binary-analysis-patterns
Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
By wshobson · 9,618 installs
npx skills add wshobson/agents --skill binary-analysis-patterns
Source repository · Upstream listing
Binary Analysis Patterns
Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.
When to Use This Skill
Reverse engineering an unknown executable to understand its behavior
Analyzing malware or obfuscated binaries with Ghidra / IDA Pro / Binary Ninja
Recognizing common assembly idioms (function prologues, switch tables, vtable dispatch)
Reconstructing high level control flow from compiled code
Identifying compiler introduced patterns (stack canaries, PIC trampolines)
Detailed section: Disassembly Fundamentals
Originally a 2047 byte section in this SKILL.md. Moved to references/details.md to fit Codex's 8 KB skill body cap.
Control Flow Patterns
Conditional Branches
Loop Patterns
Switch Statement Patterns
Data Structure Patterns
Array Access
Structure Access
Linked List Traversal
Common Code Patterns
String Operations
Arithmetic Patterns
Bit Manipulation
Decompilation Patterns
Variable Recovery
Function Signature Recovery
Type Recovery
Ghidra Analysis Tips
Improving Decompilation
Pattern Matching Scripts
IDA Pro Patterns
IDAPython Analysis
Best Practices
Analysis Workflow
1. Initial triage : File type, architecture, imports/exports
2. String analysis : Identify interesting strings, error messages
3. Function identification : Entry points, exports, cross references
4. Control flow mapping : Understand program structure
5. Data structure recovery : Identify structs, arrays, globals
6. Algorithm identification : Crypto, hashing, compression
7. Documentation : Comments, renamed symbols, type definitions
Common Pitfalls
Optimizer artifacts : Code may not match source structure
Inline functions : Functions may be expanded inline
Tail call optimization : jmp instead of call + ret
Dead code : Unreachable code from optimization
Position independent code : RIP relative addressing