Updated 2w ago
by 2389-research
binary-re
Agentic binary reverse engineering for ELF binaries on ARM64, ARMv7, x86_64 - hypothesis-driven analysis with radare2, Ghidra, GDB, QEMU
20 GitHub stars (20)
+2 in 16 days
| Period | New stars |
|---|---|
| Oct 1 | 0 |
| Oct 2 | 0 |
| Oct 3 | 0 |
| Oct 4 | 0 |
| Oct 5 | 0 |
| Oct 6 | 0 |
| Oct 7 | 0 |
| Oct 8 | 0 |
| Oct 9 | +1 |
| Oct 10 | 0 |
| Oct 11 | +1 |
| Oct 12 | 0 |
| Oct 13 | 0 |
| Oct 14 | 0 |
| Oct 15 | 0 |
| Oct 16 | 0 |
- 6 skills (6 skills found in its SKILL.md files)
- 3 forks (3 forks)
- 2w ago last update (Last updated 2w ago)
Install
Skills CLI
npx skills add 2389-research/binary-re
Asks which skills and agents to install. Just one: npx skills add 2389-research/binary-re --skill binary-re — add -g for every project.
Claude Code
git clone https://github.com/2389-research/binary-recp -r "binary-re/skills/binary-re" ~/.claude/skills/
Copies the binary-re skill into ~/.claude/skills/ for every project (use .claude/skills/ for one project). Repeat for the other skills listed below.
Plugin
/plugin marketplace add 2389-research/binary-re
Run inside Claude Code if the repository ships a plugin marketplace, then pick plugins from /plugin.
Skills can run code on your machine — read the SKILL.md first.
What it does
In the author's own words, from each skill's SKILL.md.
-
binary-re
Analyzes ELF binaries, executables, and firmware images to understand behavior without source code; coordinates sub-skills binary-re:triage, binary-re:static-analysis, binary-re:dynamic-analysis, binary-re:synthesis, and binary-re:tool-setup. Use when working with a binary, executable, or ELF file; asked to reverse engineer, disassemble, decompile, or figure out what something does; targeting ARM…
skills/binary-re/SKILL.md on GitHub (opens in a new tab) -
binary-re:dynamic-analysis
Observes runtime behavior of binaries via QEMU emulation, GDB debugging, and Frida hooking — syscall tracing, breakpoints, memory inspection, and function interception. Use when running, tracing, or debugging a binary, verifying hypotheses from static analysis, or watching actual syscalls, network calls, or file access; requires human approval before any execution.
skills/dynamic-analysis/SKILL.md on GitHub (opens in a new tab) -
binary-re:static-analysis
Performs static analysis of binary code using radare2 and Ghidra — function enumeration, cross-reference tracing, decompilation, and control flow graphs without executing the binary. Use when disassembling or decompiling code, mapping functions, tracing data flow, or building hypotheses before dynamic verification.
skills/static-analysis/SKILL.md on GitHub (opens in a new tab) -
binary-re:synthesis
Compiles binary analysis findings into structured reports — correlates facts from triage, static, and dynamic phases, validates hypotheses against evidence, and produces traceable documentation. Use when ready to summarize findings, generate a report, document what a binary does, or prepare results for handoff or archival.
skills/synthesis/SKILL.md on GitHub (opens in a new tab) -
binary-re:tool-setup
Installs and configures reverse engineering tools including radare2, Ghidra, GDB, QEMU, Frida, and cross-compilation toolchains for ARM64, ARMv7, x86_64, and MIPS. Use when a tool command fails, a required tool is missing, or you need to set up a fresh analysis environment.
skills/tool-setup/SKILL.md on GitHub (opens in a new tab) -
binary-re:triage
Fingerprints unknown binaries using rabin2 — detects architecture (ARM, x86, MIPS), ABI, libc, dependencies, and strings of interest. Use when first encountering an unknown binary, ELF file, or firmware blob, or when you need architecture or ABI information before committing to deeper analysis.
skills/triage/SKILL.md on GitHub (opens in a new tab)
No skill matches that filter.
Review before you install
A skill is a set of instructions and scripts your agent will follow, and it can run code on your machine. Read the SKILL.md and any scripts first — this listing is not a security review.