---
name: reverse-engineering-d3bd2b463725
description: Reverse Engineering Skill
version: 1.0.0
---

# Reverse Engineering Skill

Binary analysis and reverse engineering via MCP servers for Ghidra, IDA Pro, radare2, and angr.

## Trigger Conditions

- User asks to analyze binaries, disassemble code, decompile functions
- Questions about malware analysis, vulnerability research, CTF challenges
- Binary diffing, patch analysis, firmware extraction
- Symbol recovery, function identification, control flow analysis

## MCP Servers

### 1. GhidrAssistMCP (Ghidra - Free)
**Repository**: https://github.com/jtang613/GhidrAssistMCP  
**Stars**: High activity  
**Transport**: HTTP/SSE on port 8080

**Installation**:
```bash
# Download from releases page
# In Ghidra: File → Install Extensions → Add Extension
# Enable: File → Configure → Configure Plugins → GhidrAssistMCP
```

**31 Built-in Tools**:
| Category | Tools |
|----------|-------|
| Program Analysis | `get_program_info`, `list_functions`, `list_data`, `list_strings`, `list_imports`, `list_exports`, `list_segments` |
| Function Analysis | `get_function_info`, `decompile_function`, `disassemble_function`, `function_xrefs`, `search_functions` |
| Navigation | `get_current_address`, `xrefs_to`, `xrefs_from`, `get_current_function` |
| Modification | `rename_function`, `rename_variable`, `set_function_prototype`, `set_local_variable_type`, `set_disassembly_comment` |
| Advanced | `auto_create_struct` |

### 2. LaurieWired/GhidraMCP (Popular Alternative)
**Repository**: https://github.com/LaurieWired/GhidraMCP  
**Transport**: Python bridge to Ghidra

### 3. IDA Pro MCP Servers

**mrexodia/ida-pro-mcp** (Most active):
```bash
git clone https://github.com/mrexodia/ida-pro-mcp
cd ida-pro-mcp
pip install -e .
```

**MxIris-Reverse-Engineering/ida-mcp-server** (473 stars):
```bash
git clone https://github.com/MxIris-Reverse-Engineering/ida-mcp-server
```

**fdrechsler/mcp-server-idapro**:
```bash
git clone https://github.com/fdrechsler/mcp-server-idapro
```

### 4. radare2-mcp (Official)
**Repository**: https://github.com/radareorg/radare2-mcp  
**Transport**: stdio

```bash
# Install radare2 first
brew install radare2  # macOS
# or: apt install radare2  # Linux

git clone https://github.com/radareorg/radare2-mcp
cd radare2-mcp
pip install -e .
```

**MCP Config**:
```json
{
  "mcpServers": {
    "radare2": {
      "command": "r2-mcp",
      "args": []
    }
  }
}
```

### 5. rand-tech/pcm (Multi-tool)
**Repository**: https://github.com/rand-tech/pcm  
MCP for reverse engineering combining multiple backends.

## Workflows

### Basic Binary Analysis
```
1. Load binary into Ghidra/IDA
2. Start MCP server
3. Query: "List all functions" → list_functions
4. Query: "Decompile main" → decompile_function
5. Query: "Find xrefs to this address" → xrefs_to
```

### Malware Analysis Pattern
```
1. get_program_info → Architecture, compiler, entry point
2. list_imports → Suspicious API calls (CreateRemoteThread, VirtualAlloc)
3. list_strings → C2 URLs, encryption keys, debug strings
4. search_functions "crypt" → Find encryption routines
5. decompile_function → Understand algorithm
6. auto_create_struct → Recover data structures
```

### Vulnerability Research
```
1. list_functions → Function list with sizes
2. search_functions "parse|read|copy" → Input handlers
3. decompile_function → Find buffer operations
4. xrefs_to → Trace data flow
5. set_decompiler_comment → Annotate findings
```

### CTF Binary Exploitation
```
1. get_program_info → Check protections (PIE, RELRO, canary)
2. list_functions → Find win/flag functions
3. decompile_function → Understand vulnerability
4. xrefs_from → Control flow analysis
5. list_segments → Memory layout for ROP
```

## CLI Quick Reference

### radare2 Commands
```bash
r2 binary                    # Open binary
aaa                          # Analyze all
afl                          # List functions
pdf @ main                   # Disassemble function
pdc @ main                   # Decompile (r2ghidra)
axt @ addr                   # Xrefs to
axf @ addr                   # Xrefs from
iz                           # List strings
ii                           # List imports
```

### Ghidra Headless
```bash
analyzeHeadless /tmp/project ProjectName \
  -import binary.exe \
  -postScript ExportDecompilation.java \
  -deleteProject
```

