| name | python-reverser-patterns |
| description | Binary reverse engineering with Python: analyze, parse, and disassemble ELF/PE executables using pwntools, capstone, Frida, and custom parsing tools. Use when understanding malware, debugging binary failures, analyzing section structure, extracting strings/entropy, or instrumenting runtime behavior. |
| license | MIT |
| compatibility | Python 3.11+. Core libraries: pwntools, capstone, pyelftools, pefile, Frida (dynamic). Optional: pyinstaller-extractor, binwalk, upx. |
| metadata | {"author":"AeonDave","version":"1.0"} |
Python Reverse Engineering
This skill focuses on hands-on binary analysis with Python: static parsing (headers, sections, strings, entropy) and dynamic instrumentation (Frida hooks, syscall tracing).
When to activate
- You need to understand why an executable fails or crashes.
- Analyzing malware, unobfuscated binaries, or stripped ELFs for behavior/functionality.
- Extracting metadata (strings, imports, entropy regions, entrypoints, section layout).
- Instrumenting runtime behavior with Frida hooks or syscall analysis.
- Comparing binary versions or detecting hardening/packing.
Core principles
- Parse from scratch first: Use Python structs or pwntools before automated tools.
- Entropy identifies obfuscation: High entropy ≈ encrypted/compressed; low entropy ≈ plaintext strings.
- Imports reveal intent: Suspicious API combos (VirtualAlloc + CreateRemoteThread) flag injection.
- Strings are quick wins: Often reveal C2 addresses, file paths, error messages without disassembly.
- Frida is for behavior: When you need to see what the binary does at runtime, not what it says.
Outcome expectations
- Binary structure is mapped (sections, headers, entrypoints).
- Strings, imports, entropy regions, and suspicious API patterns are identified.
- Custom analysis scripts (IAT dump, entropy heatmap, section diff) are written and run.
- Runtime behavior is instrumented via Frida when static analysis is insufficient.
Recommended workflow
- Triage: File type (ELF/PE/Mach-O?), architecture, bitness, stripped/debug symbols.
- Headers: Parse DOS/COFF headers, optional header, entry point, base address.
- Sections: Extract .text, .data, .rodata, .relro; flag unusual sections.
- Strings: Dump ASCII/UTF-8 strings; search for patterns (URLs, IPs, paths, error messages).
- Imports: Enumerate DLLs and functions (PE) or dynamic symbols (ELF); flag suspicious APIs.
- Entropy: Block-by-block analysis to identify encrypted/compressed regions.
- Disassembly (if needed): Use capstone or pwntools to disassemble hotspots.
- Frida instrumentation: Hook critical functions or syscalls to observe runtime behavior.
- Comparison: Diff two binary versions for delta analysis (hardening, patching, payload changes).
Quick review checklist
- Binary parsed without crashing; sections are readable.
- Entry point and imports are enumerated.
- Strings scanned for suspicious patterns (URLs, credentials, error messages).
- Entropy zones identified; high-entropy blobs are flagged.
- Frida hooks compile and attach without crashes.
Anti-patterns
- Blind disassembly without context: Always check strings, imports, and entropy first.
- Ignoring section flags: RWX sections, missing RELRO, or executable heap are red flags.
- Over-relying on automated tools: Use IDA/Ghidra for complex cases; Python for automation and scripting.
- Frida hooks without error handling: Always wrap hooks in try/except; unhandled exceptions kill the session.
Resources
Load on demand:
references/binary-formats.md — ELF/PE parsing, headers, sections, symbols.references/pwntools-reference.md — ELF object, string search, section access, disassembly.references/static-analysis.md — strings, imports, entropy, IAT dumps, suspicious APIs.references/capstone.md — disassembly, instruction decoding, syntax options.references/frida-basics.md — attach, hooks, intercept calls, bytecode patching.references/custom-tooling.md — write entropy heatmaps, section diffs, API detectors.
