# Analyze Compiled Binaries with Proven Patterns

Compiled binaries obscure source-level logic and data structures. This skill maps common assembly patterns to clearer control flow, types, and function behavior.

## Install

```bash
npx skillstore add sickn33/binary-analysis-patterns
```

## Metadata

- Status: approved
- Slug: sickn33-binary-analysis-patterns
- Skillstore revision: r2
- Version status: missing
- Tree hash: df6782b5fc176b5fec103107ef8cbb17886072b0283a2c3ea0f34d100aeab1f0
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/binary-analysis-patterns
- Ref: 5a26d1d61d694db29af9b138c661c1981076d9df
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-binary-analysis-patterns
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-binary-analysis-patterns/manifest

## Capabilities

- Explains x86-64, ARM64, and ARM32 calling conventions.
- Identifies common branches, loops, jump tables, and function boundaries.
- Relates memory access patterns to arrays, structures, and linked lists.
- Supports variable, type, and function signature recovery from disassembly.
- Provides reference examples for Ghidra scripting and IDAPython analysis.

## Use Cases

- Triage unfamiliar functions: Recognize prologues, arguments, branches, and returns before deeper investigation.
- Teach assembly recognition: Connect common source constructs with x86 and ARM instruction patterns.
- Improve decompiler annotations: Infer names, types, structures, and signatures for clearer project documentation.

## Prompt Templates

### Identify function basics

```
Inspect this disassembly: [paste snippet]. Identify the architecture, calling convention, prologue, epilogue, arguments, and likely return value. Explain each conclusion.
```

### Reconstruct control flow

```
Reconstruct this assembly: [paste snippet]. Describe branches, loops, switch logic, and signed versus unsigned comparisons. Mark uncertain interpretations.
```

### Recover data and types

```
Analyze memory accesses here: [paste snippet]. Infer arrays, structures, field offsets, variable widths, and a probable function signature. Explain supporting evidence.
```

### Assess optimized output

```
Review this binary excerpt: [paste snippet]. Compare plausible decompilations, identify optimizer artifacts, and produce an analysis workflow with confidence levels.
```

## Limitations

- Provides reference guidance but does not execute disassemblers or inspect binary files directly.
- Examples are generic and may differ after compiler optimization or obfuscation.
- Recovered types and signatures require validation against the target architecture.
- The referenced implementation playbook is not included in the scanned package.

## Best Practices

- Confirm architecture and calling convention before interpreting registers.
- Trace control flow and cross-references before assigning semantic names.
- Document assumptions and validate recovered types against multiple instructions.

## Anti Patterns

- Do not assume optimized assembly mirrors original source structure.
- Do not infer a type from one instruction without supporting accesses.
- Do not treat decompiler output as authoritative without checking disassembly.

## Security Audit

- Audited at: 2026-08-14T10:29:08.938\+00:00
- Summary: All 44 static findings are false positives caused by Markdown inline code and fenced examples in SKILL.md. No shell execution, prompt injection, data exfiltration, or other malicious intent was found.

## Stats

- Views: 129
- Downloads: 18
- Favorites: 0
- Popularity score: 0