reverse-engineering

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Reverse Engineering & Debugging

逆向工程与调试

Professional methodology for static analysis, dynamic analysis, debugging, and binary exploitation.

静态分析、动态分析、调试及二进制漏洞利用的专业方法论。

Quick Reference — Load the Right Reference File

快速参考——加载正确的参考文件

Task	Reference File
Static analysis, disassembly, Ghidra, radare2, objdump, patching	`references/static-analysis.md`
GDB (+ pwndbg/gef/peda), LLDB, strace/ltrace, crash analysis	`references/dynamic-debugging.md`
Android APK, DEX, smali, ADB, Frida on Android, repackaging	`references/android-re.md`
iOS IPA, Mach-O, class-dump, Frida ObjC/Swift, Keychain	`references/ios-re.md`
macOS XPC, launchd, kext, SIP, Linux kernel modules	`references/macos-kernel-re.md`
Windows PE, WinDbg, x64dbg, .NET/dnSpy, kernel drivers	`references/windows-re.md`
Frida scripting, hooking Java/Native/ObjC, SSL unpin, gadget	`references/frida.md`
.NET IL, dnSpy, de4dot, Java/JVM, Kotlin, Unity/IL2CPP, Mono	`references/managed-code-re.md`
Malware, obfuscation, packer analysis, IOC extraction, Volatility	`references/malware-analysis.md`
CTF pwn/rev, BOF, ROP, heap exploitation, pwntools, angr/Z3	`references/exploit-dev.md`
Network protocol RE, Wireshark, mitmproxy, Protobuf, gRPC, Lua dissectors, Boofuzz	`references/protocol-re.md`
Firmware, binwalk, QEMU emulation, JTAG/UART, U-Boot, IoT	`references/firmware-embedded.md`
EAC, BattlEye, Vanguard, FACEIT, VAC, kernel AC analysis	`references/anticheat-re.md`
Ghidra Python/Java scripts, headless, vulnerability finding, custom analyzers	`references/ghidra-scripting.md`
IDAPython / IDALib scripts, Hex-Rays API, batch decompile, OLLVM helpers	`references/idapython.md`
Unicorn engine emulation, function-level emulation, JNI stubbing, syscall sim	`references/unicorn-emulation.md`
Stripped symbol recovery, magic numbers, paired calls, xref analysis	`references/symbol-recovery.md`
C/C++ structure recovery, vtables, std::string/vector/map, field type inference	`references/struct-recovery.md`

任务	参考文件
静态分析、反汇编、Ghidra、radare2、objdump、补丁制作	`references/static-analysis.md`
GDB（搭配pwndbg/gef/peda）、LLDB、strace/ltrace、崩溃分析	`references/dynamic-debugging.md`
Android APK、DEX、smali、ADB、Android平台Frida、重打包	`references/android-re.md`
iOS IPA、Mach-O、class-dump、Frida ObjC/Swift、Keychain	`references/ios-re.md`
macOS XPC、launchd、kext、SIP、Linux内核模块	`references/macos-kernel-re.md`
Windows PE、WinDbg、x64dbg、.NET/dnSpy、内核驱动	`references/windows-re.md`
Frida脚本编写、Java/Native/ObjC钩子、SSL证书解绑、gadget	`references/frida.md`
.NET IL、dnSpy、de4dot、Java/JVM、Kotlin、Unity/IL2CPP、Mono	`references/managed-code-re.md`
恶意软件、混淆、加壳分析、IOC提取、Volatility	`references/malware-analysis.md`
CTF pwn/rev、BOF、ROP、堆漏洞利用、pwntools、angr/Z3	`references/exploit-dev.md`
网络协议逆向、Wireshark、mitmproxy、Protobuf、gRPC、Lua dissectors、Boofuzz	`references/protocol-re.md`
固件、binwalk、QEMU仿真、JTAG/UART、U-Boot、IoT	`references/firmware-embedded.md`
EAC、BattlEye、Vanguard、FACEIT、VAC、内核反作弊分析	`references/anticheat-re.md`
Ghidra Python/Java脚本、无头模式、漏洞查找、自定义分析器	`references/ghidra-scripting.md`
IDAPython / IDALib脚本、Hex-Rays API、批量反编译、OLLVM辅助工具	`references/idapython.md`
Unicorn引擎仿真、函数级仿真、JNI桩代码、系统调用模拟	`references/unicorn-emulation.md`
剥离符号恢复、魔术数字、配对调用、交叉引用分析	`references/symbol-recovery.md`
C/C++结构恢复、虚表、std::string/vector/map、字段类型推断	`references/struct-recovery.md`

