Binary Reversing

Use this skill after engagement-scope has established the authorized target, scope evidence, artifact handling rules, and desired deliverable. If no brief is present, infer local/offline scope from files in the workspace and ask only for missing context that changes whether unpacking, emulation, or dynamic execution is allowed.

Default to static analysis. Do not execute unknown binaries, detonate suspicious samples, contact embedded network endpoints, or run unpacked code unless the engagement explicitly allows isolated lab execution. Use binary-debugging when runtime state, crashes, registers, traces, or process behavior become the blocker.

Reversing Modes

Choose one primary mode: