恶意程序逆向工程分析

---
name: reverse-engineering
description: Deep binary analysis using Ghidra and IDA Pro - disassembly, decompilation, control flow analysis, and cryptographic algorithm identification
---

# Reverse Engineering

## Overview

This skill provides guidance and tooling for deep binary analysis of malware samples using reverse engineering tools such as Ghidra and IDA Pro. It covers disassembly, decompilation, control flow analysis, and identification of cryptographic algorithms embedded in binaries.

## When to Use

- After initial triage and static analysis indicate deeper inspection is needed
- When understanding the exact logic of malware behavior is required
- To identify custom encryption, packing, or obfuscation routines
- To map out program control flow and call graphs
- To find hidden functionality not revealed by dynamic analysis

## Prerequisites

- **Ghidra** (free, open-source) or **IDA Pro** (commercial): disassembly and decompilation
- **Python 3.10+** for running automation scripts
- **Ghidra headless analyzer** (`analyzeHeadless`): required by `ghidra_analyze.py`
- Familiarity with **x86/x64 assembly** and common calling conventions
- A triaged malware sample (unpacked if possible) ready for deep analysis

## Step-by-Step Instructions

1. **Load the binary** into Ghidra or IDA Pro for initial auto-analysis
2. **Review the entry point** and identify the main function or DllMain
3. **Examine imports/exports** to understand API usage patterns
4. **Trace control flow** from entry point through key decision branches
5. **Identify cryptographic routines** using known constants and patterns
6. **Decompile critical functions** to obtain pseudo-C representation
7. **Annotate and rename** functions and variables for clarity
8. **Document findings** including algorithms, keys, and C2 logic

## Available Scripts

### ghidra_analyze.py
Runs Ghidra in headless mode to perform automated analysis on a binary, extracting functions, strings, imports, exports, and cross-references.

```bash
python scripts/ghidra_analyze.py --binary sample.exe --ghidra-path /opt/ghidra --output report.json
```

### function_identifier.py
Scans binary files for known cryptographic constants (AES S-box, RC4 KSA patterns, MD5/SHA initialization vectors) to identify embedded crypto routines.

```bash
python scripts/function_identifier.py --binary sample.exe --output crypto_report.json
```

## Key Techniques

### Disassembly Analysis
- Identify function prologues and epilogues
- Recognize compiler-generated patterns vs hand-written assembly
- Trace data flow through registers and stack variables

### Decompilation
- Use Ghidra's decompiler for pseudo-C output
- Cross-reference decompiled output with disassembly for accuracy
- Identify inlined functions and optimized code patterns

### Control Flow Analysis
- Map out conditional branches and loop structures
- Identify anti-analysis checks (debugger detection, VM detection)
- Trace error handling and fallback paths

### Crypto Identification
- Search for known algorithm constants in binary data
- Identify custom XOR, RC4, AES, and RSA implementations
- Extract hardcoded keys and initialization vectors

## References

- `references/ghidra-workflow.md` - Step-by-step Ghidra analysis workflow
- `references/x86-quick-ref.md` - x86/x64 instruction quick reference
- `references/crypto-identification.md` - Cryptographic algorithm identification guide