What problem does it solve? Binary-heavy CTF challenges involving reverse engineering, malware analysis, DFIR, firmware, and pwnable exploitation require a disciplined workflow that preserves evidence, separates decoded layers from original artifacts, and ties every claim to observable boundaries like crash edges or leak edges. ## Core Features & Use Cases - Reverse and Forensic Triage: Separates loader, payload, config, and post-decode behavior while correlating files, memory, logs, registry, and PCAPs into one execution graph. - Native Exploit Path Analysis: Maps mitigations, libc or runtime behavior, syscall surfaces, and protocol framing, recording primitives, controllable bytes, leak sources, and target objects separately. - Evidence Preservation: Keeps original, decoded, dumped, and instrumented artifacts as distinct files with offsets, hashes, crash registers, and protocol steps documented. - Use Case: During a CTF pwnable challenge, use this Skill after the sandbox orchestrator is active to triage the binary, identify the crash edge, record the leak source, and replay the exploit primitive from a clean baseline. ## Quick Start After the ctf-sandbox-orchestrator has established sandbox assumptions, ask the assistant to reverse this binary, inspect the crash dump, and prove the exploit primitive from a clean baseline.
