reverse-skills-max/reverse-engineering-cli/SKILL.md

name, description, version, platforms, triggers, depends_on, metadata

name	description	version	platforms	triggers	depends_on	metadata
reverse-engineering-cli	Use for CLI tool reverse engineering: binary analysis, auth flow mapping, token extraction, API endpoint enumeration, state machine reconstruction, protocol analysis, config file discovery, and bypass techniques for command-line applications.	1.0.0	linux macos windows	reverse engineering cli tool binary analysis auth flow mapping token extraction api		tags reverse engineering cli

Reverse Engineering — CLI Tools

When to Use

• RE of any CLI binary/tool
• Auth flow analysis (login/logout/token refresh)
• Token storage discovery and extraction
• API endpoint enumeration from binaries
• State machine reconstruction
• Protocol reverse engineering
• Bypass of authentication or licensing in CLI tools

Core Protocol

Load ../../meta-rules/meta-re/SKILL.md for the full methodology.

Quick Start

# 1. Identify binary
file <binary> && readelf -h <binary>

# 2. Extract auth strings
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc" | grep -v "registry/src" | sort -u

# 3. Extract URLs/endpoints
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u

# 4. Extract config paths
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA" | grep -v "registry/src" | sort -u

# 5. Extract SQL queries (token stores)
strings <binary> | grep -iE "SELECT|INSERT|CREATE TABLE|DELETE FROM"

# 6. Extract API operations
strings <binary> | grep -oE "[A-Z][a-zA-Z]+Service\.[A-Z][a-zA-Z]+" | sort -u

# 7. Capture network traffic
strace -f -e trace=network -o /tmp/re/strace.log <binary> <cmd>

Auth Flow Patterns

Device Code Flow (AWS SSO OIDC)

1. POST /oauth2/device → deviceCode + userCode
2. User opens browser, enters code
3. POST /oauth2/token → poll until authorized
4. Response: accessToken + refreshToken

PKCE OAuth

1. Generate code_verifier → code_challenge = SHA256
2. Browser auth → redirect with code
3. POST /token with code_verifier
4. Response: access_token + refresh_token

External IdP (Social)

1. Redirect to Google/GitHub
2. Callback → extract tokens
3. Exchange for service token with profile ARN

Token Storage

Common patterns:

• SQLite KV: auth_kv table, keys like <app>:odic:token
• Keyring: secret-tool lookup <key>
• JSON config: ~/.config/<app>/credentials.json

Output Requirements

Every RE session produces:

1. Binary profile
2. Auth flow map
3. Token schema
4. API endpoint list
5. State machine diagram
6. Bypass vectors
7. Config file map

Related

• skill reverse-engineering-binary — бинари
• skill cli-tooling — CLI