[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EHTFK891PZDZ3093SPANTX":3,"skill-same:01M6EHTFK891PZDZ3093SPANTX":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":54,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6EHTFK891PZDZ3093SPANTX","binary-re",null,"This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on \"binary\", \"executable\", \"ELF\", \"what does this do\", \"reverse engineer\", \"disassemble\", \"decompile\", \"pyc file\", \"python bytecode\", \"analyze binary\", \"figure out\", \"marshal\". Routes to sub-skills for triage, static analysis, dynamic analysis, synthesis, or tool setup.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002F2389-research\u002Fbinary-re\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"binary re","binary","analyze","understand","dynamic analysis","triggers","reverse engineer","do","engineer","work","python","tool","how","analysis","analyzing","ELF","file","setup","triage","static analysis","2026-11-10 10:12:30",false,"---\nname: binary-re\ndescription: This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on \"binary\", \"executable\", \"ELF\", \"what does this do\", \"reverse engineer\", \"disassemble\", \"decompile\", \"pyc file\", \"python bytecode\", \"analyze binary\", \"figure out\", \"marshal\". Routes to sub-skills for triage, static analysis, dynamic analysis, synthesis, or tool setup.\n---\n\n# Binary Reverse Engineering\n\n## Purpose\n\nComprehensive guide for binary reverse engineering. This skill provides the overall methodology, philosophy, and reference material. Related skills handle specific phases:\n\n## Related Skills\n\n| Skill | Purpose | Trigger Keywords |\n|-------|---------|------------------|\n| `binary-re:triage` | Fast fingerprinting | \"what is this binary\", \"identify\", \"file type\" |\n| `binary-re:static-analysis` | r2 + Ghidra analysis | \"disassemble\", \"decompile\", \"functions\" |\n| `binary-re:dynamic-analysis` | QEMU + GDB + Frida | \"run\", \"execute\", \"debug\", \"trace\" |\n| `binary-re:synthesis` | Report generation | \"summarize\", \"report\", \"document findings\" |\n| `binary-re:tool-setup` | Install tools | \"install\", \"setup\", \"tool not found\" |\n\n**Note:** Each skill auto-detects based on keywords. You don't need to explicitly route - just ask what you need.\n\n## Pre-Flight Verification\n\n**Before beginning any analysis, verify tooling availability:**\n\n### Core Tools (Required)\n```bash\nrabin2 -v  # Should show version\nr2 -v      # Should show version\n```\n\n### Decompilation (Optional)\n```bash\n# Check r2ghidra availability\nr2 -qc 'pdg?' - 2>\u002Fdev\u002Fnull | grep -q Usage && echo \"r2ghidra OK\" || echo \"r2ghidra missing - install with: r2pm -ci r2ghidra\"\n```\n\n### Dynamic Analysis Platform Check\n| Host Platform | Method | Setup Required |\n|---------------|--------|----------------|\n| Linux x86_64 | Native QEMU | `apt install qemu-user` |\n| macOS (any) | Docker + binfmt | See `binary-re-tool-setup` skill |\n| Windows | WSL2 | Use Linux method inside WSL |\n\n**If dynamic tools unavailable:** Proceed with static-only analysis, note reduced confidence in synthesis phase.\n\n### Fallback Tooling (No r2\u002FGhidra)\n\nWhen radare2 or Ghidra aren't available, use standard binutils\u002FLLVM tools:\n\n```bash\n# Metadata (replaces rabin2 -I)\nreadelf -h binary              # ELF header\nreadelf -d binary              # Dynamic section (dependencies)\nfile binary                    # Quick identification\n\n# Imports\u002FExports (replaces rabin2 -i\u002F-E)\nreadelf -Ws binary | grep -E \"FUNC|OBJECT\" | awk '{print $8}'\nnm -D binary 2>\u002Fdev\u002Fnull       # Dynamic symbols\n\n# Strings (replaces rabin2 -zz)\nstrings -a -n 8 binary | grep -Ei 'http|ftp|\u002Fetc|\u002Fvar|error|pass|key|token|api'\n\n# Disassembly (replaces r2 pdf)\nobjdump -d -M intel binary | head -500\n# Or LLVM (better cross-arch support):\nllvm-objdump -d --no-show-raw-insn binary | head -500\n\n# Dependencies (replaces rabin2 -l)\nldd binary 2>\u002Fdev\u002Fnull || readelf -d binary | grep NEEDED\n```\n\n**Limitations of fallback approach:**\n- No cross-references (axt\u002Faxf) - must trace manually\n- No decompilation - assembly only\n- No function boundary detection - raw disassembly\n- Reduced accuracy for stripped binaries\n\n---\n\n## Philosophy\n\n**The LLM drives analysis; the human provides context.**\n\nHuman provides:\n- Platform info (device type, OS, hardware)\n- Suspected purpose (what the binary might do)\n- Constraints (no network, isolated env, etc.)\n\nLLM executes:\n- Tool selection and invocation\n- Hypothesis formation from evidence\n- Experiment design\n- Knowledge synthesis\n\n## The Agentic Loop\n\n```\n┌─────────────────────────────────────────────────┐\n│           HYPOTHESIS-DRIVEN ANALYSIS            │\n├─────────────────────────────────────────────────┤\n│                                                 │\n│  0. I\u002FO SANITY → Compare known inputs\u002Foutputs   │\n│  1. OBSERVE → Gather facts via tools            │\n│  2. HYPOTHESIZE → Form theories from facts      │\n│  3. PLAN → Design experiments to test theories  │\n│  4. EXECUTE → Run tools (gate risky ops)        │\n│  5. RECORD → Capture observations               │\n│  6. UPDATE → Confirm\u002Frefute hypotheses          │\n│  7. LOOP → Until understanding sufficient       │\n│                                                 │\n└─────────────────────────────────────────────────┘\n```\n\n### Step 0: Compare Known I\u002FO First (CRITICAL)\n\n**Before diving into code analysis, always check if known inputs\u002Foutputs exist.**\n\nThis step prevents hours of wasted analysis by establishing ground truth first.\n\n⚠️ **REQUIRES HUMAN APPROVAL** - Even for I\u002FO comparison, get explicit approval before execution.\n\n```bash\n# SAFE: Use emulation for cross-arch binaries (after human approval)\n# ARM32 example:\nqemu-arm -L \u002Fusr\u002Farm-linux-gnueabihf -- .\u002Fbinary input.txt > actual_output.txt\n\n# x86-64 native (still requires approval):\n.\u002Fbinary input.txt > actual_output.txt\n\n# Docker-based (macOS - safest option):\ndocker run --rm --platform linux\u002Farm\u002Fv7 -v ~\u002Fsamples:\u002Fwork:ro \\\n  arm32v7\u002Fdebian:bullseye-slim \u002Fwork\u002Fbinary \u002Fwork\u002Finput.txt > actual_output.txt\n\n# Compare outputs:\ndiff expected_output.txt actual_output.txt\ncmp -l expected_output.txt actual_output.txt | head -20  # Byte-level\n\n# Document the delta:\n# - Where does output first diverge?\n# - What pattern appears in the corruption?\n# - Does file size match (logic bug) or differ (truncation)?\n```\n\n**Record as FACT:**\n```\nFACT: Output differs at byte {N}, expected \"{X}\" got \"{Y}\" (source: diff\u002Fcmp)\nFACT: File sizes match\u002Fdiffer by {N} bytes (source: ls -l)\n```\n\nThis single step often reveals the bug category before any disassembly.\n\n## Knowledge Model\n\nThroughout analysis, maintain structured knowledge via **episodic memory**:\n\n```\nFACTS: Verified observations with tool attribution\nHYPOTHESES: Theories with confidence and evidence\nQUESTIONS: Open unknowns blocking progress\nEXPERIMENTS: Planned tool invocations\nOBSERVATIONS: Results from experiments\nDECISIONS: Human-approved choices with rationale\n```\n\n### Episodic Memory Integration\n\nKnowledge persists across sessions via episodic memory. Use consistent tagging:\n\n```\n[BINARY-RE:{phase}] {artifact_name} (sha256: {hash})\nFACT: {observation} (source: {tool})\nHYPOTHESIS: {theory} (confidence: {0.0-1.0})\nQUESTION: {unknown}\nDECISION: {choice} (rationale: {why})\n```\n\n**Starting analysis:** Search episodic memory for artifact hash first\n**After each phase:** Findings are automatically captured in conversation\n**Resuming:** Search `[BINARY-RE] {artifact_name}` to restore context\n\n## Human-in-the-Loop Triggers\n\n**ALWAYS ask human before:**\n\n1. **Executing the binary** - Even under QEMU, confirm sandbox\n2. **Network operations** - Prevent unintended phone-home\n3. **Conflicting evidence** - Resolve contradictory findings\n4. **Privileged operations** - Device access, root actions\n5. **Major direction changes** - Significant analysis pivots\n\n## Session Management\n\n### Starting New Analysis\n\n```\n1. Compute artifact hash: sha256sum binary\n2. Search episodic memory: \"[BINARY-RE] sha256:{hash}\"\n3. If previous analysis found:\n   → \"Found previous analysis from {date}. Resume or start fresh?\"\n4. If resuming: Load facts\u002Fhypotheses, continue from last phase\n5. If fresh: Begin with triage phase\n```\n\n### Resuming Interrupted Analysis\n\n```\nUser: \"Continue analyzing that thermostat binary\"\n\nClaude:\n1. Invoke episodic-memory:search-conversations\n   Query: \"[BINARY-RE] thermostat\"\n2. Retrieve previous session findings\n3. Summarize: \"Last session identified ARM32\u002Fmusl, found network\n   functions. We were about to run dynamic analysis.\"\n4. Continue from that phase\n```\n\n### Searching Past Analyses\n\n```\nUser: \"Have we analyzed any ARM binaries with hardcoded passwords?\"\n\nClaude:\n1. Search: \"[BINARY-RE] FACT: hardcoded\" or \"[BINARY-RE] ARM\"\n2. Return matching artifacts and findings\n```\n\n## Standard Analysis Flow\n\nFor typical unknown binary analysis:\n\n```\n1. Triage (binary-re-triage)\n   └─ Architecture, ABI, dependencies, capabilities\n\n2. Static Analysis (binary-re-static-analysis)\n   └─ Functions, strings, xrefs, decompilation\n\n3. Dynamic Analysis (binary-re-dynamic-analysis) - if safe\n   └─ Syscalls, network, file access\n\n4. Synthesis (binary-re-synthesis)\n   └─ Structured report with evidence\n```\n\n## Quick Reference\n\n### Essential Commands\n\n```bash\n# Fast triage\nrabin2 -I binary              # Metadata\nrabin2 -l binary              # Dependencies\nrabin2 -zz binary             # Strings\n\n# Static analysis\nr2 -q -c 'aa; aflj' binary    # Functions\nr2 -q -c 'izj' binary         # Strings\n\n# Dynamic (ARM example)\nqemu-arm -L \u002Fusr\u002Farm-linux-gnueabihf -strace .\u002Fbinary\n```\n\n### Architecture Detection\n\n| Indicator | Architecture | QEMU Binary | Ghidra Processor |\n|-----------|--------------|-------------|------------------|\n| `e_machine=EM_386 (3)` | x86 32-bit | `qemu-i386` or Docker `--platform linux\u002Fi386` | `x86:LE:32:default` |\n| `e_machine=EM_ARM (40)` | ARM 32-bit | `qemu-arm` or Docker `--platform linux\u002Farm\u002Fv7` | `ARM:LE:32:v7` |\n| `e_machine=EM_AARCH64 (183)` | ARM 64-bit | `qemu-aarch64` or Docker `--platform linux\u002Farm64` | `AARCH64:LE:64:v8A` |\n| `e_machine=EM_X86_64 (62)` | x86-64 | Native or Docker `--platform linux\u002Famd64` | `x86:LE:64:default` |\n| `e_machine=EM_MIPS (8)` | MIPS 32 LE | `qemu-mipsel` | `MIPS:LE:32:default` |\n| `e_machine=EM_MIPS (8)` BE | MIPS 32 BE | `qemu-mips` | `MIPS:BE:32:default` |\n| `e_machine=EM_RISCV (243)` | RISC-V 64 | `qemu-riscv64` | `RISCV:LE:64:RV64I` |\n| `e_machine=EM_RISCV (243)` 32 | RISC-V 32 | `qemu-riscv32` | `RISCV:LE:32:RV32I` |\n\n### Libc Detection\n\n| Interpreter | Libc |\n|-------------|------|\n| `ld-linux-armhf.so.3` | glibc (ARM hard-float) |\n| `ld-musl-arm.so.1` | musl |\n| `ld-uClibc.so.0` | uClibc |\n\n## Error Recovery\n\n| Situation | Action |\n|-----------|--------|\n| Tool not found | Use `binary-re-tool-setup` skill |\n| Wrong architecture | Re-run triage, verify file