160 lines
4.4 KiB
Markdown
160 lines
4.4 KiB
Markdown
---
|
|
name: reverse-engineering-full
|
|
description: Use for full-spectrum binary reverse engineering (ELF/PE/Mach-O), protocol
|
|
RE, auth flow mapping, IPC analysis, shell integration, telemetry extraction, token
|
|
storage, state machine reconstruction, API enumeration, and security report generation.
|
|
Covers Rust, Go, C/C++, Python, .NET, Java.
|
|
version: 1.0.0
|
|
platforms:
|
|
- linux
|
|
- macos
|
|
- windows
|
|
triggers:
|
|
- reverse
|
|
- engineering
|
|
- full
|
|
- spectrum
|
|
- binary
|
|
- elf
|
|
- mach
|
|
- protocol
|
|
- auth
|
|
- flow
|
|
- mapping
|
|
- ipc
|
|
depends_on: []
|
|
metadata:
|
|
tags:
|
|
- reverse
|
|
- engineering
|
|
- full
|
|
---
|
|
|
|
# Reverse Engineering — Full Framework
|
|
|
|
## When to Use
|
|
|
|
- Any binary reverse engineering task
|
|
- Protocol analysis (IPC, network, file format)
|
|
- Auth flow mapping and token extraction
|
|
- Telemetry and data collection analysis
|
|
- Shell/terminal integration analysis
|
|
- API endpoint enumeration from binaries
|
|
- State machine reconstruction
|
|
- Security assessment of closed-source software
|
|
- Migration path analysis (rebrand/fork detection)
|
|
- Bypass vector identification
|
|
|
|
## Core Protocol
|
|
|
|
Load `skills/meta-rules/meta-re/re-full-practice.md` for the complete methodology.
|
|
|
|
## Quick Start
|
|
|
|
```bash
|
|
# Phase 1: Binary profiling (always first)
|
|
file <binary> && readelf -h <binary> 2>/dev/null || otool -h <binary> 2>/dev/null
|
|
strings <binary> | head -100 # Quick scan
|
|
|
|
# Phase 2: String extraction by category
|
|
strings <binary> | grep -iE "login|logout|token|auth|session|oauth|oidc|cookie" > /tmp/re/auth.txt
|
|
strings <binary> | grep -oE "https://[a-zA-Z0-9._/-]+" | sort -u > /tmp/re/urls.txt
|
|
strings <binary> | grep -iE "\.config|\.local|\.cache|HOME|APPDATA|registry" | grep -v "registry/src" > /tmp/re/paths.txt
|
|
strings <binary> | grep -iE "error|fail|panic|assert|exception" | grep -v "registry/src" > /tmp/re/errors.txt
|
|
|
|
# Phase 3: Language detection
|
|
strings <binary> | grep -oE "crates/[^/]+" | sort -u # Rust
|
|
strings <binary> | grep -oE "vendor/[^/]+" | sort -u # Go
|
|
strings <binary> | grep -oE "site-packages/[^/]+" | sort -u # Python
|
|
strings <binary> | grep -oE "node_modules/[^/]+" | sort -u # Node
|
|
|
|
# Phase 4: Protocol analysis
|
|
strings <binary> | grep -iE "\.(proto|mux|ipc|rpc|grpc)" | sort -u
|
|
strings <binary> | grep -iE "unix.socket|socket.path|named.pipe" | sort -u
|
|
|
|
# Phase 5: Generate report
|
|
# Use the report template from skills/meta-rules/meta-re/re-report-template.md
|
|
```
|
|
|
|
## Phase Breakdown
|
|
|
|
### Phase 1: Binary Reconnaissance
|
|
- File type, architecture, bitness
|
|
- Stripped vs debug symbols
|
|
- Dynamic dependencies (ldd/otool)
|
|
- Packed/obfuscated detection
|
|
- Language/framework identification
|
|
|
|
### Phase 2: String Extraction & Classification
|
|
- Auth/credential strings
|
|
- URLs/endpoints
|
|
- File paths/config locations
|
|
- Error messages (state indicators)
|
|
- Protocol/message type names
|
|
- Environment variables
|
|
- Telemetry/analytics identifiers
|
|
|
|
### Phase 3: Structural Analysis
|
|
- Import table analysis
|
|
- Section analysis (.text, .rodata, .data)
|
|
- Symbol table (if not stripped)
|
|
- Embedded resources
|
|
- Certificate/signature info
|
|
|
|
### Phase 4: Protocol Reverse Engineering
|
|
- IPC mechanism (Unix sockets, named pipes, TCP, D-Bus)
|
|
- Message format (Protobuf, JSON, custom binary)
|
|
- Request/response patterns
|
|
- State machine from message types
|
|
- Authentication within protocol
|
|
|
|
### Phase 5: Auth Flow Mapping
|
|
- Login methods enumeration
|
|
- Token storage location and format
|
|
- Refresh mechanism
|
|
- Session management
|
|
- Logout/cleanup behavior
|
|
|
|
### Phase 6: Telemetry & Data Collection
|
|
- Event types enumeration
|
|
- Data fields per event
|
|
- Destination endpoints
|
|
- Frequency/triggers
|
|
- Opt-out mechanisms
|
|
|
|
### Phase 7: Security Analysis
|
|
- Token storage security
|
|
- Communication encryption
|
|
- Permission model
|
|
- Attack surface mapping
|
|
- Bypass vectors
|
|
|
|
### Phase 8: Report Generation
|
|
- Use the structured report template
|
|
- Include all findings with evidence
|
|
- Provide architecture diagrams
|
|
- List actionable security findings
|
|
|
|
## Output Requirements
|
|
|
|
Every RE session produces a report with these sections:
|
|
1. Binary Profile
|
|
2. Language & Framework
|
|
3. Crate/Module Architecture
|
|
4. Auth Flow Map
|
|
5. Token Storage Schema
|
|
6. State Machine
|
|
7. API Endpoints
|
|
8. IPC Protocol
|
|
9. Shell/Integration Analysis
|
|
10. Telemetry Schema
|
|
11. Security Findings
|
|
12. Architecture Diagram
|
|
13. Bypass Vectors
|
|
14. Migration/Rebrand Analysis (if applicable)
|
|
|
|
|
|
## Related
|
|
- `skill reverse-engineering-binary — бинари`
|
|
- `skill reverse-engineering-obfuscation — деобфускация`
|