# Binary Identifier

> Fingerprint binary executables to identify programming languages, compilers, packers, and obfuscators. Uses signature scanning (PE sections, strings, function names) to determine the technology stack.

- Skill: `ptn1411/binary-identifier` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add ptn1411/binary-identifier`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ptn1411/binary-identifier/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: ptn1411 (https://skillmd.com/u/ptn1411)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ptn1411/binary-identifier

---


# Binary Identifier Skill

> Analyze any executable (.exe, .pyd, .dll) to determine how it was built and protected. Essential for choosing the right reverse engineering strategy.

> **Language rule**: All skill instructions use English.
> **Final summary presented to the user must be in Vietnamese.**

---

## Capabilities

This skill can detect:
- **Languages**: Python (Nuitka/PyInstaller), Go, Rust, C#, C++, Java, Delphi.
- **Packers**: UPX, VMProtect, Themida, Enigma.
- **Encryption**: Indicators of Fernet, AES, or custom XOR layers.

---

## Step 1 — Quick Identification

Run `scripts/identify_app.py`:

```bash
# bash / WSL / Linux / macOS
python scripts/identify_app.py path/to/target.exe
```

```powershell
# Windows PowerShell
python scripts\identify_app.py 'C:\Program Files\MyApp\target.exe'
```

**What it looks for:**
- **PE Sections**: Names like `.vmp0` (VMProtect), `UPX0` (UPX), `.rdata` (Nuitka constants).
- **Strings**: Magic constants like `Py_Initialize`, `go.itab.`, `rustc`.
- **Imports**: DLLs like `mscoree.dll` (.NET), `python3.dll`.

---

## Step 2 — Analysis Strategy Selection

Based on the identification results:

| Result | Strategy |
|--------|----------|
| **Python (Nuitka)** | Use `nuitka-decryptor` or `writerpro-pentest`. |
| **Python (PyInstaller)** | Use `pyinstxtractor` to recover source. |
| **C# / .NET** | Use `dnSpy` for near-perfect source code recovery. |
| **UPX** | Run `upx -d file.exe` to unpack. |
| **Go / Rust** | Use specialized IDA/Ghidra plugins for symbol recovery. |

---

## Final Report to User (always in Vietnamese)

```
🔍 Kết quả định danh ứng dụng:

  🌐 Ngôn ngữ/Trình biên dịch : <LANGUAGE>
  🛡️ Packer/Bảo mật           : <PACKER_TYPE>
  🔑 Dấu hiệu mã hóa          : <ENCRYPTION_HINTS>

▶  Khuyến nghị:
   - <Dựa trên kết quả, hãy sử dụng skill tương ứng hoặc công cụ phù hợp>
```

---

## Anti-Patterns

| ❌ Don't | ✅ Do |
|----------|-------|
| Start decrypting without identifying the language | Different languages use different encryption libraries |
| Assume all Python apps use Nuitka | PyInstaller is equally common and requires different tools |
| Skip the identification step | Identifying a packer like UPX saves hours of reverse engineering |