---
name: reverse-engineering-cli
description: 'Use for CLI tool reverse engineering: binary analysis, auth flow mapping,
  token extraction, API endpoint enumeration, state machine reconstruction, protocol
  analysis, config file discovery, and bypass techniques for command-line applications.'
version: 1.0.0
platforms:
- linux
- macos
- windows
triggers:
  - reverse
  - engineering
  - cli
  - tool
  - binary
  - analysis
  - auth
  - flow
  - mapping
  - token
  - extraction
  - api
depends_on: []
metadata:
  tags:
  - reverse
  - engineering
  - cli
---

# Reverse Engineering — CLI Tools

## When to Use

- RE of any CLI binary/tool
- Auth flow analysis (login/logout/token refresh)
- Token storage discovery and extraction
- API endpoint enumeration from binaries
- State machine reconstruction
- Protocol reverse engineering
- Bypass of authentication or licensing in CLI tools

## Core Protocol

Load `../../meta-rules/meta-re/SKILL.md` for the full methodology.

## Quick Start

```bash
# 1. Identify binary
file <binary> && readelf -h <binary>

# 2. Extract auth strings
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u

# 3. Extract URLs/endpoints
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u

# 4. Extract config paths
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u

# 5. Extract SQL queries (token stores)
strings <binary> | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM"

# 6. Extract API operations
strings <binary> | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u

# 7. Capture network traffic
strace -f -e trace=network -o /tmp/re/strace.log <binary> <cmd>
```

## Auth Flow Patterns

### Device Code Flow (AWS SSO OIDC)
1. POST /oauth2/device → deviceCode + userCode
2. User opens browser, enters code
3. POST /oauth2/token → poll until authorized
4. Response: accessToken + refreshToken

### PKCE OAuth
1. Generate code_verifier → code_challenge = SHA256
2. Browser auth → redirect with code
3. POST /token with code_verifier
4. Response: access_token + refresh_token

### External IdP (Social)
1. Redirect to Google/GitHub
2. Callback → extract tokens
3. Exchange for service token with profile ARN

## Token Storage

Common patterns:
- SQLite KV: `auth_kv` table, keys like `<app>:odic:token`
- Keyring: `secret-tool lookup <key>`
- JSON config: `~/.config/<app>/credentials.json`

## Output Requirements

Every RE session produces:
1. Binary profile
2. Auth flow map
3. Token schema
4. API endpoint list
5. State machine diagram
6. Bypass vectors
7. Config file map


## Related
- `skill reverse-engineering-binary — бинари`
- `skill cli-tooling — CLI`