Reverse Engineer Skill

Authorization Checkpoint

STOP: Verify authorization before proceeding.

Only assist with reverse engineering when:

• Software is owned by the user
• Internal company applications with permission
• Legacy systems authorized for inspection/migration
• Security research with proper scope/authorization
• Interoperability under applicable law

Refuse requests involving:

• Cracking licenses, DRM, paywalls, activation systems
• Bypassing authentication or access controls
• Malware development or stealth techniques
• Credential theft or data exfiltration
• Evading detection or violating terms of service

First Response Protocol

When user provides a target, immediately produce:

1. Target Classification - Type, platform, suspected stack
2. Investigation Plan - Prioritized analysis sequence
3. Recommended Tools - Specific to this target
4. Python Automation - Relevant bundled scripts
5. First Actions - Commands/scripts to run
6. Expected Outputs - What we'll learn
7. Risk/Legal Note - Authorization reminder

Workspace Setup

Run scripts/init_workspace.py to create:

/reverse_engineering_workspace
  /input          - Original artifacts (read-only)
  /copies         - Working copies
  /extracted      - Unpacked contents
  /strings        - String extractions
  /traffic        - Network captures
  /screenshots    - Visual documentation
  /notes          - Investigation log
  /scripts        - Automation scripts
  /reports        - Generated reports
  /artifacts      - Intermediate findings
  /timelines      - Event sequences

Investigation Workflow

Phase 1: Initial Discovery (Non-destructive)

1. File inventory - scripts/file_inventory.py
2. Type identification - magic numbers, headers
3. String extraction - scripts/strings_extractor.py
4. Entropy analysis - scripts/entropy_scanner.py (detect packing)
5. Format-specific headers - PE/ELF/Mach-O parsing

Phase 2: Static Analysis

1. Disassembly - Function identification, CFG
2. Decompilation - C-like pseudocode where available
3. Import/Export analysis - API dependencies
4. String clustering - Categorize extracted strings
5. Configuration extraction - Parse embedded configs

Phase 3: Dynamic Analysis (Sandboxed only)

1. Behavior observation - Sandboxed execution
2. API monitoring - System call tracing
3. Network capture - Traffic analysis
4. Memory analysis - Runtime state inspection

Phase 4: Documentation

1. Architecture reconstruction - Component diagram
2. Data flow mapping - Information flow
3. Report generation - scripts/report_generator.py

Tool Selection

Python Libraries (pip install)

Core: pip install pwntools angr capstone lief pefile pyelftools python-magic Mobile: pip install androguard frida-tools Network: pip install scapy mitmproxy Bindings: pip install r2pipe pyghidra

See references/tool_installation.md for full details.

External Tools by Target Type

Output Format

Use this structure for every analysis step:

## Goal
[What we're trying to learn]

## Evidence Available
[Artifacts/data at hand]

## Approach
[Methodology]

## Tools Needed
[Specific tools]

## Commands / Python Scripts
[Executable commands]

## Findings
[What was discovered]

## Confidence
[High/Medium/Low + justification]

## Risks / Unknowns
[Limitations, gaps]

## Next Step
[Logical follow-up]

Bundled Scripts

Target-Specific Workflows

See references/analysis_workflows.md for detailed workflows:

• Windows PE executables
• Linux ELF binaries
• macOS applications
• Android APKs
• iOS IPAs
• Firmware images
• Web applications
• Database files

Reference Materials

• tool_installation.md - Setup guides per platform
• analysis_workflows.md - Target-specific workflows
• pe_format.md - PE format reference
• elf_format.md - ELF format reference
• report_templates.md - Report templates

Deliverables Checklist

Maintain these outputs throughout analysis:

• Executive Summary (what software does, stack, findings)
• Artifact Inventory (files, hashes, types)
• Architecture Reconstruction (components, boundaries, flows)
• Behavior Notes (startup, auth, data persistence)
• Reverse Engineering Log (timestamped actions)
• Open Questions (unknowns, unresolved paths)
• Final Report (technical, engineer-ready)

Special Handling

Packed/Obfuscated Binaries

1. Identify packer signature
2. Explain analysis limitations
3. Suggest sandboxed dynamic analysis
4. Do NOT provide unpacking instructions for protected software

Malware Analysis

1. Emphasize isolated/sandboxed environment
2. Focus on defensive IOCs
3. Never assist with weaponization

Encrypted Binaries

1. Document encryption presence
2. Explain static analysis limitations
3. Recommend dynamic approaches
4. Never help break copy protection