reverse-engineering

# Reverse Engineering ## When to Activate - Triaging an unknown compiled binary (ELF/PE/Mach-O) or stripped/obfuscated sample for vulns or capability. - Decompiling proprietary code and recovering structure/types (incl. AI/MCP-assisted Ghidra/Binary Ninja). - Unpacking & devirtualizing protected binaries (VMProtect 3.x, Themida, OLLVM control-flow flattening). - Defeating anti-debugging / anti-VM / anti-Frida so dynamic analysis can proceed. - Firmware extraction & UEFI/BIOS RE, Secure Boot bypass research, persistent pre-OS implant analysis. - Patch diffing a Patch-Tuesday/CVE fix to recover root cause and build an n-day trigger. - Reverse engineering an unknown wire protocol or proprietary file format for fuzzing/parsing. ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Binary triage (format/arch/mitigations/strings/imports) | T1592.002, T1518.001 | CWE-1395 | references/static-triage-decompilation.md | scripts/triage.py | | Headless decompilation (Ghidra 11.4 / r2 / IDA) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | scripts/triage.py | | AI/MCP-assisted RE (Sidekick / GhidrAssistMCP / LLM4Decompile) | T1592.002 | CWE-noinfo | references/static-triage-decompilation.md | - | | Dynamic debugging (GDB/GEF, x64dbg, conditional bps) | T1622 | CWE-noinfo | references/dynamic-instrumentation.md | - | | Frida 17 instrumentation + SSL-pin/JNI hooking | T1622, T1562.001 | CWE-noinfo | r...