EncidXVII/claude-reverse-engineering-skill

---
Claude Reverse Engineering Skill
An Agent Skill that gives your AI agent a professional reverse-engineering workflow: **identify** what a file really is, **pick tools that are actually installed**, **decompile and export** code headlessly, **map the network surface**, and **report findings** that point to real addresses — while handling untrusted samples safely.
It covers native executables (ELF, PE, Mach-O), Android (APK, AAB, DEX), iOS and macOS apps, .NET and Java bytecode, JavaScript/Electron/WebAssembly, cross-platform frameworks (Flutter, React Native, Xamarin/MAUI, Unity), installers, firmware images, and network protocols.
Built for authorized work: security research, CTFs, malware analysis, interoperability, and debugging.
Contents
- Why this skill
- What it can analyze
- Works with
- Install
- Usage
- Bundled tools
- How it works
- Requirements
- What the skill runs
- FAQ
- Responsible use
- Contributing
- License
Why this skill
- **One command to install, nothing to configure.** A standard Agent Skill: install it as a Claude Code plugin or with npx skills add, and it works. No cloning, no index scripts, no per-client adapters, no extra runtimes — just Python 3.8+.
- **Scripts that do the analysis.** The bundled tools read the files themselves — triage, app/platform metadata, endpoint extraction, decompiled-code export — instead of only routing the agent to someone else's tool.
- **Triage first, not guesswork.** A zero-dependency triage script reads magic bytes and real headers (PE, ELF, Mach-O, CLR), fingerprints 25+ frameworks, packers, and installers, and tells the agent exactly which playbook to open next.
- **Headless by design.** Agents can't click through a GUI. The skill ships a Ghidra post-script that exports decompiled C, imports, and strings to a text file — tested against Ghidra 12.1.4, with a CI job that re-runs it on every push — plus non-interactive commands for rizin, jadx, Frida, gdb, and lldb.
- **Drives real RE tools over MCP.** When rea, GhidraMCP, IDA Pro MCP, radare2-mcp, or jadx MCP is connected, the agent decompiles, renames, and follows cross-references directly — the skill supplies the method, the server does the calls.
- **Finds the network surface fast.** Pulls Retrofit annotations, HTTP client calls, URLs, hosts, auth headers, and crypto usage out of decompiled code and minified JS, each with file:line.
- **Safe with untrusted samples.** Isolation rules for malware, python -I against import hijacking, and an explicit rule that text inside a binary is data — never instructions — so analyzed files can't prompt-inject the agent.
- **Grounded output.** Every finding must cite an address, offset, symbol, or request the tools actually showed, say how it's known (decompiler, assembly, runtime, or inferred), and name what wasn't verified.
- **Tested on real tools, not just docs.** 63 automated checks covering every script and the skill's structure, run in CI on Linux, macOS, and Windows, plus a CI job that runs the Ghidra export against a real Ghidra release on every push.
- **Light on context.** One short SKILL.md; the 14 playbooks load only when a task needs them, so the skill costs almost nothing until it's used.
- **One permissive license.** Everything is Apache-2.0 — safe to use at work, fork, and ship.
What it can analyze
| Target | Examples | Playbook |
| --- | --- | --- |
| Native binaries | .exe .dll .sys · ELF .so · Mach-O .dylib | native-binaries.md |
| Android | .apk .aab .dex · native libs · smali | android.md |
| iOS / Apple | .ipa · Mach-O apps · frameworks · .app bundles | ios.md |
| .NET & Java | managed .dll/.exe · .jar .class .war | managed-bytecode.md |
| JS, Electron, WASM | bundles · source maps · .asar · .wasm · browser extensions | js-electron-wasm.md |
| Frameworks & packagers | Flutter · React Native/Hermes · Xamarin/MAUI · Unity · Godot · PyInstaller · Node SEA · Go · Rust | frameworks-packagers.md |