Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble", "decompile", "what does this function do", "find functions", "analyze code", "r2", "ghidra", "pdg", "afl"
Performs deep static analysis on binaries using radare2 and Ghidra. Decompile functions and trace cross-references when you ask to "disassemble", "decompile", or analyze specific functions.
/plugin marketplace add 2389-research/claude-plugins/plugin install binary-re@2389-research-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Understand binary structure and logic without execution. Map functions, trace data flow, decompile critical code.
CRITICAL: Before diving into disassembly, check if known inputs/outputs exist.
⚠️ REQUIRES HUMAN APPROVAL - Get explicit approval before any execution, even for I/O comparison.
# SAFE: Use emulation for cross-arch binaries (after human approval)
# ARM32:
qemu-arm -L /usr/arm-linux-gnueabihf -- ./binary < input.txt > actual.txt
# ARM64:
qemu-aarch64 -L /usr/aarch64-linux-gnu -- ./binary < input.txt > actual.txt
# Docker-based (macOS/cross-arch - see dynamic-analysis Option D):
docker run --rm --platform linux/arm/v7 -v ~/samples:/work:ro \
arm32v7/debian:bullseye-slim sh -c '/work/binary < /work/input.txt' > actual.txt
# x86-64 native (still requires approval):
./binary < input.txt > actual.txt
# Compare outputs:
diff expected.txt actual.txt
cmp -l expected.txt actual.txt | head -20 # Byte-level differences
# Record findings:
# - Where does output first diverge?
# - Does file size match? (logic bug vs truncation)
# - What pattern appears in corruption?
This step often reveals the bug category before any code analysis.
Stage 1 (Light): Function enumeration, strings, imports - fast, broad coverage Stage 2 (Deep): Targeted decompilation, CFG analysis - slow, focused
| Binary Size | Command | Tradeoff |
|---|---|---|
| < 500KB | aaa | Full analysis, may be slow |
| 500KB - 5MB | aa; aac | Functions + all call targets |
| > 5MB | aa + targeted af @addr | Fast, manual depth control |
# Launch r2 with controlled analysis
r2 -q0 -e scr.color=false -e anal.timeout=120 -e anal.maxsize=67108864 binary
# Inside r2 (choose based on binary size):
aa # Basic analysis
aac # Also analyze all call targets (recommended for most binaries)
Critical settings:
anal.timeout=120 - Prevent runaway analysisanal.maxsize=67108864 - 64MB max function sizeaa; aac for medium binaries, aaa only for small onesIf axtj returns empty for known imports:
# The import may be called indirectly or analysis was too shallow
# Option 1: Deeper analysis
aac # Analyze all calls
# Option 2: Manually create function at call target
af @0x8048abc
# Option 3: Search for references to import address
axtj @sym.imp.connect
# All functions as JSON
aflj
# Filter by name pattern
aflj~main
aflj~init
aflj~network
aflj~send
aflj~recv
# Function count
afl~?
# Who calls this function?
axtj @sym.imp.connect
# What does this function call?
axfj @sym.main
# Data references to address
axtj @0x12345
# Find which function contains a string
izj~api.vendor.com
# Note the vaddr, then find containing function
afi @0xVADDR
# Or search and map
"/j api" # Search for string
axtj @@hit* # Xrefs to all hits
# Imports with addresses
iij
# Exports with addresses
iEj
# Symbols (if not stripped)
isj
# Disassemble function as JSON
pdfj @sym.main
# Disassemble N instructions from address
pdj 20 @0x8400
# Print function summary
afi @sym.main
Before attempting decompilation, verify r2ghidra is installed:
# Check if r2ghidra is available
r2 -qc 'pdg?' - 2>/dev/null | grep -q Usage && echo "r2ghidra OK" || echo "SKIP: r2ghidra not installed"
# If missing, install with:
r2pm -ci r2ghidra
If r2ghidra unavailable: Rely on disassembly (pdf) and cross-reference analysis (axt/axf).
