250 lines
7.6 KiB
Markdown
250 lines
7.6 KiB
Markdown
---
|
||
name: reverse-engineering-binary
|
||
description: 'Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O
|
||
analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis,
|
||
unpacking, signature analysis, and any task involving compiled binary inspection
|
||
or modification.'
|
||
version: 1.0.0
|
||
platforms:
|
||
- linux
|
||
- macos
|
||
- windows
|
||
depends_on: []
|
||
metadata:
|
||
tags:
|
||
- reverse
|
||
- engineering
|
||
- binary
|
||
---
|
||
|
||
# Reverse Engineering — Binary Analysis
|
||
|
||
## Trigger Conditions
|
||
|
||
- Disassembling or decompiling binaries (PE, ELF, Mach-O)
|
||
- IDA Pro, Ghidra, radare2, Binary Ninja workflows
|
||
- Analyzing compiled code without source
|
||
- Binary patching, crackme/CTF challenges
|
||
- Malware reverse engineering, IOC extraction
|
||
- Function identification, control flow reconstruction
|
||
- String extraction, crypto constant identification
|
||
- Import/export table analysis, IAT reconstruction
|
||
- Binary instrumentation (Frida, DynamoRIO, Pin)
|
||
- Shellcode analysis, payload decoding
|
||
- Firmware extraction, embedded binary RE
|
||
- Comparing binary diffs, version analysis
|
||
- Writing loaders, unpackers, decoders
|
||
|
||
## Core Methodology
|
||
|
||
### 1. Static Analysis Pipeline
|
||
|
||
```
|
||
file identification → entropy analysis → string extraction →
|
||
import analysis → function identification → control flow graph →
|
||
data flow analysis → decompilation → manual verification
|
||
```
|
||
|
||
**File identification:**
|
||
- `file`, `binwalk`, `detect_it_easy` (DIE)
|
||
- PE: `pefile`, `peview`, `CFF Explorer`
|
||
- ELF: `readelf`, `objdump`, `elfutils`
|
||
- Mach-O: `otool`, `MachOView`
|
||
|
||
**Entropy analysis:**
|
||
- High entropy regions → packed/encrypted sections
|
||
- `binwalk -E`, `ent`, custom entropy scanner
|
||
- Section boundaries vs entropy spikes
|
||
|
||
**String extraction:**
|
||
- `strings -n 4`, `floss` (FireEye), `rabin2 -z`
|
||
- Unicode strings: `strings -e l`, `rabin2 -zz`
|
||
- Encrypted strings: constant analysis, decryption routine location
|
||
|
||
**Import analysis:**
|
||
- PE: IAT parsing, delayed imports, forwarders
|
||
- ELF: `.dynsym`, `.got.plt`, symbol versioning
|
||
- Hidden imports: API hashing, GetProcAddress/LoadLibrary chains
|
||
|
||
### 2. Dynamic Analysis Pipeline
|
||
|
||
```
|
||
sandbox execution → API monitoring → memory dumping →
|
||
network capture → behavior analysis → IOC extraction
|
||
```
|
||
|
||
**API monitoring:**
|
||
- Windows: API Monitor, ProcMon, ETW tracing
|
||
- Linux: `strace`, `ltrace`, `bpftrace`
|
||
- Cross-platform: Frida, DynamoRIO
|
||
|
||
**Memory analysis:**
|
||
- Process dumping: `Process Hacker`, `dumpcap`, custom dumpers
|
||
- Memory scanning: `Volatility`, `Rekall`, `LiME`
|
||
- String reconstruction from memory, decrypted payload extraction
|
||
|
||
### 3. Decompilation & Manual RE
|
||
|
||
**IDA Pro workflow:**
|
||
```
|
||
1. Load binary → auto-analysis → review entry points
|
||
2. Identify strings → cross-reference → locate key functions
|
||
3. Rename functions/variables based on behavior
|
||
4. Create structs for data structures
|
||
5. Apply FLIRT signatures for known libraries
|
||
6. Graph view for complex control flow
|
||
7. Pseudocode (F5) → manual correction
|
||
8. Write IDC/IDAPython scripts for automation
|
||
```
|
||
|
||
**Ghidra workflow:**
|
||
```
|
||
1. Import → auto-analyze (all analyzers)
|
||
2. Symbol tree → identify main/entry
|
||
3. Data type manager → create custom structs
|
||
4. Decompile → fix variable types
|
||
5. Script manager → Python/Java automation
|
||
6. Version tracking → binary diffing
|
||
7. Function graph → identify obfuscation patterns
|
||
```
|
||
|
||
**radare2 workflow:**
|
||
```
|
||
r2 binary
|
||
aaa # analyze all
|
||
afl # list functions
|
||
pdf @ main # print disassembly function
|
||
pdg @ main # decompile (if available)
|
||
izz # strings
|
||
ii # imports
|
||
is # symbols
|
||
axt @ <addr> # cross-references to
|
||
axf @ <addr> # cross-references from
|
||
```
|
||
|
||
### 4. Binary Patching
|
||
|
||
**Common patch targets:**
|
||
