[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CSAP40KR0M47GBA9VXF0GC":3,"skill-same:01M6CSAP40KR0M47GBA9VXF0GC":62},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":27,"linkOnly":28,"markdownContent":29,"markdownBody":30,"frontMatter":31,"refName":34,"commitSha":35,"skillDirectory":36,"forksCount":37,"repositoryHtmlUrl":38,"repositoryHomepageUrl":38,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":40,"updatedAt":41,"install":42,"resources":55},"01M6CSAP40KR0M47GBA9VXF0GC","binary-analysis-patterns",null,"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.","Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fbinary-analysis-patterns\u002FSKILL.md",[],[19,20,21,22,23,24,25,26],"analysis","binary analysis","binary analysis patterns","patterns","code","analyzing","assembly","community","2026-11-10 10:12:30",false,"---\nname: binary-analysis-patterns\ndescription: \"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# Binary Analysis Patterns\n\nComprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\n\n## Use this skill when\n\n- Working on binary analysis patterns tasks or workflows\n- Needing guidance, best practices, or checklists for binary analysis patterns\n\n## Do not use this skill when\n\n- The task is unrelated to binary analysis patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Disassembly Fundamentals\n\n### x86-64 Instruction Patterns\n\n#### Function Prologue\u002FEpilogue\n```asm\n; Standard prologue\npush rbp           ; Save base pointer\nmov rbp, rsp       ; Set up stack frame\nsub rsp, 0x20      ; Allocate local variables\n\n; Leaf function (no calls)\n; May skip frame pointer setup\nsub rsp, 0x18      ; Just allocate locals\n\n; Standard epilogue\nmov rsp, rbp       ; Restore stack pointer\npop rbp            ; Restore base pointer\nret\n\n; Leave instruction (equivalent)\nleave              ; mov rsp, rbp; pop rbp\nret\n```\n\n#### Calling Conventions\n\n**System V AMD64 (Linux, macOS)**\n```asm\n; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack\n; Return: RAX (and RDX for 128-bit)\n; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11\n; Callee-saved: RBX, RBP, R12-R15\n\n; Example: func(a, b, c, d, e, f, g)\nmov rdi, [a]       ; 1st arg\nmov rsi, [b]       ; 2nd arg\nmov rdx, [c]       ; 3rd arg\nmov rcx, [d]       ; 4th arg\nmov r8, [e]        ; 5th arg\nmov r9, [f]        ; 6th arg\npush [g]           ; 7th arg on stack\ncall func\n```\n\n**Microsoft x64 (Windows)**\n```asm\n; Arguments: RCX, RDX, R8, R9, then stack\n; Shadow space: 32 bytes reserved on stack\n; Return: RAX\n\n; Example: func(a, b, c, d, e)\nsub rsp, 0x28      ; Shadow space + alignment\nmov rcx, [a]       ; 1st arg\nmov rdx, [b]       ; 2nd arg\nmov r8, [c]        ; 3rd arg\nmov r9, [d]        ; 4th arg\nmov [rsp+0x20], [e] ; 5th arg on stack\ncall func\nadd rsp, 0x28\n```\n\n### ARM Assembly Patterns\n\n#### ARM64 (AArch64) Calling Convention\n```asm\n; Arguments: X0-X7\n; Return: X0 (and X1 for 128-bit)\n; Frame pointer: X29\n; Link register: X30\n\n; Function prologue\nstp x29, x30, [sp, #-16]!  ; Save FP and LR\nmov x29, sp                 ; Set frame pointer\n\n; Function epilogue\nldp x29, x30, [sp], #16    ; Restore FP and LR\nret\n```\n\n#### ARM32 Calling Convention\n```asm\n; Arguments: R0-R3, then stack\n; Return: R0 (and R1 for 64-bit)\n; Link register: LR (R14)\n\n; Function prologue\npush {fp, lr}\nadd fp, sp, #4\n\n; Function epilogue\npop {fp, pc}    ; Return by popping PC\n```\n\n## Control Flow Patterns\n\n### Conditional Branches\n\n```asm\n; if (a == b)\ncmp eax, ebx\njne skip_block\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - signed\ncmp eax, ebx\njge skip_block    ; Jump if greater or equal\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - unsigned\ncmp eax, ebx\njae skip_block    ; Jump if above or equal\n; ... if body ...\nskip_block:\n```\n\n### Loop Patterns\n\n```asm\n; for (int i = 0; i \u003C n; i++)\nxor ecx, ecx           ; i = 0\nloop_start:\ncmp ecx, [n]           ; i \u003C n\njge loop_end\n; ... loop body ...\ninc ecx                ; i++\njmp loop_start\nloop_end:\n\n; while (condition)\njmp loop_check\nloop_body:\n; ... body ...\nloop_check:\ncmp eax, ebx\njl loop_body\n\n; do-while\nloop_body:\n; ... body ...\ncmp eax, ebx\njl loop_body\n```\n\n### Switch Statement Patterns\n\n```asm\n; Jump table pattern\nmov eax, [switch_var]\ncmp eax, max_case\nja default_case\njmp [jump_table + eax*8]\n\n; Sequential comparison (small switch)\ncmp eax, 1\nje case_1\ncmp eax, 2\nje case_2\ncmp eax, 3\nje case_3\njmp default_case\n```\n\n## Data Structure Patterns\n\n### Array Access\n\n```asm\n; array[i] - 4-byte elements\nmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index\n\n; array[i] - 8-byte elements\nmov rax, [rbx + rcx*8]\n\n; Multi-dimensional array[i][j]\n; arr[i][j] = base + (i * cols + j) * element_size\nimul eax, [cols]\nadd eax, [j]\nmov edx, [rbx + rax*4]\n```\n\n### Structure Access\n\n```c\nstruct Example {\n    int a;      \u002F\u002F offset 0\n    char b;     \u002F\u002F offset 4\n    \u002F\u002F padding  \u002F\u002F offset 5-7\n    long c;     \u002F\u002F offset 8\n    short d;    \u002F\u002F offset 16\n};\n```\n\n```asm\n; Accessing struct fields\nmov rdi, [struct_ptr]\nmov eax, [rdi]         ; s->a (offset 0)\nmovzx eax, byte [rdi+4] ; s->b (offset 4)\nmov rax, [rdi+8]       ; s->c (offset 8)\nmovzx eax, word [rdi+16] ; s->d (offset 16)\n```\n\n### Linked List Traversal\n\n```asm\n; while (node != NULL)\nlist_loop:\ntest rdi, rdi          ; node == NULL?\njz list_done\n; ... process node ...\nmov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)\njmp list_loop\nlist_done:\n```\n\n## Common Code Patterns\n\n### String Operations\n\n```asm\n; strlen pattern\nxor ecx, ecx\nstrlen_loop:\ncmp byte [rdi + rcx], 0\nje strlen_done\ninc ecx\njmp strlen_loop\nstrlen_done:\n; ecx contains length\n\n; strcpy pattern\nstrcpy_loop:\nmov al, [rsi]\nmov [rdi], al\ntest al, al\njz strcpy_done\ninc rsi\ninc rdi\njmp strcpy_loop\nstrcpy_done:\n\n; memcpy using rep movsb\nmov rdi, dest\nmov rsi, src\nmov rcx, count\nrep movsb\n```\n\n### Arithmetic Patterns\n\n```asm\n; Multiplication by constant\n; x * 3\nlea eax, [rax + rax*2]\n\n; x * 5\nlea eax, [rax + rax*4]\n\n; x * 10\nlea eax, [rax + rax*4]  ; x * 5\nadd eax, eax            ; * 2\n\n; Division by power of 2 (signed)\nmov eax, [x]\ncdq                     ; Sign extend to EDX:EAX\nand edx, 7              ; For divide by 8\nadd eax, edx            ; Adjust for negative\nsar eax, 3              ; Arithmetic shift right\n\n; Modulo power of 2\nand eax, 7              ; x % 8\n```\n\n### Bit Manipulation\n\n```asm\n; Test specific bit\ntest eax, 0x80          ; Test bit 7\njnz bit_set\n\n; Set bit\nor eax, 0x10            ; Set bit 4\n\n; Clear bit\nand eax, ~0x10          ; Clear bit 4\n\n; Toggle bit\nxor eax, 0x10           ; Toggle bit 4\n\n; Count leading zeros\nbsr eax, ecx            ; Bit scan reverse\nxor eax, 31             ; Convert to leading zeros\n\n; Population count (popcnt)\npopcnt eax, ecx         ; Count set bits\n```\n\n## Decompilation Patterns\n\n### Variable Recovery\n\n```asm\n; Local variable at rbp-8\nmov qword [rbp-8], rax  ; Store to local\nmov rax, [rbp-8]        ; Load from local\n\n; Stack-allocated array\nlea rax, [rbp-0x40]     ; Array starts at rbp-0x40\nmov [rax], edx          ; array[0] = value\nmov [rax+4], ecx        ; array[1] = value\n```\n\n### Function Signature Recovery\n\n```asm\n; Identify parameters by register usage\nfunc:\n    ; rdi used as first param (System V)\n    mov [rbp-8], rdi    ; Save param to local\n    ; rsi used as second param\n    mov [rbp-16], rsi\n    ; Identify return by RAX at end\n    mov rax, [result]\n    ret\n```\n\n### Type Recovery\n\n```asm\n; 1-byte operations suggest char\u002Fbool\nmovzx eax, byte [rdi]   ; Zero-extend byte\nmovsx eax, byte [rdi]   ; Sign-extend byte\n\n; 2-byte operations suggest short\nmovzx eax, word [rdi]\nmovsx eax, word [rdi]\n\n; 4-byte operations suggest int\u002Ffloat\nmov eax, [rdi]\nmovss xmm0, [rdi]       ; Float\n\n; 8-byte operations suggest long\u002Fdouble\u002Fpointer\nmov rax, [rdi]\nmovsd xmm0, [rdi]       ; Double\n```\n\n## Ghidra Analysis Tips\n\n### Improving Decompilation\n\n```java\n\u002F\u002F In Ghidra scripting\n\u002F\u002F Fix function signature\nFunction func = getFunctionAt(toAddr(0x401000));\nfunc.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);\n\n\u002F\u002F Create structure type\nStructureDataType struct = new StructureDataType(\"MyStruct\", 0);\nstruct.add(IntegerDataType.dataType, \"field_a\", null);\nstruct.add(PointerDataType.dataType, \"next\", null);\n\n\u002F\u002F Apply to memory\ncreateData(toAddr(0x601000), struct);\n```\n\n### Pattern Matching Scripts\n\n```python\n# Find all calls to dangerous functions\nfor func in currentProgram.getFunctionManager().getFunctions(True):\n    for ref in getReferencesTo(func.getEntryPoint()):\n        if func.getName() in [\"strcpy\", \"sprintf\", \"gets\"]:\n            print(f\"Dangerous call at {ref.getFromAddress()}\")\n```\n\n## IDA Pro Patterns\n\n### IDAPython Analysis\n\n```python\nimport idaapi\nimport idautils\nimport idc\n\n# Find all function calls\ndef find_calls(func_name):\n    for func_ea in idautils.Functions():\n        for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):\n            if idc.print_insn_mnem(head) == \"call\":\n                target = idc.get_operand_value(head, 0)\n                if idc.get_func_name(target) == func_name:\n                    print(f\"Call to {func_name} at {hex(head)}\")\n\n# Rename functions based on strings\ndef auto_rename():\n    for s in idautils.Strings():\n        for xref in idautils.XrefsTo(s.ea):\n            func = idaapi.get_func(xref.frm)\n            if func and \"sub_\" in idc.get_func_name(func.start_ea):\n                # Use string as hint for naming\n                pass\n```\n\n## Best Practices\n\n### Analysis Workflow\n\n1. **Initial triage**: File type, architecture, imports\u002Fexports\n2. **String analysis**: Identify interesting strings, error messages\n3. **Function identification**: Entry points, exports, cross-references\n4. **Control flow mapping**: Understand program structure\n5. **Data structure recovery**: Identify structs, arrays, globals\n6. **Algorithm identification**: Crypto, hashing, compression\n7. **Documentation**: Comments, renamed symbols, type definitions\n\n### Common Pitfalls\n\n- **Optimizer artifacts**: Code may not match source structure\n- **Inline functions**: Functions may be expanded inline\n- **Tail call optimization**: `jmp` instead of `call` + `ret`\n- **Dead code**: Unreachable code from optimization\n- **Position-independent code**: RIP-relative addressing\n","# Binary Analysis Patterns\n\nComprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\n\n## Use this skill when\n\n- Working on binary analysis patterns tasks or workflows\n- Needing guidance, best practices, or checklists for binary analysis patterns\n\n## Do not use this skill when\n\n- The task is unrelated to binary analysis patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Disassembly Fundamentals\n\n### x86-64 Instruction Patterns\n\n#### Function Prologue\u002FEpilogue\n```asm\n; Standard prologue\npush rbp           ; Save base pointer\nmov rbp, rsp       ; Set up stack frame\nsub rsp, 0x20      ; Allocate local variables\n\n; Leaf function (no calls)\n; May skip frame pointer setup\nsub rsp, 0x18      ; Just allocate locals\n\n; Standard epilogue\nmov rsp, rbp       ; Restore stack pointer\npop rbp            ; Restore base pointer\nret\n\n; Leave instruction (equivalent)\nleave              ; mov rsp, rbp; pop rbp\nret\n```\n\n#### Calling Conventions\n\n**System V AMD64 (Linux, macOS)**\n```asm\n; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack\n; Return: RAX (and RDX for 128-bit)\n; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11\n; Callee-saved: RBX, RBP, R12-R15\n\n; Example: func(a, b, c, d, e, f, g)\nmov rdi, [a]       ; 1st arg\nmov rsi, [b]       ; 2nd arg\nmov rdx, [c]       ; 3rd arg\nmov rcx, [d]       ; 4th arg\nmov r8, [e]        ; 5th arg\nmov r9, [f]        ; 6th arg\npush [g]           ; 7th arg on stack\ncall func\n```\n\n**Microsoft x64 (Windows)**\n```asm\n; Arguments: RCX, RDX, R8, R9, then stack\n; Shadow space: 32 bytes reserved on stack\n; Return: RAX\n\n; Example: func(a, b, c, d, e)\nsub rsp, 0x28      ; Shadow space + alignment\nmov rcx, [a]       ; 1st arg\nmov rdx, [b]       ; 2nd arg\nmov r8, [c]        ; 3rd arg\nmov r9, [d]        ; 4th arg\nmov [rsp+0x20], [e] ; 5th arg on stack\ncall func\nadd rsp, 0x28\n```\n\n### ARM Assembly Patterns\n\n#### ARM64 (AArch64) Calling Convention\n```asm\n; Arguments: X0-X7\n; Return: X0 (and X1 for 128-bit)\n; Frame pointer: X29\n; Link register: X30\n\n; Function prologue\nstp x29, x30, [sp, #-16]!  ; Save FP and LR\nmov x29, sp                 ; Set frame pointer\n\n; Function epilogue\nldp x29, x30, [sp], #16    ; Restore FP and LR\nret\n```\n\n#### ARM32 Calling Convention\n```asm\n; Arguments: R0-R3, then stack\n; Return: R0 (and R1 for 64-bit)\n; Link register: LR (R14)\n\n; Function prologue\npush {fp, lr}\nadd fp, sp, #4\n\n; Function epilogue\npop {fp, pc}    ; Return by popping PC\n```\n\n## Control Flow Patterns\n\n### Conditional Branches\n\n```asm\n; if (a == b)\ncmp eax, ebx\njne skip_block\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - signed\ncmp eax, ebx\njge skip_block    ; Jump if greater or equal\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - unsigned\ncmp eax, ebx\njae skip_block    ; Jump if above or equal\n; ... if body ...