output |\n| QEMU fails | Try Qiling, Unicorn, or on-device |\n| Analysis timeout | Reduce scope, use `aa` not `aaa` |\n| Conflicting evidence | Ask human, document both interpretations |\n\n## Documentation\n\nSee companion docs:\n- `docs\u002Fr2-commands.md` - Complete r2 reference for LLMs\n- `docs\u002Fghidra-headless.md` - Ghidra scripting guide\n- `docs\u002Farch-adapters.md` - Per-architecture quirks\n- `docs\u002Fpython-bytecode-re.md` - Python .pyc\u002Fmarshal obfuscation patterns\n\n## Integration\n\nWorks with other plugins:\n- **remote-system-maintenance**: Extract binaries from devices via SSH\n- **fresh-eyes-review**: Validate conclusions before documenting\n- **scenario-testing**: Create reproducible analysis environments\n","# Binary Reverse Engineering\n\n## Purpose\n\nComprehensive guide for binary reverse engineering. This skill provides the overall methodology, philosophy, and reference material. Related skills handle specific phases:\n\n## Related Skills\n\n| Skill | Purpose | Trigger Keywords |\n|-------|---------|------------------|\n| `binary-re:triage` | Fast fingerprinting | \"what is this binary\", \"identify\", \"file type\" |\n| `binary-re:static-analysis` | r2 + Ghidra analysis | \"disassemble\", \"decompile\", \"functions\" |\n| `binary-re:dynamic-analysis` | QEMU + GDB + Frida | \"run\", \"execute\", \"debug\", \"trace\" |\n| `binary-re:synthesis` | Report generation | \"summarize\", \"report\", \"document findings\" |\n| `binary-re:tool-setup` | Install tools | \"install\", \"setup\", \"tool not found\" |\n\n**Note:** Each skill auto-detects based on keywords. You don't need to explicitly route - just ask what you need.\n\n## Pre-Flight Verification\n\n**Before beginning any analysis, verify tooling availability:**\n\n### Core Tools (Required)\n```bash\nrabin2 -v  # Should show version\nr2 -v      # Should show version\n```\n\n### Decompilation (Optional)\n```bash\n# Check r2ghidra availability\nr2 -qc 'pdg?' - 2>\u002Fdev\u002Fnull | grep -q Usage && echo \"r2ghidra OK\" || echo \"r2ghidra missing - install with: r2pm -ci r2ghidra\"\n```\n\n### Dynamic Analysis Platform Check\n| Host Platform | Method | Setup Required |\n|---------------|--------|----------------|\n| Linux x86_64 | Native QEMU | `apt install qemu-user` |\n| macOS (any) | Docker + binfmt | See `binary-re-tool-setup` skill |\n| Windows | WSL2 | Use Linux method inside WSL |\n\n**If dynamic tools unavailable:** Proceed with static-only analysis, note reduced confidence in synthesis phase.\n\n### Fallback Tooling (No r2\u002FGhidra)\n\nWhen radare2 or Ghidra aren't available, use standard binutils\u002FLLVM tools:\n\n```bash\n# Metadata (replaces rabin2 -I)\nreadelf -h binary              # ELF header\nreadelf -d binary              # Dynamic section (dependencies)\nfile binary                    # Quick identification\n\n# Imports\u002FExports (replaces rabin2 -i\u002F-E)\nreadelf -Ws binary | grep -E \"FUNC|OBJECT\" | awk '{print $8}'\nnm -D binary 2>\u002Fdev\u002Fnull       # Dynamic symbols\n\n# Strings (replaces rabin2 -zz)\nstrings -a -n 8 binary | grep -Ei 'http|ftp|\u002Fetc|\u002Fvar|error|pass|key|token|api'\n\n# Disassembly (replaces r2 pdf)\nobjdump -d -M intel binary | head -500\n# Or LLVM (better cross-arch support):\nllvm-objdump -d --no-show-raw-insn binary | head -500\n\n# Dependencies (replaces rabin2 -l)\nldd binary 2>\u002Fdev\u002Fnull || readelf -d binary | grep NEEDED\n```\n\n**Limitations of fallback approach:**\n- No cross-references (axt\u002Faxf) - must trace manually\n- No decompilation - assembly only\n- No function boundary detection - raw disassembly\n- Reduced accuracy for stripped binaries\n\n---\n\n## Philosophy\n\n**The LLM drives analysis; the human provides context.