Menü
General-purpose binary analysis — understand functionality, architecture, and behavior
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
| name | General Reverse Engineering |
| description | General-purpose binary analysis — understand functionality, architecture, and behavior |
| tags | ["analysis","reverse-engineering","general"] |
Task: General Reverse Engineering. You are analyzing a binary to understand its functionality, architecture, or behavior. No assumption about maliciousness.
Build a mental map of the binary's structure. Start at the entry point or user-specified function. Name functions as you understand them — each rename makes the next function easier to read. Focus on what the user is interested in, not exhaustive coverage.
get_binary_info — format, architecture, size, function countlist_imports + list_exports — understand the binary's interface (batch these)decompile_function → understand → rename_function / rename_variable → follow call chainsxrefs_to and xrefs_from to trace data and code referencesUse xref tools BEFORE decompiling for exploration — they're cheaper:
function_xrefs on entry → map top-level subsystems without decompiling everythingxrefs_to on interesting imports → find which functions use specific APIsDepth guidance:
Libraries/frameworks: Focus on exported functions and their calling conventions. Use list_exports to map the public API.
Drivers/kernel modules: Identify dispatch routines, IOCTL handlers, initialization. Consider using /driver-analysis for Windows drivers.
Proprietary formats: Trace the parsing code. Use create_struct and suggest_struct_from_accesses to reconstruct data structures. Apply with apply_struct_to_address.
Firmware/embedded: Check for known library signatures in function prologues. Map memory-mapped I/O regions via list_segments.
Statically linked (Go/Rust): No imports — look for runtime strings (runtime., go.itab, panicked at). Function count will be high; focus on entry and user code.
set_comment and set_function_comment to document non-obvious logicWhen analyzing potentially malicious code, use Spectra's security-focused features:
Findings Bookmarking:
[FINDING:0x401000] or [FINDING:0x401000|Description] to create clickable finding linksSuspicious API Detection:
Anti-Debugging Detection:
Hex Address Navigation:
[FINDING:0x401000] for bookmarked locationsDeliver what the user asks for:
Next-generation 0day discovery & exploit development — comprehensive code analysis, allocator vulnerabilities, compiler-induced bugs, SIMD/vector issues, JIT vulnerabilities, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with exploit generation, privilege escalation, backdoor establishment
Next-generation 0day discovery — novel overflow patterns, allocator exploits, compiler-induced bugs, bounds-check bypass, SIMD/vector overflows, JIT vulns, custom allocator attacks, ASLR/kASLR bypass, UAF, OOB, RCE with weaponized exploit generation, privilege escalation, backdoor establishment
Container escape vulnerability discovery — Docker, Kubernetes, container runtime exploitation, namespace isolation bypass, privilege escalation through container boundaries
Crypto implementation analysis — weak algorithms, side-channels, key management flaws, padding oracles, random generation failures, implementation bugs
IoT device security analysis — firmware extraction, RTOS exploits, hardware interfaces, protocol vulnerabilities, side-channel attacks, update mechanism exploitation
Industrial control system security — Modbus, DNP3, IEC 104, Ethernet/IP, PLC exploitation, control logic manipulation, sensor/actuator attacks, ICS protocol analysis