Loading...
Loading...
Found 43 Skills
N-day Patch Diff to Exploit. Reverse-engineer vulnerability points from vendor-released patches, write PoCs, and develop usable attack modules. Applicable scenarios: Known CVE number but only patches available without PoC; SRC/red teams need to target unpatched assets; N-day weaponization; Patch Tuesday follow-up. Core method: Obtain before/after binaries → align symbols → binary diff → reverse-engineer bug class by examining newly added security checks → write PoC to trigger the vulnerability. Trigger keywords: N-day, Nday, patch diff, patch diff, patch tuesday, 1day, binary diff vulnerability, bindiff exploitation, ghidriff, Diaphora, patch analysis, CVE reproduction, vulnerability restoration, patch reverse-engineering, N-day weaponization.
Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.
IDA Pro Python scripting for reverse engineering. Use when writing IDAPython scripts, analyzing binaries, working with IDA's API for disassembly, decompilation (Hex-Rays), type systems, cross-references, functions, segments, or any IDA database manipulation. Covers ida_* modules (50+), idautils iterators, and common patterns.
.NET / C# Binary Reverse Engineering. Use this when the target is a .NET assembly (managed .exe/.dll with CLR in PE header), C# compiled product (including NativeAOT), red team Sharp* tools (Rubeus / SharpHound / SharpShell, etc.), .NET obfuscated programs (ConfuserEx / SmartAssembly / Babel / Eazfuscator), or .NET loader / info-stealer / packed malware. Prioritize using dnSpyEx + de4dot; link with dnSpy MCP when direct AI operation is required. Not applicable for pure native binaries (use reverse-engineering / ida-reverse instead).
Expert reverse engineer specializing in binary analysis, disassembly, decompilation, and software analysis. Masters IDA Pro, Ghidra, radare2, x64dbg, and modern RE toolchains. Handles executable analysis, library inspection, protocol extraction, and vulnerability research. Use PROACTIVELY for binary analysis, CTF challenges, security research, or understanding undocumented software.
IDA Pro Reverse Analysis Assistant Skill. Use this skill whenever the user mentions reverse engineering, decompilation, analyzing binary/PE/ELF/APK/DLL/SO files, cracking, password finding, vulnerability analysis, malware analysis, firmware analysis, or needs to analyze files such as exe/dll/so/elf/macho/sys. Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or "reverse engineering". This includes requests like "Check this exe", "Analyze this dll", "Help me crack it", "Find the password", "How to register this software", etc. Use the bundled scripts (scripts/start.ps1, scripts/open.ps1) for deterministic server management and file opening — do NOT write ad-hoc PowerShell commands for these operations.
Query IDA strings, bytes, and binary data. Use when asked to search strings, find byte patterns, rebuild string tables, or analyze binary content.
Reverse engineering techniques for CTF challenges. Use when analyzing binaries, game clients, obfuscated code, or esoteric languages.
Reconstruct data structures by analyzing memory access patterns across functions
Use for authorized binary analysis in Binary Ninja, including HLIL/MLIL/LLIL inspection, strings/imports/exports, cross-references, types, patch review, Python API automation, and optional Binary Ninja MCP or localhost HTTP integration.
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.
Provides reverse engineering techniques for CTF challenges. Use when analyzing binaries, game clients, obfuscated code, esoteric languages, custom VMs, anti-debugging, anti-analysis bypass, WASM, .NET, APK (including Flutter/Dart AOT with Blutter), HarmonyOS HAP/ABC, Python bytecode, Go/Rust/Swift/Kotlin binaries, VMProtect/Themida, Ghidra, GDB, radare2, Frida, angr, Qiling, Triton, binary diffing, macOS/iOS Mach-O, embedded firmware, kernel modules, game engines, or extracting flags from compiled executables.