# Decompile specific function
pdgj @sym.target_function
# Or named function
pdgj @sym.main
For complex functions or when r2ghidra struggles:
# Create analysis project and run script
analyzeHeadless /tmp/ghidra_proj proj \
-import binary \
-overwrite \
-processor ARM:LE:32:v7 \
-postScript ExportDecompilation.java sym.target_function \
-deleteProject
Processor strings:
ARM:LE:32:v7 or ARM:LE:32:CortexAARCH64:LE:64:v8Ax86:LE:64:defaultMIPS:LE:32:defaultMIPS:BE:32:default# Basic blocks in function
afbj @sym.main
# Function call graph (dot format)
agCd @sym.main > callgraph.dot
# Control flow graph
agfd @sym.main > cfg.dot
# Analyze local variables
afvj @sym.main
# Stack frame layout
afvd @sym.main
# Global data references
adrj
# Find all network-related calls
axtj @sym.imp.socket
axtj @sym.imp.connect
axtj @sym.imp.send
axtj @sym.imp.recv
axtj @sym.imp.SSL_read
axtj @sym.imp.SSL_write
# Trace caller chain
for func in $(aflj | jq -r '.[].name'); do
axfj @$func | grep -q "socket\|connect" && echo $func
done
# Find file operations
axtj @sym.imp.open
axtj @sym.imp.fopen
# Trace string arguments
"/j /etc"
"/j .conf"
"/j .json"
# Check what functions reference these paths
# Common crypto imports
axtj @sym.imp.EVP_EncryptInit
axtj @sym.imp.AES_encrypt
axtj @sym.imp.SHA256
# Hardcoded keys (check strings near crypto calls)
izj | jq '.strings[] | select(.length == 16 or .length == 32)'
| Command | Output | Use Case |
|---|---|---|
aflj | Functions list | Map code structure |
axtj @addr | Xrefs TO address | Who uses this? |
axfj @addr | Xrefs FROM address | What does it call? |
pdfj @addr | Disassembly | Understand instructions |
pdgj @addr | Decompilation | Pseudo-C output |
afbj @addr | Basic blocks | Control flow |
izj | Data strings | Configuration, URLs |
iij | Imports | External dependencies |
iEj | Exports | Public interface |
afvj @addr | Local variables | Stack analysis |
Record analysis findings as structured facts:
{
"functions_analyzed": [
{
"name": "sub_8400",
"address": "0x8400",
"size": 256,
"calls": ["socket", "connect", "send"],
"called_by": ["main", "init_network"],
"strings_referenced": ["api.vendor.com"],
"hypothesis": "network_initialization"
}
],
"call_graph": {
"main": ["init_config", "init_network", "main_loop"],
"init_network": ["sub_8400", "SSL_CTX_new"]
},
"data_flow": [
{
"source": "config_file_read",
"through": ["parse_config", "extract_url"],
"sink": "connect_to_server"
}
]
}
After static analysis, record findings for episodic memory:
[BINARY-RE:static] {filename} (sha256: {hash})
Functions analyzed: {count}
Decompilation performed: {yes|no}
Key functions:
FACT: Function at {addr} calls {imports} (source: r2 axfj)
FACT: Function at {addr} references string "{string}" (source: r2 axtj)
FACT: Function {name} appears to {purpose} (source: decompilation)
Cross-references:
FACT: {caller} calls {callee} (source: r2 axtj)
HYPOTHESIS UPDATE: {refined theory} (confidence: {new_value})
Supporting: {fact_ids}
Contradicting: {fact_ids}
New questions:
QUESTION: {discovered unknown}
Answered questions:
RESOLVED: {question} → {answer}
[BINARY-RE:static] thermostat_daemon (sha256: a1b2c3d4...)
Functions analyzed: 47
Decompilation performed: yes (function 0x8400)
Key functions:
FACT: Function 0x8400 calls curl_easy_perform, curl_easy_setopt (source: r2 axfj)
FACT: Function 0x8400 references string "api.thermco.com/telemetry" (source: r2 axtj)
FACT: Function 0x9200 parses JSON using jsmn library (source: decompilation)
FACT: Function 0x10800 is main loop, calls 0x8400 after sleep(30) (source: r2 pdf)
Cross-references:
FACT: main calls init_config (0x9000) then main_loop (0x10800) (source: r2 axtj)
FACT: main_loop calls send_telemetry (0x8400) in loop (source: r2 pdf)
HYPOTHESIS UPDATE: Telemetry client sending to api.thermco.com every 30 seconds (confidence: 0.85)
Supporting: URL string, curl imports, sleep(30) in loop
Contradicting: none
New questions:
QUESTION: What data fields are included in telemetry payload?
QUESTION: Is there any authentication/API key?
Answered questions:
RESOLVED: "What endpoint?" → api.thermco.com/telemetry via HTTPS
After static analysis:
→ binary-re-dynamic-analysis to verify hypotheses with runtime observation
→ binary-re-synthesis if sufficient understanding reached
Use when working with Payload CMS projects (payload.config.ts, collections, fields, hooks, access control, Payload API). Use when debugging validation errors, security issues, relationship queries, transactions, or hook behavior.