{"id":"5c13c2f6-d9e0-4aae-b93e-8b38e69096c6","shortId":"GksT3J","kind":"skill","title":"binary-analysis-patterns","tagline":"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.","description":"# Binary Analysis Patterns\n\nComprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\n\n## Use this skill when\n\n- Working on binary analysis patterns tasks or workflows\n- Needing guidance, best practices, or checklists for binary analysis patterns\n\n## Do not use this skill when\n\n- The task is unrelated to binary analysis patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources/implementation-playbook.md`.\n\n## Disassembly Fundamentals\n\n### x86-64 Instruction Patterns\n\n#### Function Prologue/Epilogue\n```asm\n; Standard prologue\npush rbp           ; Save base pointer\nmov rbp, rsp       ; Set up stack frame\nsub rsp, 0x20      ; Allocate local variables\n\n; Leaf function (no calls)\n; May skip frame pointer setup\nsub rsp, 0x18      ; Just allocate locals\n\n; Standard epilogue\nmov rsp, rbp       ; Restore stack pointer\npop rbp            ; Restore base pointer\nret\n\n; Leave instruction (equivalent)\nleave              ; mov rsp, rbp; pop rbp\nret\n```\n\n#### Calling Conventions\n\n**System V AMD64 (Linux, macOS)**\n```asm\n; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack\n; Return: RAX (and RDX for 128-bit)\n; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11\n; Callee-saved: RBX, RBP, R12-R15\n\n; Example: func(a, b, c, d, e, f, g)\nmov rdi, [a]       ; 1st arg\nmov rsi, [b]       ; 2nd arg\nmov rdx, [c]       ; 3rd arg\nmov rcx, [d]       ; 4th arg\nmov r8, [e]        ; 5th arg\nmov r9, [f]        ; 6th arg\npush [g]           ; 7th arg on stack\ncall func\n```\n\n**Microsoft x64 (Windows)**\n```asm\n; Arguments: RCX, RDX, R8, R9, then stack\n; Shadow space: 32 bytes reserved on stack\n; Return: RAX\n\n; Example: func(a, b, c, d, e)\nsub rsp, 0x28      ; Shadow space + alignment\nmov rcx, [a]       ; 1st arg\nmov rdx, [b]       ; 2nd arg\nmov r8, [c]        ; 3rd arg\nmov r9, [d]        ; 4th arg\nmov [rsp+0x20], [e] ; 5th arg on stack\ncall func\nadd rsp, 0x28\n```\n\n### ARM Assembly Patterns\n\n#### ARM64 (AArch64) Calling Convention\n```asm\n; Arguments: X0-X7\n; Return: X0 (and X1 for 128-bit)\n; Frame pointer: X29\n; Link register: X30\n\n; Function prologue\nstp x29, x30, [sp, #-16]!  ; Save FP and LR\nmov x29, sp                 ; Set frame pointer\n\n; Function epilogue\nldp x29, x30, [sp], #16    ; Restore FP and LR\nret\n```\n\n#### ARM32 Calling Convention\n```asm\n; Arguments: R0-R3, then stack\n; Return: R0 (and R1 for 64-bit)\n; Link register: LR (R14)\n\n; Function prologue\npush {fp, lr}\nadd fp, sp, #4\n\n; Function epilogue\npop {fp, pc}    ; Return by popping PC\n```\n\n## Control Flow Patterns\n\n### Conditional Branches\n\n```asm\n; if (a == b)\ncmp eax, ebx\njne skip_block\n; ... if body ...\nskip_block:\n\n; if (a < b) - signed\ncmp eax, ebx\njge skip_block    ; Jump if greater or equal\n; ... if body ...\nskip_block:\n\n; if (a < b) - unsigned\ncmp eax, ebx\njae skip_block    ; Jump if above or equal\n; ... if body ...\nskip_block:\n```\n\n### Loop Patterns\n\n```asm\n; for (int i = 0; i < n; i++)\nxor ecx, ecx           ; i = 0\nloop_start:\ncmp ecx, [n]           ; i < n\njge loop_end\n; ... loop body ...\ninc ecx                ; i++\njmp loop_start\nloop_end:\n\n; while (condition)\njmp loop_check\nloop_body:\n; ... body ...\nloop_check:\ncmp eax, ebx\njl loop_body\n\n; do-while\nloop_body:\n; ... body ...\ncmp eax, ebx\njl loop_body\n```\n\n### Switch Statement Patterns\n\n```asm\n; Jump table pattern\nmov eax, [switch_var]\ncmp eax, max_case\nja default_case\njmp [jump_table + eax*8]\n\n; Sequential comparison (small switch)\ncmp eax, 1\nje case_1\ncmp eax, 2\nje case_2\ncmp eax, 3\nje case_3\njmp default_case\n```\n\n## Data Structure Patterns\n\n### Array Access\n\n```asm\n; array[i] - 4-byte elements\nmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index\n\n; array[i] - 8-byte elements\nmov rax, [rbx + rcx*8]\n\n; Multi-dimensional array[i][j]\n; arr[i][j] = base + (i * cols + j) * element_size\nimul eax, [cols]\nadd eax, [j]\nmov edx, [rbx + rax*4]\n```\n\n### Structure Access\n\n```c\nstruct Example {\n    int a;      // offset 0\n    char b;     // offset 4\n    // padding  // offset 5-7\n    long c;     // offset 8\n    short d;    // offset 16\n};\n```\n\n```asm\n; Accessing struct fields\nmov rdi, [struct_ptr]\nmov eax, [rdi]         ; s->a (offset 0)\nmovzx eax, byte [rdi+4] ; s->b (offset 4)\nmov rax, [rdi+8]       ; s->c (offset 8)\nmovzx eax, word [rdi+16] ; s->d (offset 16)\n```\n\n### Linked List Traversal\n\n```asm\n; while (node != NULL)\nlist_loop:\ntest rdi, rdi          ; node == NULL?\njz list_done\n; ... process node ...\nmov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)\njmp list_loop\nlist_done:\n```\n\n## Common Code Patterns\n\n### String Operations\n\n```asm\n; strlen pattern\nxor ecx, ecx\nstrlen_loop:\ncmp byte [rdi + rcx], 0\nje strlen_done\ninc ecx\njmp strlen_loop\nstrlen_done:\n; ecx contains length\n\n; strcpy pattern\nstrcpy_loop:\nmov al, [rsi]\nmov [rdi], al\ntest al, al\njz strcpy_done\ninc rsi\ninc rdi\njmp strcpy_loop\nstrcpy_done:\n\n; memcpy using rep movsb\nmov rdi, dest\nmov rsi, src\nmov rcx, count\nrep movsb\n```\n\n### Arithmetic Patterns\n\n```asm\n; Multiplication by constant\n; x * 3\nlea eax, [rax + rax*2]\n\n; x * 5\nlea eax, [rax + rax*4]\n\n; x * 10\nlea eax, [rax + rax*4]  ; x * 5\nadd eax, eax            ; * 2\n\n; Division by power of 2 (signed)\nmov eax, [x]\ncdq                     ; Sign extend to EDX:EAX\nand edx, 7              ; For divide by 8\nadd eax, edx            ; Adjust for negative\nsar eax, 3              ; Arithmetic shift right\n\n; Modulo power of 2\nand eax, 7              ; x % 8\n```\n\n### Bit Manipulation\n\n```asm\n; Test specific bit\ntest eax, 0x80          ; Test bit 7\njnz bit_set\n\n; Set bit\nor eax, 0x10            ; Set bit 4\n\n; Clear bit\nand eax, ~0x10          ; Clear bit 4\n\n; Toggle bit\nxor eax, 0x10           ; Toggle bit 4\n\n; Count leading zeros\nbsr eax, ecx            ; Bit scan reverse\nxor eax, 31             ; Convert to leading zeros\n\n; Population count (popcnt)\npopcnt eax, ecx         ; Count set bits\n```\n\n## Decompilation Patterns\n\n### Variable Recovery\n\n```asm\n; Local variable at rbp-8\nmov qword [rbp-8], rax  ; Store to local\nmov rax, [rbp-8]        ; Load from local\n\n; Stack-allocated array\nlea rax, [rbp-0x40]     ; Array starts at rbp-0x40\nmov [rax], edx          ; array[0] = value\nmov [rax+4], ecx        ; array[1] = value\n```\n\n### Function Signature Recovery\n\n```asm\n; Identify parameters by register usage\nfunc:\n    ; rdi used as first param (System V)\n    mov [rbp-8], rdi    ; Save param to local\n    ; rsi used as second param\n    mov [rbp-16], rsi\n    ; Identify return by RAX at end\n    mov rax, [result]\n    ret\n```\n\n### Type Recovery\n\n```asm\n; 1-byte operations suggest char/bool\nmovzx eax, byte [rdi]   ; Zero-extend byte\nmovsx eax, byte [rdi]   ; Sign-extend byte\n\n; 2-byte operations suggest short\nmovzx eax, word [rdi]\nmovsx eax, word [rdi]\n\n; 4-byte operations suggest int/float\nmov eax, [rdi]\nmovss xmm0, [rdi]       ; Float\n\n; 8-byte operations suggest long/double/pointer\nmov rax, [rdi]\nmovsd xmm0, [rdi]       ; Double\n```\n\n## Ghidra Analysis Tips\n\n### Improving Decompilation\n\n```java\n// In Ghidra scripting\n// Fix function signature\nFunction func = getFunctionAt(toAddr(0x401000));\nfunc.