reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
249
reverse-engineering-binary/SKILL.md
Normal file
249
reverse-engineering-binary/SKILL.md
Normal file
@@ -0,0 +1,249 @@
|
||||
---
|
||||
name: reverse-engineering-binary
|
||||
description: 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
|
||||
analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis,
|
||||
unpacking, signature analysis, and any task involving compiled binary inspection
|
||||
or modification.'
|
||||
version: 1.0.0
|
||||
platforms:
|
||||
- linux
|
||||
- macos
|
||||
- windows
|
||||
depends_on: []
|
||||
metadata:
|
||||
tags:
|
||||
- reverse
|
||||
- engineering
|
||||
- binary
|
||||
---
|
||||
|
||||
# Reverse Engineering — Binary Analysis
|
||||
|
||||
## Trigger Conditions
|
||||
|
||||
- Disassembling or decompiling binaries (PE, ELF, Mach-O)
|
||||
- IDA Pro, Ghidra, radare2, Binary Ninja workflows
|
||||
- Analyzing compiled code without source
|
||||
- Binary patching, crackme/CTF challenges
|
||||
- Malware reverse engineering, IOC extraction
|
||||
- Function identification, control flow reconstruction
|
||||
- String extraction, crypto constant identification
|
||||
- Import/export table analysis, IAT reconstruction
|
||||
- Binary instrumentation (Frida, DynamoRIO, Pin)
|
||||
- Shellcode analysis, payload decoding
|
||||
- Firmware extraction, embedded binary RE
|
||||
- Comparing binary diffs, version analysis
|
||||
- Writing loaders, unpackers, decoders
|
||||
|
||||
## Core Methodology
|
||||
|
||||
### 1. Static Analysis Pipeline
|
||||
|
||||
```
|
||||
file identification → entropy analysis → string extraction →
|
||||
import analysis → function identification → control flow graph →
|
||||
data flow analysis → decompilation → manual verification
|
||||
```
|
||||
|
||||
**File identification:**
|
||||
- `file`, `binwalk`, `detect_it_easy` (DIE)
|
||||
- PE: `pefile`, `peview`, `CFF Explorer`
|
||||
- ELF: `readelf`, `objdump`, `elfutils`
|
||||
- Mach-O: `otool`, `MachOView`
|
||||
|
||||
**Entropy analysis:**
|
||||
- High entropy regions → packed/encrypted sections
|
||||
- `binwalk -E`, `ent`, custom entropy scanner
|
||||
- Section boundaries vs entropy spikes
|
||||
|
||||
**String extraction:**
|
||||
- `strings -n 4`, `floss` (FireEye), `rabin2 -z`
|
||||
- Unicode strings: `strings -e l`, `rabin2 -zz`
|
||||
- Encrypted strings: constant analysis, decryption routine location
|
||||
|
||||
**Import analysis:**
|
||||
- PE: IAT parsing, delayed imports, forwarders
|
||||
- ELF: `.dynsym`, `.got.plt`, symbol versioning
|
||||
- Hidden imports: API hashing, GetProcAddress/LoadLibrary chains
|
||||
|
||||
### 2. Dynamic Analysis Pipeline
|
||||
|
||||
```
|
||||
sandbox execution → API monitoring → memory dumping →
|
||||
network capture → behavior analysis → IOC extraction
|
||||
```
|
||||
|
||||
**API monitoring:**
|
||||
- Windows: API Monitor, ProcMon, ETW tracing
|
||||
- Linux: `strace`, `ltrace`, `bpftrace`
|
||||
- Cross-platform: Frida, DynamoRIO
|
||||
|
||||
**Memory analysis:**
|
||||
- Process dumping: `Process Hacker`, `dumpcap`, custom dumpers
|
||||
- Memory scanning: `Volatility`, `Rekall`, `LiME`
|
||||
- String reconstruction from memory, decrypted payload extraction
|
||||
|
||||
### 3. Decompilation & Manual RE
|
||||
|
||||
**IDA Pro workflow:**
|
||||
```
|
||||
1. Load binary → auto-analysis → review entry points
|
||||
2. Identify strings → cross-reference → locate key functions
|
||||
3. Rename functions/variables based on behavior
|
||||
4. Create structs for data structures
|
||||
5. Apply FLIRT signatures for known libraries
|
||||
6. Graph view for complex control flow
|
||||
7. Pseudocode (F5) → manual correction
|
||||
8. Write IDC/IDAPython scripts for automation
|
||||
```
|
||||
|
||||
**Ghidra workflow:**
|
||||
```
|
||||
1. Import → auto-analyze (all analyzers)
|
||||
2. Symbol tree → identify main/entry
|
||||
3. Data type manager → create custom structs
|
||||
4. Decompile → fix variable types
|
||||
5. Script manager → Python/Java automation
|
||||
6. Version tracking → binary diffing
|
||||
7. Function graph → identify obfuscation patterns
|
||||
```
|
||||
|
||||
**radare2 workflow:**
|
||||
```
|
||||
r2 binary
|
||||
aaa # analyze all
|
||||
afl # list functions
|
||||
pdf @ main # print disassembly function
|
||||
pdg @ main # decompile (if available)
|
||||
izz # strings
|
||||
ii # imports
|
||||
is # symbols
|
||||
axt @ <addr> # cross-references to
|
||||
axf @ <addr> # cross-references from
|
||||
```
|
||||
|
||||
### 4. Binary Patching
|
