general-reverse-engineering

name	General Reverse Engineering
description	General-purpose binary analysis — understand functionality, architecture, and behavior
tags	["analysis","reverse-engineering","general"]

Task: General Reverse Engineering. You are analyzing a binary to understand its functionality, architecture, or behavior. No assumption about maliciousness.

Approach

Build a mental map of the binary's structure. Start at the entry point or user-specified function. Name functions as you understand them — each rename makes the next function easier to read. Focus on what the user is interested in, not exhaustive coverage.

Workflow

1. get_binary_info — format, architecture, size, function count
2. list_imports + list_exports — understand the binary's interface (batch these)
3. Start at the function of interest (or entry if exploring)
4. decompile_function → understand → rename_function / rename_variable → follow call chains
5. Use xrefs_to and xrefs_from to trace data and code references
6. Build up a picture of the binary's modules, data structures, and control flow

Call Graph Strategy

Use xref tools BEFORE decompiling for exploration — they're cheaper:

1. function_xrefs on entry → map top-level subsystems without decompiling everything
2. xrefs_to on interesting imports → find which functions use specific APIs
3. Decompile only the nodes you actually need to understand
4. After understanding a function's purpose, check its callers to propagate context upward

Depth guidance:

• Immediate callers/callees: quick orientation
• 2 levels: neighborhood — usually sufficient
• 3+ levels: subsystem mapping — only for deep dives

Domain-Specific Tips

Libraries/frameworks: Focus on exported functions and their calling conventions. Use list_exports to map the public API.

Drivers/kernel modules: Identify dispatch routines, IOCTL handlers, initialization. Consider using /driver-analysis for Windows drivers.

Proprietary formats: Trace the parsing code. Use create_struct and suggest_struct_from_accesses to reconstruct data structures. Apply with apply_struct_to_address.

Firmware/embedded: Check for known library signatures in function prologues. Map memory-mapped I/O regions via list_segments.

Statically linked (Go/Rust): No imports — look for runtime strings (runtime., go.itab, panicked at). Function count will be high; focus on entry and user code.

Renaming Strategy

• Before renaming, form a hypothesis from: decompiled code + xrefs + string references
• Rename in semantic batches: all network functions together, all crypto together
• After renaming a batch: re-decompile to verify the renamed code reads correctly
• Use set_comment and set_function_comment to document non-obvious logic
• Naming conventions: PascalCase for functions, g_ prefix for globals, PascalCase for structs

Security & Malware Analysis Features

When analyzing potentially malicious code, use Spectra's security-focused features:

Findings Bookmarking:

• Bookmark important addresses with notes, tags, and categories
• Use [FINDING:0x401000] or [FINDING:0x401000|Description] to create clickable finding links
• Categories: Critical, Suspicious, Verified, Interesting, False Positive, Question
• Export findings as markdown report for documentation

Suspicious API Detection:

• Spectra automatically highlights dangerous APIs with color-coded severity
• Critical APIs (red): CreateRemoteThread, WriteProcessMemory, VirtualAllocEx
• High severity APIs (orange): VirtualProtect, GetProcAddress
• Medium severity APIs (yellow): LoadLibrary, InternetConnect, socket
• Each API includes MITRE ATT&CK technique references

Anti-Debugging Detection:

• Windows API checks: IsDebuggerPresent, CheckRemoteDebuggerPresent
• PEB checks: fs:[30h]/gs:[60h] BeingDebugged access
• Assembly instructions: rdtsc, int 2d, int 3
• Exception handlers: SetUnhandledExceptionFilter

Hex Address Navigation:

• All hex addresses (0x401000, 00401000, 401000h) are clickable links
• Click any address to jump to that location in IDA
• Use [FINDING:0x401000] for bookmarked locations

Output

Deliver what the user asks for:

• Function summaries with addresses
• Architectural overview
• Data structure definitions (C-style)
• Specific answers about behavior
• Security findings with bookmarked addresses for critical code
• Suspicious API calls with severity ratings and MITRE references