Reverse engineer ELF binaries and firmware for ARM64, ARMv7, x86_64 via automated triage for architecture detection, static analysis with radare2 and Ghidra for disassembly and decompilation, dynamic analysis with QEMU emulation, GDB debugging, Frida hooking, plus tool setup and structured report synthesis with hypothesis validation.
npx claudepluginhub 2389-research/claude-pluginsUse when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary", "execute", "debug", "trace syscalls", "set breakpoint", "qemu", "gdb", "frida", "strace", "watch memory"
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"
Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence chains. Keywords - "summarize findings", "generate report", "document analysis", "what did we find", "write up results", "export findings"
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu missing", "tool not installed", "configure gdb", "cross-compiler"
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary", "identify architecture", "check file type", "rabin2", "file analysis", "quick scan"
Claude Code plugins and MCP servers we use at 2389.
Add the marketplace:
/plugin marketplace add 2389-research/claude-plugins
Install plugins individually:
/plugin install css-development@2389-research
/plugin install firebase-development@2389-research
/plugin install terminal-title@2389-research
| Plugin | Description | Documentation |
|---|---|---|
| css-development | CSS development workflows with Tailwind composition, semantic naming, and dark mode by default | README |
| firebase-development | Firebase project workflows including setup, features, debugging, and validation | README |
| terminal-title | Automatically updates terminal title with emoji + project + topic context, plus TodoWrite conventions | README |
This marketplace also lists external MCP servers:
Browse the marketplace: https://2389-research.github.io/claude-plugins
This is a monorepo containing multiple independent plugins. Each plugin:
css-development/, firebase-development/, etc.).claude-plugin/plugin.json configurationSee CLAUDE.md for developer documentation on the monorepo structure and conventions.
mkdir -p new-plugin/.claude-pluginnew-plugin/.claude-plugin/plugin.jsonnew-plugin/skills/new-plugin/README.md and new-plugin/CLAUDE.md.claude-plugin/marketplace.json with new plugin entrynpm run generateSee docs/DEVELOPMENT.md for comprehensive development guide.
Want to chat about these plugins or how we use Claude Code?
Email us: hello@2389.ai
We'd love to hear from you!
Binary reverse engineering, malware analysis, firmware security, and software protection research for authorized security research, CTF competitions, and defensive security
Share bugs, ideas, or general feedback.
Reverse engineer binaries using Ghidra's headless analyzer. Decompile executables, extract functions, strings, symbols, and analyze call graphs without GUI.
Iterative artifact refinement with investigation-first judge board - constructs problem-specific judges that read the code, understand the problem, and propose evidence-based improvements
Debugging specialist for errors, test failures, and unexpected behavior. Use proactively when encountering any issues.
Interact with and understand the DWARF debugging format
Automates browser interactions for web testing, form filling, screenshots, and data extraction