Binary Analysis Patterns

Covers the essential patterns you need when reverse engineering binaries, from recognizing function prologues and calling conventions across x86-64, ARM32, and ARM64 to identifying control flow structures like loops and switch statements. Includes concrete examples for data structure access, string operations, and arithmetic optimizations that compilers typically generate. The decompilation section shows how to recover variable types and function signatures, while the tool-specific patterns for Ghidra and IDA Pro help automate analysis tasks. Most useful when you're staring at disassembly trying to understand what the original C code looked like, or when you need to quickly identify common code patterns in malware or proprietary software.

skills.sh installs: 11.4K
GitHub stars: 42.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add wshobson/agents --skill binary-analysis-patterns --agent claude-code

Installs into .claude/skills of the current project.

Files

Binary Analysis Patterns

Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.

When to Use This Skill

Reverse-engineering an unknown executable to understand its behavior
Analyzing malware or obfuscated binaries with Ghidra / IDA Pro / Binary Ninja
Recognizing common assembly idioms (function prologues, switch tables, vtable dispatch)
Reconstructing high-level control flow from compiled code
Identifying compiler-introduced patterns (stack canaries, PIC trampolines)

Detailed section: Disassembly Fundamentals

Originally a 2047-byte section in this SKILL.md. Moved to references/details.md to fit Codex's 8 KB skill body cap.

Control Flow Patterns

Conditional Branches

; if (a == b)
cmp eax, ebx
jne skip_block
; ... if body ...
skip_block:

; if (a < b) - signed
cmp eax, ebx
jge skip_block    ; Jump if greater or equal
; ... if body ...
skip_block:

; if (a < b) - unsigned
cmp eax, ebx
jae skip_block    ; Jump if above or equal
; ... if body ...
skip_block: