Binary Analysis Tracks Supported by reverse-skill: Static, Dynamic, and Diff Workflows

reverse-skill provides five specialized binary analysis tracks—static disassembly, language-specific targeting, OLLVM de-obfuscation, dynamic symbolic execution, and LLM-driven binary diffing—organized through a routing matrix in skills/routing.md that maps target types and user intents to optimal toolchains.

The reverse-skill repository by zhaoxuya520 delivers a comprehensive, multi-track framework for binary reverse engineering that categorizes workflows across three axes: target type, user intent, and toolchain. This architecture ensures that whether you are dissecting a stripped Rust binary, de-obfuscating OLLVM-protected malware, or migrating symbols between firmware versions, the system routes your task to the most appropriate skill module.

Static Disassembly and Decompilation Track

The static analysis track offers multiple skill modules catering to different commercial and open-source toolchains. Located primarily in skills/routing.md#by-target-type, this track routes decompilation requests to:

• ida-reverse/ – Full IDA Pro MCP integration supporting graph view navigation, batch renaming, and advanced IDAPython scripting for deep binary inspection
• radare2/ – CLI-centric analysis workflows optimized for quick-scan operations and automated scripting via r2pipe
• ghidra-reverse/ – Headless Ghidra analysis capabilities for environments where IDA Pro is unavailable, enabling large-scale batch processing
• binary-ninja – Advanced patching workflows using the Python API and fine-grained intermediate language (IL) analysis as documented in skills/reverse-engineering/tools-advanced.md#binary-diffing

Each module maintains its own SKILL.md file defining specific automation protocols and API interactions for its respective toolchain.

Language-Specific Binary Tracks

reverse-skill provides specialized handling for binaries compiled from modern languages and managed runtimes, recognizing that stripped executables require distinct recovery techniques:

• go-rust-reverse/ – Handles stripped Go and Rust binaries across ELF, PE, and Mach-O formats, recovering function names and data structures lost during stripping
• dotnet-reverse/ – Focuses on .NET assemblies and IL decompilation with CLR inspection capabilities
• apk-reverse/ – Manages Android APK decompilation using jadx and apktool, including native .so library analysis within mobile applications

These tracks are activated through the routing matrix when the target type matches specific signatures (e.g., "Go/Rust stripped binary" or "Android APK") as defined in skills/routing.md.

Obfuscation and OLLVM De-obfuscation Track

For binaries protected by code obfuscation, reverse-skill maintains a dedicated workflow in skills/reverse-engineering/references/ollvm-deobfuscation.md. This track specializes in defeating:

• OLLVM control-flow flattening – Restoring original control structures flattened by the Obfuscator-LLVM toolchain
• MBA (Mixed Boolean-Arithmetic) expressions – Simplifying arithmetic obfuscation patterns
• Indirect branch obfuscation – Resolving hidden control flow targets

The track integrates multiple specialized tools including obpo-plugin, d810-ng, ollvm-unflattener, and deollvm, routing to the appropriate de-obfuscator based on the specific protection identified in the binary.

Dynamic and Symbolic Execution Track

Documented in skills/reverse-engineering/tools-dynamic.md, this track handles runtime analysis, taint tracking, and symbolic execution. The toolchain support includes:

• angr – Python-based symbolic execution framework for automated vulnerability discovery
• Qiling – Advanced emulation framework supporting cross-platform binary execution
• Unicorn – Lightweight CPU emulator for targeted instruction-level analysis
• Frida – Dynamic instrumentation toolkit for hooking running processes on mobile and desktop platforms
• Pin – Intel's dynamic binary instrumentation framework for custom analysis routines

This track activates when user intent involves runtime tracing or when static analysis hits opaque predicates that require concrete execution to resolve.

Binary Diff and Symbol Migration Track

The binary-diff/ skill module enables LLM-driven binary comparison and cross-version symbol migration. Defined in skills/binary-diff/SKILL.md, this track performs:

• Function-level diffing – Comparing disassembly across binary versions to identify modified procedures
• Cross-version symbol migration – Transferring function names and comments from a known-good baseline to an updated build
• Offset migration – Adjusting analysis markers when binary layouts shift between versions

The workflow leverages large language models to semantically compare disassembly outputs when traditional bindiff algorithms fail to account for compiler optimization changes.

