vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
main
reverse-skills-max/reverse-engineering-full/SKILL.md

4.4 KiB
Raw Permalink Blame History

name, description, version, platforms, triggers, depends_on, metadata
name description version platforms triggers depends_on metadata
reverse-engineering-full Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token storage, state machine reconstruction, API enumeration, and security report generation. Covers Rust, Go, C/C++, Python, .NET, Java. 1.0.0
linux
macos
windows
reverse
engineering
full
spectrum
binary
elf
mach
protocol
auth
flow
mapping
ipc
tags
reverse
engineering
full

Reverse Engineering — Full Framework

When to Use

  • Any binary reverse engineering task
  • Protocol analysis (IPC, network, file format)
  • Auth flow mapping and token extraction
  • Telemetry and data collection analysis
  • Shell/terminal integration analysis
  • API endpoint enumeration from binaries
  • State machine reconstruction
  • Security assessment of closed-source software
  • Migration path analysis (rebrand/fork detection)
  • Bypass vector identification

Core Protocol

Load skills/meta-rules/meta-re/re-full-practice.md for the complete methodology.

Quick Start

# Phase 1: Binary profiling (always first)
file <binary> && readelf -h <binary> 2>/dev/null || otool -h <binary> 2>/dev/null
strings <binary> | head -100  # Quick scan

# Phase 2: String extraction by category
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt
strings <binary> | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt

# Phase 3: Language detection
strings <binary> | grep -oE "crates/[^/]+" | sort -u     # Rust
strings <binary> | grep -oE "vendor/[^/]+" | sort -u     # Go
strings <binary> | grep -oE "site-packages/[^/]+" | sort -u  # Python
strings <binary> | grep -oE "node_modules/[^/]+" | sort -u   # Node

# Phase 4: Protocol analysis
strings <binary> | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u
strings <binary> | grep -iE "unix.socket|socket.path|named.pipe" | sort -u

# Phase 5: Generate report
# Use the report template from skills/meta-rules/meta-re/re-report-template.md

Phase Breakdown

Phase 1: Binary Reconnaissance

  • File type, architecture, bitness
  • Stripped vs debug symbols
  • Dynamic dependencies (ldd/otool)
  • Packed/obfuscated detection
  • Language/framework identification

Phase 2: String Extraction & Classification

  • Auth/credential strings
  • URLs/endpoints
  • File paths/config locations
  • Error messages (state indicators)
  • Protocol/message type names
  • Environment variables
  • Telemetry/analytics identifiers

Phase 3: Structural Analysis

  • Import table analysis
  • Section analysis (.text, .rodata, .data)
  • Symbol table (if not stripped)
  • Embedded resources
  • Certificate/signature info

Phase 4: Protocol Reverse Engineering

  • IPC mechanism (Unix sockets, named pipes, TCP, D-Bus)
  • Message format (Protobuf, JSON, custom binary)
  • Request/response patterns
  • State machine from message types
  • Authentication within protocol

Phase 5: Auth Flow Mapping

  • Login methods enumeration
  • Token storage location and format
  • Refresh mechanism
  • Session management
  • Logout/cleanup behavior

Phase 6: Telemetry & Data Collection

  • Event types enumeration
  • Data fields per event
  • Destination endpoints
  • Frequency/triggers
  • Opt-out mechanisms

Phase 7: Security Analysis

  • Token storage security
  • Communication encryption
  • Permission model
  • Attack surface mapping
  • Bypass vectors

Phase 8: Report Generation

  • Use the structured report template
  • Include all findings with evidence
  • Provide architecture diagrams
  • List actionable security findings

Output Requirements

Every RE session produces a report with these sections:

  1. Binary Profile
  2. Language & Framework
  3. Crate/Module Architecture
  4. Auth Flow Map
  5. Token Storage Schema
  6. State Machine
  7. API Endpoints
  8. IPC Protocol
  9. Shell/Integration Analysis
  10. Telemetry Schema
  11. Security Findings
  12. Architecture Diagram
  13. Bypass Vectors
  14. Migration/Rebrand Analysis (if applicable)

Related

  • skill reverse-engineering-binary — бинари
  • skill reverse-engineering-obfuscation — деобфускация