Reverse Engineering

When to Activate

• Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
• Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
• Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
• Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
• Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
• Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
• Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.

Technique Map