Code Examples by Track

Static Analysis with radare2

import r2pipe

r2 = r2pipe.open('sample.bin')
r2.cmd('aaa')                     # auto-analyse

print(r2.cmd('afl'))              # list functions

print(r2.cmd('pdf @ main'))       # disassemble "main"

r2.quit()

Source: skills/radare2/SKILL.md

Symbolic Execution with angr

import angr

proj = angr.Project('sample.bin', auto_load_libs=False)
state = proj.factory.entry_state()
sim = proj.factory.simulation_manager(state)
sim.run()

for found in sim.found:
    print('Reached address:', hex(found.addr))

Source: skills/reverse-engineering/tools-dynamic.md

LLM-Assisted Binary Diff

import yaml
import requests

def llm_compare(old_disasm, old_proc, new_disasm, new_proc, symbols):
    prompt = f"""Compare the following procedures...
    OLD: {old_disasm}
    NEW: {new_disasm}"""
    
    response = requests.post(
        'https://api.deepseek.com/v1/chat/completions',
        json={
            'model': 'deepseek-v3',
            'messages': [{'role': 'user', 'content': prompt}]
        },
        headers={'Authorization': 'Bearer <API_KEY>'}
    )
    return yaml.safe_load(
        response.json()['choices'][0]['message']['content']
    )

Source: skills/binary-diff/SKILL.md

IDA Pro Batch Processing

Invoke IDA in automated mode from PowerShell:

& "$env:IDA_PATH\ida64.exe" -A -S"script.py" sample.bin

The accompanying IDAPython script (script.py):

import idaapi
import ida_name

for func_idx in range(idaapi.get_func_qty()):
    func = idaapi.get_func(func_idx)
    # Apply binary-diff derived rename logic here

    ida_name.set_name(func.start_ea, "recovered_name")

Source: skills/ida-reverse/SKILL.md

Summary

• reverse-skill organizes binary analysis into five distinct tracks: static disassembly, language-specific targets, OLLVM de-obfuscation, dynamic execution, and binary diffing
• The routing matrix in skills/routing.md matches target types (ELF, PE, APK, OLLVM) and user intents (decompile, diff, debug) to concrete toolchains (IDA, radare2, angr, Frida)
• Language-specific tracks provide specialized recovery for Go, Rust, .NET, and Android binaries that lose metadata during compilation
• OLLVM support integrates multiple de-obfuscation plugins to handle control-flow flattening and MBA expressions
• Binary diffing leverages LLM capabilities to perform semantic comparison and automated symbol migration across firmware versions

Frequently Asked Questions

How does reverse-skill determine which binary analysis track to use?

reverse-skill employs a routing matrix defined in skills/routing.md that evaluates three axes: the target type (e.g., "OLLVM-obfuscated binary" or "stripped Rust ELF"), the user intent (e.g., "decompile", "bindiff", or "runtime trace"), and the available toolchain (IDA, radare2, angr). When a request does not map cleanly to existing capabilities, the system suggests creating a new skill rather than forcing an inappropriate match.

What tools are available for analyzing OLLVM-obfuscated binaries?

The OLLVM track in skills/reverse-engineering/references/ollvm-deobfuscation.md supports multiple specialized tools including obpo-plugin, d810-ng, ollvm-unflattener, and deollvm. These tools target specific obfuscation techniques such as control-flow flattening, MBA expressions, and indirect branch obfuscation, with the routing system selecting the appropriate tool based on the protection signature detected in the binary.

Can reverse-skill handle both static and dynamic analysis of Android APKs?

Yes. The apk-reverse/ track handles static decompilation using jadx and apktool for Java/Kotlin layers, while the dynamic analysis track (tools-dynamic.md) supports Frida-based instrumentation of running Android applications. For native .so libraries embedded in APKs, the system can route to language-specific tracks (Go/Rust) or standard static analysis modules depending on the compilation target.

How does the binary-diff track perform cross-version symbol migration?

The binary-diff track defined in skills/binary-diff/SKILL.md uses an LLM-driven comparison workflow that ingests disassembly from both binary versions, semantically matches functions despite compiler optimization changes, and generates migration scripts. This approach handles function offset shifts and structural changes that traditional byte-level diffing tools cannot reconcile, enabling automated transfer of names and comments from baseline to target binaries.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}