<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: reverse-engineering
description: >-
  Reverse engineering covering static binary analysis, dynamic analysis and debugging,
  packed executable analysis, network protocol reversing, firmware image analysis,
  code deobfuscation, .NET assembly analysis, Android and iOS application reversing,
  Ghidra scripting, shellcode analysis, and ransomware sample reverse engineering.
  Enables malware research, vulnerability discovery, and threat intelligence with
  Ghidra, IDA Pro, x64dbg, Frida, radare2, and dnSpy tooling.
domain: cybersecurity
subdomain: reverse-engineering
tags:
  - reverse-engineering
  - static-analysis
  - dynamic-analysis
  - packed-executables
  - protocol-reversing
  - firmware-analysis
  - deobfuscation
  - dotnet-reversing
  - android-reversing
  - ios-reversing
  - ghidra
  - shellcode-analysis
  - ransomware-analysis
  - ida-pro
  - radare2
  - frida
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1027", "T1140", "T1059", "T1204", "T1036"]
  cwe: ["CWE-506", "CWE-912", "CWE-798", "CWE-327", "CWE-200"]
  frameworks: ["MITRE ATT&CK", "CWE", "OWASP", "PTES"]
---

# Reverse Engineering

## When to Use

Activate when the operator asks about binary reverse engineering, malware analysis,
firmware extraction, protocol reversing, code deobfuscation, mobile app reversing,
Ghidra scripting, shellcode analysis, or ransomware dissection.

Mode: `[MODE: RED]` for offensive reverse engineering; `[MODE: BLUE]` for malware defense and detection; `[MODE: PURPLE]` for threat intelligence.

## Prerequisites

- Tools: `ghidra`, `radare2`, `frida`, `x64dbg`, `dnSpy`, `jadx`, `binwalk`
- Isolated malware analysis lab (VM or sandbox)
- Authorization and signed Rules of Engagement (RoE)
- Sample acquisition through authorized channels

## Quick Reference

| Technique | Primary Tools | CWE |
|-----------|--------------|-----|
| Static binary analysis | Ghidra, radare2, objdump | CWE-506 |
| Dynamic analysis | GDB, x64dbg, strace, Frida | CWE-506 |
| Packed executables | DIE, UPX, unipacker | CWE-506 |
| Protocol reversing | Wireshark, Scapy, mitmproxy | CWE-327 |
| Firmware analysis | binwalk, FACT, ubi_reader | CWE-798 |
| Code deobfuscation | de4dot, js-beautify, miasm | CWE-506 |
| .NET assemblies | dnSpy, ILSpy, de4dot | CWE-506 |
| Android apps | jadx, apktool, Frida | CWE-200 |
| iOS apps | Hopper, class-dump, Frida | CWE-200 |
| Ghidra scripting | Ghidra, pyhidra, Ghidrathon | CWE-506 |
| Shellcode analysis | scdbg, speakeasy, unicorn | CWE-94 |
| Ransomware RE | Ghidra, x64dbg, CyberChef | CWE-327 |

## Workflow

### Step 1: Identify Target

```bash
file ./sample
rabin2 -I ./sample
binwalk -e ./firmware.bin
```

### Step 2: Load in RE Tool

```bash
# Ghidra headless analysis
analyzeHeadless /tmp/project proj \\
    -import ./sample \\
    -postScript AnalyzeAll.java

# radare2 interactive
r2 -A ./sample
```

### Step 3: Analyze and Document

```bash
# Export function list
r2 -q -c "aaa; aflj" ./sample | python3 -m json.tool

# Generate call graph
r2 -q -c "aaa; agCd" ./sample > callgraph.dot
```



## Verification

- [ ] All tools installed and operational
- [ ] Target acquired through authorized channels
- [ ] Analysis completed with findings documented
- [ ] Detection opportunities identified for blue team
- [ ] Artifacts preserved and report generated

## References

- [MITRE ATT&CK](https://attack.mitre.org/) — Adversary tactics and techniques
- [CWE](https://cwe.mitre.org/) — Common Weakness Enumeration
- [OWASP](https://owasp.org/) — Open Web Application Security Project
