---
name: reverse-engineering-full
description: Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
  RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token
  storage, state machine reconstruction, API enumeration, and security report generation.
  Covers Rust, Go, C/C++, Python, .NET, Java.
version: 1.0.0
platforms:
- linux
- macos
- windows
triggers:
  - reverse
  - engineering
  - full
  - spectrum
  - binary
  - elf
  - mach
  - protocol
  - auth
  - flow
  - mapping
  - ipc
depends_on: []
metadata:
  tags:
  - reverse
  - engineering
  - full
---

# Reverse Engineering — Full Framework

## When to Use

- Any binary reverse engineering task
- Protocol analysis (IPC, network, file format)
- Auth flow mapping and token extraction
- Telemetry and data collection analysis
- Shell/terminal integration analysis
- API endpoint enumeration from binaries
- State machine reconstruction
- Security assessment of closed-source software
- Migration path analysis (rebrand/fork detection)
- Bypass vector identification

## Core Protocol

Load `skills/meta-rules/meta-re/re-full-practice.md` for the complete methodology.

## Quick Start

```bash
# Phase 1: Binary profiling (always first)
file <binary> && readelf -h <binary> 2>/dev/null || otool -h <binary> 2>/dev/null
strings <binary> | head -100  # Quick scan

# Phase 2: String extraction by category
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt
strings <binary> | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt

# Phase 3: Language detection
strings <binary> | grep -oE "crates/[^/]+" | sort -u     # Rust
strings <binary> | grep -oE "vendor/[^/]+" | sort -u     # Go
strings <binary> | grep -oE "site-packages/[^/]+" | sort -u  # Python
strings <binary> | grep -oE "node_modules/[^/]+" | sort -u   # Node

# Phase 4: Protocol analysis
strings <binary> | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u
strings <binary> | grep -iE "unix.socket|socket.path|named.pipe" | sort -u

# Phase 5: Generate report
# Use the report template from skills/meta-rules/meta-re/re-report-template.md
```

## Phase Breakdown

### Phase 1: Binary Reconnaissance
- File type, architecture, bitness
- Stripped vs debug symbols
- Dynamic dependencies (ldd/otool)
- Packed/obfuscated detection
- Language/framework identification

### Phase 2: String Extraction & Classification
- Auth/credential strings
- URLs/endpoints
- File paths/config locations
- Error messages (state indicators)
- Protocol/message type names
- Environment variables
- Telemetry/analytics identifiers

### Phase 3: Structural Analysis
- Import table analysis
- Section analysis (.text, .rodata, .data)
- Symbol table (if not stripped)
- Embedded resources
- Certificate/signature info

### Phase 4: Protocol Reverse Engineering
- IPC mechanism (Unix sockets, named pipes, TCP, D-Bus)
- Message format (Protobuf, JSON, custom binary)
- Request/response patterns
- State machine from message types
- Authentication within protocol

### Phase 5: Auth Flow Mapping
- Login methods enumeration
- Token storage location and format
- Refresh mechanism
- Session management
- Logout/cleanup behavior

### Phase 6: Telemetry & Data Collection
- Event types enumeration
- Data fields per event
- Destination endpoints
- Frequency/triggers
- Opt-out mechanisms

### Phase 7: Security Analysis
- Token storage security
- Communication encryption
- Permission model
- Attack surface mapping
- Bypass vectors

### Phase 8: Report Generation
- Use the structured report template
- Include all findings with evidence
- Provide architecture diagrams
- List actionable security findings

## Output Requirements

Every RE session produces a report with these sections:
1. Binary Profile
2. Language & Framework
3. Crate/Module Architecture
4. Auth Flow Map
5. Token Storage Schema
6. State Machine
7. API Endpoints
8. IPC Protocol
9. Shell/Integration Analysis
10. Telemetry Schema
11. Security Findings
12. Architecture Diagram
13. Bypass Vectors
14. Migration/Rebrand Analysis (if applicable)


## Related
- `skill reverse-engineering-binary — бинари`
- `skill reverse-engineering-obfuscation — деобфускация`