||||
|
||||
**Common patch targets:**
|
||||
- License checks: `test eax, eax` → `xor eax, eax` (always true)
|
||||
- Conditional jumps: `je` → `jmp` or `jne`
|
||||
- Function skipping: `call func` → `nop` × 5
|
||||
- Return value modification: `mov eax, 1` before `ret`
|
||||
- Anti-debug bypass: `IsDebuggerPresent` → return 0
|
||||
|
||||
**PE patching:**
|
||||
```python
|
||||
import pefile
|
||||
|
||||
pe = pefile.PE("target.exe")
|
||||
# Find target RVA
|
||||
for section in pe.sections:
|
||||
if section.Name.startswith(b'.text'):
|
||||
text_rva = section.VirtualAddress
|
||||
text_raw = section.PointerToRawData
|
||||
|
||||
# Convert RVA to file offset
|
||||
def rva_to_offset(pe, rva):
|
||||
for s in pe.sections:
|
||||
if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize:
|
||||
return rva - s.VirtualAddress + s.PointerToRawData
|
||||
|
||||
# Patch
|
||||
offset = rva_to_offset(pe, target_rva)
|
||||
pe.set_bytes_at_offset(offset, b'\x90' * 5) # NOP
|
||||
pe.write("target_patched.exe")
|
||||
```
|
||||
|
||||
### 5. Anti-Analysis Detection & Bypass
|
||||
|
||||
**Anti-debug techniques:**
|
||||
- `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`
|
||||
- `NtQueryInformationProcess(ProcessDebugPort)`
|
||||
- `GetTickCount` timing checks
|
||||
- `RDTSC` instruction timing
|
||||
- SEH-based debugger detection
|
||||
- Hardware breakpoint detection (`GetThreadContext`)
|
||||
|
||||
**Bypass methods:**
|
||||
- Patch detection functions to return false
|
||||
- Frida script to hook and override return values
|
||||
- Hide debugger from process list
|
||||
- Use kernel debugger (WinDbg) for kernel-mode targets
|
||||
- Time manipulation for timing-based checks
|
||||
|
||||
**Anti-VM techniques:**
|
||||
- MAC address checks (00:0C:29 = VMware)
|
||||
- Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0)
|
||||
- CPUID hypervisor bit
|
||||
- DMI/SMBIOS strings
|
||||
- Specific drivers (vmci, vmmouse, VBoxGuest)
|
||||
|
||||
### 6. Crypto Identification
|
||||
|
||||
**Constant-based identification:**
|
||||
```
|
||||
MD5: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
|
||||
SHA1: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
|
||||
SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ...
|
||||
AES: S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...)
|
||||
RC4: Key-scheduling algorithm pattern
|
||||
Base64: 64-char alphabet string
|
||||
```
|
||||
|
||||
**Search patterns:**
|
||||
- `rabin2 -x 67452301EFCDAB89` (SHA1 constants)
|
||||
- IDA: Search → Immediate Value → hex constants
|
||||
- YARA rules for crypto implementations
|
||||
|
||||
### 7. Automation Scripts
|
||||
|
||||
**IDAPython — find all API hash calls:**
|
||||
```python
|
||||
from idaapi import *
|
||||
from idautils import *
|
||||
|
||||
def find_api_hash_calls(hash_value):
|
||||
"""Find calls to API hash resolver with specific hash."""
|
||||
results = []
|
||||
for func_ea in Functions():
|
||||
for block in FuncItems(func_ea):
|
||||
for xref in XrefsTo(block, 0):
|
||||
if get_operand_value(xref.frm, 0) == hash_value:
|
||||
results.append(xref.frm)
|
||||
return results
|
||||
```
|
||||
|
||||
**Frida — trace all imports:**
|
||||
```javascript
|
||||
Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), {
|
||||
onEnter: function(args) {
|
||||
console.log('CreateFileW(' + args[0].readUtf16String() + ')');
|
||||
}
|
||||
});
|
||||
```
|
||||
|
||||
## Implementation Standards
|
||||
|
||||
- All RE artifacts are complete: full scripts, working patches, complete analysis
|
||||
- Provide both static and dynamic analysis approaches
|
||||
- Include automation scripts for repetitive tasks
|
||||
- Document findings in structured format
|
||||
- Cross-reference findings across multiple tools
|
||||
- No partial analysis — complete or nothing
|
||||
|
||||
## Output Format
|
||||
|
||||
For binary RE tasks:
|
||||
1. **Identification** — file type, architecture, compiler, packer
|
||||
2. **Static Analysis** — strings, imports, key functions, control flow
|
||||
3. **Dynamic Analysis** — behavior, API calls, network, file operations
|
||||
4. **Key Findings** — algorithms, crypto, protocols, backdoors
|
||||
5. **Artifacts** — patches, scripts, YARA rules, IOCs
|
||||
|
||||
Всё, брат.
|
||||
|
||||
## Related
|
||||
- `skill reverse-engineering-full — полный RE`
|
||||
- `skill reverse-engineering-obfuscation — деобфускация`
|
||||
- `skill binary-exploitation — бинарные эксплойты`
|
||||
- `skill fuzzing — фазинг`
|
||||
Reference in New Issue
Block a user