## Resources

- [Awesome Reverse Engineering](https://github.com/wtsxDev/reverse-engineering)
- [CTF Wiki - Reverse](https://ctf-wiki.org/reverse/)
- [Ghidra Scripting](https://ghidra.re/ghidra_docs/api/)
- [radare2 Book](https://book.rada.re/)

## r2con Speaker Repositories

Key repositories from r2con 2016-2025 speakers for process tree and binary analysis:

### Core radare2 Team
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Sergi Alvarez | pancake | [github.com/trufae](https://github.com/trufae) | radare2 creator, r2pipe |
| Anton Kochkov | xvilka | [github.com/XVilka](https://github.com/XVilka) | UEFI, radeco decompiler |
| Florian Märkl | thestr4ng3r | [github.com/thestr4ng3r](https://github.com/thestr4ng3r) | Cutter/Rizin founder |
| condret | condret | [github.com/condret](https://github.com/condret) | ESIL core, SIOL I/O |
| wargio | wargio | [github.com/wargio](https://github.com/wargio) | GSoC mentor |
| maijin | maijin | [github.com/maijin](https://github.com/maijin) | r2 book maintainer |

### ESIL & Symbolic Execution
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Chase Kanipe | alkalinesec | [github.com/alkalinesec](https://github.com/alkalinesec) | ESILSolve symbolic exec |
| Sylvain Pelissier | Pelissier_S | N/A | ESIL side-channel simulation |
| Abel Valero | skuater | [github.com/skuater](https://github.com/skuater) | r2wars, ESIL plugins |
| Gerardo García | killabytenow | [github.com/killabytenow](https://github.com/killabytenow) | ESIL limits |

### Frida Integration (r2frida)
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Ole André Ravnås | oleavr | [github.com/oleavr](https://github.com/oleavr) | Frida creator, NowSecure |
| Giovanni Rocca | iGio90 | [github.com/iGio90](https://github.com/iGio90) | Dwarf debugger |
| Grant Douglas | hexploitable | [github.com/hexploitable](https://github.com/hexploitable) | r2frida mobile |
| Alex Soler | as0ler | N/A | r2frida Kung Fu, r2env |

### Malware & Security Analysis
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Axelle Apvrille | cryptax | [github.com/cryptax](https://github.com/cryptax) | Malware, r2ai, droidlysis |
| Tim Blazytko | mr_phrazer | [github.com/mrphrazer](https://github.com/mrphrazer) | MBA deobfuscation, msynth |
| Julien Voisin | jvoisin | [github.com/jvoisin](https://github.com/jvoisin) | Security tooling |
| cmatthewbrooks | cmatthewbrooks | N/A | Windows malware |

### Signatures & Similarity
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Barton Rhodes | bmorphism | [github.com/bmorphism](https://github.com/bmorphism) | r2 Zignatures (2020) |
| swoops | swoops | [github.com/swoops](https://github.com/swoops) | libc_zignatures, dr_pebber |
| Fernando Dominguez | FernandoDoming | [github.com/FernandoDoming](https://github.com/FernandoDoming) | diaphora similarity |

### Mobile Security (OWASP MSTG)
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Carlos Holguera | cpholguera | [github.com/cpholguera](https://github.com/cpholguera) | OWASP MSTG co-author |
| Eduardo Novella | enovella | [github.com/enovella](https://github.com/enovella) | NowSecure, r2frida |
| Francesco Tamagni | mrmacete | [github.com/mrmacete](https://github.com/mrmacete) | NowSecure iOS |

### Decompilation & Analysis
| Speaker | Handle | Repository | Specialty |
|---------|--------|------------|-----------|
| Ahmed Abd El Mawgood | oddcoder | [github.com/oddcoder](https://github.com/oddcoder) | RAIR (Radare In Rust) |
| Antide Petit | xarkes | [github.com/xarkes](https://github.com/xarkes) | Cutter development |
| Arnau Gamez | arnaugamez | [github.com/arnaugamez](https://github.com/arnaugamez) | Side-channel attacks |

