vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
da24c2bd206830822af121457bf51692ef7fc3aa
reverse-skills-max/reverse-engineering-binary/SKILL.md

7.6 KiB
Raw Blame History

name, description, version, platforms, depends_on, metadata
name description version platforms depends_on metadata
reverse-engineering-binary Use for binary reverse engineering: disassembly, decompilation, PE/ELF/Mach-O analysis, IDA Pro, Ghidra, radare2, binary patching, crackme solving, malware analysis, unpacking, signature analysis, and any task involving compiled binary inspection or modification. 1.0.0
linux
macos
windows
tags
reverse
engineering
binary

Reverse Engineering — Binary Analysis

Trigger Conditions

  • Disassembling or decompiling binaries (PE, ELF, Mach-O)
  • IDA Pro, Ghidra, radare2, Binary Ninja workflows
  • Analyzing compiled code without source
  • Binary patching, crackme/CTF challenges
  • Malware reverse engineering, IOC extraction
  • Function identification, control flow reconstruction
  • String extraction, crypto constant identification
  • Import/export table analysis, IAT reconstruction
  • Binary instrumentation (Frida, DynamoRIO, Pin)
  • Shellcode analysis, payload decoding
  • Firmware extraction, embedded binary RE
  • Comparing binary diffs, version analysis
  • Writing loaders, unpackers, decoders

Core Methodology

1. Static Analysis Pipeline

file identification → entropy analysis → string extraction →
import analysis → function identification → control flow graph →
data flow analysis → decompilation → manual verification

File identification:

  • file, binwalk, detect_it_easy (DIE)
  • PE: pefile, peview, CFF Explorer
  • ELF: readelf, objdump, elfutils
  • Mach-O: otool, MachOView

Entropy analysis:

  • High entropy regions → packed/encrypted sections
  • binwalk -E, ent, custom entropy scanner
  • Section boundaries vs entropy spikes

String extraction:

  • strings -n 4, floss (FireEye), rabin2 -z
  • Unicode strings: strings -e l, rabin2 -zz
  • Encrypted strings: constant analysis, decryption routine location

Import analysis:

  • PE: IAT parsing, delayed imports, forwarders
  • ELF: .dynsym, .got.plt, symbol versioning
  • Hidden imports: API hashing, GetProcAddress/LoadLibrary chains

2. Dynamic Analysis Pipeline

sandbox execution → API monitoring → memory dumping →
network capture → behavior analysis → IOC extraction

API monitoring:

  • Windows: API Monitor, ProcMon, ETW tracing
  • Linux: strace, ltrace, bpftrace
  • Cross-platform: Frida, DynamoRIO

Memory analysis:

  • Process dumping: Process Hacker, dumpcap, custom dumpers
  • Memory scanning: Volatility, Rekall, LiME
  • String reconstruction from memory, decrypted payload extraction

3. Decompilation & Manual RE

IDA Pro workflow:

1. Load binary → auto-analysis → review entry points
2. Identify strings → cross-reference → locate key functions
3. Rename functions/variables based on behavior
4. Create structs for data structures
5. Apply FLIRT signatures for known libraries
6. Graph view for complex control flow
7. Pseudocode (F5) → manual correction
8. Write IDC/IDAPython scripts for automation

Ghidra workflow:

1. Import → auto-analyze (all analyzers)
2. Symbol tree → identify main/entry
3. Data type manager → create custom structs
4. Decompile → fix variable types
5. Script manager → Python/Java automation
6. Version tracking → binary diffing
7. Function graph → identify obfuscation patterns

radare2 workflow:

r2 binary
aaa                          # analyze all
afl                          # list functions
pdf @ main                   # print disassembly function
pdg @ main                   # decompile (if available)
izz                          # strings
ii                           # imports
is                           # symbols
axt @ <addr>                 # cross-references to
axf @ <addr>                 # cross-references from

4. Binary Patching

Common patch targets:

  • License checks: test eax, eax → xor eax, eax (always true)
  • Conditional jumps: je → jmp or jne
  • Function skipping: call func → nop × 5
  • Return value modification: mov eax, 1 before ret
  • Anti-debug bypass: IsDebuggerPresent → return 0

PE patching:

import pefile

pe = pefile.PE("target.exe")
# Find target RVA
for section in pe.sections:
    if section.Name.startswith(b'.text'):
        text_rva = section.VirtualAddress
        text_raw = section.PointerToRawData

# Convert RVA to file offset
def rva_to_offset(pe, rva):
    for s in pe.sections:
        if s.VirtualAddress <= rva < s.VirtualAddress + s.Misc_VirtualSize:
            return rva - s.VirtualAddress + s.PointerToRawData

# Patch
offset = rva_to_offset(pe, target_rva)
pe.set_bytes_at_offset(offset, b'\x90' * 5)  # NOP
pe.write("target_patched.exe")

5. Anti-Analysis Detection & Bypass

Anti-debug techniques:

  • IsDebuggerPresent, CheckRemoteDebuggerPresent
  • NtQueryInformationProcess(ProcessDebugPort)
  • GetTickCount timing checks
  • RDTSC instruction timing
  • SEH-based debugger detection
  • Hardware breakpoint detection (GetThreadContext)

Bypass methods:

  • Patch detection functions to return false
  • Frida script to hook and override return values
  • Hide debugger from process list
  • Use kernel debugger (WinDbg) for kernel-mode targets
  • Time manipulation for timing-based checks

Anti-VM techniques:

  • MAC address checks (00:0C:29 = VMware)
  • Registry keys (HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0)
  • CPUID hypervisor bit
  • DMI/SMBIOS strings
  • Specific drivers (vmci, vmmouse, VBoxGuest)

6. Crypto Identification

Constant-based identification:

MD5:    0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476
SHA1:   0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0
SHA256: 0x6A09E667, 0xBB67AE85, 0x3C6EF372, 0xA54FF53A, ...
AES:    S-box lookup table (256 bytes starting 0x63, 0x7C, 0x77, ...)
RC4:    Key-scheduling algorithm pattern
Base64: 64-char alphabet string

Search patterns:

  • rabin2 -x 67452301EFCDAB89 (SHA1 constants)
  • IDA: Search → Immediate Value → hex constants
  • YARA rules for crypto implementations

7. Automation Scripts

IDAPython — find all API hash calls:

from idaapi import *
from idautils import *

def find_api_hash_calls(hash_value):
    """Find calls to API hash resolver with specific hash."""
    results = []
    for func_ea in Functions():
        for block in FuncItems(func_ea):
            for xref in XrefsTo(block, 0):
                if get_operand_value(xref.frm, 0) == hash_value:
                    results.append(xref.frm)
    return results

Frida — trace all imports:

Interceptor.attach(Module.getExportByName(null, 'CreateFileW'), {
    onEnter: function(args) {
        console.log('CreateFileW(' + args[0].readUtf16String() + ')');
    }
});

Implementation Standards

  • All RE artifacts are complete: full scripts, working patches, complete analysis
  • Provide both static and dynamic analysis approaches
  • Include automation scripts for repetitive tasks
  • Document findings in structured format
  • Cross-reference findings across multiple tools
  • No partial analysis — complete or nothing

Output Format

For binary RE tasks:

  1. Identification — file type, architecture, compiler, packer
  2. Static Analysis — strings, imports, key functions, control flow
  3. Dynamic Analysis — behavior, API calls, network, file operations
  4. Key Findings — algorithms, crypto, protocols, backdoors
  5. Artifacts — patches, scripts, YARA rules, IOCs

Всё, брат.

Related

  • skill reverse-engineering-full — полный RE
  • skill reverse-engineering-obfuscation — деобфускация
  • skill binary-exploitation — бинарные эксплойты
  • skill fuzzing — фазинг