Binary Triage

cyberkaida/reverse-engineering-assistant

When you drop a binary into ReVa and need to figure out what you're dealing with before diving deep, this walks you through the essentials: memory layout, strings, imports, and functions. It's structured around eight specific steps that help you spot the suspicious stuff fast, like network APIs in weird places or crypto functions you weren't expecting. The real value is in the cross-reference phase where you trace back which functions touch your flagged strings or sketchy imports, then it generates a prioritized todo list for actual reverse engineering work. Think of it as the difference between staring at a binary wondering where to start versus having a map of exactly which functions deserve your attention first.

skills.sh installs: 234
GitHub stars: 954
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add cyberkaida/reverse-engineering-assistant --skill binary-triage --agent claude-code

Installs into .claude/skills of the current project.

Files

Binary Triage

Instructions

We are triaging a binary to quickly understand what it does. This is an initial survey, not deep analysis. Our goal is to:

Identify key components and behaviors
Flag suspicious or interesting areas
Create a task list of next steps for deeper investigation

Binary triage with ReVa

Follow this systematic workflow using ReVa's MCP tools:

1. Identify the Program

Use get-current-program to see the active program
Or use list-project-files to see available programs in the project
Note the programPath (e.g., "/Hatchery.exe") for use in subsequent tools

2. Survey Memory Layout

Use get-memory-blocks to understand the binary structure
Examine key sections:
- .text - executable code
- .data - initialized data
- .rodata - read-only data (strings, constants)
- .bss - uninitialized data
Flag unusual characteristics:
- Unusually large sections
- Packed/encrypted sections
- Executable data sections
- Writable code sections