binary-analysis

Binary Analysis — Agent Skill

Analyze unknown binary files with a deterministic, non-interactive CLI backed by Ghidra's static-analysis engine. The skill teaches you how to reason about binaries: when to triage versus deep-dive, how to interpret canonical evidence, and how to produce auditable reports. All observable operations happen through the binary CLI — you never call Ghidra APIs directly.

When to Use

Load this skill when any of the following conditions match:

• A user provides a binary file (PE, ELF, Mach-O, firmware image) and asks what it does, what APIs it imports, or whether it is suspicious.
• A user asks for decompilation, disassembly, call-graph exploration, or cross-reference analysis of a specific function or address.
• A user wants a structured triage report, suspicious-API analysis, or capability map for an unknown binary.
• A user asks to compare two binaries, verify export tables, or extract strings matching a pattern.
• A user wants to set up the analysis toolchain (binary doctor, binary bootstrap) or manage analysis projects.

When Not to Use

Do not load this skill for:

• Runtime or dynamic analysis — debugging, strace/dtrace, sandbox execution, process monitoring. This skill is static-analysis only (V1).
• Binary patching or modification — hex-editing, resource editing, repackaging. The analysis harness is read-only by design.
• Binaries you already fully understand — if the user is asking for documentation or explanation of known code, use a general-purpose skill.
• Source-code analysis — C, C++, Rust, or assembly source files. Use a language-specific or general code-analysis skill instead.
• Network forensics or packet capture — PCAP analysis, protocol reverse engineering at the wire level. Use a network-focused skill.
• Live memory forensics — process memory dumps, heap analysis. Static analysis of memory-mapped regions from files is in scope; live-process introspection is not.

What the Agent Owns vs What the CLI Owns

This boundary is the most important concept in the skill. Crossing it produces unreliable evidence, wasted context, or both.

Rule of thumb: If a fact appears in a CLI JSON response under data, it is deterministic evidence you can cite. If you are tempted to infer something not directly supported by that evidence, flag it as an agent inference and note the confidence gap.

Core Workflow

Every analysis session follows this sequence. Do not skip phases — each one produces evidence the next phase depends on.

Phase 1: Environment Check

binary doctor --json

If any component reports severity: "ERROR", run the bootstrap plan:

binary bootstrap --plan --json

Review the plan. If the user authorizes installation, run:

binary bootstrap --apply --json

Verify with binary version --json.

Phase 2: Project Setup

Create a project for every binary you analyze. Projects isolate analysis state and provide an audit trail.

binary project create <project-name> --json
binary import <path-to-binary> --project <project-name> --json

Use copy mode (default) for reproducibility. Use --reference only when the binary is large, read-only, or shared across projects, and explain the staleness risk to the user.

Phase 3: Initial Analysis

Run the standard analysis profile first. It covers the structural queries most triage workflows need.

binary analyze --project <project-name> --json

Check the response:

• success: true, partial: false — proceed to Phase 4.
• success: true, partial: true — review diagnostics for gaps. Proceed with bounded results, noting limitations.
• success: false, partial: true — timeout. Extract what completed, report what did not.
• success: false, partial: false — hard failure. Check diagnostics for the failure reason. The project is now FAILED; run binary project clean to reset.

Phase 4: Evidence Collection

Choose analyses based on the user's question. Run these in order, building evidence from broad to specific.

For triage (broad survey):

binary triage --project <project-name> --json
binary suspicious-apis --project <project-name> --json
binary capability-map --project <project-name> --json

For structural understanding:

binary metadata --project <project-name> --json
binary sections --project <project-name> --json
binary entrypoints --project <project-name> --json
binary imports --project <project-name> --json
binary exports --project <project-name> --json
binary strings --project <project-name> --contains "<pattern>" --json

For function-level deep-dive:

binary functions --project <project-name> --json
binary decompile --project <project-name> <function-selector> --json
binary disassemble --project <project-name> <target> --json
binary xrefs --project <project-name> <entity-selector> --json
binary callers --project <project-name> <function-selector> --json
binary callees --project <project-name> <function-selector> --json
binary callgraph --project <project-name> <function-selector> --depth 3 --json

For path analysis:

binary trace --project <project-name> --from <source> --to <target> --json

Phase 5: Report and Handoff

Generate a durable report before explaining results to the user:

binary export-report --project <project-name> --type triage --format markdown --json

Read the report. Synthesize findings into a clear explanation. Always mark agent inferences separately from CLI evidence. Example:

## CLI Evidence (deterministic)
- The binary imports VirtualAlloc, WriteProcessMemory, and CreateRemoteThread
  (suspicious-apis, risk_score 8, rule_id: process-injection)
- Entry point at 0x401000, 3 sections (.text, .rdata, .data)

## Agent Assessment (inference)
- The API combination suggests process injection capability. This is a
  heuristic, not a confirmed behavior. The binary would need to be executed
  (out of scope for static analysis) to confirm.

Safety Boundaries

The CLI enforces these boundaries automatically. You must never attempt to bypass them, even if a user asks.

Evidence Standards

All CLI evidence follows a confidence hierarchy. Use these standards when citing evidence in reports or explanations.

Evidence Categories (triage output)

Confidence Levels

Agent Inferences

When you synthesize multiple CLI observations into a conclusion, label it explicitly as an agent inference. Never present an inference as a CLI fact. Use language like:

• "Based on the combination of X and Y, the agent assesses that..."
• "The CLI reports Z as a heuristic (confidence: MEDIUM). The agent interprets this as consistent with..."
• "The CLI could not determine W. The agent notes this is an open question."

Reference Routing

References are loaded on demand — do not read them all at startup. Use this table to route your current task to the right reference file.

Reporting Expectations

Every analysis session must produce at least one of these outputs before the agent considers the task complete:

1. Triage report — for unknown binaries. Covers observations, heuristics, unknowns, and an agent assessment section clearly separated from CLI evidence.
2. Focused analysis — for targeted questions about a specific function, import, or behavior. Answers the user's question with CLI evidence first, agent interpretation second.
3. Capability summary — for "what does this binary do" questions. Maps functional areas with evidence sources and confidence levels.

Reports must:

• Separate CLI evidence (deterministic) from agent assessment (interpretation).
• Cite confidence levels for every heuristic claim.
• Include provenance: project ID, binary SHA-256, adapter and backend versions.
• Note partial results, timeouts, or diagnostic warnings — do not hide limitations.

Verification Matrix

Before presenting results to the user, verify:

Exit Criteria

Stop and report results when:

• A triage report has been generated and the user's question is answered with evidence-backed findings.
• A focused analysis has produced the specific information requested (decompiled function, call path, import list) with provenance.
• Three non-converging diagnostic passes have been attempted for the same issue. Report the evidence gathered and the blocker.
• The binary format is unsupported (exit code 5). Report the format limitation.
• A hard dependency is missing and the user declines to install it. Report the gap.

Do not stop after a single structural query unless it fully answers the user's question. Static analysis is iterative — broad survey, then deep-dive.