Bundled Tools (

tools/

)

配套工具（

tools/

）

The skill ships ready-to-use companion utilities (all original work, MIT-licensed):

Tool	Purpose
`tools/ida_export_plugin.py`	IDA Pro plugin (Ctrl-Shift-E) — exports the IDB into a `decompile/` directory of plain-text files an agent can read directly
`tools/dex_memory_dumper.js`	Frida agent — dumps DEX from a running Android process via memory scan + ClassLoader traversal
`tools/mcp/`	Setup notes and config snippets for connecting agents to upstream MCP servers ( `ida-pro-mcp` , `GhidraMCP` , `r2mcp` )

See

tools/README.md

for usage details. The

tools/mcp/

directory documents the live-query workflow (alternative to file export) — both modes are supported by the methodology files above.

本技能附带可直接使用的配套工具（均为原创，MIT许可）：

工具	用途
`tools/ida_export_plugin.py`	IDA Pro插件（快捷键Ctrl-Shift-E）——将IDB导出到 `decompile/` 目录下的纯文本文件，供Agent直接读取
`tools/dex_memory_dumper.js`	Frida代理——通过内存扫描+ClassLoader遍历，从运行中的Android进程导出DEX文件
`tools/mcp/`	连接Agent到上游MCP服务器（ `ida-pro-mcp` 、 `GhidraMCP` 、 `r2mcp` ）的设置说明和配置片段

使用细节请查看

tools/README.md

。

tools/mcp/

目录记录了实时查询工作流（文件导出的替代方案）——上述方法论文件均支持这两种模式。

Universal First Steps

通用初始步骤

Before loading any reference file, establish context:

加载任何参考文件前，先明确上下文：

1. Identify the Target

1. 识别目标

bash

file <binary>           # file type, arch, bits, stripped?
xxd <binary> | head -4  # magic bytes
strings -a <binary> | head -60
checksec --file=<binary>  # NX, PIE, RELRO, stack canary, ASLR

Binary format decision tree:

ELF → Linux native →

references/static-analysis.md

references/dynamic-debugging.md

PE/PE32+ → Windows native →

references/windows-re.md

references/static-analysis.md

PE with .NET metadata →
```
references/managed-code-re.md
```
(dnSpy first)

Mach-O → macOS/iOS →

references/macos-kernel-re.md

references/ios-re.md

DEX/APK/AAB → Android →
```
references/android-re.md
```
JAR/WAR/AAR → Java →
```
references/managed-code-re.md
```

.sys driver →

references/windows-re.md

(kernel section) or

references/anticheat-re.md

Assembly-CSharp.dll → Unity →
```
references/managed-code-re.md
```
(Unity section)
Unknown/firmware →
```
references/firmware-embedded.md
```
(binwalk + entropy)

Task-type decision tree (applies to any format):

Stripped binary, unknown functions →
```
references/symbol-recovery.md
```
Unknown struct layouts in decompilation →
```
references/struct-recovery.md
```
Need to run just one function in isolation →
```
references/unicorn-emulation.md
```
Using IDA Pro for analysis →
```
references/idapython.md
```
Using Ghidra for analysis →
```
references/ghidra-scripting.md
```

bash

file <binary>           # 文件类型、架构、位数、是否剥离符号？
xxd <binary> | head -4  # 魔术字节
strings -a <binary> | head -60
checksec --file=<binary>  # NX、PIE、RELRO、栈金丝雀、ASLR

二进制格式决策树：

ELF → Linux原生 →

references/static-analysis.md

references/dynamic-debugging.md

PE/PE32+ → Windows原生 →

references/windows-re.md

references/static-analysis.md

含.NET元数据的PE →
```
references/managed-code-re.md
```
（优先使用dnSpy）

Mach-O → macOS/iOS →

references/macos-kernel-re.md

references/ios-re.md

DEX/APK/AAB → Android →
```
references/android-re.md
```
JAR/WAR/AAR → Java →
```
references/managed-code-re.md
```

.sys驱动 →

references/windows-re.md

（内核部分）或

references/anticheat-re.md

Assembly-CSharp.dll → Unity →
```
references/managed-code-re.md
```
（Unity部分）
未知格式/固件 →
```
references/firmware-embedded.md
```
（binwalk + 熵分析）

