🔬 Reverse Engineering & Binary Analysis
Overview
This skill enables Claude to assist with reverse engineering tasks including binary analysis, disassembly, decompilation, firmware reverse engineering, and protocol analysis. Claude will help interpret assembly code, identify patterns, map control flows, and extract meaningful information from binaries.
Prerequisites
Required
- Python 3.8+
capstone,pyelftools,pefile
Optional
- Ghidra — NSA's reverse engineering framework
- IDA Pro / Free — Interactive disassembler
- radare2 — Open-source RE framework
- Binary Ninja — RE platform
- GDB + GEF/PEDA — Debugging
- Binwalk — Firmware analysis
- strings, file, objdump — Standard Linux utilities
pip install capstone pyelftools pefile liefCore Capabilities
1. Static Binary Analysis
Claude can analyze binaries without executing them:
When the user asks to analyze a binary:
- Identify the file type (ELF, PE, Mach-O, raw firmware)
- Extract file metadata (architecture, endianness, entry point, sections)
- Parse headers and section tables
- Extract string references (ASCII, Unicode, encrypted)
- Identify linked libraries and imported/exported functions
- Detect packing, obfuscation, or anti-analysis techniques
- Identify cryptographic constants and known algorithms
- Map out function call graph and control flow
- Perform entropy analysis to detect encrypted/compressed sections
- Generate a structured analysis report
Analysis Checklist:
[ ] File identification (magic bytes, file type)
[ ] Architecture & ABI determination
[ ] Section analysis (code, data, resources)
[ ] Import/Export table enumeration
[ ] String extraction and categorization
[ ] Entropy analysis (packed/encrypted detection)
[ ] Security features (ASLR, DEP, Stack Canary, PIE)
[ ] Compiler/linker identification
[ ] Embedded resources extraction2. Disassembly & Decompilation
Claude can help interpret disassembled code:
When the user shares disassembled code:
- Identify the instruction set architecture (x86, x64, ARM, MIPS)
- Trace execution flow from entry point
- Identify function boundaries and calling conventions
- Recognize common patterns (loops, conditionals, switches)
- Identify library function calls and system calls
- Reconstruct high-level logic from assembly
- Identify vulnerability patterns in disassembly
- Annotate code with meaningful comments
Common Patterns to Recognize:
| Pattern | Indicators |
|---|---|
| Function prologue | push rbp; mov rbp, rsp |
| Stack buffer | sub rsp, N |
| Loop | cmp/jl or dec/jnz pairs |
| Switch/case | Jump table with indexed indirect jump |
| String operations | rep movs, rep stos |
| Crypto operations | Known constants (AES S-Box, SHA constants) |
| Anti-debug | IsDebuggerPresent, ptrace, timing checks |
3. Firmware Reverse Engineering
Claude can assist with embedded firmware analysis:
When the user asks to analyze firmware:
- Identify firmware format and extract filesystem
- Find and analyze bootloader code
- Identify the RTOS or embedded OS
- Map memory layout and peripheral registers
- Extract hardcoded credentials and keys
- Identify communication protocols and interfaces
- Analyze update mechanisms for vulnerabilities
- Check for debug interfaces (JTAG, UART, SWD)
4. Protocol Reverse Engineering
Claude can help reverse engineer network and serial protocols:
When the user asks to reverse a protocol:
- Analyze captured traffic/data for structure patterns
- Identify message boundaries and framing
- Determine field types (length, type, checksum, payload)
- Map command-response pairs
- Identify authentication and encryption mechanisms
- Build protocol state machine
- Create protocol specification document
- Generate parser code for the protocol
5. Anti-Reversing Technique Identification
Claude can identify and explain anti-analysis measures:
When the user encounters anti-reversing:
- Detect packing (UPX, Themida, VMProtect, custom)
- Identify anti-debugging techniques
- Detect anti-VM/sandbox checks
- Identify code obfuscation methods
- Detect control flow flattening
- Identify string encryption routines
- Suggest bypass techniques for each measure
Usage Instructions
Example Prompts
> Analyze this ELF binary and describe its functionality
> Explain this x86_64 assembly code and identify what it does
> Help me reverse engineer this firmware image from an IoT device
> Identify the protocol structure from this captured network traffic
> What anti-debugging techniques are used in this sample?
> Parse this PE file and list all imports with their DLLsScript Reference
binary_analyzer.py
python scripts/binary_analyzer.py --file suspicious.elf --output analysis.json
python scripts/binary_analyzer.py --file malware.exe --strings --imports
python scripts/binary_analyzer.py --file firmware.bin --entropyIntegration Guide
Chaining with Other Skills
- ← Malware Analysis (05): Receive samples requiring deeper RE analysis
- → Exploit Development (03): Feed vulnerability findings for exploit creation
- → Threat Hunting (06): Extract IOCs and behavioral signatures
- → Blue Team Defense (15): Create detection rules from RE findings