Reverse engineer binaries and analyze unknown executables

Provides a triage-first methodology for understanding an unknown compiled, obfuscated, packed, or virtualized binary before any further work, framed around local, authorized targets - CTF challenges, crackmes, wargames, or sandboxed training binaries by default, unless there is clear evidence otherwise. The problem-solving order is deliberately cheapest-first: extract strings for a plaintext flag, try ltrace/strace since dynamic analysis often reveals the answer without reversing anything, try Frida hooking strcmp/memcmp to capture the expected value directly, try angr's symbolic execution to solve many flag-checkers automatically, try Qiling to emulate a foreign-architecture binary or sidestep heavy anti-debug without leaving artifacts, then map control flow before modifying execution, and validate assumptions by comparing multiple decompilers' output (dogbolt.org) rather than trusting one. "Quick win" one-liners cover plaintext flag grepping (strings/rabin2 -z), a memory-dumping strategy (break at the final comparison and dump the register holding the computed answer rather than reverse the transform by hand), decoy-flag detection (breaking at the actual final comparison, not an earlier fake success path), PIE-binary debugging with relative breakpoints, distinguishing the two comparison-direction patterns (transform(input) == stored versus transform(stored) == input, which need opposite handling), and common lightweight encryption patterns (single-byte XOR, known-plaintext XOR against flag{/CTF{, hardcoded-key RC4, XOR keyed by position index).

Beyond the root triage flow, the skill indexes a large set of topic-specific reference files rather than inlining everything: static-analysis tooling (GDB, Ghidra, radare2, IDA, Binary Ninja, RISC-V with Capstone, Unicorn emulation, Python bytecode, WASM, Android APK, .NET, packed binaries); dynamic-analysis tooling (Frida hooking and anti-debug bypass, angr path exploration and CFG, lldb, x64dbg, Qiling, Triton, plus side-channel techniques like an Intel Pin instruction-counting channel and an LD_PRELOAD memcmp byte-by-byte bruteforce oracle); advanced tooling (VMProtect/Themida analysis, binary diffing with BinDiff/Diaphora, deobfuscation frameworks, custom VM-bytecode lifting to LLVM IR, advanced GDB/Ghidra scripting, LIEF-based patching); a comprehensive anti-analysis reference (Linux and Windows anti-debug techniques, anti-VM/sandbox detection, anti-DBI/Frida-detection bypass, code integrity self-hashing, anti-disassembly tricks, and bypass strategies for each); foundational and competition-specific pattern catalogs (custom VMs, nanomites, self-modifying code, mixed-mode stagers, and dozens of named CTF-specific techniques across three pattern files); language-specific notes (Python bytecode/opcode remapping, Pyarmor unpacking, HarmonyOS HAP/ABC, esolangs); platform/framework notes (Rust serde_json schema recovery, Android JNI/DEX patching, Electron ASAR extraction); compiled-language notes (Go, Rust, Swift, Kotlin/JVM, Haskell, C++ vtable/RTTI reconstruction); OS/hardware-platform notes (macOS/iOS, embedded/IoT firmware, kernel drivers, automotive CAN bus, RISC-V and ARM64 hardware RE); and a field-notes quick-reference for after initial triage narrows down the target type.

Use it to understand how an unknown binary works before any further tasking, or to choose tools and a workflow for static/dynamic analysis of a new target. When the binary is understood and the next step is heap/ROP/kernel exploitation, pivot to a pwn-chain skill; for deleted files, PCAP, or disk artifacts, pivot to digital-forensics; for a web app with a small client-side helper, pivot to js-reverse; for real malware, C2, or packing specifically, pivot to malware-analysis; and for orchestrating a multi-challenge CTF contest, pivot to a ctf-sandbox sidecar. Its own limitations are explicit: packers and virtualized code resist casual analysis and should be expected to take long sessions, and reversing third-party software carries legal restrictions the user needs to know for their own jurisdiction.

Input is the target binary and, where relevant, a description of what's already known about it. Setup installs frida-tools, angr, qiling, uncompyle6, capstone, lief, and z3-solver via pip, plus gdb, radare2, binutils, strace/ltrace, apktool, and upx from the system package manager, with r2pm -ci r2ghidra adding radare2's native Ghidra decompiler integration. Output is a reproducible record of the analysis: the commands or scripts run (r2pipe, Frida, angr, or plain Python automation of what would otherwise be manual clicking), and whatever evidence-backed conclusion or extracted value the target yields.

Wraps a wide standard reverse-engineering toolchain - GDB (optionally with pwndbg or GEF), radare2, Ghidra (including headless analysis), IDA, Binary Ninja, Frida, angr, Qiling, Triton, Unicorn, and dogbolt.org for side-by-side decompiler comparison - and hands off to sibling skills for IDA-specific work, radare2 CLI-specific work, APK-layer analysis, or a broader CTF-contest orchestrator when the task grows beyond single-binary triage.

CTF players, security researchers, and reverse engineers triaging an unfamiliar compiled binary in a local, authorized context, who want a cheapest-first workflow before committing to a full manual reverse-engineering session. Community-sourced from zhaoxuya520/reverse-skill under the MIT license, added 2026-08-25.