Vm And Bytecode Reverse

When you hit a CTF challenge or malware sample with a custom VM interpreter, this walks you through the whole reversing process: finding the fetch-decode-execute dispatcher loop (switch-based, jump table, or if-chain), mapping opcodes to operations, extracting the bytecode blob, and writing a custom disassembler. It covers both stack-based and register-based VM architectures with opcode reference tables for common patterns, plus maze challenges that use position tracking and directional input. The disassembler templates are immediately useful since most VMs follow the same structural patterns even when obfuscated. If you've ever stared at a giant switch statement with 200 cases or tried to make sense of bytecode being fed into a handler table, the systematic opcode mapping approach here will save you hours of manual analysis.

skills.sh installs: 4K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill vm-and-bytecode-reverse --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: VM & Bytecode Reverse Engineering — Expert Analysis Playbook

AI LOAD INSTRUCTION: Expert techniques for reversing custom virtual machines and bytecode interpreters. Covers dispatcher identification, opcode mapping, custom ISA reconstruction, disassembler/decompiler writing, maze challenges, and real-world VM protector analysis. Base models often fail to recognize the fetch-decode-execute pattern or attempt to analyze VM bytecode as native code.

0. RELATED ROUTING

code-obfuscation-deobfuscation when the VM is a commercial protector (VMProtect/Themida)
symbolic-execution-tools when using angr to solve VM-based challenges
anti-debugging-techniques when the VM includes anti-debug checks