\nskip_block:\n```\n\n### Loop Patterns\n\n```asm\n; for (int i = 0; i \u003C n; i++)\nxor ecx, ecx           ; i = 0\nloop_start:\ncmp ecx, [n]           ; i \u003C n\njge loop_end\n; ... loop body ...\ninc ecx                ; i++\njmp loop_start\nloop_end:\n\n; while (condition)\njmp loop_check\nloop_body:\n; ... body ...\nloop_check:\ncmp eax, ebx\njl loop_body\n\n; do-while\nloop_body:\n; ... body ...\ncmp eax, ebx\njl loop_body\n```\n\n### Switch Statement Patterns\n\n```asm\n; Jump table pattern\nmov eax, [switch_var]\ncmp eax, max_case\nja default_case\njmp [jump_table + eax*8]\n\n; Sequential comparison (small switch)\ncmp eax, 1\nje case_1\ncmp eax, 2\nje case_2\ncmp eax, 3\nje case_3\njmp default_case\n```\n\n## Data Structure Patterns\n\n### Array Access\n\n```asm\n; array[i] - 4-byte elements\nmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index\n\n; array[i] - 8-byte elements\nmov rax, [rbx + rcx*8]\n\n; Multi-dimensional array[i][j]\n; arr[i][j] = base + (i * cols + j) * element_size\nimul eax, [cols]\nadd eax, [j]\nmov edx, [rbx + rax*4]\n```\n\n### Structure Access\n\n```c\nstruct Example {\n    int a;      \u002F\u002F offset 0\n    char b;     \u002F\u002F offset 4\n    \u002F\u002F padding  \u002F\u002F offset 5-7\n    long c;     \u002F\u002F offset 8\n    short d;    \u002F\u002F offset 16\n};\n```\n\n```asm\n; Accessing struct fields\nmov rdi, [struct_ptr]\nmov eax, [rdi]         ; s->a (offset 0)\nmovzx eax, byte [rdi+4] ; s->b (offset 4)\nmov rax, [rdi+8]       ; s->c (offset 8)\nmovzx eax, word [rdi+16] ; s->d (offset 16)\n```\n\n### Linked List Traversal\n\n```asm\n; while (node != NULL)\nlist_loop:\ntest rdi, rdi          ; node == NULL?\njz list_done\n; ... process node ...\nmov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)\njmp list_loop\nlist_done:\n```\n\n## Common Code Patterns\n\n### String Operations\n\n```asm\n; strlen pattern\nxor ecx, ecx\nstrlen_loop:\ncmp byte [rdi + rcx], 0\nje strlen_done\ninc ecx\njmp strlen_loop\nstrlen_done:\n; ecx contains length\n\n; strcpy pattern\nstrcpy_loop:\nmov al, [rsi]\nmov [rdi], al\ntest al, al\njz strcpy_done\ninc rsi\ninc rdi\njmp strcpy_loop\nstrcpy_done:\n\n; memcpy using rep movsb\nmov rdi, dest\nmov rsi, src\nmov rcx, count\nrep movsb\n```\n\n### Arithmetic Patterns\n\n```asm\n; Multiplication by constant\n; x * 3\nlea eax, [rax + rax*2]\n\n; x * 5\nlea eax, [rax + rax*4]\n\n; x * 10\nlea eax, [rax + rax*4]  ; x * 5\nadd eax, eax            ; * 2\n\n; Division by power of 2 (signed)\nmov eax, [x]\ncdq                     ; Sign extend to EDX:EAX\nand edx, 7              ; For divide by 8\nadd eax, edx            ; Adjust for negative\nsar eax, 3              ; Arithmetic shift right\n\n; Modulo power of 2\nand eax, 7              ; x % 8\n```\n\n### Bit Manipulation\n\n```asm\n; Test specific bit\ntest eax, 0x80          ; Test bit 7\njnz bit_set\n\n; Set bit\nor eax, 0x10            ; Set bit 4\n\n; Clear bit\nand eax, ~0x10          ; Clear bit 4\n\n; Toggle bit\nxor eax, 0x10           ; Toggle bit 4\n\n; Count leading zeros\nbsr eax, ecx            ; Bit scan reverse\nxor eax, 31             ; Convert to leading