How does it handle Python bytecode?

The skill includes specific sub-routines for analyzing .pyc and marshal files, helping you understand obfuscated or compiled Python logic.

What tools does the binary-re skill require?

The skill prefers radare2 and Ghidra for deep analysis, but it includes robust fallback mechanisms using standard binutils like readelf, objdump, and strings if specialized tools aren't available.

Can I analyze binaries from different CPU architectures?

Yes, the skill supports cross-architecture analysis for ARM, MIPS, and RISC-V using QEMU-user emulation and Docker-based environments.

Does it remember my progress if I restart?

Yes, the skill utilizes episodic memory to tag and search for previous findings by file hash, allowing you to resume interrupted analysis sessions seamlessly.

Is the analysis process automated?

It uses an 'Agentic Loop' to drive analysis, but it follows a strict 'Human-in-the-Loop' policy, requiring your explicit approval before executing any binary or performing network operations.

Binary Reverse Engineering Toolkit

Name: Binary Reverse Engineering Toolkit
Author: 2389-research

by2389-research

•

Seguridad y Pruebas

Analyzes binaries, executables, and bytecode using a structured methodology to uncover functionality and internal logic.

Acerca de

The Binary Reverse Engineering skill provides a comprehensive framework for deep analysis of ELF files, executables, and Python bytecode. It orchestrates a sophisticated workflow that spans initial triage, static analysis with radare2 and Ghidra, and dynamic analysis via QEMU and GDB. By utilizing a hypothesis-driven 'Agentic Loop' and episodic memory, the skill ensures that findings are documented, theories are tested, and complex cross-architecture binaries are understood with high confidence. It is an essential tool for security auditing, malware analysis, and legacy software interoperability tasks.

Características Principales

Episodic memory integration for persistent context across analysis sessions
8 GitHub stars
Hypothesis-driven analysis loop to maintain focus and verify findings
Automated binary triage and architecture detection (x86, ARM, MIPS, RISC-V)
Integration with radare2 and Ghidra for advanced disassembly and decompilation
Cross-architecture dynamic analysis using QEMU, GDB, and Frida

Casos de Uso

Analyzing unknown ELF binaries to identify suspicious behavior or security vulnerabilities
Reverse engineering Python .pyc files and bytecode to recover lost logic or audit scripts
Debugging proprietary firmware through emulation and system call tracing

Acerca de

Características Principales

Episodic memory integration for persistent context across analysis sessions
8 GitHub stars
Hypothesis-driven analysis loop to maintain focus and verify findings
Automated binary triage and architecture detection (x86, ARM, MIPS, RISC-V)
Integration with radare2 and Ghidra for advanced disassembly and decompilation
Cross-architecture dynamic analysis using QEMU, GDB, and Frida

Casos de Uso

Analyzing unknown ELF binaries to identify suspicious behavior or security vulnerabilities
Reverse engineering Python .pyc files and bytecode to recover lost logic or audit scripts
Debugging proprietary firmware through emulation and system call tracing