### Key Tool Repositories
```bash
# radare2 ecosystem
git clone https://github.com/radareorg/radare2      # Core framework
git clone https://github.com/radareorg/r2ghidra     # Ghidra decompiler
git clone https://github.com/radareorg/radare2-mcp  # MCP server
git clone https://github.com/radareorg/esil-rs      # ESIL in Rust

# Rizin fork (Cutter backend)
git clone https://github.com/rizinorg/rizin         # Rizin framework
git clone https://github.com/rizinorg/cutter        # GUI
git clone https://github.com/rizinorg/rz-ghidra     # Ghidra integration

# Frida ecosystem
git clone https://github.com/frida/frida-core       # Core library
git clone https://github.com/frida/frida-gum        # Instrumentation
git clone https://github.com/frida/cryptoshark      # Code tracer

# Speaker tools
git clone https://github.com/swoops/libc_zignatures # libc signatures
git clone https://github.com/swoops/dr_pebber       # Fake TEB/PEB for ESIL
git clone https://github.com/mrphrazer/msynth       # MBA simplification
git clone https://github.com/cryptax/droidlysis     # Android analysis
git clone https://github.com/iGio90/Dwarf           # Frida debugger
git clone https://github.com/condret/r2premium      # r2 premium features
```

### Process Tree Analysis Perspectives

Each speaker brings unique analysis perspective:

| Speaker | Focus | Process Tree Approach |
|---------|-------|----------------------|
| **pancake** | Core r2 | `r2 -d pid://PID` attach, sandbox escape surfaces |
| **xvilka** | UEFI/radeco | Chromium shmem handles, decompile GPU process |
| **condret** | ESIL | Each PID as ESIL context, trace IPC parsing |
| **Pelissier_S** | Side-channel | Timing oracles in `--time-ticks-*` params |
| **alkalinesec** | ESILSolve | Symbolic exec on sandbox constraints |
| **iGio90** | r2frida | `frida -U -n 'process'` + r2 integration |
| **thestr4ng3r** | Cutter | GUI attach, graph shader pipeline |
| **cryptax** | Malware | Persistence via flox-watchdog, LOLbins |
| **bmorphism** | Zignatures | `zg` signature generation across renderer variants |
| **swoops** | dr_pebber | Fake PEB structures for Windows emulation |
| **mr_phrazer** | Deobfuscation | MBA expressions in obfuscated binaries |

## Example Session

```
User: Analyze this binary for buffer overflow vulnerabilities

Agent:
1. Starting GhidraMCP server...
2. Loading binary and auto-analyzing...
3. [list_functions] Found 47 functions
4. [search_functions "strcpy|sprintf|gets"] Found 3 dangerous calls:
   - sub_401234: uses strcpy with stack buffer
   - sub_401456: sprintf without bounds
5. [decompile_function "sub_401234"] 
   
   void vuln_func(char *input) {
       char buffer[64];
       strcpy(buffer, input);  // VULNERABLE: no bounds check
       ...
   }

6. [xrefs_to "sub_401234"] Called from main+0x45
7. Vulnerability confirmed: Stack buffer overflow in sub_401234
```

---

## End-of-Skill Interface

## Integration with Gay.jl Colors

Assign deterministic colors to binary analysis domains:

```julia
using Gay

# Trit classification for RE tools
GHIDRA_TRIT = 0      # ZERO - foundational analysis
IDA_TRIT = 1         # PLUS - commercial/advanced  
RADARE2_TRIT = -1    # MINUS - lightweight/CLI

# Color functions by complexity
function color_function(cyclomatic_complexity::Int, seed::UInt64)
    Gay.color_at(cyclomatic_complexity, seed)
end

# Color control flow graph nodes
function color_cfg_node(block_id::Int, func_seed::UInt64)
    Gay.color_at(block_id, func_seed)
end
```

## Related Skills

- `effective-topos`: radare2 integration
- `mcp-tripartite`: Binary analysis trit (-1 MINUS)
- `binsec`: Symbolic execution tutorials
- `gay-mcp`: Deterministic coloring for CFG visualization

---
Source attribution: plurigrid
Original project: https://github.com/plurigrid/asi/blob/293ce9f76e3abcd5ba18db284688bc0d9ac6691d/plugins/asi/skills/reverse-engineering/SKILL.md
License: MIT
License information: https://opensource.org/license/mit
Original upstream instructions; downloaded from Mega AI Hub.

## Upstream license notice

MIT License

Copyright (c) 2025 SkillCreator.ai

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.



# Mega AI Hub resource metadata

Creator / publisher: plurigrid
Original project: https://github.com/plurigrid/asi/blob/293ce9f76e3abcd5ba18db284688bc0d9ac6691d/plugins/asi/skills/reverse-engineering/SKILL.md
Attribution basis: Source repository record

Fields of work: Data & Analytics, Development & Engineering
Roles: Data Scientist, ML / AI Engineer, Security Engineer
Specialties: Backend
Tools: Ghidra, Angr, Radare2, Ida Pro
Country applicability: Country not specified
Classification basis: Source catalog labels
Instruction SHA-256: 9f33d8bcf28d1c7a182369fa8173bb907dd1d5686503ff673343aa61465d460b