skills.rest
lNwNl
lNwNlCOMMUNITY
Explore all skills by this author →
GitHub

vm-and-bytecode-reverse

Reverse engineer custom virtual machines and bytecode interpreters in CTF binaries.

Updated Jun 5, 2026
Search Tags:#bytecode#ctf#reverse engineering#opcode#virtual machine#disassembler#maze solving
One-click install
npx skills add https://github.com/lNwNl/Praxis --skill vm-and-bytecode-reverse-lnwnl
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vm-and-bytecode-reverse
Source: https://github.com/lNwNl/Praxis/tree/main/skills/_disabled/vm-and-bytecode-reverse
Command: npx skills add https://github.com/lNwNl/Praxis --skill vm-and-bytecode-reverse-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? CTF challenges and protected software often hide logic inside custom virtual machines with proprietary bytecode, and base models frequently misread the fetch-decode-execute pattern or analyze VM bytecode as native code. This Skill provides a structured playbook for identifying dispatchers, mapping opcodes, and reconstructing the hidden program. ## Core Features & Use Cases - VM Identification: Recognize switch-based, table-based, and if-chain dispatchers plus stack-based, register-based, and esoteric VM architectures from binary patterns. - Disassembler Authoring: Step-by-step methodology to extract bytecode and write a custom Python disassembler that turns raw opcodes into readable assembly. - Maze Solving: Extract 2D grid data from binaries and solve maze challenges with BFS/DFS pathfinding across different direction encodings. - Use Case: Given a CTF binary that reads input and prints wrong, identify the switch dispatcher in IDA, map 15 opcodes, disassemble the embedded bytecode, trace the XOR transformation on input, and recover the correct flag. ## Quick Start Analyze this CTF binary that appears to use a custom virtual machine and help me recover the expected input.

Frequently Asked Questions about vm-and-bytecode-reverse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reverse engineer a custom VM in a CTF challenge?▼

Start by locating the dispatcher loop, typically a large switch statement or function pointer table indexed by bytecode. Map each opcode to its operation, extract the bytecode from the data section, write a Python disassembler, then trace how input flows to the comparison logic.

How to identify a bytecode dispatcher in IDA or Ghidra?▼

Look for a while loop containing a large switch statement, an indirect jump through a table indexed by a byte, or a single function with high cyclomatic complexity. Cross-references to a data buffer read byte-by-byte are another strong indicator.

What tools work for analyzing VM-based obfuscation?▼

IDA Pro and Ghidra handle dispatcher and handler analysis, angr performs symbolic execution through the VM, Unicorn emulates handlers quickly, and Pin or DynamoRIO record execution traces. For recurring VM architectures, write a Ghidra Sleigh processor module.

How do I solve maze challenges in reverse engineering CTFs?▼

Extract the 2D grid from the binary's data section, identify the direction encoding such as WASD or UDLR, then run BFS or DFS to find the shortest path from start to end. Convert the resulting path into the input format the binary expects.

When should I use symbolic execution instead of writing a disassembler?▼

Use angr or Z3 when the VM applies complex transformations to input that are hard to invert manually, or when nested VMs make static analysis impractical. For simple XOR or ADD checks, manual reversal of the disassembled logic is faster.

Related Skills

Explore More Software Engineering Skills→
jd-opensourcejd-opensource
299

pentest-ctf-binary

Analyze binary files to identify memory corruption vulnerabilities and develop exploits.

Official
Advanced
yaklangyaklang
1.6k

symbolic-execution-tools

Automate symbolic execution and constraint solving on compiled binaries with angr, Z3, and Unicorn.

Official
Advanced
bingookbingook

code-obfuscation-deobfuscation

Identify and deobfuscate obfuscation techniques in native binaries.

Community
Advanced
wgpsecwgpsec
1.6k

ctf-reverse

Analyze and bypass anti-analysis protections in CTF reverse-engineering binaries.

Official
Advanced