reverse-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok609hecl1pq6qi
159
reverse-engineering-full/SKILL.md
Normal file
159
reverse-engineering-full/SKILL.md
Normal file
@@ -0,0 +1,159 @@
|
||||
---
|
||||
name: reverse-engineering-full
|
||||
description: Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
|
||||
RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token
|
||||
storage, state machine reconstruction, API enumeration, and security report generation.
|
||||
Covers Rust, Go, C/C++, Python, .NET, Java.
|
||||
version: 1.0.0
|
||||
platforms:
|
||||
- linux
|
||||
- macos
|
||||
- windows
|
||||
triggers:
|
||||
- reverse
|
||||
- engineering
|
||||
- full
|
||||
- spectrum
|
||||
- binary
|
||||
- elf
|
||||
- mach
|
||||
- protocol
|
||||
- auth
|
||||
- flow
|
||||
- mapping
|
||||
- ipc
|
||||
depends_on: []
|
||||
metadata:
|
||||
tags:
|
||||
- reverse
|
||||
- engineering
|
||||
- full
|
||||
---
|
||||
|
||||
# Reverse Engineering — Full Framework
|
||||
|
||||
## When to Use
|
||||
|
||||
- Any binary reverse engineering task
|
||||
- Protocol analysis (IPC, network, file format)
|
||||
- Auth flow mapping and token extraction
|
||||
- Telemetry and data collection analysis
|
||||
- Shell/terminal integration analysis
|
||||
- API endpoint enumeration from binaries
|
||||
- State machine reconstruction
|
||||
- Security assessment of closed-source software
|
||||
- Migration path analysis (rebrand/fork detection)
|
||||
- Bypass vector identification
|
||||
|
||||
## Core Protocol
|
||||
|
||||
Load `skills/meta-rules/meta-re/re-full-practice.md` for the complete methodology.
|
||||
|
||||
## Quick Start
|
||||
|
||||
```bash
|
||||
# Phase 1: Binary profiling (always first)
|
||||
file <binary> && readelf -h <binary> 2>/dev/null || otool -h <binary> 2>/dev/null
|
||||
strings <binary> | head -100 # Quick scan
|
||||
|
||||
# Phase 2: String extraction by category
|
||||
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt
|
||||
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt
|
||||
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt
|
||||
strings <binary> | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt
|
||||
|
||||
# Phase 3: Language detection
|
||||
strings <binary> | grep -oE "crates/[^/]+" | sort -u # Rust
|
||||
strings <binary> | grep -oE "vendor/[^/]+" | sort -u # Go
|
||||
strings <binary> | grep -oE "site-packages/[^/]+" | sort -u # Python
|
||||
strings <binary> | grep -oE "node_modules/[^/]+" | sort -u # Node
|
||||
|
||||
# Phase 4: Protocol analysis
|
||||
strings <binary> | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u
|
||||
strings <binary> | grep -iE "unix.socket|socket.path|named.pipe" | sort -u
|
||||
|
||||
# Phase 5: Generate report
|
||||
# Use the report template from skills/meta-rules/meta-re/re-report-template.md
|
||||
```
|
||||
|
||||
## Phase Breakdown
|
||||
|
||||
### Phase 1: Binary Reconnaissance
|
||||
- File type, architecture, bitness
|
||||
- Stripped vs debug symbols
|
||||
- Dynamic dependencies (ldd/otool)
|
||||
- Packed/obfuscated detection
|
||||
- Language/framework identification
|
||||
|
||||
### Phase 2: String Extraction & Classification
|
||||
- Auth/credential strings
|
||||
- URLs/endpoints
|
||||
- File paths/config locations
|
||||
- Error messages (state indicators)
|
||||
- Protocol/message type names
|
||||
- Environment variables
|
||||
- Telemetry/analytics identifiers
|
||||
|
||||
### Phase 3: Structural Analysis
|
||||
- Import table analysis
|
||||
- Section analysis (.text, .rodata, .data)
|
||||
- Symbol table (if not stripped)
|
||||
- Embedded resources
|
||||
- Certificate/signature info
|
||||
|
||||
### Phase 4: Protocol Reverse Engineering
|
||||
- IPC mechanism (Unix sockets, named pipes, TCP, D-Bus)
|
||||
- Message format (Protobuf, JSON, custom binary)
|
||||
- Request/response patterns
|
||||
- State machine from message types
|
||||
- Authentication within protocol
|
||||
|
||||
### Phase 5: Auth Flow Mapping
|
||||
- Login methods enumeration
|
||||
- Token storage location and format
|
||||
- Refresh mechanism
|
||||
- Session management
|
||||
- Logout/cleanup behavior
|
||||
|
||||
### Phase 6: Telemetry & Data Collection
|
||||
- Event types enumeration
|
||||
- Data fields per event
|
||||
- Destination endpoints
|
||||
- Frequency/triggers
|
||||
- Opt-out mechanisms
|
||||
|
||||
### Phase 7: Security Analysis
|
||||
- Token storage security
|
||||
- Communication encryption
|
||||
- Permission model
|
||||
- Attack surface mapping
|
||||
- Bypass vectors
|
||||
|
||||
### Phase 8: Report Generation
|
||||
- Use the structured report template
|
||||
- Include all findings with evidence
|
||||
- Provide architecture diagrams
|
||||
- List actionable security findings
|
||||
|
||||
## Output Requirements
|
||||
|
||||
Every RE session produces a report with these sections:
|
||||
1. Binary Profile
|
||||
2. Language & Framework
|
||||
3. Crate/Module Architecture
|
||||
4. Auth Flow Map
|
||||
5. Token Storage Schema
|
||||
6. State Machine
|
||||
7. API Endpoints
|
||||
8. IPC Protocol
|
||||
9. Shell/Integration Analysis
|
||||
10. Telemetry Schema
|
||||
11. Security Findings
|
||||
12. Architecture Diagram
|
||||
13. Bypass Vectors
|
||||
14. Migration/Rebrand Analysis (if applicable)
|
||||
|
||||
|
||||
## Related
|
||||
- `skill reverse-engineering-binary — бинари`
|
||||
- `skill reverse-engineering-obfuscation — деобфускация`
|
||||
Reference in New Issue
Block a user