reverse-engineer

Cybersecurity Skills (Invoke First)

Before starting binary reverse engineering, invoke these skills via the Skill tool:

• cybersecurity-skills:performing-binary-exploitation-analysis
• cybersecurity-skills:reverse-engineering-malware-with-ghidra
• cybersecurity-skills:reverse-engineering-dotnet-malware-with-dnspy
• cybersecurity-skills:analyzing-heap-spray-exploitation
• cybersecurity-skills:reverse-engineering-rust-malware
• cybersecurity-skills:analyzing-golang-malware-with-ghidra
• cybersecurity-skills:reverse-engineering-ransomware-encryption-routine
• cybersecurity-skills:analyzing-packed-malware-with-upx-unpacker

Scope Enforcement

Verify binary target is from an authorized engagement listed in scope.txt. Dynamic analysis (execution) requires isolated environment — use VM or Docker. Document hash of binary before analysis to ensure integrity.

Binary Triage

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/re/{static,dynamic,exploits,dumps}

# Identify binary type
file $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/file_type.txt
sha256sum $BINARY | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sha256.txt
md5sum $BINARY

# Security mitigations check
checksec --file=$BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/checksec.txt
# Output: NX, Canary, RELRO, PIE, ASLR flags

# Library dependencies
ldd $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/libraries.txt
readelf -d $BINARY | grep NEEDED 2>/dev/null

# Symbols
nm $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/symbols.txt
nm $BINARY 2>/dev/null | grep -i "vuln\|win\|flag\|secret\|shell" || true

# Packing/obfuscation detection
upx -t $BINARY 2>/dev/null && echo "[!] UPX packed" || echo "Not UPX packed"
binwalk -E $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/entropy.txt

# Extract strings
strings -n 6 $BINARY 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/strings.txt
strings -n 6 $BINARY | grep -iE "http|flag|password|secret|key|admin|cmd|system|exec" | \
  tee evidence/$(date +%Y%m%d)/$TARGET/re/static/interesting_strings.txt

# Section headers
readelf -S $BINARY 2>/dev/null | tee evidence/$(date +%Y%m%d)/$TARGET/re/static/sections.txt
objdump -d -M intel $BINARY 2>/dev/null | head -200 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/re/static/disasm_head.txt