Master Common RE Scripting Environments

Provides reverse-engineering guidance across common RE scripting environments (IDAPython, Ghidra scripting via Jython, r2pipe/radare2, pwntools, capstone, keystone, unicorn, angr, Triton), following a four-phase analysis methodology: reconnaissance (file identification, metadata extraction, packer detection, initial triage), static analysis (disassembler setup, entry points, program structure mapping, annotation, cross-referencing), dynamic analysis (isolated VM setup, breakpoint strategy, execution tracing, input manipulation), and documentation (functions, data structures, algorithms, findings). It also recognizes common code patterns and calling conventions across x86 cdecl/stdcall, x64 Windows, x64 System V, and ARM.

Use it for authorized security research, CTF competitions and educational challenges, defensive malware analysis, responsible vulnerability disclosure, or understanding software for interoperability - not for unauthorized system access, creating malware, illegitimately bypassing licensing, IP theft, or any other illegal activity. The skill is explicitly gated: it requires the user to state the exact target, confirm written authorization and scope, and explicitly confirm before any command that probes, exploits, extracts data from, or attempts credential access against a target runs; without that confirmation it stays read-only and defensive-guidance-only.

Given a target binary, DLL, or CTF challenge, the skill walks through the four-phase methodology and returns a scoped analysis approach - recommended tools, step-by-step methodology, and documented findings with supporting evidence. It recognizes common patterns like these, verbatim from its own reference examples:

// String obfuscation (XOR)
for (int i = 0; i < len; i++)
    str[i] ^= key;

// Anti-debugging (IsDebuggerPresent)
if (IsDebuggerPresent())
    exit(1);

// API hashing (common in malware)
hash = 0;
while (*name)
    hash = ror(hash, 13) + *name++;

// Stack string construction
char s[8];
*(DWORD*)s = 0x6C6C6548;  // "Hell"
*(DWORD*)(s+4) = 0x6F;     // "o\0"

Two worked examples illustrate the approach: a CTF binary password check (identify the binary with file/checksec, load it in Ghidra/IDA, look for string comparisons and crypto constants, set GDB breakpoints on strcmp, examine memory at the comparison point) and a closed-source DLL's authentication handling (list exports with dumpbin /exports, analyze statically in IDA/Ghidra, hook API calls with Frida and trace parameters dynamically, then document signatures and structures). Deeper implementation detail lives in resources/implementation-playbook.md.

Built around standard RE tooling: IDAPython, Ghidra/Jython scripting, r2pipe, pwntools, capstone, keystone, unicorn, angr, and Triton, plus external tools referenced in the worked examples - GDB, Frida, dumpbin, and checksec.

Security researchers, CTF competitors, and malware analysts doing authorized reverse-engineering work who need a structured methodology and tool guidance rather than starting from a blank editor - always gated behind explicit target confirmation and written-authorization checks.