1---2name: reverse-engineering-33description: Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days4---5
6# Reverse Engineering
7
8## When to Activate
9
10- Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
11- Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
12- Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
13- Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
14- Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
15- Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
16- Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.
17
18## Technique Map
19
20| Technique | ATT&CK | CWE | Reference | Script |
21|-----------|--------|-----|-----------|--------|
22| Binary triage (format/arch/mitigations/strings/imports) | T1592.002, T1518.001 | CWE-1395 | references/static-triage-decompilation.md | scripts/triage.py |
23| Headless decompilation (Ghidra 11.4 / r2 / IDA) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | scripts/triage.py |
24| AI/MCP-assisted RE (Sidekick / GhidrAssistMCP / LLM4Decompile) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | - |
25| Dynamic debugging (GDB/GEF, x64dbg, conditional bps) | T1622 | CWE-noinfo | references/dynamic-instrumentation.md | - |
26| Frida 17 instrumentation + SSL-pin/JNI hooking | T1622, T1562.001 | CWE-noinfo | references/dynamic-instrumentation.md | scripts/frida_universal.js |
27| Symbolic / concolic execution (angr, Triton) | T1480.001 | CWE-noinfo | references/dynamic-instrumentation.md | scripts/deflatten_triton.py |
28| Anti-debug detection & bypass (PEB/ptrace/HW-bp/timing) | T1622, T1497.001 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
29| Anti-VM / sandbox-evasion neutralization | T1497, T1497.003 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
30| Packer unpack → OEP dump (UPX/runtime packers) | T1027.002, T1620 | CWE-noinfo | references/anti-reversing-bypass.md | scripts/antidebug_unhook.py |
31| String / API-hash deobfuscation (Unicorn emulation) | T1027.013, T1140, T1027.007 | CWE-noinfo | references/deobfuscation.md | scripts/string_decrypt_emu.py |
32| OLLVM control-flow-flattening de-flattening | T1027.009, T1027 | CWE-noinfo | references/deobfuscation.md | scripts/deflatten_triton.py |
33| VM-protector devirtualization (VMProtect 3.x / Themida) | T1027.009 | CWE-noinfo | references/deobfuscation.md | scripts/deflatten_triton.py |
34| Firmware extraction (binwalk/squashfs/QEMU emulation) | T1542.001 | CWE-1263 | references/firmware-uefi.md | scripts/uefi_triage.py |
35| UEFI/BIOS RE + Secure Boot bypass research | T1542.001, T1542.003 | CWE-347 | references/firmware-uefi.md | scripts/uefi_triage.py |
36| Patch diffing → n-day root cause (BinDiff/Diaphora/ghidriff) | T1203, T1592.002 | CWE-noinfo | references/patch-diffing-protocol.md | scripts/patchdiff_fetch.py |
37| Protocol / file-format inference (Netzob/Kaitai) | T1592.002 | CWE-noinfo | references/patch-diffing-protocol.md | scripts/proto_infer.py |
38
39## Quick Start
40
41```bash
42# 0. Triage: format, arch, mitigations, packer entropy, strings, imports, capabilities → JSON
43python3 scripts/triage.py ./sample -o out/triage.json
44
45# 1. Headless decompile to C (Ghidra 11.4 analyzeHeadless wrapper inside triage.py --decompile)
46python3 scripts/triage.py ./sample --decompile --ghidra "$GHIDRA_HOME" -o out/
47
48# 2. If packed/protected → defeat anti-debug, dump OEP (run under x64dbg+ScyllaHide on Windows)
49python3 scripts/antidebug_unhook.py --scan ./sample # enumerate anti-debug primitives first
50
51# 3. Dynamic: attach Frida (Android/Linux/Win), universal SSL-unpin + native trace
52frida -U -f com.target.app -l scripts/frida_universal.js --no-pause
53
54# 4. Deobfuscate: emulate string decryptor over all xrefs; de-flatten OLLVM with Triton
55python3 scripts/string_decrypt_emu.py ./sample --func 0x401500 --auto-xref -o out/strings.txt
56python3 scripts/deflatten_triton.py ./sample --func 0x401abc -o out/cfg.dot
57
58# 5. Firmware: carve + identify + map UEFI DXE/PEI attack surface, scan for PKfail/known hashes
59python3 scripts/uefi_triage.py firmware.bin -o out/fw/
60
61# 6. n-day: fetch pre/post-patch Windows binary from winbindex and diff
62python3 scripts/patchdiff_fetch.py --pe afd.sys --kb-after KB5050000 -o out/diff/
63
64# 7. Unknown protocol: infer fields/state machine from a pcap, emit Kaitai + Wireshark dissector
65python3 scripts/proto_infer.py capture.pcap --port 4444 -o out/proto/
66```
67
68## OPSEC & Detection (summary)
69
70| Technique | Telemetry / IOC | Detection (Sigma/EDR) | OPSEC note |
71|-----------|-----------------|------------------------|------------|
72| Static triage / decompile | None (offline on analyst box) | N/A — runs in lab | Analyze copies in an isolated, snapshotted VM; never on the target |
73| Frida / dynamic hooking | `frida-agent.so` in `/proc/self/maps`, port 27042, `gum-js-loop`/`gmain` threads, `ptrace` on target | App-side RASP (Talsec/DeepID), frida-string scans, EDR userland hook tripwires | Rename agent, use gadget+`-l` script mode, embed gadget in APK to dodge port checks |
74| Anti-debug bypass | Debug registers DR0-7 set, PEB.BeingDebugged flips, hooked Nt* prologues | Self-integrity checks, KiUserExceptionDispatcher checks, TitanHide-vs-malware arms race | Prefer kernel TitanHide/HyperHide for hardened packers; snapshot before each run |
75| Packer/OEP dump | New RWX region, IAT rebuild, written `dump.exe` on disk | EDR RWX-alloc + tail-jump heuristics (lab only) | All in lab; dumped sample is for analysis, not redeployment |
76| String/API-hash decrypt (Unicorn) | None on target (offline emulation) | N/A | Pure offline; safe — no sample execution of network/FS code |
77| Firmware / SPI flash dump | Hardware: chip-clip on SPI; software: `chipsec`/`flashrom` reads | Boot Guard / measured boot (TPM PCRs), Binarly/CHIPSEC verifiers | Physical/authorized only; flashing back a modded image is destructive & loud |
78| Secure Boot bypass research | New unsigned bootloader in ESP, MokList/dbx anomalies, unexpected `bootmgfw` hash | Measured boot PCR[0/2/4/7] drift, `dbx` revocation checks, ESET/Binarly scanners | Lab VMs / disposable hardware; document, never persist a real implant |
79| Patch diffing | None on target (fetches public binaries) | N/A | Public Microsoft/distro binaries; n-day PoC stays in lab until disclosure/ROE |
80| Protocol inference | Replays captured/crafted packets at the service | IDS on malformed/replayed frames; rate anomalies | Throttle active probes; prefer passive pcap when a live target is in scope |
81
82## Deep Dives
83
84- references/static-triage-decompilation.md — File/arch/mitigation triage, entropy & packer ID, capability detection (capa), Ghidra 11.4 `analyzeHeadless` + PyGhidra, r2/rizin & IDA decompile flows, and the 2025 AI/MCP-assisted layer (Binary Ninja Sidekick, GhidrAssistMCP, LLM4Decompile / SK²Decompile) with verification discipline.
85- references/dynamic-instrumentation.md — GDB/GEF & x64dbg workflows, conditional/commands breakpoints, Frida 17 internals (Interceptor/Stalker/Java), universal SSL-unpin + JNI tracing, and angr/Triton symbolic + concolic execution with backward slicing for path/value recovery.
86- references/anti-reversing-bypass.md — Anti-debug taxonomy (PEB flags, NtSetInformationThread/ThreadHideFromDebugger, DR0-7 / GetThreadContext, KiUserExceptionDispatcher, NtClose, INT 2D, rdtsc timing, Linux ptrace/TracerPid), anti-VM/al-khaser, ScyllaHide/TitanHide, and runtime-packer OEP dumping.
87- references/deobfuscation.md — String & API-hash decryption via Unicorn emulation, OLLVM control-flow-flattening de-flattening (dispatcher recovery, Triton backward slicing à la LummaC2), MBA simplification, and VM-protector devirtualization (NoVmp/VTIL, Titan, Triton lifting) for VMProtect 3.x / Themida.
88- references/firmware-uefi.md — binwalk/unblob carving, squashfs/JFFS2 extraction, QEMU+afl emulation, UEFI volume/DXE/PEI parsing (UEFITool/chipsec), SMM callout & NVRAM variable surface, and Secure Boot bypass research with the verified 2024-2025 chain: LogoFAIL (CVE-2023-40238), PKfail (CVE-2024-8105), CVE-2024-7344, BlackLotus/Bootkitty context.
89- references/patch-diffing-protocol.md — winbindex binary acquisition, MSU/CAB extraction, BinDiff/Diaphora/ghidriff function-level diffing, LLM-assisted triage (PatchWatch/DiffRays) with hallucination caveats, late-2025 kernel targets (cldflt.sys, win32k, CLFS), plus network/file-format protocol RE (Netzob, Kaitai Struct, BinPRE-style field inference).
majiayu000