Skills binary-re-dynamic-analysis
📦
binary-re-dynamic-analysis
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Analyze Binary Runtime Behavior
Unknown binaries can hide behavior that static review cannot confirm. This skill guides controlled execution, tracing, debugging, and evidence capture for dynamic analysis.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "binary-re-dynamic-analysis" from https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis.md and its manifest at https://skillstore.io/api/skills/2389-research-binary-re-dynamic-analysis/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "binary-re-dynamic-analysis". Analyze whether this ARM binary contacts a server during startup.
Expected outcome:
The workflow recommends QEMU syscall tracing inside a network-blocked sandbox, followed by evidence notes for socket creation, connection attempts, and timing behavior.
Using "binary-re-dynamic-analysis". The binary fails under emulation with a missing loader error.
Expected outcome:
The response identifies a likely sysroot or linker mismatch, suggests checking the binary architecture, and recommends a container or corrected library path.
Using "binary-re-dynamic-analysis". I need proof that a function receives a secret at runtime.
Expected outcome:
The skill guides GDB breakpoints or Frida hooks, then asks for captured arguments, memory context, and a confidence update in the analysis journal.
Security Audit
Criticalv8 • 7/9/2026 Open versioned report
The skill is primarily an authorized dynamic binary analysis guide and includes an explicit human-approval requirement. Confirmed risks remain because it instructs users to execute unknown binaries, use privileged Docker for binfmt setup, source local GDB configuration, create linker symlinks, and optionally run samples on low-isolation devices.
1
Files scanned
564
Lines analyzed
27
Review items
0
False positives ignored
Confirmed security concerns (3)
Critical
Docker privileged mode
docker run --rm --privileged --platform linux/arm64 \
The setup command explicitly runs Docker with --privileged to register binfmt handlers. This expands container permissions over the host and is a real high-impact action.
High
Low-Isolation On-Device Execution Path
The skill presents on-device analysis as an option when emulation fails and notes that on-device isolation is low. Running unknown binaries on real targets can expose the device, credentials, and attached networks if not tightly controlled.
The analysis options explicitly rate on-device isolation as low, and the on-device section includes commands to run the binary and pull traces from a target device.
Medium
Anti-Analysis Bypass Guidance
The skill explains how to identify and bypass anti-debugging checks, including patching ptrace and using QEMU to avoid /proc-based debugger detection. This is legitimate in authorized reverse engineering but is dual-use and should be framed with stronger authorization boundaries.
The cited section directly lists anti-analysis patterns and bypass techniques. The surrounding purpose is defensive analysis, so the risk is dual-use rather than clearly malicious.
Capability review items (27)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
-ex "source ~/.gdbinit-gef.py" \
The GDB example sources a hidden user configuration file, which can execute debugger extensions or Python commands. This is common in RE setups but should be treated as executable local configuration.
High
Symlink creation
ln -sf /lib/ld-linux-armhf.so.3 /lib/ld-linux.so.3 2>/dev/null || true
The Docker example creates or overwrites a system linker symlink as root inside the container. It is intended for container repair but is dangerous if run outside the intended isolation.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```gdb
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```gdb
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
For cross-arch Frida, deploy `frida-server` to the target device:
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```javascript
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```javascript
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```javascript
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Ruby/shell backtick execution
```bash
This section provides executable dynamic-analysis or instrumentation commands for running or attaching to binaries. The use is legitimate for authorized research, but it can execute untrusted code if copied without a sandbox.
Medium
Hidden file access
-ex "source ~/.gdbinit-gef.py" \
The GDB example sources a hidden user configuration file, which can execute debugger extensions or Python commands. This is common in RE setups but should be treated as executable local configuration.
