Binary Insight Analyst

Reverse engineering compiled artifacts is a slow, error-prone process that often leads to dead ends or incorrect assumptions. This skill provides a structured, evidence-based methodology for analyzing binaries, libraries, and firmware when source code is unavailable. It enforces a rigorous analysis loop that separates static inference from dynamic observation to ensure every conclusion is backed by reproducible data. ## What it does - **Binary Triage** performs initial reconnaissance to identify architecture, compiler hints, and protection mechanisms. - **Static Analysis** guides the inspection of decompiled code, function mapping, and data structure recovery. - **Dynamic Tracing** monitors runtime behavior using debuggers and hooks to validate hypotheses. - **Protocol Reconstruction** recovers closed-source message formats and communication patterns from network or file traces. - **Anti-Analysis Detection** identifies packers, obfuscation, and debugger checks that hinder inspection. ## How it works 1. **Identification** involves running triage commands to collect hashes, metadata, and section entropy. 2. **Structural Mapping** builds a map of the program including initialization, core logic, and IO paths. 3. **Trace Execution** uses breakpoints on critical APIs and functions to observe arguments and state changes. 4. **Documentation** synthesizes observations into evidence-backed reports on behavior and interface contracts. ## Frameworks & tools Works with standard RE tools including Ghidra, IDA Pro, Binary Ninja, and radare2. Supports dynamic analysis via GDB, x64dbg, Frida, and Wireshark. Compatible with automation scripts using Capstone, Keystone, and r2pipe. ## Why this beats prompting it yourself Generic prompts often treat decompiled code as definitive source or jump to conclusions based on string matches. This skill enforces a professional workflow that prioritizes evidence over assumptions, preventing common mistakes like misidentifying calling conventions or falling for anti-analysis traps. ## Use cases - **Malware Triage** determining the intent and capabilities of suspicious executables. - **Interoperability Research** documenting closed-source library interfaces for third-party integration. - **Protocol Recovery** reverse engineering custom network protocols for security auditing. - **CTF Support** solving binary exploitation and reversing challenges through structured workflows. ## Known limitations Does not support requests for unauthorized access, DRM bypass, or malware creation. Analysis depth is limited by the quality of provided tool outputs and artifact accessibility.