reverse-engineering-deep-analysis

--- ## LIBRARY-FIRST PROTOCOL (MANDATORY) **Before writing ANY code, you MUST check:** ### Step 1: Library Catalog - Location: `.claude/library/catalog.json` - If match >70%: REUSE or ADAPT ### Step 2: Patterns Guide - Location: `.claude/docs/inventories/LIBRARY-PATTERNS-GUIDE.md` - If pattern exists: FOLLOW documented approach ### Step 3: Existing Projects - Location: `D:\Projects\*` - If found: EXTRACT and adapt ### Decision Matrix | Match | Action | |-------|--------| | Library >90% | REUSE directly | | Library 70-90% | ADAPT minimally | | Pattern exists | FOLLOW pattern | | In project | EXTRACT | | No match | BUILD (add to library after) | --- ## When to Use This Skill Use this skill when analyzing malware samples, reverse engineering binaries for security research, conducting vulnerability assessments, extracting IOCs from suspicious files, validating software for supply chain security, or performing CTF challenges and binary exploitation research. ## When NOT to Use This Skill Do NOT use for unauthorized reverse engineering of commercial software, analyzing binaries on production systems, reversing software without legal authorization, violating terms of service or EULAs, or analyzing malware outside isolated environments. Avoid for simple string extraction (use basic tools instead). ## Success Criteria - All security-relevant behaviors identified (network, file, registry, process activity) - Malicious indicators extracted with confidence scores (IOCs, C2 domains, encryption keys) - Vulnerabilities documented with CVE mapping where applicable - Analysis completed within sandbox environment (VM/container with snapshots) - Findings validated through multiple analysis methods (static + dynamic + symbolic) - Complete IOC report generated (STIX/MISP format for threat intelligence sharing) - Zero false positives in vulnerability assessments - Exploitation proof-of-concept created (if vulnerability research) ## Edge Cases & Challenges - Anti-analysis techniques (debugger detection, VM detection, timing checks) - Obfuscated or packed binaries requiring unpacking - Multi-stage malware with encrypted payloads - Kernel-mode rootkits requiring specialized analysis - Symbolic execution state explosion (>10,000 paths) - Binary analysis timeout on complex programs (>24 hours) - False positives from legitimate software behavior - Encrypted network traffic requiring SSL interception ## Guardrails (CRITICAL SECURITY RULES) - NEVER execute unknown binaries on host systems (ONLY in isolated VM/sandbox) - NEVER analyze malware without proper containment (air-gapped lab preferred) - NEVER reverse engineer software without legal authorization - NEVER share extracted credentials or encryption keys publicly - NEVER bypass licensing mechanisms for unauthorized use - ALWAYS use sandboxed environments with network monitoring - ALWAYS take VM snapshots before executing suspicious binaries - ALWAYS validate findings through multiple analysis methods - ALWAYS document analysis methodology with timestamps - ALWAYS assume binaries are malicious until proven safe - ALWAYS use network isolation to prevent malware communication - ALWAYS sanitize IOCs before sharing (redact internal IP addresses) ## Evidence-Based Validation All reverse engineering findings MUST be validated through: 1. **Multi-method analysis** - Static + dynamic + symbolic execution confirm same behavior 2. **Sandbox validation** - Execute in isolated environment, capture all activity 3. **Network monitoring** - Packet capture validates network-based findings 4. **Memory forensics** - Validate runtime secrets through memory dumps 5. **Behavioral correlation** - Cross-reference with known malware signatures (YARA, ClamAV) 6. **Reproducibility** - Second analyst can replicate findings from analysis artifacts # Reverse Engineering: Deep Analysis ## What This Skill Does Performs deep reverse engineering through runtime execution and symbolic exploration: - **Level 3 (≤1 hr)**: Dynamic analysis - Execute in sandbox with GDB, capture memory/secrets, trace syscalls - **Level 4 (2-6 hrs)**: Symbolic execution - Use Angr/Z3 to synthesize inputs that reach target states **Decision Gate**: After Level 3, evaluates if symbolic execution needed to reach unexplored paths. **Timebox**: 3-7 hours total --- ## Prerequisites ### Level 3 Tools - **GDB** with **GEF** or **Pwndbg** extensions - **strace/ltrace** - System/library call tracing - **Sandbox environment** - Isolated execution (firejail, Docker, or custom) ### Level 4 Tools - **Angr** - Symbolic execution framework (Python) - **Z3** - SMT solver - **Python 3.9+** - For Angr scripts ### MCP Servers - `sandbox-validator` - Safe binary execution - `memory-mcp` - Store runtime findings - `sequential-thinking` - Path exploration decisions - `graph-analyst` - Visualize execution paths --- ## ⚠️ CRITICAL SECURITY WARNING **NEVER execute unknown binaries on your host system!