ghidra
Installation
SKILL.md
Identify the sample by hash, format, and architecture. Use symbols, strings, imports, cross-references, decompilation, and call chains to test a concrete behavior hypothesis.
Complete when every claimed behavior names the program location and an evidence path that reaches it.