任务类型决策树（适用于所有格式）：

剥离符号的二进制、未知函数 →
```
references/symbol-recovery.md
```
反编译中未知的结构体布局 →
```
references/struct-recovery.md
```
需要单独运行某个函数 →
```
references/unicorn-emulation.md
```
使用IDA Pro进行分析 →
```
references/idapython.md
```
使用Ghidra进行分析 →
```
references/ghidra-scripting.md
```

2. Establish Scope

2. 确定范围

Ask the user (or infer from context):

Goal: understand logic / find vuln / bypass protection / patch / CTF flag / malware IOCs?
Platform: Linux / Windows / macOS / Android / iOS / embedded?
Tools available: Ghidra / IDA / radare2 / Binary Ninja / Hopper?
Dynamic possible?: Can we run it? VM? Emulator? Physical device?

询问用户（或从上下文推断）：

目标：理解逻辑 / 查找漏洞 / 绕过保护 / 打补丁 / 获取CTF flag / 提取恶意软件IOC？
平台：Linux / Windows / macOS / Android / iOS / 嵌入式设备？
可用工具：Ghidra / IDA / radare2 / Binary Ninja / Hopper？
能否动态运行：是否可以执行目标程序？是否有虚拟机？模拟器？物理设备？

3. Choose Analysis Mode

3. 选择分析模式

Static only  → No execution risk, slower understanding
Dynamic only → Fast but misses dead code
Static + Dynamic (recommended) → Static for map, dynamic for runtime truth

仅静态分析  → 无执行风险，但理解速度较慢
仅动态分析 → 速度快，但会遗漏死代码
静态+动态（推荐） → 静态分析用于梳理结构，动态分析验证运行时实际情况

Core Toolchain Summary

核心工具链汇总

Static

静态分析

Tool	Best For
`Ghidra`	Full decompilation, scripting, free
`radare2` / `cutter`	CLI powerhouse, scripting, embedded
`Binary Ninja`	API-first, fast, commercial
`IDA Pro` / `IDA Free`	Industry standard, best signatures
`objdump`	Quick disassembly, no install
`readelf` / `nm`	ELF symbol/section inspection
`jadx`	Android DEX → Java, GUI
`apktool`	APK unpack / repack / smali

工具	最佳用途
`Ghidra`	完整反编译、脚本支持、免费
`radare2` / `cutter`	CLI功能强大、脚本支持、适用于嵌入式设备
`Binary Ninja`	优先支持API、速度快、商业软件
`IDA Pro` / `IDA Free`	行业标准、签名库最完善
`objdump`	快速反汇编、无需安装
`readelf` / `nm`	ELF符号/段检查
`jadx`	Android DEX转Java、带GUI
`apktool`	APK解包/重打包/smali处理

Dynamic

动态分析

Tool	Best For
`GDB` + `pwndbg` / `peda` / `gef`	Linux ELF debugging
`LLDB`	macOS/iOS/Swift debugging
`Frida`	Cross-platform hooking, no source
`strace` / `ltrace`	Syscall / library call tracing
`Valgrind`	Memory errors, Helgrind
`WinDbg`	Windows kernel + user mode
`x64dbg`	Windows GUI debugger

工具	最佳用途
`GDB` + `pwndbg` / `peda` / `gef`	Linux ELF调试
`LLDB`	macOS/iOS/Swift调试
`Frida`	跨平台钩子、无需源码
`strace` / `ltrace`	系统调用/库函数追踪
`Valgrind`	内存错误检测、Helgrind
`WinDbg`	Windows内核+用户态调试
`x64dbg`	Windows GUI调试器

Network

网络分析

Tool	Best For
`Wireshark` / `tshark`	Packet capture + dissection
`mitmproxy` / `Burp Suite`	HTTP/S MITM
`Frida`	In-process SSL unpin
`tcpdump`	Headless capture

工具	最佳用途
`Wireshark` / `tshark`	数据包捕获+解析
`mitmproxy` / `Burp Suite`	HTTP/S中间人攻击
`Frida`	进程内SSL证书解绑
`tcpdump`	无界面捕获

Methodology Frameworks

方法论框架

Static Analysis Workflow

静态分析工作流

1. file + strings + checksec           → quick triage
2. Entropy analysis                    → packed/encrypted?
3. Import table / symbol table         → understand capabilities
4. Load in decompiler                  → rename, retype, annotate
5. Identify key functions              → main(), crypto, network, anti-debug
6. Trace data flow                     → user input → sink
7. Document findings                   → comment inline

1. file + strings + checksec           → 快速分类
2. 熵分析                              → 是否加壳/加密？
3. 导入表 / 符号表                     → 了解功能范围
4. 加载到反编译器中                    → 重命名、重新定义类型、添加注释
5. 识别关键函数                        → main()、加密函数、网络函数、反调试函数
6. 追踪数据流                          → 用户输入 → 输出点
7. 记录发现结果                        → 内联注释

Dynamic Analysis Workflow

动态分析工作流

1. Set up isolated environment         → VM / container / device
2. Run with strace/ltrace first        → understand syscall footprint
3. Attach debugger                     → set breakpoints at key functions
4. Observe runtime behavior            → memory, registers, branches taken
5. Correlate with static              → validate decompiler output
6. Patch / hook as needed             → bypass checks, log values

1. 搭建隔离环境                        → 虚拟机 / 容器 / 设备
2. 先使用strace/ltrace运行             → 了解系统调用足迹
3. 附加调试器                          → 在关键函数处设置断点
4. 观察运行时行为                      → 内存、寄存器、分支走向
5. 与静态分析关联                      → 验证反编译器输出
6. 按需打补丁/设置钩子                 → 绕过检查、记录值

Vulnerability Discovery Workflow

漏洞发现工作流

1. Attack surface mapping             → inputs: file, network, env vars, args
2. Dangerous function search          → strcpy, gets, sprintf, memcpy, system
3. Integer overflow candidates        → size calculations, loops
4. Format string candidates           → printf(user_input)
5. UAF / double-free candidates       → heap allocation patterns
6. Trigger + confirm                  → crash → controlled → exploitable

1. 攻击面映射                         → 输入：文件、网络、环境变量、参数
2. 危险函数搜索                       → strcpy、gets、sprintf、memcpy、system
3. 整数溢出候选点                     → 大小计算、循环
4. 格式化字符串候选点                 → printf(user_input)
5. UAF/双释放候选点                   → 堆分配模式
6. 触发并确认                         → 崩溃 → 可控 → 可利用

Anti-Analysis Bypass — Quick Reference

反分析绕过——快速参考

Anti-Debug Detection

反调试检测

bash

undefined

bash

undefined

Check if binary detects debugger

检查二进制文件是否检测调试器

strings <bin> | grep -iE "ptrace|debugger|isDebuggerPresent|TracerPid"

Linux: ptrace self-detection

Linux：ptrace自检测

Bypass: preload hook or patch the ptrace call

绕过：预加载钩子或补丁ptrace调用

undefined

undefined

Common Protections

常见保护机制

Protection	Detection	Bypass
`ptrace` anti-debug	`strace` shows ptrace(TRACEME)	Patch JNZ→JMP or LD_PRELOAD fake ptrace
Timing checks	`rdtsc` / `clock_gettime` in loop	Patch comparison or NOP
Checksum/integrity	Hash of own .text section	Patch after decryption, before check
Packer (UPX etc.)	High entropy + small imports	`upx -d` / dump from memory after unpack
Obfuscated strings	No readable strings	Run + extract from memory / Frida hook
SSL pinning (mobile)	Network fail in app	Frida ssl-unpin / see `references/frida.md`

保护机制	检测方式	绕过方法
`ptrace` 反调试	`strace` 显示ptrace(TRACEME)	将JNZ补丁为JMP或使用LD_PRELOAD伪造ptrace
计时检查	循环中使用 `rdtsc` / `clock_gettime`	补丁比较逻辑或替换为NOP
校验和/完整性检查	对自身.text段哈希	在解密后、检查前打补丁
加壳（如UPX）	高熵值+少量导入表	`upx -d` / 加壳后从内存导出
混淆字符串	无可读字符串	运行后从内存提取 / Frida钩子
SSL证书绑定（移动端）	应用内网络请求失败	Frida ssl-unpin / 查看 `references/frida.md`

Output Standards

输出标准

When reporting RE findings, always structure output as:

markdown

undefined

报告逆向工程结果时，请始终按照以下结构组织：

markdown

undefined

Binary: <name>

二进制文件：<名称>

Format: ELF64 / PE32+ / DEX / Mach-O
Arch: x86_64 / ARM64 / ARMv7 / MIPS
Stripped: Yes/No | PIE: Yes/No | NX: Yes/No

格式：ELF64 / PE32+ / DEX / Mach-O
架构：x86_64 / ARM64 / ARMv7 / MIPS
是否剥离符号：是/否 | PIE：是/否 | NX：是/否

Key Findings

关键发现

<function name @ offset> — <what it does>
...

