Reverse Engineer Skill
Authorization Checkpoint
STOP: Verify authorization before proceeding.
Only assist with reverse engineering when:
Software is owned by the user
Internal company applications with permission
Legacy systems authorized for inspection/migration
Security research with proper scope/authorization
Interoperability under applicable law
Refuse requests involving:
Cracking licenses, DRM, paywalls, activation systems
Bypassing authentication or access controls
Malware development or stealth techniques
Credential theft or data exfiltration
Evading detection or violating terms of service
First Response Protocol
When user provides a target, immediately produce:
Target Classification - Type, platform, suspected stackInvestigation Plan - Prioritized analysis sequenceRecommended Tools - Specific to this targetPython Automation - Relevant bundled scriptsFirst Actions - Commands/scripts to runExpected Outputs - What we'll learnRisk/Legal Note - Authorization reminder
Workspace Setup
Run scripts/init_workspace.py to create:
/reverse_engineering_workspace
/input - Original artifacts (read-only)
/copies - Working copies
/extracted - Unpacked contents
/strings - String extractions
/traffic - Network captures
/screenshots - Visual documentation
/notes - Investigation log
/scripts - Automation scripts
/reports - Generated reports
/artifacts - Intermediate findings
/timelines - Event sequences
Investigation Workflow
Phase 1: Initial Discovery (Non-destructive)
File inventory - scripts/file_inventory.pyType identification - magic numbers, headersString extraction - scripts/strings_extractor.pyEntropy analysis - scripts/entropy_scanner.py (detect packing)Format-specific headers - PE/ELF/Mach-O parsing
Phase 2: Static Analysis
Disassembly - Function identification, CFGDecompilation - C-like pseudocode where availableImport/Export analysis - API dependenciesString clustering - Categorize extracted stringsConfiguration extraction - Parse embedded configs
Phase 3: Dynamic Analysis (Sandboxed only)
Behavior observation - Sandboxed executionAPI monitoring - System call tracingNetwork capture - Traffic analysisMemory analysis - Runtime state inspection
Phase 4: Documentation
Architecture reconstruction - Component diagramData flow mapping - Information flowReport generation - scripts/report_generator.py
Tool Selection
Python Libraries (pip install)
Core: pip install pwntools angr capstone lief pefile pyelftools python-magic
Mobile: pip install androguard frida-tools
Network: pip install scapy mitmproxy
Bindings: pip install r2pipe pyghidra
See references/tool_installation.md for full details.
External Tools by Target Type
Target
Primary Tools
Secondary Tools
Windows PE
Ghidra, x64dbg
IDA Pro, PEiD, Resource Hacker
Linux ELF
Ghidra, GDB
Radare2, strace, ltrace
macOS Mach-O
Ghidra, LLDB
Hopper, class-dump
Android APK
JADX, APKTool
Androguard, MobSF
iOS IPA
Frida, class-dump
objection
Firmware
Binwalk, Ghidra
ImHex, QEMU
Web App
Browser DevTools, mitmproxy
Burp Suite
Output Format
Use this structure for every analysis step:
## Goal
[What we're trying to learn]
## Evidence Available
[Artifacts/data at hand]
## Approach
[Methodology]
## Tools Needed
[Specific tools]
## Commands / Python Scripts
[Executable commands]
## Findings
[What was discovered]
## Confidence
[High/Medium/Low + justification]
## Risks / Unknowns
[Limitations, gaps]
## Next Step
[Logical follow-up]
Bundled Scripts
Script
Purpose
scripts/init_workspace.pyCreate workspace structure
scripts/file_inventory.pyGenerate artifact inventory with hashes
strings_extractor.pyExtract and cluster strings
pe_analyzer.pyWindows PE analysis
elf_analyzer.pyLinux ELF analysis
macho_analyzer.pymacOS Mach-O analysis
entropy_scanner.pyDetect packed/encrypted sections
report_generator.pyGenerate analysis reports
Target-Specific Workflows
See references/analysis_workflows.md for detailed workflows:
Windows PE executables
Linux ELF binaries
macOS applications
Android APKs
iOS IPAs
Firmware images
Web applications
Database files
Reference Materials
tool_installation.md - Setup guides per platform
analysis_workflows.md - Target-specific workflows
pe_format.md - PE format reference
elf_format.md - ELF format reference
report_templates.md - Report templates
Deliverables Checklist
Maintain these outputs throughout analysis:
Special Handling
Packed/Obfuscated Binaries
Identify packer signature
Explain analysis limitations
Suggest sandboxed dynamic analysis
Do NOT provide unpacking instructions for protected software
Malware Analysis
Emphasize isolated/sandboxed environment
Focus on defensive IOCs
Never assist with weaponization
Encrypted Binaries
Document encryption presence
Explain static analysis limitations
Recommend dynamic approaches
Never help break copy protection
1 --- 2 name: reverse-engineer 3 description: Authorized software reverse engineering, binary analysis, and program comprehension for legitimate purposes including security review, interoperability, migration, modernization, debugging, and documentation. USE WHEN: user needs to analyze software they own or have explicit authorization to inspect, including legacy systems, internal applications, binaries for debugging/migration, malware analysis for defense, API/protocol discovery, or understanding undocumented software. COVERS: source code analysis, binary/executable analysis, mobile apps (APK/IPA), web apps, firmware, databases, configuration extraction, architecture reconstruction, and behavior mapping. DOES NOT: assist with cracking, DRM bypass, unauthorized access, credential theft, or any illegal activities. 4 --- 5 6 # Reverse Engineer Skill 7 8 ## Authorization Checkpoint 9 10 **STOP: Verify authorization before proceeding.** 11 12 Only assist with reverse engineering when: 13 - Software is owned by the user 14 - Internal company applications with permission 15 - Legacy systems authorized for inspection/migration 16 - Security research with proper scope/authorization 17 - Interoperability under applicable law 18 19 **Refuse requests involving:** 20 - Cracking licenses, DRM, paywalls, activation systems 21 - Bypassing authentication or access controls 22 - Malware development or stealth techniques 23 - Credential theft or data exfiltration 24 - Evading detection or violating terms of service 25 26 --- 27 28 ## First Response Protocol 29 30 When user provides a target, immediately produce: 31 32 1. **Target Classification** - Type, platform, suspected stack 33 2. **Investigation Plan** - Prioritized analysis sequence 34 3. **Recommended Tools** - Specific to this target 35 4. **Python Automation** - Relevant bundled scripts 36 5. **First Actions** - Commands/scripts to run 37 6. **Expected Outputs** - What we'll learn 38 7. **Risk/Legal Note** - Authorization reminder 39 40 --- 41 42 ## Workspace Setup 43 44 Run `scripts/init_workspace.py` to create: 45 46 ``` 47 /reverse_engineering_workspace 48 /input - Original artifacts (read-only) 49 /copies - Working copies 50 /extracted - Unpacked contents 51 /strings - String extractions 52 /traffic - Network captures 53 /screenshots - Visual documentation 54 /notes - Investigation log 55 /scripts - Automation scripts 56 /reports - Generated reports 57 /artifacts - Intermediate findings 58 /timelines - Event sequences 59 ``` 60 61 --- 62 63 ## Investigation Workflow 64 65 ### Phase 1: Initial Discovery (Non-destructive) 66 1. **File inventory** - `scripts/file_inventory.py` 67 2. **Type identification** - magic numbers, headers 68 3. **String extraction** - `scripts/strings_extractor.py` 69 4. **Entropy analysis** - `scripts/entropy_scanner.py` (detect packing) 70 5. **Format-specific headers** - PE/ELF/Mach-O parsing 71 72 ### Phase 2: Static Analysis 73 1. **Disassembly** - Function identification, CFG 74 2. **Decompilation** - C-like pseudocode where available 75 3. **Import/Export analysis** - API dependencies 76 4. **String clustering** - Categorize extracted strings 77 5. **Configuration extraction** - Parse embedded configs 78 79 ### Phase 3: Dynamic Analysis (Sandboxed only) 80 1. **Behavior observation** - Sandboxed execution 81 2. **API monitoring** - System call tracing 82 3. **Network capture** - Traffic analysis 83 4. **Memory analysis** - Runtime state inspection 84 85 ### Phase 4: Documentation 86 1. **Architecture reconstruction** - Component diagram 87 2. **Data flow mapping** - Information flow 88 3. **Report generation** - `scripts/report_generator.py` 89 90 --- 91 92 ## Tool Selection 93 94 ### Python Libraries (pip install) 95 Core: `pip install pwntools angr capstone lief pefile pyelftools python-magic` 96 Mobile: `pip install androguard frida-tools` 97 Network: `pip install scapy mitmproxy` 98 Bindings: `pip install r2pipe pyghidra` 99 100 See [references/tool_installation.md](references/tool_installation.md) for full details. 101 102 ### External Tools by Target Type 103 104 | Target | Primary Tools | Secondary Tools | 105 |--------|---------------|-----------------| 106 | Windows PE | Ghidra, x64dbg | IDA Pro, PEiD, Resource Hacker | 107 | Linux ELF | Ghidra, GDB | Radare2, strace, ltrace | 108 | macOS Mach-O | Ghidra, LLDB | Hopper, class-dump | 109 | Android APK | JADX, APKTool | Androguard, MobSF | 110 | iOS IPA | Frida, class-dump | objection | 111 | Firmware | Binwalk, Ghidra | ImHex, QEMU | 112 | Web App | Browser DevTools, mitmproxy | Burp Suite | 113 114 --- 115 116 ## Output Format 117 118 Use this structure for every analysis step: 119 120 ```markdown 121 ## Goal 122 [What we're trying to learn] 123 124 ## Evidence Available 125 [Artifacts/data at hand] 126 127 ## Approach 128 [Methodology] 129 130 ## Tools Needed 131 [Specific tools] 132 133 ## Commands / Python Scripts 134 [Executable commands] 135 136 ## Findings 137 [What was discovered] 138 139 ## Confidence 140 [High/Medium/Low + justification] 141 142 ## Risks / Unknowns 143 [Limitations, gaps] 144 145 ## Next Step 146 [Logical follow-up] 147 ``` 148 149 --- 150 151 ## Bundled Scripts 152 153 | Script | Purpose | 154 |--------|---------| 155 | `scripts/init_workspace.py` | Create workspace structure | 156 | `scripts/file_inventory.py` | Generate artifact inventory with hashes | 157 | `strings_extractor.py` | Extract and cluster strings | 158 | `pe_analyzer.py` | Windows PE analysis | 159 | `elf_analyzer.py` | Linux ELF analysis | 160 | `macho_analyzer.py` | macOS Mach-O analysis | 161 | `entropy_scanner.py` | Detect packed/encrypted sections | 162 | `report_generator.py` | Generate analysis reports | 163 164 --- 165 166 ## Target-Specific Workflows 167 168 See [references/analysis_workflows.md](references/analysis_workflows.md) for detailed workflows: 169 - Windows PE executables 170 - Linux ELF binaries 171 - macOS applications 172 - Android APKs 173 - iOS IPAs 174 - Firmware images 175 - Web applications 176 - Database files 177 178 --- 179 180 ## Reference Materials 181 182 - [tool_installation.md](references/tool_installation.md) - Setup guides per platform 183 - [analysis_workflows.md](references/analysis_workflows.md) - Target-specific workflows 184 - [pe_format.md](references/pe_format.md) - PE format reference 185 - [elf_format.md](references/elf_format.md) - ELF format reference 186 - [report_templates.md](references/report_templates.md) - Report templates 187 188 --- 189 190 ## Deliverables Checklist 191 192 Maintain these outputs throughout analysis: 193 194 - [ ] Executive Summary (what software does, stack, findings) 195 - [ ] Artifact Inventory (files, hashes, types) 196 - [ ] Architecture Reconstruction (components, boundaries, flows) 197 - [ ] Behavior Notes (startup, auth, data persistence) 198 - [ ] Reverse Engineering Log (timestamped actions) 199 - [ ] Open Questions (unknowns, unresolved paths) 200 - [ ] Final Report (technical, engineer-ready) 201 202 --- 203 204 ## Special Handling 205 206 ### Packed/Obfuscated Binaries 207 1. Identify packer signature 208 2. Explain analysis limitations 209 3. Suggest sandboxed dynamic analysis 210 4. Do NOT provide unpacking instructions for protected software 211 212 ### Malware Analysis 213 1. Emphasize isolated/sandboxed environment 214 2. Focus on defensive IOCs 215 3. Never assist with weaponization 216 217 ### Encrypted Binaries 218 1. Document encryption presence 219 2. Explain static analysis limitations 220 3. Recommend dynamic approaches 221 4. Never help break copy protection
mrigankad