AgentAlley

Skills · Security

Binary Analysis Patterns

Unverified●31/40

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.

Originally by wshobson · MIT

Claude Code◐PartialHas SKILL.md but declares no allowed-tools — Claude Code will ask for permission each time
Cursor◐PartialPlain prose you can paste in — but no Cursor rules file
Codex◐PartialPlain prose you can paste in — but no AGENTS.md
Gemini CLI◐PartialPlain prose you can paste in
Copilot◐PartialPlain prose you can paste in — but no Copilot instructions file
npx agentalley add binary-analysis-patterns

This command does not work yet — the CLI is still being built. Until then, use Raw in the reader below to take the file.

Who is stuck, and on what

Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.

The whole source

No sign-in, no blur, nothing truncated
binary-analysis-patterns/SKILL.md352 lines7.7 KBRawView on GitHub
Frontmatter — 2 properties
namebinary-analysis-patterns
descriptionMaster binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
1---
2name: binary-analysis-patterns
3description: Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
4---A5 — No allowed-tools declared — no way to tell what this skill may touch
5 
6# Binary Analysis Patterns
7 
8Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.
9 
10## When to Use This Skill
11 
12- Reverse-engineering an unknown executable to understand its behavior
13- Analyzing malware or obfuscated binaries with Ghidra / IDA Pro / Binary Ninja
14- Recognizing common assembly idioms (function prologues, switch tables, vtable dispatch)
15- Reconstructing high-level control flow from compiled code
16- Identifying compiler-introduced patterns (stack canaries, PIC trampolines)
17 
18## Detailed section: Disassembly Fundamentals
19 
20Originally a 2047-byte section in this SKILL.md. Moved to `references/details.md` to fit Codex's 8 KB skill body cap.
21 
22## Control Flow Patterns
23 
24### Conditional Branches
25 
26```asm
27; if (a == b)
28cmp eax, ebx
29jne skip_block
30; ... if body ...
31skip_block:
32 
33; if (a < b) - signed
34cmp eax, ebx
35jge skip_block ; Jump if greater or equal
36; ... if body ...
37skip_block:
38 
39; if (a < b) - unsigned
40cmp eax, ebx
41jae skip_block ; Jump if above or equal
42; ... if body ...
43skip_block:
44```
45 
46### Loop Patterns
47 
48```asm
49; for (int i = 0; i < n; i++)
50xor ecx, ecx ; i = 0
51loop_start:
52cmp ecx, [n] ; i < n
53jge loop_end
54; ... loop body ...
55inc ecx ; i++
56jmp loop_start
57loop_end:
58 
59; while (condition)
60jmp loop_check
61loop_body:
62; ... body ...
63loop_check:
64cmp eax, ebx
65jl loop_body
66 
67; do-while
68loop_body:
69; ... body ...
70cmp eax, ebx
71jl loop_body
72```
73 
74### Switch Statement Patterns
75 
76```asm
77; Jump table pattern
78mov eax, [switch_var]
79cmp eax, max_case
80ja default_case
81jmp [jump_table + eax*8]
82 
83; Sequential comparison (small switch)
84cmp eax, 1
85je case_1
86cmp eax, 2
87je case_2
88cmp eax, 3
89je case_3
90jmp default_case
91```
92 
93## Data Structure Patterns
94 
95### Array Access
96 
97```asm
98; array[i] - 4-byte elements
99mov eax, [rbx + rcx*4] ; rbx=base, rcx=index
100 
101; array[i] - 8-byte elements
102mov rax, [rbx + rcx*8]
103 
104; Multi-dimensional array[i][j]
105; arr[i][j] = base + (i * cols + j) * element_size
106imul eax, [cols]
107add eax, [j]
108mov edx, [rbx + rax*4]
109```
110 
111### Structure Access
112 
113```c
114struct Example {
115 int a; // offset 0
116 char b; // offset 4
117 // padding // offset 5-7
118 long c; // offset 8
119 short d; // offset 16
120};
121```
122 
123```asm
124; Accessing struct fields
125mov rdi, [struct_ptr]
126mov eax, [rdi] ; s->a (offset 0)
127movzx eax, byte [rdi+4] ; s->b (offset 4)
128mov rax, [rdi+8] ; s->c (offset 8)
129movzx eax, word [rdi+16] ; s->d (offset 16)
130```
131 
132### Linked List Traversal
133 
134```asm
135; while (node != NULL)
136list_loop:
137test rdi, rdi ; node == NULL?
138jz list_done
139; ... process node ...
140mov rdi, [rdi+8] ; node = node->next (assuming next at offset 8)
141jmp list_loop
142list_done:
143```
144 
145## Common Code Patterns
146 
147### String Operations
148 
149```asm
150; strlen pattern
151xor ecx, ecx
152strlen_loop:
153cmp byte [rdi + rcx], 0
154je strlen_done
155inc ecx
156jmp strlen_loop
157strlen_done:
158; ecx contains length
159 
160; strcpy pattern
161strcpy_loop:
162mov al, [rsi]
163mov [rdi], al
164test al, al
165jz strcpy_done
166inc rsi
167inc rdi
168jmp strcpy_loop
169strcpy_done:
170 
171; memcpy using rep movsb
172mov rdi, dest
173mov rsi, src
174mov rcx, count
175rep movsb
176```
177 
178### Arithmetic Patterns
179 
180```asm
181; Multiplication by constant
182; x * 3
183lea eax, [rax + rax*2]
184 
185; x * 5
186lea eax, [rax + rax*4]
187 
188; x * 10
189lea eax, [rax + rax*4] ; x * 5
190add eax, eax ; * 2
191 
192; Division by power of 2 (signed)
193mov eax, [x]
194cdq ; Sign extend to EDX:EAX
195and edx, 7 ; For divide by 8
196add eax, edx ; Adjust for negative