**\n\nHuman provides:\n- Platform info (device type, OS, hardware)\n- Suspected purpose (what the binary might do)\n- Constraints (no network, isolated env, etc.)\n\nLLM executes:\n- Tool selection and invocation\n- Hypothesis formation from evidence\n- Experiment design\n- Knowledge synthesis\n\n## The Agentic Loop\n\n```\n┌─────────────────────────────────────────────────┐\n│           HYPOTHESIS-DRIVEN ANALYSIS            │\n├─────────────────────────────────────────────────┤\n│                                                 │\n│  0. I\u002FO SANITY → Compare known inputs\u002Foutputs   │\n│  1. OBSERVE → Gather facts via tools            │\n│  2. HYPOTHESIZE → Form theories from facts      │\n│  3. PLAN → Design experiments to test theories  │\n│  4. EXECUTE → Run tools (gate risky ops)        │\n│  5. RECORD → Capture observations               │\n│  6. UPDATE → Confirm\u002Frefute hypotheses          │\n│  7. LOOP → Until understanding sufficient       │\n│                                                 │\n└─────────────────────────────────────────────────┘\n```\n\n### Step 0: Compare Known I\u002FO First (CRITICAL)\n\n**Before diving into code analysis, always check if known inputs\u002Foutputs exist.**\n\nThis step prevents hours of wasted analysis by establishing ground truth first.\n\n⚠️ **REQUIRES HUMAN APPROVAL** - Even for I\u002FO comparison, get explicit approval before execution.\n\n```bash\n# SAFE: Use emulation for cross-arch binaries (after human approval)\n# ARM32 example:\nqemu-arm -L \u002Fusr\u002Farm-linux-gnueabihf -- .\u002Fbinary input.txt > actual_output.txt\n\n# x86-64 native (still requires approval):\n.\u002Fbinary input.txt > actual_output.txt\n\n# Docker-based (macOS - safest option):\ndocker run --rm --platform linux\u002Farm\u002Fv7 -v ~\u002Fsamples:\u002Fwork:ro \\\n  arm32v7\u002Fdebian:bullseye-slim \u002Fwork\u002Fbinary \u002Fwork\u002Finput.txt > actual_output.txt\n\n# Compare outputs:\ndiff expected_output.txt actual_output.txt\ncmp -l expected_output.txt actual_output.txt | head -20  # Byte-level\n\n# Document the delta:\n# - Where does output first diverge?\n# - What pattern appears in the corruption?\n# - Does file size match (logic bug) or differ (truncation)?\n```\n\n**Record as FACT:**\n```\nFACT: Output differs at byte {N}, expected \"{X}\" got \"{Y}\" (source: diff\u002Fcmp)\nFACT: File sizes match\u002Fdiffer by {N} bytes (source: ls -l)\n```\n\nThis single step often reveals the bug category before any disassembly.\n\n## Knowledge Model\n\nThroughout analysis, maintain structured knowledge via **episodic memory**:\n\n```\nFACTS: Verified observations with tool attribution\nHYPOTHESES: Theories with confidence and evidence\nQUESTIONS: Open unknowns blocking progress\nEXPERIMENTS: Planned tool invocations\nOBSERVATIONS: Results from experiments\nDECISIONS: Human-approved choices with rationale\n```\n\n### Episodic Memory Integration\n\nKnowledge persists across sessions via episodic memory. Use consistent tagging:\n\n```\n[BINARY-RE:{phase}] {artifact_name} (sha256: {hash})\nFACT: {observation} (source: {tool})\nHYPOTHESIS: {theory} (confidence: {0.0-1.0})\nQUESTION: {unknown}\nDECISION: {choice} (rationale: {why})\n```\n\n**Starting analysis:** Search episodic memory for artifact hash first\n**After each phase:** Findings are automatically captured in conversation\n**Resuming:** Search `[BINARY-RE] {artifact_name}` to restore context\n\n## Human-in-the-Loop Triggers\n\n**ALWAYS ask human before:**\n\n1. **Executing the binary** - Even under QEMU, confirm sandbox\n2. **Network operations** - Prevent unintended phone-home\n3. **Conflicting evidence** - Resolve contradictory findings\n4. **Privileged operations** - Device access, root actions\n5. **Major direction changes** - Significant analysis pivots\n\n## Session Management\n\n### Starting New Analysis\n\n```\n1. Compute artifact hash: sha256sum binary\n2. Search episodic memory: \"[BINARY-RE] sha256:{hash}\"\n3. If previous analysis found:\n   → \"Found previous analysis from {date}. Resume or start fresh?\"\n4. If resuming: Load facts\u002Fhypotheses, continue from last phase\n5. If fresh: Begin with triage phase\n```\n\n### Resuming Interrupted Analysis\n\n```\nUser: \"Continue analyzing that thermostat binary\"\n\nClaude:\n1. Invoke episodic-memory:search-conversations\n   Query: \"[BINARY-RE] thermostat\"\n2. Retrieve previous session findings\n3. Summarize: \"Last session identified ARM32\u002Fmusl, found network\n   functions. We were about to run dynamic analysis.\"\n4. Continue from that phase\n```\n\n### Searching Past Analyses\n\n```\nUser: \"Have we analyzed any ARM binaries with hardcoded passwords?\"\n\nClaude:\n1. Search: \"[BINARY-RE] FACT: hardcoded\" or \"[BINARY-RE] ARM\"\n2. Return matching artifacts and findings\n```\n\n## Standard Analysis Flow\n\nFor typical unknown binary analysis:\n\n```\n1. Triage (binary-re-triage)\n   └─ Architecture, ABI, dependencies, capabilities\n\n2. Static Analysis (binary-re-static-analysis)\n   └─ Functions, strings, xrefs, decompilation\n\n3. Dynamic Analysis (binary-re-dynamic-analysis) - if safe\n   └─ Syscalls, network, file access\n\n4. Synthesis (binary-re-synthesis)\n   └─ Structured report with evidence\n```\n\n## Quick Reference\n\n### Essential Commands\n\n```bash\n# Fast triage\nrabin2 -I binary              # Metadata\nrabin2 -l binary              # Dependencies\nrabin2 -zz binary             # Strings\n\n# Static analysis\nr2 -q -c 'aa; aflj' binary    # Functions\nr2 -q -c 'izj' binary         # Strings\n\n# Dynamic (ARM example)\nqemu-arm -L \u002Fusr\u002Farm-linux-gnueabihf -strace .\u002Fbinary\n```\n\n### Architecture Detection\n\n| Indicator | Architecture | QEMU Binary | Ghidra Processor |\n|-----------|--------------|-------------|------------------|\n| `e_machine=EM_386 (3)` | x86 32-bit | `qemu-i386` or Docker `--platform linux\u002Fi386` | `x86:LE:32:default` |\n| `e_machine=EM_ARM (40)` | ARM 32-bit | `qemu-arm` or Docker `--platform linux\u002Farm\u002Fv7` | `ARM:LE:32:v7` |\n| `e_machine=EM_AARCH64 (183)` | ARM 64-bit | `qemu-aarch64` or Docker `--platform linux\u002Farm64` | `AARCH64:LE:64:v8A` |\n| `e_machine=EM_X86_64 (62)` | x86-64 | Native or Docker `--platform linux\u002Famd64` | `x86:LE:64:default` |\n| `e_machine=EM_MIPS (8)` | MIPS 32 LE | `qemu-mipsel` | `MIPS:LE:32:default` |\n| `e_machine=EM_MIPS (8)` BE | MIPS 32 BE | `qemu-mips` | `MIPS:BE:32:default` |\n| `e_machine=EM_RISCV (243)` | RISC-V 64 | `qemu-riscv64` | `RISCV:LE:64:RV64I` |\n| `e_machine=EM_RISCV (243)` 32 | RISC-V 32 | `qemu-riscv32` | `RISCV:LE:32:RV32I` |\n\n### Libc Detection\n\n| Interpreter | Libc |\n|-------------|------|\n| `ld-linux-armhf.so.3` | glibc (ARM hard-float) |\n| `ld-musl-arm.so.1` | musl |\n| `ld-uClibc.so.0` | uClibc |\n\n## Error Recovery\n\n| Situation | Action |\n|-----------|--------|\n| Tool not found | Use `binary-re-tool-setup` skill |\n| Wrong architecture | Re-run triage, verify file output |\n| QEMU fails | Try Qiling, Unicorn, or on-device |\n| Analysis timeout | Reduce scope, use `aa` not `aaa` |\n| Conflicting evidence | Ask human, document both interpretations |\n\n## Documentation\n\nSee companion docs:\n- `docs\u002Fr2-commands.md` - Complete r2 reference for LLMs\n- `docs\u002Fghidra-headless.md` - Ghidra scripting guide\n- `docs\u002Farch-adapters.md` - Per-architecture quirks\n- `docs\u002Fpython-bytecode-re.md` - Python .pyc\u002Fmarshal obfuscation patterns\n\n## Integration\n\nWorks with other plugins:\n- **remote-system-maintenance**: Extract binaries from devices via SSH\n- **fresh-eyes-review**: Validate