skills.rest
MDSIXONE
MDSIXONECOMMUNITY
Explore all skills by this author →
GitHub

reverse-engineering

Analyzes compiled, obfuscated, and packed binaries using static and dynamic reverse engineering techniques.

Updated Aug 14, 2026
Search Tags:#ctf#reverse engineering#binary analysis#frida#decompilation#anti-debugging#angr
One-click install
npx skills add https://github.com/MDSIXONE/opencode-config --skill reverse-engineering-mdsixone
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: reverse-engineering
Source: https://github.com/MDSIXONE/opencode-config/tree/main/skills/reverse-skill/skills/reverse-engineering
Command: npx skills add https://github.com/MDSIXONE/opencode-config --skill reverse-engineering-mdsixone

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires frida-tools, angr, qiling, uncompyle6, capstone, lief, z3-solver, and includes references (resource) components.

What problem does it solve? Understanding how a compiled, obfuscated, packed, or virtualized binary works is slow and error-prone without a structured methodology. This Skill provides a complete reverse engineering playbook covering binaries, APKs, WASM, firmware, custom VMs, bytecode, and anti-analysis defenses, so you can systematically understand a target before exploiting or solving it. ## Core Features & Use Cases - Static and dynamic analysis workflows: Covers GDB, Ghidra, radare2, IDA, Frida hooking, angr symbolic execution, Qiling emulation, and Unicorn CPU emulation with concrete commands and scripts. - Anti-analysis bypass reference: Documents 30+ anti-debug, anti-VM, anti-DBI, and self-integrity techniques (ptrace, PEB checks, TLS callbacks, Frida detection, CRC self-hashing) with working bypasses for each. - Language and platform playbooks: Dedicated guides for Go, Rust, Swift, Kotlin, Python bytecode, WASM, Android APK/JNI, macOS/iOS, embedded firmware, kernel drivers, and RISC-V/ARM64 targets. - Use Case: Given a stripped, UPX-packed CTF binary with ptrace anti-debugging and a custom VM flag checker, follow the triage workflow: unpack with upx, bypass ptrace via LD_PRELOAD, map the VM opcode handlers, then solve the flag check with angr or a Z3 script. ## Quick Start Ask the agent to analyze the target binary with this skill, starting from strings extraction and ltrace/strace triage before moving to decompilation and symbolic execution.

Frequently Asked Questions about reverse-engineering

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a packed or obfuscated binary?▼

Start with triage: run file, strings, and checksec, then try ltrace/strace for quick wins. Unpack UPX with upx -d, bypass anti-debugging via LD_PRELOAD hooks or patching, then use Ghidra or radare2 for decompilation and angr for symbolic execution of flag checkers.

What tools are best for dynamic binary analysis?▼

Frida handles runtime hooking of functions like strcmp and memcmp to capture expected values without full reversing. angr performs symbolic execution to solve input constraints automatically, while Qiling emulates foreign-architecture binaries and bypasses anti-debug checks without debugger artifacts.

How do I bypass ptrace anti-debugging on Linux?▼

Use an LD_PRELOAD hook that forces ptrace to return 0, patch the call with pwntools, or catch the syscall in GDB and set rax to 0. For direct syscalls that bypass libc hooks, intercept at the syscall level with GDB's catch syscall command.

Does this skill work for Android APK reverse engineering?▼

Yes, it covers APK analysis with apktool for resources and jadx for Java decompilation, plus native .so analysis, JNI RegisterNatives obfuscation tracing, and Frida-based runtime instrumentation. Flutter APKs with Dart AOT are handled via Blutter.

When should I use a different skill instead of reverse engineering?▼

Switch to a pwn skill when the vulnerability is already understood and the task is exploitation. Use forensics skills for disk or PCAP artifacts, web skills for pure web workflows, and crypto skills when the core challenge is a mathematical or cryptographic problem rather than binary comprehension.

How do I reverse engineer stripped Go binaries?▼

Use GoReSym to recover function names from the pclntab structure, which survives stripping. For Garble-obfuscated binaries, apply GoResolver for CFG-based function matching and GoStringUngarbler for string decryption, then load results into IDA with the go_parser plugin.

Related Skills

Explore More Software Engineering Skills→
AeonDaveAeonDave
15

binwalk

Analyze and extract embedded files from binary firmware images.

Community
Intermediate
langbyyilangbyyi
96

ctf-pwn

Solve CTF binary exploitation challenges with pwntools, ROPgadget, and GDB-pwndbg.

Community
Advanced
XerrionXerrion

rev-malware

Extract IoCs, map MITRE ATT&CK, and author YARA/Sigma rules.

Community
Advanced
SnailSploitSnailSploit
2.9k

fuzzing-methodology

Guide software fuzzing campaigns with techniques and workflows for AFL++ and libFuzzer.

Community
Advanced