Analyze Binary Code Patterns

This skill provides comprehensive patterns for analyzing compiled binaries, reading assembly code, and reconstructing program logic. Disassembly fundamentals cover x86-64 function prologue/epilogue forms (standard frame setup with push rbp/mov rbp, rsp, leaf functions that skip frame-pointer setup, and the leave shorthand), and calling conventions for System V AMD64 (Linux/macOS: arguments in RDI/RSI/RDX/RCX/R8/R9 then stack, return in RAX, caller- vs callee-saved registers) versus Microsoft x64 (Windows: RCX/RDX/R8/R9 then stack, with a 32-byte shadow space), plus ARM64/AArch64 (X0-X7 arguments, X29 frame pointer, X30 link register, stp/ldp for prologue/epilogue) and ARM32 (R0-R3 arguments, LR/R14 link register) conventions. Control-flow patterns cover recognizing signed vs unsigned conditional branches (jge vs jae), for/while/do-while loop shapes, and switch statements as either a jump table (jmp [table + eax*8]) or sequential comparisons for small cases. Data-structure patterns cover array indexing ([base + index*scale]), multi-dimensional array address arithmetic, C struct field access mapped to fixed byte offsets, and linked-list traversal (node = node->next via a fixed offset load). Common code patterns cover recognizing strlen/strcpy/memcpy (including rep movsb) idioms, arithmetic tricks compilers emit (multiplication by small constants via lea, division/modulo by powers of two via shift/mask with sign adjustment), and bit manipulation (test/set/clear/toggle a bit, bsr for leading-zero count, popcnt for population count). Decompilation patterns cover recovering local variables and stack-allocated arrays from rbp-relative offsets, recovering a function's parameter list from which registers are used first (per the calling convention in play) and its return type from RAX usage at the end, and recovering primitive types from operand size (1-byte ops suggest char/bool, 4-byte suggest int/float, 8-byte suggest long/double/pointer, with movss/movsd signaling float/double specifically). Tool-specific scripting is shown for Ghidra (Java scripting to fix a function's return type, define a custom structure type, and apply it to memory; a Python pattern-matching script flagging calls to dangerous functions like strcpy/sprintf/gets) and IDA Pro (IDAPython to enumerate all calls to a named function, and a sketch for auto-renaming sub_-prefixed functions using nearby string references as hints). A seven-step analysis workflow structures the overall process: initial triage (file type, architecture, imports/exports), string analysis, function identification, control-flow mapping, data-structure recovery, algorithm identification (crypto/hashing/compression), and documentation. Common pitfalls are called out explicitly: optimizer artifacts that don't match source structure, inlined functions, tail-call optimization (jmp instead of call+ret), dead code from optimization, and position-independent code using RIP-relative addressing.

Use this skill when working on binary analysis, reverse engineering, or malware/CTF/vulnerability-research tasks that need disassembly pattern recognition, decompiler output cleanup, or Ghidra/IDA scripting. It is not for tasks unrelated to binary analysis, or when a different domain or tool entirely is what's needed - this is a reference for reading and reconstructing compiled code, not for writing exploits or automating attacks.

Input is disassembled or decompiled binary code (x86-64 or ARM), or a specific reverse-engineering goal (recover a function signature, identify a data structure, find dangerous calls). Output is recognized instruction/calling-convention patterns, recovered variable/parameter/type information, and Ghidra/IDA scripts that apply that recovered structure back onto the binary. On ARM32, this includes recognizing the push {fp, lr} / pop {fp, pc} prologue/epilogue idiom, where the function returns by popping directly into the program counter.

Targets x86-64 (System V AMD64 and Microsoft x64) and ARM (AArch64 and ARM32) disassembly, with scripting examples for Ghidra (Java and Python scripting API) and IDA Pro (IDAPython).

push rbp           ; Save base pointer
mov rbp, rsp       ; Set up stack frame
sub rsp, 0x20      ; Allocate local variables

Reverse engineers, malware analysts, and security researchers reading compiled binaries who need to recognize calling conventions, control-flow idioms, and compiler-generated patterns, and script Ghidra or IDA Pro to recover types and structure.