---
name: reverse-engineering-binary
description: 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
  analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis,
  unpacking, signature analysis, and any task involving compiled binary inspection
  or modification.'
version: 1.0.0
platforms:
- linux
- macos
- windows
depends_on: []
metadata:
  tags:
  - reverse
  - engineering
  - binary
---

# Reverse Engineering — Binary Analysis

## Trigger Conditions

- Disassembling or decompiling binaries (PE, ELF, Mach-O)
- IDA Pro, Ghidra, radare2, Binary Ninja workflows
- Analyzing compiled code without source
- Binary patching, crackme/CTF challenges
- Malware reverse engineering, IOC extraction
- Function identification, control flow reconstruction
- String extraction, crypto constant identification
- Import/export table analysis, IAT reconstruction
- Binary instrumentation (Frida, DynamoRIO, Pin)
- Shellcode analysis, payload decoding
- Firmware extraction, embedded binary RE
- Comparing binary diffs, version analysis
- Writing loaders, unpackers, decoders

## Core Methodology

### 1. Static Analysis Pipeline

```
file identification → entropy analysis → string extraction →
import analysis → function identification → control flow graph →
data flow analysis → decompilation → manual verification
```

**File identification:**
- `file`, `binwalk`, `detect_it_easy` (DIE)
- PE: `pefile`, `peview`, `CFF Explorer`
- ELF: `readelf`, `objdump`, `elfutils`
- Mach-O: `otool`, `MachOView`

**Entropy analysis:**
- High entropy regions → packed/encrypted sections
- `binwalk -E`, `ent`, custom entropy scanner
- Section boundaries vs entropy spikes

**String extraction:**
- `strings -n 4`, `floss` (FireEye), `rabin2 -z`
- Unicode strings: `strings -e l`, `rabin2 -zz`
- Encrypted strings: constant analysis, decryption routine location

**Import analysis:**
- PE: IAT parsing, delayed imports, forwarders
- ELF: `.dynsym`, `.got.plt`, symbol versioning
- Hidden imports: API hashing, GetProcAddress/LoadLibrary chains

### 2. Dynamic Analysis Pipeline

```
sandbox execution → API monitoring → memory dumping →
network capture → behavior analysis → IOC extraction
```

**API monitoring:**
- Windows: API Monitor, ProcMon, ETW tracing
- Linux: `strace`, `ltrace`, `bpftrace`
- Cross-platform: Frida, DynamoRIO

**Memory analysis:**
- Process dumping: `Process Hacker`, `dumpcap`, custom dumpers
- Memory scanning: `Volatility`, `Rekall`, `LiME`
- String reconstruction from memory, decrypted payload extraction

### 3. Decompilation & Manual RE

**IDA Pro workflow:**
```
1. Load binary → auto-analysis → review entry points
2. Identify strings → cross-reference → locate key functions
3. Rename functions/variables based on behavior
4. Create structs for data structures
5. Apply FLIRT signatures for known libraries
6. Graph view for complex control flow
7. Pseudocode (F5) → manual correction
8. Write IDC/IDAPython scripts for automation
```

**Ghidra workflow:**
```
1. Import → auto-analyze (all analyzers)
2. Symbol tree → identify main/entry
3. Data type manager → create custom structs
4. Decompile → fix variable types
5. Script manager → Python/Java automation
6. Version tracking → binary diffing
7. Function graph → identify obfuscation patterns
```

**radare2 workflow:**
```
r2 binary
aaa                          # analyze all
afl                          # list functions
pdf @ main                   # print disassembly function
pdg @ main                   # decompile (if available)
izz                          # strings
ii                           # imports
is                           # symbols
axt @ <addr>                 # cross-references to
axf @ <addr>                 # cross-references from
```

### 4. Binary Patching

**Common patch targets:**
- License checks: `test eax, eax` → `xor eax, eax` (always true)
- Conditional jumps: `je` → `jmp` or `jne`
- Function skipping: `call func` → `nop` × 5
- Return value modification: `mov eax, 1` before `ret`
- Anti-debug bypass: `IsDebuggerPresent` → return 0

**PE patching:**
```python
import pefile

pe = pefile.PE("target.exe")
# Find target RVA
for section in pe.sections:
    if section.Name.startswith(b'.text'):
        text_rva = section.VirtualAddress
        text_raw = section.PointerToRawData

# Convert RVA to file offset
def rva_to_offset(pe, rva):
    for s in pe.sections:
        if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize:
            return rva - s.VirtualAddress + s.PointerToRawData

# Patch
offset = rva_to_offset(pe, target_rva)
pe.set_bytes_at_offset(offset, b'\x90' * 5)  # NOP
pe.write("target_patched.exe")
```

### 5. Anti-Analysis Detection & Bypass

**Anti-debug techniques:**
- `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`
- `NtQueryInformationProcess(ProcessDebugPort)`
- `GetTickCount` timing checks
- `RDTSC` instruction timing
- SEH-based debugger detection
- Hardware breakpoint detection (`GetThreadContext`)

**Bypass methods:**
- Patch detection functions to return false
- Frida script to hook and override return values
- Hide debugger from process list
- Use kernel debugger (WinDbg) for kernel-mode targets
- Time manipulation for timing-based checks

**Anti-VM techniques:**
- MAC address checks (00:0C:29 = VMware)
- Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0)
- CPUID hypervisor bit
- DMI/SMBIOS strings
- Specific drivers (vmci, vmmouse, VBoxGuest)

### 6. Crypto Identification

**Constant-based identification:**
```
MD5:    0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
SHA1:   0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ...
AES:    S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...)
RC4:    Key-scheduling algorithm pattern
Base64: 64-char alphabet string
```

**Search patterns:**
- `rabin2 -x 67452301EFCDAB89` (SHA1 constants)
- IDA: Search → Immediate Value → hex constants
- YARA rules for crypto implementations

### 7. Automation Scripts

**IDAPython — find all API hash calls:**
```python
from idaapi import *
from idautils import *

def find_api_hash_calls(hash_value):
    """Find calls to API hash resolver with specific hash."""
    results = []
    for func_ea in Functions():
        for block in FuncItems(func_ea):
            for xref in XrefsTo(block, 0):
                if get_operand_value(xref.frm, 0) == hash_value:
                    results.append(xref.frm)
    return results
```

**Frida — trace all imports:**
```javascript
Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), {
    onEnter: function(args) {
        console.log('CreateFileW(' + args[0].readUtf16String() + ')');
    }
});
```

## Implementation Standards

- All RE artifacts are complete: full scripts, working patches, complete analysis
- Provide both static and dynamic analysis approaches
- Include automation scripts for repetitive tasks
- Document findings in structured format
- Cross-reference findings across multiple tools
- No partial analysis — complete or nothing

## Output Format

For binary RE tasks:
1. **Identification** — file type, architecture, compiler, packer
2. **Static Analysis** — strings, imports, key functions, control flow
3. **Dynamic Analysis** — behavior, API calls, network, file operations
4. **Key Findings** — algorithms, crypto, protocols, backdoors
5. **Artifacts** — patches, scripts, YARA rules, IOCs

Всё, брат.

## Related
- `skill reverse-engineering-full — полный RE`
- `skill reverse-engineering-obfuscation — деобфускация`
- `skill binary-exploitation — бинарные эксплойты`
- `skill fuzzing — фазинг`