analysis Report: `malware_sample.exe` ## Overview Analyzed `malware_sample.exe` (MD5: `a1b2c3d4e5f6...`) using static and dynamic analysis. The binary is a 32-bit PE executable with obfuscated strings and anti-debugging checks. Primary goal: extract C2 (Command & Control) server addresses and encryption keys. ## Static Analysis Findings ### Strings Extraction - **Suspicious Strings:** - `http://c2.example.com/api/v1/command` (C2 endpoint) - `AES-256-CBC` (Encryption algorithm) - `kernel32.dll::VirtualAlloc` (Memory allocation function) - **Obfuscation:** Strings are XOR-encrypted with a 4-byte key (`0xDE, 0xAD, 0xBE, 0xEF`). ### Control Flow Graph (CFG) - **Main Function (`sub_401000`):** - Calls `VirtualAlloc` to allocate RWX memory. - Decrypts embedded payload in memory. - Spawns a thread to execute the payload. - **Anti-Debugging:** Uses `IsDebuggerPresent()` and `NtQueryInformationProcess()`. ## Dynamic Analysis Findings ### Debugging Session (x64dbg) - **Breakpoint at `sub_401000`:** - Memory allocation at `0x00400000` (RWX permissions). - Payload decrypted to `0x00401000` (shellcode-like structure). - **C2 Communication:** - POST request to `http://c2.example.com/api/v1/command` with encrypted data. - Encryption key: `0x13, 0x37, 0x42, 0x00` (XOR key). ## Exploitation Potential - **Vulnerabilities:** - RWX memory region could be exploited for code injection. - Weak XOR encryption allows easy decryption of C2 traffic. - **Mitigation:** - Patch `VirtualAlloc` calls to enforce W^X (Write XOR Execute) policy. - Monitor outbound connections to `c2.example.com`. ## Recommendations 1. **Unpack the Payload:** Use a debugger to dump the decrypted payload from memory. 2. **Decrypt C2 Traffic:** XOR-decrypt the traffic using the extracted key. 3. **Analyze Payload:** Reverse engineer the decrypted payload for further insights. --- *Analysis completed in 45 minutes. For further investigation, attach to the process in a sandboxed environment.*
Find the right skills for your stack
Take a free 3-minute scan and get personalized AI skill recommendations.
Take free scan