Analyze Binary Code Patterns

This skill teaches an agent to read compiled binaries at the assembly level and reconstruct the original program logic. It covers x86-64 instruction patterns for function prologues and epilogues, the System V AMD64 (Linux/macOS) and Microsoft x64 (Windows) calling conventions with their argument registers and shadow-space rules, and ARM64 and ARM32 calling conventions and stack-frame setup. It then walks control-flow patterns (conditional branches, for/while/do-while loops, jump-table and sequential-comparison switch statements), data structure patterns (array indexing, struct field access by offset, linked-list traversal), and common code idioms (strlen/strcpy/memcpy patterns, multiplication by constant via lea, division and modulo by powers of two, bit test/set/clear/toggle, population count). A decompilation section covers recovering local variables, function signatures from register usage, and variable types from operand size, and separate sections give Ghidra scripting examples (fixing a function's return type, defining a structure type, and a Python pattern-matching script that scans call references for dangerous functions like strcpy, sprintf, and gets) and IDAPython examples (finding calls to a named function, renaming functions from nearby strings).

Use it when disassembling or decompiling a compiled binary to understand its logic: identifying calling conventions, tracing control flow, recovering data structures and variable types, or scripting Ghidra or IDA Pro to speed up analysis. It does not apply outside binary analysis - a different domain or tool is out of scope. Its stated analysis workflow: initial triage of file type, architecture, and imports/exports; string analysis for interesting strings and error messages; function identification via entry points and cross-references; control-flow mapping; data structure recovery; algorithm identification, such as crypto, hashing, or compression; and documentation through renamed symbols and type definitions. Its stated pitfalls: optimizer artifacts that don't match source structure, inlined functions, tail-call optimization showing jmp instead of call+ret, dead code from optimization, and position-independent, RIP-relative addressing.

Inputs: a compiled binary or its disassembly, and, for the scripting sections, a target function address (Ghidra) or function name (IDAPython). Outputs: recovered calling-convention and register-usage information, reconstructed control-flow and data-structure layouts, inferred variable types from operand widths, and, from the scripting examples, an updated function return type or new structure type in Ghidra, or a printed list of call sites to a named function in IDA.

Ghidra, scripted in Java to set function return types (setReturnType) and define structures (StructureDataType), and IDA Pro, scripted in IDAPython (idautils, idaapi, idc) to enumerate functions, find calls to a target function, and rename functions based on nearby strings. Covers x86-64 and ARM (AArch64 and ARM32) architectures.

push rbp           ; Save base pointer
mov rbp, rsp       ; Set up stack frame
sub rsp, 0x20      ; Allocate local variables

Reverse engineers and security researchers analyzing compiled binaries who need reference patterns for calling conventions, control flow, data structures, and Ghidra or IDA Pro scripting.