Reverse Engineering

When to Activate

• Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
• Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
• Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
• Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
• Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
• Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
• Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.

Technique Map

Quick Start

# 0. Triage: format, arch, mitigations, packer entropy, strings, imports, capabilities → JSON
python3 scripts/triage.py ./sample -o out/triage.json

# 1. Headless decompile to C (Ghidra 11.4 analyzeHeadless wrapper inside triage.py --decompile)
python3 scripts/triage.py ./sample --decompile --ghidra "$GHIDRA_HOME" -o out/

# 2. If packed/protected → defeat anti-debug, dump OEP (run under x64dbg+ScyllaHide on Windows)
python3 scripts/antidebug_unhook.py --scan ./sample      # enumerate anti-debug primitives first

# 3. Dynamic: attach Frida (Android/Linux/Win), universal SSL-unpin + native trace
frida -U -f com.target.app -l scripts/frida_universal.js --no-pause

# 4. Deobfuscate: emulate string decryptor over all xrefs; de-flatten OLLVM with Triton
python3 scripts/string_decrypt_emu.py ./sample --func 0x401500 --auto-xref -o out/strings.txt
python3 scripts/deflatten_triton.py ./sample --func 0x401abc -o out/cfg.dot

# 5. Firmware: carve + identify + map UEFI DXE/PEI attack surface, scan for PKfail/known hashes
python3 scripts/uefi_triage.py firmware.bin -o out/fw/

# 6. n-day: fetch pre/post-patch Windows binary from winbindex and diff
python3 scripts/patchdiff_fetch.py --pe afd.sys --kb-after KB5050000 -o out/diff/

# 7. Unknown protocol: infer fields/state machine from a pcap, emit Kaitai + Wireshark dissector
python3 scripts/proto_infer.py capture.pcap --port 4444 -o out/proto/

OPSEC & Detection (summary)

Deep Dives

• references/static-triage-decompilation.md — File/arch/mitigation triage, entropy & packer ID, capability detection (capa), Ghidra 11.4 analyzeHeadless + PyGhidra, r2/rizin & IDA decompile flows, and the 2025 AI/MCP-assisted layer (Binary Ninja Sidekick, GhidrAssistMCP, LLM4Decompile / SK²Decompile) with verification discipline.
• references/dynamic-instrumentation.md — GDB/GEF & x64dbg workflows, conditional/commands breakpoints, Frida 17 internals (Interceptor/Stalker/Java), universal SSL-unpin + JNI tracing, and angr/Triton symbolic + concolic execution with backward slicing for path/value recovery.
• references/anti-reversing-bypass.md — Anti-debug taxonomy (PEB flags, NtSetInformationThread/ThreadHideFromDebugger, DR0-7 / GetThreadContext, KiUserExceptionDispatcher, NtClose, INT 2D, rdtsc timing, Linux ptrace/TracerPid), anti-VM/al-khaser, ScyllaHide/TitanHide, and runtime-packer OEP dumping.
• references/deobfuscation.md — String & API-hash decryption via Unicorn emulation, OLLVM control-flow-flattening de-flattening (dispatcher recovery, Triton backward slicing à la LummaC2), MBA simplification, and VM-protector devirtualization (NoVmp/VTIL, Titan, Triton lifting) for VMProtect 3.x / Themida.
• references/firmware-uefi.md — binwalk/unblob carving, squashfs/JFFS2 extraction, QEMU+afl emulation, UEFI volume/DXE/PEI parsing (UEFITool/chipsec), SMM callout & NVRAM variable surface, and Secure Boot bypass research with the verified 2024-2025 chain: LogoFAIL (CVE-2023-40238), PKfail (CVE-2024-8105), CVE-2024-7344, BlackLotus/Bootkitty context.
• references/patch-diffing-protocol.md — winbindex binary acquisition, MSU/CAB extraction, BinDiff/Diaphora/ghidriff function-level diffing, LLM-assisted triage (PatchWatch/DiffRays) with hallucination caveats, late-2025 kernel targets (cldflt.sys, win32k, CLFS), plus network/file-format protocol RE (Netzob, Kaitai Struct, BinPRE-style field inference).
• references/rr-time-travel.md — deterministic record/replay root cause: rr record/replay, reverse-continue/stepi + hardware watchpoints to the corrupting write, the auditable trace in the scoped workspace; emits the trace_proof artifact. Backed by scripts/rr_root_cause.sh (degrades gracefully where rr is absent). Runs in .devcontainer/.
• references/coverage-reachability.md — proving the vulnerable line/function actually executed: gcov line-hit (build --coverage, run the witness, assert the line is not #####) and -finstrument-functions/rr/uftrace function traces; the coverage_proof/trace_proof the native-bug bar in validate_findings.py requires before [CONFIRMED].
• references/patch-diffing-protocol.md is fed by scripts/cve_diff.py — multi-source canonical fix-commit discovery (OSV/NVD/GitHub Advisories) with de-dup by (repo, sha) + OSV GIT-range fixed events, then a scope-gated, git_safe-hardened clone + git diff fix^..fix. Use it to locate the patch before BinDiff/ghidriff; chain into /engage.crash for root-cause + exploitability.