binary-triage

What problem does it solve?

This Skill provides a structured, rapid survey of a binary to understand its basic behavior, memory layout, strings, imports/exports, and function usage, enabling engineers to quickly identify suspicious activity and plan the next steps.

Core Features & Use Cases

• Memory layout survey: identify sections like .text, .data, .rodata, and .bss, and flag unusual characteristics.
• Strings survey: extract strings and scan for indicators such as network indicators, file paths, APIs, and error messages.
• Import/Export and symbol analysis: enumerate external symbols and categorize potentially suspicious APIs.
• Function overview: list named and anonymous functions and highlight likely entry points and callers.
• Task list generation: produce a prioritized set of next steps for deeper analysis.
• Use Case: When first examining a binary, triage quickly to determine if it is benign or malicious and plan subsequent investigations.

Quick Start

Load a binary in the MCP-enabled environment and run binary-triage to begin the initial survey. Review the resulting summary to identify memory layout, notable strings, and external imports, then follow the generated TODOs to guide deeper analysis.