reverse-engineering

Analyzes compiled, obfuscated, and packed binaries using static and dynamic reverse engineering workflows.

21|8|Updated Aug 3, 2026
One-click install
npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill reverse-engineering-chengzongcai
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineering
Source: https://github.com/chengzongcai/reverse-skill-backup/tree/main/skills/reverse-engineering
Command: npx skills add https://github.com/chengzongcai/reverse-skill-backup --skill reverse-engineering-chengzongcai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires frida-tools, angr, qiling, uncompyle6, capstone, lief, z3-solver, and includes references (resource) components.

What problem does it solve? Understanding how a compiled, obfuscated, packed, or virtualized binary works is slow and error-prone without a repeatable methodology. This Skill gives an AI agent a structured triage-to-synthesis workflow for reversing binaries, APKs, WASM, firmware, custom VMs, and anti-analysis logic before exploitation or solving. ## Core Features & Use Cases - Full RE workflow: Guides triage, static analysis (Ghidra, IDA, radare2), dynamic analysis (Frida, angr, GDB, Qiling), and synthesis with concrete commands and quick-win checks like strings, ltrace, and strcmp hooking. - Anti-analysis bypass reference: Covers ptrace, PEB checks, TLS callbacks, timing checks, Frida detection, self-hashing, control-flow flattening, and MBA obfuscation with specific bypass techniques. - Pattern and language libraries: Documents CTF patterns, language-specific reversing (Go, Rust, Python bytecode, Swift, Kotlin), and platform specifics (macOS/iOS, firmware, kernel drivers, ARM64, RISC-V). - Use Case: Given an unknown stripped ELF crackme, the agent runs initial triage, identifies an XOR-obfuscated flag check, hooks memcmp with Frida, and recovers the flag without fully reversing the binary. ## Quick Start Analyze the attached binary 'crackme' using the reverse-engineering skill and recover the expected input or flag.

Frequently Asked Questions about reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer an unknown binary file?▼

Start with triage: run file, checksec, strings, and ltrace/strace to identify the format and quick wins. Then map control flow with Ghidra or radare2, and use dynamic tools like Frida or GDB to observe runtime behavior before deep manual reversing.

How to bypass anti-debugging checks like ptrace in Linux binaries?▼

Common bypasses include LD_PRELOAD hooks that fake ptrace return values, patching the check with pwntools, or setting GDB to catch the syscall and zero the result. The reference covers over 30 anti-debug, anti-VM, and anti-Frida techniques with specific bypasses.

What tools are best for dynamic binary analysis?▼

Frida handles runtime hooking of functions like strcmp and memcmp, angr performs symbolic execution to solve flag checkers, and Qiling emulates foreign-architecture binaries without debugger artifacts. GDB with pwndbg covers interactive debugging and memory dumping.

Can this handle packed or obfuscated binaries like UPX or VMProtect?▼

Yes. UPX binaries are unpacked with upx -d, while VMProtect and Themida targets are approached by tracing operations on input rather than full devirtualization. OLLVM control-flow flattening is handled with tools like d810-ng and Miasm.

When should I not use reverse engineering and switch to exploitation instead?▼

Switch to a pwn-focused workflow once the vulnerability is already understood and the remaining task is heap, ROP, or kernel exploitation. Reversing is only the right step when understanding the binary's logic is the actual blocker.

Does it support non-x86 platforms like ARM64, RISC-V, or firmware?▼

Yes. It documents ARM64/AArch64 calling conventions and syscalls, RISC-V analysis with Capstone and qemu-riscv64, and embedded firmware extraction with binwalk, UART/JTAG, and QEMU emulation.