Reverse Engineering

This is your go-to for tearing apart binaries when you need to understand what's actually happening under the hood. It covers the full spectrum from initial triage with rabin2 and checksec through Ghidra decompilation, dynamic instrumentation with Frida, and symbolic execution with angr. The skill shines in practical scenarios like bypassing anti-debugging tricks, firmware extraction and analysis, and patch diffing to hunt for 1-day vulnerabilities. It even gets into UEFI/BIOS RE and de-obfuscation of control flow flattening. The anti-reversing bypass table alone is worth having on hand. If you're doing malware analysis, exploit dev, or need to reverse a proprietary protocol, this gives you the workflows and tool invocations to move fast.

install copies · 90 days. Times the install command was copied on this site in the last 90 days, bots filtered.: 7
GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill reverse-engineering --agent claude-code

Installs into .claude/skills of the current project.

Files

Reverse Engineering

When to Activate

Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability.
Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja).
Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening).
Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed.
Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis.
Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger.
Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing.