Skill UI

A comprehensive technical guide detailing essential patterns and techniques for analyzing compiled binaries. It covers foundational assembly concepts across x86-64, ARM architectures, and provides structured examples for function prologues, calling conventions, control flow (loops, branches), data structure access, and common arithmetic/string operations. Essential for reverse engineering and low-level systems programming.

A comprehensive guide detailing the entire workflow for analyzing embedded firmware. It covers hardware-level extraction methods (UART, JTAG, SPI dump), filesystem analysis (SquashFS, JFFS2), binary reverse engineering using tools like Ghidra, and identifying common vulnerabilities (Buffer Overflow, Command Injection). Ideal for security researchers and embedded systems engineers.

This skill provides a comprehensive, expert guide to the entire reverse engineering lifecycle. It covers advanced techniques for binary analysis, including static analysis (disassembly, metadata extraction, control flow mapping) and dynamic analysis (API hooking, memory tracing). Mastery includes utilizing industry-leading tools such as IDA Pro, Ghidra, radare2, and specialized frameworks like pwntools and angr. The methodology is structured for secure research, CTF challenges, and vulnerability assessment, emphasizing best practices and ethical use.

A comprehensive guide and workflow for detecting Mimikatz and similar credential-dumping activities. It utilizes command-line pattern matching, LSASS memory access signatures, binary indicators, and in-memory analysis. Ideal for threat hunting, scoping compromises during incident response, or validating detection coverage in purple team exercises using EDR/SIEM data.

A comprehensive toolkit for analyzing ELF binaries to locate memory-corruption vulnerabilities, such as buffer overflows and ROP chains. This skill is vital for authorized penetration testing and CTF challenges, allowing users to evaluate compiler mitigations (ASLR, NX, Canary, PIE) and develop robust proof-of-concept exploits.

A comprehensive tool suite designed to analyze firmware images from embedded devices, including routers, IoT endpoints, and critical system components like UEFI/BIOS. It facilitates deep security analysis by performing firmware extraction, filesystem integrity checks, binary reverse engineering, and sophisticated detection of bootkits, backdoors, and unauthorized modifications.

This guide details how to perform pre-execution static analysis of Windows PE malware samples using tools like PEStudio, Python's pefile, and FLOSS. It focuses on examining file headers, section entropy, import address tables (IAT), and embedded strings to identify malicious functionalities, packing techniques, and indicators of compromise (IOCs) without running the binary. Ideal for initial triage of suspicious executables.

This curriculum covers foundational exploitation techniques essential for binary security analysis. Users will learn to control program execution flow, including overwriting EIP/RIP, constructing ROP chains, implementing ret2libc, and shellcode injection. It provides practical, hands-on exercises on stack overflows and heap manipulation in a controlled Linux environment, establishing the core primitives needed before tackling modern mitigation bypasses.

This advanced playbook details expert techniques for format string exploitation. It covers arbitrary stack reading (%p), memory writing (%n), and exploiting weaknesses like GOT/hook overwrites. Essential for CTF challenges and binary vulnerability analysis to achieve reliable Remote Code Execution (RCE).

A comprehensive playbook for advanced mobile security assessments of iOS applications. Covers both jailbroken and non-jailbroken environments, focusing on critical attack vectors such as keychain extraction, URL scheme hijacking, Universal Links exploitation via AASA misconfigurations, runtime memory manipulation (Frida/Objection), and binary protection analysis.

This playbook provides advanced techniques for symbolic execution using angr, Z3, and Unicorn Engine. It covers automating CTF challenges, handling constraint solving patterns, function hooking, memory manipulation, and emulating custom virtual machines for binary analysis and key recovery.

This skill generates an enterprise-grade threat model report for MCP surfaces. It categorizes security threats and outputs severity levels like clean, low, medium, or high. Suitable for pre-launch security reviews and periodic audits. It integrates with the harness binary and supports JSON or table formats.