What kind of report does it generate?

It produces a structured overview covering program metadata, memory layout, notable strings, suspicious imports (like network or process APIs), and a prioritized list of next steps for the researcher.

Does this skill perform full decompilation?

It performs selective, shallow decompilation of entry points and suspicious functions identified during triage to provide context without getting bogged down in full-program analysis.

What is the primary purpose of the Binary Triage skill?

It is designed to quickly survey a binary file's structure and behavior to provide a high-level overview and identify 'red flags' before starting time-intensive deep analysis.

How does it handle obfuscated or packed binaries?

The skill surveys memory sections for unusual characteristics, such as executable data sections or high-entropy blocks, which often indicate packing or encryption.

Does this skill require Ghidra to function?

Yes, this skill is designed to work with the ReVa MCP server, which facilitates communication between Claude and a Ghidra instance where the binary is loaded.

Binary Triage & Analysis

Name: Binary Triage & Analysis
Author: cyberkaida

bycyberkaida

•

479

セキュリティとテスト

Performs systematic initial surveys of binaries to identify key components, suspicious behaviors, and prioritize deeper reverse engineering tasks.

概要

The Binary Triage skill provides a structured, multi-step workflow for the initial analysis of binary files using the ReVa Ghidra MCP server. It automates the surveying of memory layouts, strings, imports, and function hierarchies to quickly flag suspicious indicators like hardcoded C2 domains, anti-analysis tricks, or sensitive API usage. By prioritizing speed over depth, this skill enables security researchers and developers to gain immediate orientation within a new program and generate an actionable investigation roadmap before committing to manual decompilation.

主な機能

Cross-reference mapping between suspicious assets and calling functions
Automated identification of entry points and stripped status
Systematic memory block and section permission analysis
479 GitHub stars
Structured triage report generation with prioritized task lists
Heuristic-based string and import filtering for suspicious indicators

ユースケース

Security auditing of compiled binaries for hidden backdoors or vulnerabilities
Initial malware analysis to identify potential capabilities and network callbacks
Orienting a reverse engineering workflow when examining unknown or complex programs

概要

主な機能

Cross-reference mapping between suspicious assets and calling functions
Automated identification of entry points and stripped status
Systematic memory block and section permission analysis
479 GitHub stars
Structured triage report generation with prioritized task lists
Heuristic-based string and import filtering for suspicious indicators

ユースケース

Security auditing of compiled binaries for hidden backdoors or vulnerabilities
Initial malware analysis to identify potential capabilities and network callbacks
Orienting a reverse engineering workflow when examining unknown or complex programs