conclusions before documenting\n- **scenario-testing**: Create reproducible analysis environments\n",{"name":5,"description":7},"main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002F2389-research\u002Fbinary-re",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill binary-re",{"tool":64,"command":65},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill binary-re",{"tool":67,"command":68},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill binary-re","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002F2389-research\u002Fbinary-re\u002FSKILL.md",true,[72,78,84,88,94,97,100,104],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"codex\u002Fprompt.md","REFERENCE","参考文档",50,"https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fcodex\u002Fprompt.md",{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"docker\u002FDockerfile","OTHER","其他",28,"https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fdocker\u002FDockerfile",{"path":85,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":86,"sourceHtmlUrl":87},"docker\u002Frequirements.txt",35,"https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fdocker\u002Frequirements.txt",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"docker\u002Fwrappers\u002Fccx_safety_wrapper.py","SCRIPT","脚本",17,"https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fdocker\u002Fwrappers\u002Fccx_safety_wrapper.py",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":96},"docker\u002Fwrappers\u002Ffoam_cfd_reduce.py","https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fdocker\u002Fwrappers\u002Ffoam_cfd_reduce.py",{"path":98,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":99},"opencode\u002Fagent.md","https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Fopencode\u002Fagent.md",{"path":101,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":102,"sourceHtmlUrl":103},"skill-report.json",13851,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002F2389-research\u002Fbinary-re\u002Fskill-report.json",{"path":105,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":106,"sourceHtmlUrl":107},"tests\u002Ffab.bats",44,"https:\u002F\u002Fgithub.com\u002Fberlinguyinca\u002Fautospec\u002Fblob\u002Fmain\u002Fcrates\u002Fautospec-cli\u002Ftests\u002Ffixtures\u002Fvalidation-cutover\u002Fautospec-fab-contract\u002Fskills\u002Fautospec-fab\u002Ftests\u002Ffab.bats",[109,119,129,138,144,151],{"skillNo":110,"name":111,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":115,"publishedAt":44},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[114],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[116,117,118],"model","model hierarchy","model hierarchy skill",{"skillNo":120,"name":121,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":125,"publishedAt":44},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[124],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[126,127,128],"MCP","zoom","zoom mcp",{"skillNo":130,"name":131,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":132,"categories":133,"keywords":134,"publishedAt":44},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[135,136,137,127],"sdk","zoom apps sdk","apps",{"skillNo":139,"name":140,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":44},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","windows","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[140],{"skillNo":145,"name":146,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":147,"categories":148,"keywords":150,"publishedAt":44},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[149],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146],{"skillNo":152,"name":153,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":156,"publishedAt":44},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[153]]