| name | triaging-unknown-binary |
| description | First-contact workflow for any unknown black-box artifact (apk, .o, .hex, exe, ELF, PE, Mach-O, firmware, archive). Identifies format/arch/packing and routes to the right format-specific analysis skill. Use this at the start of every reverse-engineering task on an unfamiliar file. |
| license | Apache-2.0 |
| metadata | {"domain":"reverse-engineering","formats":"apk, elf, pe, macho, dex, ihex, firmware, archive"} |
Triaging an Unknown Binary
Overview
Before any deep analysis you must know what you are holding. This skill is the
entry router: identify the artifact, then hand off to the matching skill.
Workflow
-
Identify. Run the triage tool on the target. It returns format, arch,
endianness, bits, entropy/packing, linked libraries, and a recommended plan.
- High entropy (≥7.2) or a
UPX/packer hint → unpack first (see step 3).
-
Route by format:
| format | go to skill |
|---|
elf, object, macho | analyzing-blackbox-elf-object |
pe | analyzing-blackbox-pe-exe |
apk, dex, jar | analyzing-blackbox-android-apk |
ihex, rawfw | analyzing-blackbox-firmware-hex |
zip/archive | unpack (archive) then re-triage each payload |
unknown | strings_scan + unpack (binwalk) to find embedded data |
-
Unpack when needed. Packed/compressed/container files: use the unpack
tool (mode auto). Then re-run triage on the extracted payload — the real
target is usually inside.
-
Cheap signal before deep work. Run strings_scan and symbols early — URLs,
crypto constants, imported APIs, and exported names often reveal the program's
purpose before you disassemble a single function.
Logic-reconstruction loop (all formats)
triage → unpack (if needed) → symbols + strings_scan → pick interesting
functions → disasm / decompile them → for input-gated branches (license,
password, opaque predicate) use symexec to solve for the input → write the
logic report (identity, entrypoints, key functions, data, external I/O,
findings).
Rules
- Static only: never execute the sample.
symexec reasons over code paths without
running the host program.
- Tie every logic claim to an address/symbol/string/snippet.
- The
triage tool's recommended_plan field names the next skill to load.
