Reverse Engineering

Purpose

Guide agents through reverse engineering binaries: Ghidra project setup and decompilation, radare2 analysis workflow, Binary Ninja scripting, initial triage with strings/file/xxd, identifying C++ patterns (vtables, RAII), analyzing stripped binaries, and diffing with Diaphora or BinDiff.

When to Use

• Analyzing an unknown binary without source code
• Recovering algorithm logic from compiled executables
• Comparing two firmware versions for vulnerability patches
• Understanding malware or CTF challenge binaries
• Recovering symbols from stripped ELF/PE files
• Automating analysis with Ghidra or r2 scripts

Workflow

1. Initial triage