binary-re:static-analysis

What problem does it solve?

This Skill enables defensive and audit-grade understanding of binary code without executing it. It focuses on mapping binary structure, enumerating functions, tracking cross-references, and producing decompiled views and control-flow graphs to guide verification and vulnerability assessment.

Core Features & Use Cases

• Stage 1: Light Analysis using radare2 to enumerate functions, extract strings, resolve imports, and identify cross-references for rapid triage.
• Stage 2: Deep Analysis with r2ghidra or Ghidra headless to decompile target functions, generate CFGs, and recover data-flow for critical routines.
• Use Case: You have a proprietary binary with unclear behavior; use this Skill to identify key functions, call graphs, and potential data flows to form hypotheses before dynamic testing.

Quick Start

1. Launch quick static analysis on a binary: run r2 with controlled settings, e.g., r2 -q0 -e scr.color=false -e anal.timeout=120 -e anal.maxsize=67108864 binary
2. Enumerate functions: aflj
3. Inspect references and cross-references: axtj @sym.imp.open or axtj @sym.main
4. If needed, decompile a function: pdgj @sym.main