skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

reverse-engineering-malware-with-ghidra

Reverse engineer malware binaries with Ghidra to extract C2 protocols, encryption routines, and detection signatures.

1|1|Updated Apr 3, 2026
Search Tags:#reverse engineering#ghidra#decompilation#disassembly#yara#malware analysis#c2 protocol
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill reverse-engineering-malware-with-ghidra-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineering-malware-with-ghidra
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/infra/reverse-engineering-malware-with-ghidra
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill reverse-engineering-malware-with-ghidra-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Analysts often need to understand exactly what a malicious binary does internally—its C2 protocol, encryption scheme, and evasion logic—when static triage and sandbox behavior reports are insufficient. This Skill provides a structured Ghidra-based workflow for disassembling and decompiling malware to produce actionable intelligence and detection signatures. ## Core Features & Use Cases - Guided Ghidra Workflow: Step-by-step process covering project setup, headless analysis, entry-point navigation, cross-reference tracing, and decompiler-driven code understanding. - C2 and Crypto Reverse Engineering: Techniques for tracing WinHTTP/socket code paths, mapping command dispatchers, and identifying XOR, RC4, AES, and Base64 routines via constants and loop patterns. - Detection Engineering Output: Produces structured analysis reports with function maps, extracted IOCs, and ready-to-use YARA rules based on unique code patterns. - Use Case: After sandbox analysis flags encrypted traffic to an unknown server, import the unpacked sample into Ghidra, trace the send path back to the encryption routine, recover the RC4 key derivation, and write a YARA rule detecting the decryptor across the malware family. ## Quick Start Ask the agent to reverse engineer an unpacked malware sample with Ghidra and document its C2 protocol, encryption routine, and IOCs as a YARA rule.

Frequently Asked Questions about reverse-engineering-malware-with-ghidra

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer malware with Ghidra?▼

Import the unpacked sample into a Ghidra project, run auto-analysis, then trace from the entry point and suspicious API imports like InternetOpen or CryptEncrypt. Use the decompiler to rename variables, retype parameters, and document the C2 and encryption logic.

How to run Ghidra headless analysis on a malware sample?▼

Use the analyzeHeadless command with the -import flag pointing to the binary, plus -postScript to run automation such as decompilation export scripts. This enables batch analysis without opening the CodeBrowser GUI.

How do I identify encryption algorithms in a disassembled binary?▼

Search for known constants such as the AES S-box, RC4's 256-byte initialization loop, or Base64 lookup tables, and look for XOR loops over byte arrays. The FindCrypt Ghidra plugin can automatically locate cryptographic constants.

Ghidra vs IDA Pro for malware reverse engineering?▼

Ghidra is free and open-source with a built-in decompiler and scripting in Python or Java, while IDA Pro is the commercial industry standard. The workflow recommends cross-validating Ghidra results with IDA Free or Binary Ninja.

When should I not start with Ghidra reverse engineering?▼

Do not use deep reverse engineering for initial triage of unknown samples. Perform static analysis with tools like PEStudio and behavioral analysis with a sandbox such as Cuckoo first, then reverse engineer only when code-level understanding is required.

Why does Ghidra decompilation show unclear variable types?▼

Decompiler output improves when you retype variables and parameters, rename functions, and set correct function signatures so types propagate to callers. Supplying PDB symbol files for Windows system DLLs also increases decompilation accuracy.

Related Skills

Explore More Software Engineering Skills→
ImJokeImJoke
1

Malware Analysis & Reverse Engineering

Analyze PE, ELF, and script-based malware across four-phase triage, static, dynamic, and unpacking workflows.

Community
Advanced
balsm-healthbalsm-health
2

extracting-iocs-from-malware-samples

Extract file hashes, network indicators, and host artifacts from malware samples.

Official
Advanced
langbyyilangbyyi
96

ctf-malware

Analyze obfuscated malware and decrypt C2 traffic for CTF challenges.

Community
Advanced
YukiIto1999YukiIto1999

performing-memory-forensics-with-volatility3-plugins

Automate Volatility3 memory forensics to extract malware indicators from RAM dumps.

Community
Advanced