** All dynamic analysis, debugging, and symbolic execution MUST be performed in: - **Isolated VM** (VMware/VirtualBox with snapshots for rollback) - **Docker container** with security policies (`--security-opt`, `--cap-drop=ALL`) - **E2B sandbox** via sandbox-configurator skill with network monitoring - **Dedicated malware analysis lab** (air-gapped if handling APTs) **Consequences of unsafe execution:** - Malware infection with kernel-level rootkits - Memory corruption and system instability - Data exfiltration via covert channels - Supply chain attacks via trojanized builds - Complete system compromise **Safe Practices:** - Always use sandboxed environments with snapshots - Monitor syscalls and network activity during execution - Use GDB/Angr in isolated containers only - Never attach debuggers to binaries on production systems - Validate all inputs before symbolic execution - Assume all binaries are malicious until proven safe through static analysis --- ## Quick Start ```bash # 1. Full deep analysis (Levels 3+4) /re:deep crackme.exe # 2. Dynamic analysis only (Level 3) /re:dynamic server.bin --args "--port 8080" # 3. Symbolic execution only (Level 4) /re:symbolic challenge.exe --target-addr 0x401337 ``` --- ## Level 3: Dynamic Analysis (≤1 hour) ### Step 1: Safe Execution in Sandbox ```bash /re:dynamic binary.exe --args "test input" --sandbox true ``` **Sandboxing**: - Filesystem isolation (read-only /usr, /bin) - Network disabled or monitored - Process limits (CPU, memory, time) - Prevents malware escape ### Step 2: Retrieve Static Analysis Context Before executing, the skill automatically retrieves Level 2 findings: ```javascript // Check memory-mcp for static analysis results const staticFindings = await mcp__memory-mcp__vector_search({ query: binary_hash, filter: {category: "reverse-engineering", re_level: 2} }) // Extract critical functions and suggested breakpoints const breakpoints = staticFindings.critical_functions.map(f => f.address) // Example: ["0x401234", "0x401567", "0x4018ab"] ``` ### Step 3: GDB Session with Auto-Loaded Breakpoints Automatically loads breakpoints from Level 2 static analysis: ```gdb # Auto-generated from static analysis break *0x401234 # check_password function break *0x401567 # validate_license function break *0x4018ab # decrypt_config function # Run with test input run --flag "test_input_from_user" ``` **GDB Session Commands** (executed automatically): ```gdb # At each breakpoint: # 1. Dump all registers info registers # 2. Dump stack (100 bytes) x/100x $rsp # 3. Dump heap allocations (if applicable) info proc mappings x/100x [heap_address] # 4. Search for secrets in memory find 0x600000, 0x700000, "password" find 0x600000, 0x700000, "admin" # 5. Dump interesting strings from registers x/s $rdi # First argument (often string pointer) x/s $rsi # Second argument ``` ### Step 4: Capture Runtime State At each breakpoint, the skill captures: **Register State**: ``` RAX: 0x0000000000401337 RBX: 0x0000000000000000 RCX: 0x00007fffffffe010 → "user_input_here" RDX: 0x0000000000000010 RSI: 0x00007fffffffe020 → "expected_password" RDI: 0x00007fffffffe030 → buffer RBP: 0x00007fffffffe100 RSP: 0x00007fffffffe0e0 RIP: 0x0000000000401234 → check_password ``` **Stack Dump** (saved to `re-project/dbg/0x401234-stack.bin`): ``` 0x7fffffffe0e0: 0x0000000000401337 0x0000000000000000 0x7fffffffe0f0: 0x00007fffffffe200 0x0000000000000001 ``` **Memory Secrets** (extracted automatically): ``` Found at 0x601000: "admin:SecretP@ss123" Found at 0x601020: "license_key=ABC-DEF-GHI-JKL" Found at 0x601040: "api_token=eyJhbGciOiJIUzI1NiIs..." ``` **Syscall Trace** (via strace): ```bash # Automatically executed in parallel strace -o re-project/dbg/syscalls.log ./binary.exe --flag test ``` **Output**: ``` open("/etc/config.ini", O_RDONLY) = 3 read(3, "password=admin123\n", 1024) = 18 socket(AF_INET, SOCK_STREAM, 0) = 4 connect(4, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("192.168.1.100")}, 16) = 0 send(4, "POST /api/login HTTP/1.1\r\n...", 256, 0) = 256 ``` ### Step 5: Output Structure ``` re-project/dbg/ ├── gdb-session.log # Full GDB transcript ├── breakpoints.txt # List of breakpoints set ├── memory-dumps/ │ ├── 0x401234-registers.txt │ ├── 0x401234-stack.bin │ ├── 0x401567-registers.txt │ ├── 0x401567-stack.bin │ └── 0x4018ab-heap.bin ├── syscalls.log # strace output ├── libcalls.log # ltrace output └── runtime-secrets.txt # Extracted passwords, keys, tokens ``` ### Step 6: Decision