<函数名 @ 偏移量> — <功能描述>
...

Vulnerability / Behavior

漏洞/行为

<description with evidence>
Offset: 0x<addr>
Triggerable via: <input vector>

<带证据的描述>
偏移量：0x<地址>
触发方式：<输入载体>

Recommended Next Steps

建议下一步操作

<action>

---

<操作内容>

---

Naming Conventions for Decompiler Work

反编译器工作命名规范

Follow these standards when annotating in Ghidra / IDA / r2:

Functions:  verb_noun_context      → decrypt_config_xor, check_license_hwid
Variables:  type_purpose           → buf_user_input, sz_packet, ptr_heap_chunk
Structs:    ST_<name>              → ST_PacketHeader, ST_LicenseData
Labels:     loc_<purpose>         → loc_anti_debug_fail, loc_success

在Ghidra/IDA/r2中添加注释时，请遵循以下标准：

函数：  动词_名词_上下文      → decrypt_config_xor, check_license_hwid
变量：  类型_用途           → buf_user_input, sz_packet, ptr_heap_chunk
结构体：ST_<名称>              → ST_PacketHeader, ST_LicenseData
标签：  loc_<用途>         → loc_anti_debug_fail, loc_success

Scripting Quick Starters

脚本快速入门

See

references/frida.md

for full Frida patterns.

完整Frida模式请查看

references/frida.md

。

GDB Python one-liner (log function args)

GDB Python单行脚本（记录函数参数）

python

undefined

python

undefined

In GDB: source this file

在GDB中：source 此文件

import gdb class LogArgs(gdb.Breakpoint): def stop(self): frame = gdb.selected_frame() print(f"[*] {frame.name()} rdi={gdb.parse_and_eval('$rdi')} rsi={gdb.parse_and_eval('$rsi')}") return False # don't stop, just log LogArgs("target_function")

undefined

undefined

radare2 batch analysis

radare2批量分析

bash

r2 -A -q -c "afl~suspicious; pdf @ sym.check_license" <binary>

bash

r2 -A -q -c "afl~suspicious; pdf @ sym.check_license" <binary>

Ghidra headless analysis

Ghidra无头分析

bash

$GHIDRA_HOME/support/analyzeHeadless /tmp/proj MyProject \
  -import <binary> -postScript PrintAST.java -scriptPath ~/ghidra_scripts

bash

$GHIDRA_HOME/support/analyzeHeadless /tmp/proj MyProject \
  -import <binary> -postScript PrintAST.java -scriptPath ~/ghidra_scripts

reverse-engineering

Original

Translation

Reverse Engineering & Debugging

逆向工程与调试

Quick Reference — Load the Right Reference File

快速参考——加载正确的参考文件

Bundled Tools (tools/)

配套工具（tools/）

Universal First Steps

通用初始步骤

1. Identify the Target

1. 识别目标

2. Establish Scope

2. 确定范围

3. Choose Analysis Mode

3. 选择分析模式

Core Toolchain Summary

核心工具链汇总

Static

静态分析

Dynamic

动态分析

Network

网络分析

Methodology Frameworks

方法论框架

Static Analysis Workflow

静态分析工作流

Dynamic Analysis Workflow

动态分析工作流

Vulnerability Discovery Workflow

漏洞发现工作流

Anti-Analysis Bypass — Quick Reference

反分析绕过——快速参考

Anti-Debug Detection

反调试检测

Check if binary detects debugger

检查二进制文件是否检测调试器

Linux: ptrace self-detection

Linux：ptrace自检测

Bypass: preload hook or patch the ptrace call

绕过：预加载钩子或补丁ptrace调用

Common Protections

常见保护机制

Output Standards

输出标准

Binary: <name>

二进制文件：<名称>

Key Findings

关键发现

Vulnerability / Behavior

漏洞/行为

Recommended Next Steps

建议下一步操作

Naming Conventions for Decompiler Work

反编译器工作命名规范

Scripting Quick Starters

脚本快速入门

GDB Python one-liner (log function args)

GDB Python单行脚本（记录函数参数）

In GDB: source this file

在GDB中：source 此文件

radare2 batch analysis

radare2批量分析

Ghidra headless analysis

Ghidra无头分析

Bundled Tools (
`tools/`
)

配套工具（
`tools/`
）