Risk Factors
⚙️ External commands (50)
SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:34-41 SKILL.md:41-45 SKILL.md:45-47 SKILL.md:47-53 SKILL.md:53-73 SKILL.md:73-82 SKILL.md:82-88 SKILL.md:88 SKILL.md:89 SKILL.md:90 SKILL.md:91-95 SKILL.md:95-107 SKILL.md:107-113 SKILL.md:113-128 SKILL.md:128-136 SKILL.md:136-146 SKILL.md:146-150 SKILL.md:150-171 SKILL.md:171-177 SKILL.md:177-183 SKILL.md:183-187 SKILL.md:187-202 SKILL.md:202-217 SKILL.md:217-218 SKILL.md:218-224 SKILL.md:224-228 SKILL.md:228-246 SKILL.md:246-248 SKILL.md:248-251 SKILL.md:251-255 SKILL.md:255-269 SKILL.md:269-273 SKILL.md:273-281 SKILL.md:281-289 SKILL.md:289-303 SKILL.md:303-307 SKILL.md:307-312 SKILL.md:312-316 SKILL.md:316-321 SKILL.md:321-327 SKILL.md:327-329 SKILL.md:329-333 SKILL.md:333-339 SKILL.md:339-349 SKILL.md:349-358 SKILL.md:358-362 SKILL.md:362-368
🌐 Network access (4)
Detected Patterns
Docker privileged mode
Audited by: claude View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2389-research-binary-re-dynamic-analysis/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/2389-research-binary-re-dynamic-analysis.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
2389-research. (2026). binary-re-dynamic-analysis security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis/audits/8BibTeX citation
@techreport{2389-research-2389-research-binary-re-dynamic-analysis-2026,
author = {2389-research},
title = {binary-re-dynamic-analysis security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis/audits/8},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "binary-re-dynamic-analysis security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
- name: "2389-research"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/2389-research-binary-re-dynamic-analysis/audits/8"
identifiers:
- type: other
value: "skillstore:2389-research-binary-re-dynamic-analysis:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Validate suspected network behavior
Run a sample in a network-controlled sandbox and confirm outbound connection attempts with syscall traces.
Debug cross-architecture firmware tools
Use QEMU and GDB to execute ARM or MIPS binaries from a Linux or macOS workstation.
Capture runtime evidence for reports
Record file access, process activity, network events, and hypothesis updates in a consistent analysis journal.
Try These Prompts
Choose a safe analysis method
I have an unknown Linux ARM binary. Help me choose the safest dynamic analysis method and list the approvals and sandbox settings needed before running it.
Trace runtime behavior
Guide me through tracing this binary with QEMU or strace. I need to identify file access, process creation, and network attempts without allowing real outbound traffic.
Debug a suspicious branch
Help me attach GDB to a cross-architecture binary under QEMU, set breakpoints near the suspected check, and collect register and memory evidence.
Instrument function calls
Create a Frida-based dynamic analysis plan for a native binary. I want to intercept network-related functions, log arguments, and preserve evidence for a final report.
Best Practices
- Get explicit human approval and document the sandbox before executing any binary.
- Prefer QEMU or a network-blocked container before lower-isolation on-device execution.
- Record each runtime claim with the tool output or observation that supports it.
Avoid
- Do not run unknown binaries directly on a workstation without isolation and resource limits.
- Do not enable privileged Docker or device access without understanding the host impact.
- Do not treat example IP addresses, paths, or journal entries as evidence from a real sample.
Frequently Asked Questions
Does this skill execute binaries automatically?
No. It gives workflows and commands, and it states that human approval is required before execution.
What tools does it cover?
It covers QEMU user mode, GDB, gdbserver, Frida, Docker, strace, LD_DEBUG, nsjail, and related troubleshooting.
Is it suitable for malware analysis?
It can support authorized malware analysis when used inside a properly isolated and monitored environment.
Can it analyze cross-architecture binaries?
Yes. It includes ARM, ARM64, MIPS, and x86 32-bit workflows using QEMU, Docker, or target devices.
Does it require privileged access?
Some setup paths use privileged Docker or target-device debugging. Those steps require careful review and approval.
What output should users expect?
Users should expect runtime observations, syscall summaries, debugger notes, function-hook evidence, and updated hypotheses.
Developer Details
Author
2389-researchLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/2389-research/claude-plugins/tree/main/binary-re/skills/dynamic-analysisRef
7db9b9f06e0ab79c575b58bc48c4d8dc9849f424
Maintenance freshness
7/18/2026
Usage
11 downloads · 175 views
File structure
📄 SKILL.md