Windows PE reverse-engineering automation skill (.exe/.dll/.sys). Fingerprint/packer-and-language detection → route by type (.NET decompile / native decompile / unpack) → dynamic debugging → deobfuscation → capability triage, using Windows tools from the catalog throughout (fetch on demand if missing). Trigger scenarios — reverse a Windows program, analyze exe/dll, PE unpacking, .NET decompilation, packer detection, x64dbg debugging, malware sample analysis.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Windows PE reverse-engineering automation skill (.exe/.dll/.sys). Fingerprint/packer-and-language detection → route by type (.NET decompile / native decompile / unpack) → dynamic debugging → deobfuscation → capability triage, using Windows tools from the catalog throughout (fetch on demand if missing). Trigger scenarios — reverse a Windows program, analyze exe/dll, PE unpacking, .NET decompilation, packer detection, x64dbg debugging, malware sample analysis.
Windows PE Reverse-Engineering Automation
Proceed through the flow below; pick tools from catalog/windows.yaml + catalog/native.yaml, and for missing ones use python tools/fetch.py <id> (installs into the project). Fingerprint first, then route by type—don't decompile blindly.
Phase 1 — Fingerprint / packer detection (mandatory first step)
Use Detect It Easy (detect-it-easy) to determine: format, language (.NET vs native C/C++ vs Go/Rust), packer/protector (UPX/Themida/VMProtect/...), and entropy.
diec --json target.exe # JSON output for the brain to route on
Known packer hit → do Phase 2 unpacking first, then return to this phase and re-fingerprint.
.NET → Phase 3a; unpacked native → Phase 3b.
Phase 2 — Unpacking (only when a packer is hit)
UPX and other standard packers: upx -d.
Themida / VMProtect / custom packers: use x64dbg (x64dbg) to manually run to the OEP → Scylla (scylla) to rebuild the IAT and export a runnable PE; use ScyllaHide (scyllahide) to defeat anti-debugging.
Already unpacked in memory / process injection: PE-sieve (pe-sieve) to dump the unpacked module from a live process (pe-sieve /pid <pid> /dump).
VM-protection devirtualization (advanced): Mergen (mergen) / NoVmp (novmp).
→ After unpacking, return to Phase 1 and re-fingerprint.
Phase 3a — .NET route
Decompile + debug + edit: dnSpyEx (dnspyex). For obfuscation (ConfuserEx etc.), first clean with de4dot-cex (de4dot), then feed into dnSpyEx.
Cross-platform/batch: ILSpy's ilspycmd.
Phase 3b — native route
Static decompilation: Ghidra (ghidra-reverse-engineering) the free workhorse / IDA (ida-reverse-engineering) if licensed / Binary Ninja (binary-ninja).
Capability triage: capa (capa-triage) to first tag crypto/anti-debug/network + addresses, then enter the decompiler with those addresses.
PE header/import-table surgery and resource viewing: PE-bear (pe-bear).
Phase 4 — Dynamic debugging
User mode: x64dbg (x64dbg) for breakpoints/single-step/memory editing/pattern scanning; if the sample detects a debugger, attach ScyllaHide/TitanHide.
Crash dumps / kernel: WinDbg (windbg), !analyze -v; for AI-driven use, pair with mcp-windbg (catalog/mcp.yaml).