- License checks: `test eax, eax` → `xor eax, eax` (always true)
|
||
- Conditional jumps: `je` → `jmp` or `jne`
|
||
- Function skipping: `call func` → `nop` × 5
|
||
- Return value modification: `mov eax, 1` before `ret`
|
||
- Anti-debug bypass: `IsDebuggerPresent` → return 0
|
||
|
||
**PE patching:**
|
||
```python
|
||
import pefile
|
||
|
||
pe = pefile.PE("target.exe")
|
||
# Find target RVA
|
||
for section in pe.sections:
|
||
if section.Name.startswith(b'.text'):
|
||
text_rva = section.VirtualAddress
|
||
text_raw = section.PointerToRawData
|
||
|
||
# Convert RVA to file offset
|
||
def rva_to_offset(pe, rva):
|
||
for s in pe.sections:
|
||
if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize:
|
||
return rva - s.VirtualAddress + s.PointerToRawData
|
||
|
||
# Patch
|
||
offset = rva_to_offset(pe, target_rva)
|
||
pe.set_bytes_at_offset(offset, b'\x90' * 5) # NOP
|
||
pe.write("target_patched.exe")
|
||
```
|
||
|
||
### 5. Anti-Analysis Detection & Bypass
|
||
|
||
**Anti-debug techniques:**
|
||
- `IsDebuggerPresent`, `CheckRemoteDebuggerPresent`
|
||
- `NtQueryInformationProcess(ProcessDebugPort)`
|
||
- `GetTickCount` timing checks
|
||
- `RDTSC` instruction timing
|
||
- SEH-based debugger detection
|
||
- Hardware breakpoint detection (`GetThreadContext`)
|
||
|
||
**Bypass methods:**
|
||
- Patch detection functions to return false
|
||
- Frida script to hook and override return values
|
||
- Hide debugger from process list
|
||
- Use kernel debugger (WinDbg) for kernel-mode targets
|
||
- Time manipulation for timing-based checks
|
||
|
||
**Anti-VM techniques:**
|
||
- MAC address checks (00:0C:29 = VMware)
|
||
- Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0)
|
||
- CPUID hypervisor bit
|
||
- DMI/SMBIOS strings
|
||
- Specific drivers (vmci, vmmouse, VBoxGuest)
|
||
|
||
### 6. Crypto Identification
|
||
|
||
**Constant-based identification:**
|
||
```
|
||
MD5: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
|
||
SHA1: 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
|
||
SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ...
|
||
AES: S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...)
|
||
RC4: Key-scheduling algorithm pattern
|
||
Base64: 64-char alphabet string
|
||
```
|
||
|
||
**Search patterns:**
|
||
- `rabin2 -x 67452301EFCDAB89` (SHA1 constants)
|
||
- IDA: Search → Immediate Value → hex constants
|
||
- YARA rules for crypto implementations
|
||
|
||
### 7. Automation Scripts
|
||
|
||
**IDAPython — find all API hash calls:**
|
||
```python
|
||
from idaapi import *
|
||
from idautils import *
|
||
|
||
def find_api_hash_calls(hash_value):
|
||
"""Find calls to API hash resolver with specific hash."""
|
||
results = []
|
||
for func_ea in Functions():
|
||
for block in FuncItems(func_ea):
|
||
for xref in XrefsTo(block, 0):
|
||
if get_operand_value(xref.frm, 0) == hash_value:
|
||
results.append(xref.frm)
|
||
return results
|
||
```
|
||
|
||
**Frida — trace all imports:**
|
||
```javascript
|
||
Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), {
|
||
onEnter: function(args) {
|
||
console.log('CreateFileW(' + args[0].readUtf16String() + ')');
|
||
}
|
||
});
|
||
```
|
||
|
||
## Implementation Standards
|
||
|
||
- All RE artifacts are complete: full scripts, working patches, complete analysis
|
||
- Provide both static and dynamic analysis approaches
|
||
- Include automation scripts for repetitive tasks
|
||
- Document findings in structured format
|
||
- Cross-reference findings across multiple tools
|
||
- No partial analysis — complete or nothing
|
||
|
||
## Output Format
|
||
|
||
For binary RE tasks:
|
||
1. **Identification** — file type, architecture, compiler, packer
|
||
2. **Static Analysis** — strings, imports, key functions, control flow
|
||
3. **Dynamic Analysis** — behavior, API calls, network, file operations
|
||
4. **Key Findings** — algorithms, crypto, protocols, backdoors
|
||
5. **Artifacts** — patches, scripts, YARA rules, IOCs
|
||
|
||
Всё, брат.
|
||
|
||
## Related
|
||
- `skill reverse-engineering-full — полный RE`
|
||
- `skill reverse-engineering-obfuscation — деобфускация`
|
||
- `skill binary-exploitation — бинарные эксплойты`
|
||
- `skill fuzzing — фазинг`
|