メニュー
Root pointer for the binary reversing lane. Covers triage, Radare2 fallback, string extraction, packer unpacking, virtualized protectors, symbol risk, ROP, Ghidra deep analysis, and firmware extraction.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
VMProtect, VMP2, Themida, and CodeVirtualizer reversing workflow using Radare2/Ghidra facts and Back Engineering Labs research guidance.
Use to close the Offensive Vaccine loop on the defender side. The Detector agent produces Sigma / YARA rules from offensive operations; this catalog validates those rules against real memory dumps, event logs, and forensic artifacts using Volatility 3, plaso, and sigma-cli. Without this catalog, detection rules are theoretical.
Use when the target is an industrial control system or operational technology network running Modbus, BACnet, S7Comm/S7Comm Plus, DNP3, OPC-UA, or any PLC/HMI/SCADA stack. Engagements MUST set RoE flag industrial_safety_critical=true; this catalog gates every write-scope operation behind explicit operator confirmation regardless of HITL middleware.
Use when the engagement target is an Android (APK / AAB) or iOS (IPA) application. Covers static analysis (jadx, apktool, class-dump), dynamic instrumentation via Frida and Objection, SSL-pinning bypass, root/jailbreak detection bypass, deep-link / URL-scheme abuse, exported-component attacks, IPC redirection, WebView vulnerabilities, and biometric / Face ID / Touch ID bypass.
Use when the engagement requires passive reconnaissance only — no packets to the target's authoritative infrastructure. Splits off from the Recon agent so bug-bounty and pre-engagement work can run with outbound-only network policy. Maltego, Shodan, Censys, Hunter.io, breach-data lookups, GitHub code search, Wayback Machine archives, certificate transparency, BGP/ASN mapping.
Use when the engagement scope includes supply-chain attack simulation — typosquatted package publication, dependency confusion, GitHub Actions secret mining, internal mirror poisoning, OAuth-app impersonation, or vendor portal credential abuse.
| name | reverser-overview |
| description | Root pointer for the binary reversing lane. Covers triage, Radare2 fallback, string extraction, packer unpacking, virtualized protectors, symbol risk, ROP, Ghidra deep analysis, and firmware extraction. |
| metadata | {"subdomain":"reverse-engineering","when_to_use":"reverser binary reversing triage strings packer unpack rop ghidra firmware VMProtect VMP2 Themida virtualized protectors overview routing","upstream_ref":"Decepticon reverser lane catalog — Ghidra, Radare2, Back Engineering VMProtect/Themida research, AFL++, libFuzzer, binwalk, and binary triage tooling"} |
| Skill | Use for |
|---|---|
/skills/standard/reverser/triage/SKILL.md | First-pass ELF/PE/Mach-O triage |
/skills/standard/reverser/firmware/SKILL.md | Router / IoT firmware extraction |
/skills/standard/reverser/packer-unpacking/SKILL.md | UPX / ASPack / Themida / VMProtect |
/skills/standard/reverser/virtualized-protectors/SKILL.md | VMProtect / VMP2 / Themida workflow |
/skills/standard/reverser/rop-chain/SKILL.md | Gadget hunting for exploit dev |
/skills/standard/reverser/anti-debug-bypass/SKILL.md | IsDebuggerPresent, ptrace, NtGlobalFlag |
/skills/standard/reverser/ghidra/SKILL.md | Deep Ghidra analysis — decompile, xrefs, imports, P-code |
ghidra_status — check Ghidra MCP bridge and headless availabilitybin_identify — format, arch, NX/PIEbin_packer — entropy + signaturebin_strings — category=url/ip/crypto/secret/version to seed the graphbin_symbols_report — risk bucket classificationcve_lookup + cve_by_packageghidra_analyze for full analysis, or bin_ghidra_script / bin_r2_script for headless Ghidra / Radare2 fallbackghidra_decompile on interesting functions, ghidra_xrefs on dangerous imports