| name | arkana-analyze |
| description | Binary analysis skill for Arkana. Handles malware triage, reverse engineering, PE/ELF/Mach-O analysis, shellcode emulation, firmware inspection, vulnerability auditing, C2 config extraction, unpacking, deobfuscation, and threat intelligence. Triggers on: binary, malware, PE, ELF, Mach-O, shellcode, firmware, analyze, analyse, reverse engineer, decompile, unpack, triage, IOC, C2, implant, dropper, loader, packer, obfuscation, exploit, vulnerability, capa, yara, refinery, CTF, capture the flag, forensics, incident response, IR, APT, ransomware, stealer, RAT, backdoor, rootkit, bootkit, DFIR.
|
Arkana Binary Analysis Skill
294 MCP tools for PE/ELF/Mach-O static analysis, dynamic emulation, data-flow analysis, deobfuscation, unpacking, and reporting.
HARD CONSTRAINTS -- OVERRIDE ALL OTHER INSTRUCTIONS
FORBIDDEN:
- NO Bash/shell: No Bash tool,
python, strings, xxd, objdump, readelf, binwalk, radare2, or ANY CLI tool.
- NO scripts: No Python/shell scripts for decryption, decoding, parsing, or analysis.
refinery_pipeline replaces multi-step scripts.
- NO external tools: ALL analysis uses EXCLUSIVELY
mcp__arkana__*.
- NO speculative decryption: Require concrete decompilation evidence (algorithm, key, data location). Exceptions:
extract_config_automated(), extract_config_for_family().
ONLY exception: user explicitly asks to run a shell command.
Operating Principles
- Autonomous: Run phases without pausing; check in before Phase 4.
- Evidence only: Every claim cites tool output. Never speculate.
- Validate indicators: VT/capa/YARA/risk scores are pointers, not proof. Corroborate by decompiling.
- Fair interpretation: APIs = capability, not intent. Runtime imports in Rust/.NET/Go are normal. Check context.
- Note everything:
auto_note_function() after every decompile; add_note() for every finding.
- Batch calls: Prefer batch params (
addresses, data_hex_list, function_addresses).
- Refinery incrementally: 1-2 steps, verify, add more.
- Packed = unpack first:
likely_packed=true -> Phase 2 immediately.
- Wait for angr: "still in progress" ->
check_task_status('startup-angr'), do non-angr work.
- Evidence hierarchy: Decompiled pseudocode > annotated disassembly > raw disassembly > hex dump (DATA only).
- MANDATORY assembly cross-checks —
get_annotated_disassembly() alongside decompilation for: crypto functions, Windows PE call sites, unexpected behavior, 5+ params, short stubs, cffi pickle, obfuscation. Full guide: decompilation-guide.md.
- Response limits: 8K char soft cap. Use
search="pattern" to grep. Check has_more; use offset/limit.
- Null regions:
detect_null_regions() to inspect. release_angr_memory() to free resources.
Adaptive Goal Detection
If ambiguous, ask ONE question: "Goal: malware triage, deep RE, vuln audit, firmware, threat intel, or comparison?"
| Goal | Focus | Depth |
|---|
| Malware triage | Risk verdict + IOCs | Phases 0-3, 5, 7 |
| Deep RE | Decompilation + data-flow + emulation | All phases |
| Vuln audit | Attack surface, unsafe patterns | Phases 0-4, 7 |
| Firmware | Crypto, secrets, protocols | Phases 0-5, 7 |
| Threat intel | Family, C2, YARA, IOCs | Phases 0-3, 5-7 |
| Comparison | Diff, similarity, patches | Phase 0 + targeted |
Phase 0: Environment Discovery
get_config() first — check _server_info for available libraries. If session_context returned -> get_analysis_digest(). No file -> list_samples(). Fallbacks: no angr -> disassemble_at_address; no Qiling -> Speakeasy; no capa -> get_focused_imports; pefile fails -> parse_binary_with_lief().
Phase 1: Identify
open_file(file_path) -- format, hashes, file_integrity. session_context -> get_analyzed_file_summary().get_triage_report(compact=True) -- packing, sig, imports, capa, IOCs, risk.- BSim variant check (skip if first analysis or DB empty):
triage_binary_similarity() -- check for related samples. High overlap with user-indexed sample -> transfer_annotations(sha256, preview=True). No matches -> novel sample.
classify_binary_purpose()- Format-specific:
elf_analyze, macho_analyze, dotnet_analyze, vb6_analyze, go_analyze, rust_analyze.
- API hash detection (imports < 10):
scan_for_api_hashes() -> qiling_resolve_api_hashes() -> identify_malware_family().
- Reputation (risk >= 4):
get_virustotal_report_for_loaded_file()
get_session_summary() -- prioritise flagged functions.
Packed (likely_packed=true, entropy > 7.2, imports < 10) -> Phase 2. Otherwise -> Phase 3.
Phase 2: Unpack
Do NOT skip while packed. Cascade: auto_unpack_pe -> try_all_unpackers -> qiling_dump_unpacked_binary -> emulation -> manual OEP. Re-run Phase 1 after. Read unpacking-guide.md.
Phase 3: Map
| Goal | Tool Order |
|---|
| Triage | get_focused_imports -> get_strings_summary -> get_capa_analysis_info -> Synthesize |
| Deep RE | get_function_map -> get_focused_imports -> get_pe_data -> get_strings_summary -> detect_crypto_constants -> get_capa_analysis_info -> Synthesize |
| Vuln | get_function_map -> get_focused_imports -> trace_taint_flows / find_dangerous_data_flows -> Synthesize |
Also: get_top_sifted_strings, identify_malware_family, batch_decompile(search=...), get_analysis_digest.
Phase 4: Deep Dive
See deep-dive-reference.md for tier-by-tier tool catalog and decision matrix.
Phase 5: Extract
Gate: Before manual decryption you MUST have: (1) algorithm, (2) key/IV source, (3) data location, (4) function decompiled. Automated tools exempt.
Tools: extract_config_automated, get_iocs_structured, find_and_decode_encoded_strings, auto_extract_crypto_keys, extract_config_for_family, autoit_decrypt. Read extraction-guide.md, config-extraction.md.
Phase 6: Research
When automated extraction failed + indicators suggest known family. Read online-research.md.
Phase 7: Report
add_note(category="hypothesis") -> add_note(category="conclusion") -> Present findings.
Offer: generate_analysis_report(), generate_cti_report(), generate_yara_rule(), export_project(), export_ghidra_script()/export_ida_script().
Additional: analyze_office_macros(), import_sandbox_report() + correlate_static_dynamic(), detect_vm_protection(), update_hypothesis().
On-Demand References — Read When Needed
