reversing-pentest

name	reversing-pentest
description	Guides binary reverse engineering with static/dynamic analysis, Ghidra, radare2, GDB, .NET decompilation, and checksec workflows. Use when analyzing unknown binaries, malware samples, or supporting exploit development.

Reversing Pentest

Prerequisites

• Target binary or sample is in scope and handled in an isolated analysis VM.
• Malware analysis may require ROE authorization for live detonation.
• Pair with binary-exploit-pentest when moving from analysis to exploitation.

Workflow

Task Progress:
- [ ] Identify file type, architecture, and packer (file, strings, die)
- [ ] Choose static vs dynamic analysis path
- [ ] Decompile managed code (.NET/Java) or disassemble native binary
- [ ] Map interesting APIs, strings, and control flow
- [ ] Document IOCs and hand off to msf-exploit-chain if MSF module exists

Phase 1: Triage and identification

Initial commands

MSF: No direct module. Use CLI triage tools.

CLI fallback:

file sample.bin
strings -a sample.bin | less
strings -el sample.bin
exiftool sample.bin
binwalk sample.bin

Packer/protector detection

MSF: No direct module. Use CLI unpack tools.

CLI fallback:

diec sample.bin
upx -d packed.bin -o unpacked.bin

Security properties (checksec)

MSF: No direct module. Use checksec CLI.

CLI fallback:

checksec --file=./binary
pwn checksec ./binary

Check: NX, ASLR, PIE, Canary, RELRO.

Phase 2: Static analysis

Ghidra

MSF: No direct module. Use Ghidra CLI.

CLI fallback:

analyzeHeadless /tmp/project ProjectName -import sample.bin -postScript DecompileAll

Workflow: import binary, auto-analyze, review decompiler output, rename functions, add comments, trace cross-references from interesting strings/APIs.

radare2 / rizin

MSF: No direct module. Use r2 CLI.

CLI fallback:

r2 -A sample.bin
aaa
afl
pdf @ main
iz
axt @ sym.imp.system

IDA Pro / IDA Free

MSF: No direct module. Use IDA GUI/CLI.

CLI fallback: Load binary, run auto-analysis, use Hex-Rays decompiler for C-like output.

Phase 3: Managed code decompilation

.NET (ILSpy, dnSpy, dotPeek)

MSF: No direct module. Use IL decompilers.

CLI fallback:

ilspycmd sample.dll -o decompiled/

Java (JD-GUI, CFR, Procyon)

MSF: No direct module. Use CFR CLI.

CLI fallback:

java -jar cfr.jar sample.jar --outputdir decompiled/

Go and Rust binaries

MSF: No direct module. Use Ghidra with language support.

CLI fallback:

redress -pkg ./binary

Phase 4: Dynamic analysis and debugging

GDB with GEF/pwndbg

MSF: No direct module. Use GDB CLI.

CLI fallback:

gdb ./binary
break main
run $(python3 -c 'print("A"*100)')
info registers
x/20wx $esp
vmmap

strace/ltrace (Linux)

MSF: No direct module. Use strace/ltrace.

CLI fallback:

strace ./binary 2>&1 | grep -E "execve|connect|open"
ltrace ./binary

Phase 5: Symbolic execution

angr

MSF: No direct module. Use angr Python API.

CLI fallback:

import angr
proj = angr.Project('./binary', auto_load_libs=False)
simgr = proj.factory.simulation_manager()
simgr.explore(find=0x401234, avoid=0x401250)
if simgr.found:
    print(simgr.found[0].posix.dumps(0))

Common analysis targets

Signal	Investigate
Hardcoded strings	URLs, passwords, encryption keys
Crypto constants	AES S-box, RSA headers
Import table	Dangerous APIs (system, exec, VirtualProtect)
Anti-debug	IsDebuggerPresent, ptrace, timing checks
License checks	Patch conditional jump to bypass

Word macros and scripts

MSF: No direct module. Use olevba/vipermonkey.

CLI fallback:

olevba document.docm
vipermonkey document.doc

Impact escalation

Stage	Technique
Understand	Map functionality, inputs, outputs
Find vulns	Buffer overflows, format strings, logic bugs
Patch/bypass	NOP jumps, patch comparisons in dnSpy/GDB
Weaponize	Hand to binary-exploit-pentest or msf-exploit-chain

Metasploit bridge (after RE confirms vulnerability)

After RE identifies product, version, or CVE, bridge to MSF:

Search for matching modules

MSF MCP (preferred):

msf_search_modules(query="<product> <version>")
msf_search_modules(query="CVE-YYYY-NNNN")

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'search <product>; search CVE-YYYY-NNNN; exit'"
searchsploit <product> <version>

Module info and check

MSF MCP (preferred):

msf_module_info(
  type="exploit",
  name="<module/path>"
)
msf_module_check(
  engagement_id="<id>",
  module_type="exploit",
  module_name="<module/path>",
  options={"RHOSTS": "<target>"}
)

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'info exploit/<module>; set RHOSTS <target>; check; exit'"

Import RE artifacts to workspace

MSF MCP (preferred):

msf_db_import(
  engagement_id="<id>",
  file_path="evidence/msf/re-analysis-notes.xml"
)
msf_note_info(workspace="default")

CLI fallback:

wsl -e bash -lc "msfconsole -q -x 'notes -a <target> -t re-analysis -n \"Buffer overflow at 0x401234\"; exit'"

Use reversing for custom targets; prefer MSF when ranked modules exist.

Related skills

• binary-exploit-pentest - stack/heap/ROP after RE identifies vuln
• forensics-pentest - malware analysis and artifact recovery
• msf-exploit-chain - module delivery after CVE mapping