zeros\n\n; Population count (popcnt)\npopcnt eax, ecx         ; Count set bits\n```\n\n## Decompilation Patterns\n\n### Variable Recovery\n\n```asm\n; Local variable at rbp-8\nmov qword [rbp-8], rax  ; Store to local\nmov rax, [rbp-8]        ; Load from local\n\n; Stack-allocated array\nlea rax, [rbp-0x40]     ; Array starts at rbp-0x40\nmov [rax], edx          ; array[0] = value\nmov [rax+4], ecx        ; array[1] = value\n```\n\n### Function Signature Recovery\n\n```asm\n; Identify parameters by register usage\nfunc:\n    ; rdi used as first param (System V)\n    mov [rbp-8], rdi    ; Save param to local\n    ; rsi used as second param\n    mov [rbp-16], rsi\n    ; Identify return by RAX at end\n    mov rax, [result]\n    ret\n```\n\n### Type Recovery\n\n```asm\n; 1-byte operations suggest char\u002Fbool\nmovzx eax, byte [rdi]   ; Zero-extend byte\nmovsx eax, byte [rdi]   ; Sign-extend byte\n\n; 2-byte operations suggest short\nmovzx eax, word [rdi]\nmovsx eax, word [rdi]\n\n; 4-byte operations suggest int\u002Ffloat\nmov eax, [rdi]\nmovss xmm0, [rdi]       ; Float\n\n; 8-byte operations suggest long\u002Fdouble\u002Fpointer\nmov rax, [rdi]\nmovsd xmm0, [rdi]       ; Double\n```\n\n## Ghidra Analysis Tips\n\n### Improving Decompilation\n\n```java\n\u002F\u002F In Ghidra scripting\n\u002F\u002F Fix function signature\nFunction func = getFunctionAt(toAddr(0x401000));\nfunc.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);\n\n\u002F\u002F Create structure type\nStructureDataType struct = new StructureDataType(\"MyStruct\", 0);\nstruct.add(IntegerDataType.dataType, \"field_a\", null);\nstruct.add(PointerDataType.dataType, \"next\", null);\n\n\u002F\u002F Apply to memory\ncreateData(toAddr(0x601000), struct);\n```\n\n### Pattern Matching Scripts\n\n```python\n# Find all calls to dangerous functions\nfor func in currentProgram.getFunctionManager().getFunctions(True):\n    for ref in getReferencesTo(func.getEntryPoint()):\n        if func.getName() in [\"strcpy\", \"sprintf\", \"gets\"]:\n            print(f\"Dangerous call at {ref.getFromAddress()}\")\n```\n\n## IDA Pro Patterns\n\n### IDAPython Analysis\n\n```python\nimport idaapi\nimport idautils\nimport idc\n\n# Find all function calls\ndef find_calls(func_name):\n    for func_ea in idautils.Functions():\n        for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):\n            if idc.print_insn_mnem(head) == \"call\":\n                target = idc.get_operand_value(head, 0)\n                if idc.get_func_name(target) == func_name:\n                    print(f\"Call to {func_name} at {hex(head)}\")\n\n# Rename functions based on strings\ndef auto_rename():\n    for s in idautils.Strings():\n        for xref in idautils.XrefsTo(s.ea):\n            func = idaapi.get_func(xref.frm)\n            if func and \"sub_\" in idc.get_func_name(func.start_ea):\n                # Use string as hint for naming\n                pass\n```\n\n## Best Practices\n\n### Analysis Workflow\n\n1. **Initial triage**: File type, architecture, imports\u002Fexports\n2. **String analysis**: Identify interesting strings, error messages\n3. **Function identification**: Entry points, exports, cross-references\n4. **Control flow mapping**: Understand program structure\n5. **Data structure recovery**: Identify structs, arrays, globals\n6. **Algorithm identification**: Crypto, hashing, compression\n7. **Documentation**: Comments, renamed symbols, type definitions\n\n### Common Pitfalls\n\n- **Optimizer artifacts**: Code may not match source structure\n- **Inline functions**: Functions may be expanded inline\n- **Tail call optimization**: `jmp` instead of `call` + `ret`\n- **Dead code**: Unreachable code from optimization\n- **Position-independent code**: RIP-relative addressing\n",{"name":5,"risk":32,"source":26,"date_added":33,"description":7},"unknown","2026-02-27","main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fbinary-analysis-patterns",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill binary-analysis-patterns",{"tool":48,"command":49},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill binary-analysis-patterns",{"tool":51,"command":52},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill binary-analysis-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fbinary-analysis-patterns\u002FSKILL.md",true,[56],{"path":57,"resourceType":58,"resourceTypeDesc":59,"sizeBytes":60,"sourceHtmlUrl":61},"evals\u002Ftriggers.json","REFERENCE","参考文档",1332,"https:\u002F\u002Fgithub.com\u002Fevent4u-app\u002Fagent-config\u002Fblob\u002Fmain\u002Fsrc\u002Fskills\u002Fforensics-report\u002Fevals\u002Ftriggers.json",[63,76,91,118,137,164],{"skillNo":64,"name":65,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":66,"categories":67,"keywords":73,"publishedAt":27},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[68],{"categoryNo":69,"categoryName":70,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[74,75],"Test Skill","test",{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":27},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[83,84,85,86,87,88,22,26,89,90],"zustand store ts","zustand","store","with","types","middleware","create","typescript",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":100,"publishedAt":27},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[97],{"categoryNo":98,"categoryName":99,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000023","Skill与智能体开发",[101,102,103,104,105,106,107,108,109,110,111,112,113,114,26,115,116,117],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","critical","creation","webinars","composio","recordings","management","tracking",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":125,"publishedAt":27},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[124],{"categoryNo":98,"categoryName":99,"taxonomyType":71,"taxonomyTypeDesc":72},[126,101,127,128,129,130,131,26,106,132,114,133,111,110,105,134,89,135,107,136],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":146,"publishedAt":27},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[143],{"categoryNo":144,"categoryName":145,"taxonomyType":71,"taxonomyTypeDesc":72},"01JBSEEDCAT000000000000009","前端开发",[147,148,149,150,151,90,152,153,154,155,156,157,86,158,159,160,161,26,162,163],"expert","zod","zod validation expert","validation","react","safe","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":171,"publishedAt":27},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[170],{"categoryNo":98,"categoryName":99,"taxonomyType":71,"taxonomyTypeDesc":72},[172,173,174,175,176,177,178,179,26,25,180,181,182,19,183,184,185,23,186,107],"zeroize audit","audit","write","passwords","get","project","c++","activate","read","Bash","secrets","data","flow","verification","rust"]