reverse-engineering

Reverse Engineering

Purpose

Guide agents through reverse engineering binaries: Ghidra project setup and decompilation, radare2 analysis workflow, Binary Ninja scripting, initial triage with strings/file/xxd, identifying C++ patterns (vtables, RAII), analyzing stripped binaries, and diffing with Diaphora or BinDiff.

When to Use

• Analyzing an unknown binary without source code
• Recovering algorithm logic from compiled executables
• Comparing two firmware versions for vulnerability patches
• Understanding malware or CTF challenge binaries
• Recovering symbols from stripped ELF/PE files
• Automating analysis with Ghidra or r2 scripts

Workflow

1. Initial triage

file suspicious_binary
strings -n 8 suspicious_binary | head -50
strings -el suspicious_binary          # UTF-16 LE
xxd suspicious_binary | head -20
readelf -h suspicious_binary           # ELF
objdump -d -M intel suspicious_binary | head -40

# Check protections
checksec --file=suspicious_binary

Command	Reveals
file	Architecture, static/dynamic, stripped
strings	URLs, paths, error messages, keys
readelf -s	Symbol table (if not stripped)
nm -D	Dynamic symbols
checksec	RELRO, NX, PIE, canary

2. Ghidra workflow

# Headless analysis
analyzeHeadless /tmp/ghidra_projects MyProject \
  -import suspicious_binary \
  -postScript ExportDecompile.java

# GUI: File → New Project → Import File → Analyze (Yes)

Key steps:

1. Auto-analysis — let Ghidra complete disassembly
2. Define functions — F at entry points if missed
3. Decompiler — Window → Decompiler (C-like output)
4. Rename — L on variables/functions for clarity
5. Cross-references — Ctrl+Shift+F on function/data

// Ghidra script (Java) — list functions > 100 bytes
import ghidra.program.model.listing.*;

FunctionManager fm = currentProgram.getFunctionManager();
for (Function f : fm.getFunctions(true)) {
    if (f.getBody().getNumAddresses() > 100)
        println(f.getName() + " @ " + f.getEntryPoint());
}