197sar eax, 3 ; Arithmetic shift right
198 
199; Modulo power of 2
200and eax, 7 ; x % 8
201```
202 
203### Bit Manipulation
204 
205```asm
206; Test specific bit
207test eax, 0x80 ; Test bit 7
208jnz bit_set
209 
210; Set bit
211or eax, 0x10 ; Set bit 4
212 
213; Clear bit
214and eax, ~0x10 ; Clear bit 4
215 
216; Toggle bit
217xor eax, 0x10 ; Toggle bit 4
218 
219; Count leading zeros
220bsr eax, ecx ; Bit scan reverse
221xor eax, 31 ; Convert to leading zeros
222 
223; Population count (popcnt)
224popcnt eax, ecx ; Count set bits
225```
226 
227## Decompilation Patterns
228 
229### Variable Recovery
230 
231```asm
232; Local variable at rbp-8
233mov qword [rbp-8], rax ; Store to local
234mov rax, [rbp-8] ; Load from local
235 
236; Stack-allocated array
237lea rax, [rbp-0x40] ; Array starts at rbp-0x40
238mov [rax], edx ; array[0] = value
239mov [rax+4], ecx ; array[1] = value
240```
241 
242### Function Signature Recovery
243 
244```asm
245; Identify parameters by register usage
246func:
247 ; rdi used as first param (System V)
248 mov [rbp-8], rdi ; Save param to local
249 ; rsi used as second param
250 mov [rbp-16], rsi
251 ; Identify return by RAX at end
252 mov rax, [result]
253 ret
254```
255 
256### Type Recovery
257 
258```asm
259; 1-byte operations suggest char/bool
260movzx eax, byte [rdi] ; Zero-extend byte
261movsx eax, byte [rdi] ; Sign-extend byte
262 
263; 2-byte operations suggest short
264movzx eax, word [rdi]
265movsx eax, word [rdi]
266 
267; 4-byte operations suggest int/float
268mov eax, [rdi]
269movss xmm0, [rdi] ; Float
270 
271; 8-byte operations suggest long/double/pointer
272mov rax, [rdi]
273movsd xmm0, [rdi] ; Double
274```
275 
276## Ghidra Analysis Tips
277 
278### Improving Decompilation
279 
280```java
281// In Ghidra scripting
282// Fix function signature
283Function func = getFunctionAt(toAddr(0x401000));
284func.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);
285 
286// Create structure type
287StructureDataType struct = new StructureDataType("MyStruct", 0);
288struct.add(IntegerDataType.dataType, "field_a", null);
289struct.add(PointerDataType.dataType, "next", null);
290 
291// Apply to memory
292createData(toAddr(0x601000), struct);
293```
294 
295### Pattern Matching Scripts
296 
297```python
298# Find all calls to dangerous functions
299for func in currentProgram.getFunctionManager().getFunctions(True):
300 for ref in getReferencesTo(func.getEntryPoint()):
301 if func.getName() in ["strcpy", "sprintf", "gets"]:
302 print(f"Dangerous call at {ref.getFromAddress()}")
303```
304 
305## IDA Pro Patterns
306 
307### IDAPython Analysis
308 
309```python
310import idaapi
311import idautils
312import idc
313 
314# Find all function calls
315def find_calls(func_name):
316 for func_ea in idautils.Functions():
317 for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):
318 if idc.print_insn_mnem(head) == "call":
319 target = idc.get_operand_value(head, 0)
320 if idc.get_func_name(target) == func_name:
321 print(f"Call to {func_name} at {hex(head)}")
322 
323# Rename functions based on strings
324def auto_rename():
325 for s in idautils.Strings():
326 for xref in idautils.XrefsTo(s.ea):
327 func = idaapi.get_func(xref.frm)
328 if func and "sub_" in idc.get_func_name(func.start_ea):
329 # Use string as hint for naming
330 pass
331```
332 
333## Best Practices
334 
335### Analysis Workflow
336 
3371. **Initial triage**: File type, architecture, imports/exports
3382. **String analysis**: Identify interesting strings, error messages
3393. **Function identification**: Entry points, exports, cross-references
3404. **Control flow mapping**: Understand program structure
3415. **Data structure recovery**: Identify structs, arrays, globals
3426. **Algorithm identification**: Crypto, hashing, compression
3437. **Documentation**: Comments, renamed symbols, type definitions
344 
345### Common Pitfalls
346 
347- **Optimizer artifacts**: Code may not match source structure
348- **Inline functions**: Functions may be expanded inline
349- **Tail call optimization**: `jmp` instead of `call` + `ret`
350- **Dead code**: Unreachable code from optimization
351- **Position-independent code**: RIP-relative addressing
352 

Reviews

Installed this one?Write the first review and take the Trailblazer badge.

Reviews only open after a real install, so this is empty — and we leave it empty rather than invent one.

Alternatives

Also in Security
Block No Verify HookConfigure a PreToolUse hook to prevent AI agents from skipping git pre-commit hooks with --no-verify and other bypass flags. Use when setting up Claude Code projects that enforce commit quality gates.Security · MIT◐····●35/40Sast ConfigurationConfigure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.Security · MIT◐····●32/40Anti Reversing TechniquesUnderstand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.Security · MIT◐◐◐◐◐●30/40Protocol Reverse EngineeringMaster network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.Security · MIT◐····●30/40