Gate - Escalate to Level 4? ```javascript // Automatically evaluated via sequential-thinking MCP const decision = await mcp__sequential-thinking__evaluate({ question: "Should we proceed to symbolic execution (Level 4)?", factors: [ `Branches explored: ${explored_branches}/${total_branches}`, `Unreachable code found: ${unreachable_functions.length > 0}`, `User's question answered: ${findings_sufficient}`, `Input-dependent paths: ${symbolic_paths_needed}` ] }) // Example evaluation: // - Explored 12/20 branches (60% coverage) // - Found 3 unreachable functions (possible anti-debug) // - User wants to reach "win" function at 0x401337 (NOT YET REACHED) // - Input-dependent path detected (password check with strcmp) // DECISION: ESCALATE TO LEVEL 4 ``` --- ## Level 4: Symbolic Execution (2-6 hours) ### Step 1: Define Target State from Dynamic Analysis ```python # From Level 3: Couldn't reach "win" function at 0x401337 with manual inputs target_addr = 0x401337 # Goal: Find input that reaches this # From Level 3: These functions lead to failure/exit avoid_addrs = [ 0x401400, # fail_message function 0x401500, # bad_password function 0x401600 # exit_program function ] ``` ### Step 2: Launch Symbolic Exploration ```bash /re:symbolic binary.exe \ --target-addr 0x401337 \ --avoid-addrs 0x401400,0x401500,0x401600 \ --max-states 1000 \ --timeout 7200 ``` **What Happens Under the Hood**: ```python import angr import claripy # Step 2.1: Load binary into Angr project project = angr.Project('./binary.exe', auto_load_libs=False) # Step 2.2: Create symbolic input # Assume input is 32-byte flag flag_length = 32 flag = claripy.BVS('flag', flag_length * 8) # Step 2.3: Create entry state with symbolic stdin state = project.factory.entry_state( stdin=flag, add_options={angr.options.LAZY_SOLVES} ) # Step 2.4: Add constraints - printable ASCII only for byte in flag.chop(8): state.add_constraints(byte >= 0x20) # Printable ASCII start state.add_constraints(byte <= 0x7e) # Printable ASCII end # Step 2.5: Create simulation manager simgr = project.factory.simulation_manager(state) # Step 2.6: Explore paths (DFS strategy) simgr.explore( find=0x401337, # Target address avoid=[0x401400, 0x401500, 0x401600], # Avoid addresses num_find=1, # Stop after finding first solution max_states=1000 # Prevent state explosion ) # Step 2.7: Check if solution found if simgr.found: # Extract concrete input solution_state = simgr.found[0] solution = solution_state.solver.eval(flag, cast_to=bytes) print(f"Solution: {solution.decode()}") # Save solution with open('re-project/sym/solutions/solution-1.txt', 'wb') as f: f.write(solution) else: print("No solution found within constraints") ``` ### Step 3: Advanced Symbolic Techniques #### Technique 1: Hook Library Functions ```python # Replace complex library functions with symbolic summaries import angr # Hook strcmp to return symbolic value class StrCmpHook(angr.SimProcedure): def run(self, s1, s2): # Return symbolic comparison result s1_str = self.state.memory.load(s1, 32) s2_str = self.state.memory.load(s2, 32) return s1_str == s2_str project.hook_symbol('strcmp', StrCmpHook()) ``` #### Technique 2: State Merging for Complex Paths ```python # Merge states at loop entry to prevent explosion simgr.use_technique(angr.exploration_techniques.Veritesting()) # Alternative: Manual state merging while simgr.active: simgr.step() if len(simgr.active) > 50: # Merge similar states simgr.merge() ``` #### Technique 3: Constraint Simplification ```python # Add intermediate constraints to guide exploration state.add_constraints( flag[0:4] == b'FLAG' # Known prefix from hints ) # This reduces search space dramatically # Without: 256^32 possibilities # With: 256^28 possibilities (4 bytes fixed) ``` ### Step 4: Validate Solution ```bash # Test synthesized input echo "FLAG_synthesized_solution_here" | ./binary.exe # Expected output: # "Success! You reached the target state." # "Congratulations! Flag: CTF{...}" ``` **Validation Steps**: 1. Run binary with synthesized input 2. Verify execution reaches target address (0x401337) 3. Check output matches expected success message 4. Store validated solution in memory-mcp ### Step 5: Output Structure ``` re-project/sym/ ├── angr-script.py # Reproducible Angr script ├── solutions/ │ ├── solution-1.txt # First valid solution │ ├── solution-2.txt # Alternative solution (if --find-all) │ └── solution-3.txt ├── constraints/ │ ├── path-1.smt2 # Z3 constraints for path 1 │ ├── path-2.smt2 │ └── simplified.smt2 # Simplified constraint set ├── validation.log # Validation test results └── exploration-metrics.json # States explored, time taken, coverage ``` **exploration-metrics.json**: ```json { "total_states": 847, "found_states": 3,