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);\n\n// Create structure type\nStructureDataType struct = new StructureDataType(\"MyStruct\", 0);\nstruct.add(IntegerDataType.dataType, \"field_a\", null);\nstruct.add(PointerDataType.dataType, \"next\", null);\n\n// Apply to memory\ncreateData(toAddr(0x601000), struct);\n```\n\n### Pattern Matching Scripts\n\n```python\n# Find all calls to dangerous functions\nfor func in currentProgram.getFunctionManager().getFunctions(True):\n    for ref in getReferencesTo(func.getEntryPoint()):\n        if func.getName() in [\"strcpy\", \"sprintf\", \"gets\"]:\n            print(f\"Dangerous call at {ref.getFromAddress()}\")\n```\n\n## IDA Pro Patterns\n\n### IDAPython Analysis\n\n```python\nimport idaapi\nimport idautils\nimport idc\n\n# Find all function calls\ndef find_calls(func_name):\n    for func_ea in idautils.Functions():\n        for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):\n            if idc.print_insn_mnem(head) == \"call\":\n                target = idc.get_operand_value(head, 0)\n                if idc.get_func_name(target) == func_name:\n                    print(f\"Call to {func_name} at {hex(head)}\")\n\n# Rename functions based on strings\ndef auto_rename():\n    for s in idautils.Strings():\n        for xref in idautils.XrefsTo(s.ea):\n            func = idaapi.get_func(xref.frm)\n            if func and \"sub_\" in idc.get_func_name(func.start_ea):\n                # Use string as hint for naming\n                pass\n```\n\n## Best Practices\n\n### Analysis Workflow\n\n1. **Initial triage**: File type, architecture, imports/exports\n2. **String analysis**: Identify interesting strings, error messages\n3. **Function identification**: Entry points, exports, cross-references\n4. **Control flow mapping**: Understand program structure\n5. **Data structure recovery**: Identify structs, arrays, globals\n6. **Algorithm identification**: Crypto, hashing, compression\n7. **Documentation**: Comments, renamed symbols, type definitions\n\n### Common Pitfalls\n\n- **Optimizer artifacts**: Code may not match source structure\n- **Inline functions**: Functions may be expanded inline\n- **Tail call optimization**: `jmp` instead of `call` + `ret`\n- **Dead code**: Unreachable code from optimization\n- **Position-independent code**: RIP-relative addressing\n\n## Limitations\n- Use this skill only when the task clearly matches the scope described above.\n- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.\n- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.","tags":["binary","analysis","patterns","antigravity","awesome","skills","sickn33","agent-skills","agentic-skills","ai-agent-skills","ai-agents","ai-coding"],"capabilities":["skill","source-sickn33","skill-binary-analysis-patterns","topic-agent-skills","topic-agentic-skills","topic-ai-agent-skills","topic-ai-agents","topic-ai-coding","topic-ai-workflows","topic-antigravity","topic-antigravity-skills","topic-claude-code","topic-claude-code-skills","topic-codex-cli","topic-codex-skills"],"categories":["antigravity-awesome-skills"],"synonyms":[],"warnings":[],"endpointUrl":"https://skills.sh/sickn33/antigravity-awesome-skills/binary-analysis-patterns","protocol":"skill","transport":"skills-sh","auth":{"type":"none","details":{"cli":"npx skills add sickn33/antigravity-awesome-skills","source_repo":"https://github.com/sickn33/antigravity-awesome-skills","install_from":"skills.sh"}},"qualityScore":"0.700","qualityRationale":"deterministic score 0.70 from registry signals: · indexed on github topic:agent-skills · 34882 github stars · SKILL.md body (9,917 chars)","verified":false,"liveness":"unknown","lastLivenessCheck":null,"agentReviews":{"count":0,"score_avg":null,"cost_usd_avg":null,"success_rate":null,"latency_p50_ms":null,"narrative_summary":null,"summary_updated_at":null},"enrichmentModel":"deterministic:skill-github:v1","enrichmentVersion":1,"enrichedAt":"2026-04-24T12:50:40.806Z","embedding":null,"createdAt":"2026-04-18T21:33:34.762Z","updatedAt":"2026-04-24T12:50:40.806Z","lastSeenAt":"2026-04-24T12:50:40.806Z","tsv":"'+0':323 '+16':713 '+4':696,1013 '+8':704,740 '-16':366,1050 '-64':113 '-7':668 '-8':974,978,986,1037 '0':491,499,660,691,771,1009,1152,1250 '0x10':920,928,936 '0x18':150 '0x20':135 '0x28':297,334 '0x40':998,1004 '0x401000':1139 '0x601000':1167 '0x80':909 '1':577,580,1016,1065,1309 '10':846 '128':200,352 '16':383,676,717 '1st':233,304 '2':583,586,837,857,862,895,1086,1316 '2nd':238,309 '3':589,592,832,888,1324 '31':951 '32':281 '3rd':243,314 '4':418,604,611,651,664,700,844,851,923,931,939,1099,1333 '4th':248,319 '5':667,839,853,1340 '5th':253,326 '6':1348 '64':404 '6th':258 '7':875,898,912,1354 '7th':262 '8':570,618,625,672,708,748,879,900,1111 'aarch64':339 'access':600,653,678 'action':99 'add':332,415,644,854,880 'address':1399 'adjust':883 'al':790,794,796,797 'algorithm':1349 'align':300 'alloc':136,152,992 'amd64':182 'analysi':3,21,45,58,72,1124,1206,1307,1318 'analyz':10,28 'appli':91,1162 'architectur':1314 'arg':234,239,244,249,254,259,263,305,310,315,320,327 'argument':186,272,343,393 'arithmet':825,889 'arm':335 'arm32':389 'arm64':338 'arr':632 'array':599,602,616,629,993,999,1008,1015,1346 'artifact':1364 'ask':1433 'asm':118,185,271,342,392,433,487,551,601,677,721,759,827,903,969,1021,1064 'assembl':14,32,336 'assum':744 'auto':1273 'b':224,237,291,308,436,449,468,662,698 'base':124,165,613,635,1269 'best':52,93,1305 'binari':2,12,20,30,44,57,71 'binary-analysis-pattern':1 'bit':201,353,405,901,906,911,914,917,922,925,930,933,938,946,964 'block':442,446,456,465,475,484 'bodi':444,463,482,511,526,527,535,540,541,547 'boundari':1441 'branch':432 'bsr':943 'byte':282,605,619,694,768,1066,1072,1077,1080,1085,1087,1100,1112 'c':225,242,292,313,654,670,706 'call':142,178,266,330,340,390,1175,1199,1217,1220,1244,1260,1379,1384 'calle':214 'callee-sav':213 'caller':203 'caller-sav':202 'case':562,565,579,585,591,595 'cdq':867 'char':661 'char/bool':1069 'check':524,529 'checklist':55 'clarif':1435 'clarifi':85 'clear':924,929,1408 'cmp':437,451,470,502,530,542,559,575,581,587,767 'code':15,33,755,1365,1387,1389,1395 'col':637,643 'comment':1356 'common':754,1361 'comparison':572 'compil':11,29 'comprehens':5,23 'compress':1353 'condit':431,521 'constant':830 'constraint':87 'contain':783 'control':428,1334 'convent':179,341,391 'convert':952 'count':822,940,957,962 'creat':1144 'createdata':1165 'criteria':1444 'cross':1331 'cross-refer':1330 'crypto':1351 'currentprogram.getfunctionmanager':1182 'd':226,247,293,318,674,715 'danger':1177,1198 'data':596,1341 'dead':1386 'decompil':965,1127 'def':1218,1272 'default':564,594 'defin':1143 'definit':1360 'describ':1412 'dest':816 'detail':104 'differ':77 'dimension':628 'disassembl':110 'divid':877 'divis':858 'do-whil':536 'document':1355 'domain':78 'done':734,753,774,781,800,809 'doubl':1122 'e':227,252,294,325 'ea':1225,1233,1238,1297 'eax':438,452,471,531,543,556,560,569,576,582,588,608,642,645,686,693,710,834,841,848,855,856,865,872,881,887,897,908,919,927,935,944,950,960,1071,1079,1092,1096,1105 'ebx':439,453,472,532,544 'ecx':496,497,503,513,763,764,776,782,945,961,1014 'edx':648,871,874,882,1007 'element':606,620,639 'end':509,519,1057,1236 'entri':1327 'environ':1424 'environment-specif':1423 'epilogu':155,378,420 'equal':461,480 'equival':170 'error':1322 'exampl':105,221,288,656 'expand':1376 'expert':1429 'export':1329 'extend':869,1076,1084 'f':228,257,1197,1259 'field':680,1155 'file':1312 'find':1173,1214,1219 'first':1031 'fix':1132 'float':1110 'flow':429,1335 'fp':368,385,413,416,422 'frame':132,145,354,375 'func':222,267,289,331,1027,1136,1180,1221,1224,1232,1235,1237,1253,1256,1262,1284,1286,1289,1294 'func.getentrypoint':1189 'func.getname':1191 'func.setreturntype':1140 'func.start':1296 'function':116,140,360,377,410,419,1018,1133,1135,1178,1216,1268,1325,1372,1373 'fundament':111 'g':229,261 'get':1195 'getfunct':1183 'getfunctionat':1137 'getreferencesto':1188 'ghidra':1123,1130 'global':1347 'goal':86 'greater':459 'guidanc':51 'hash':1352 'head':1229,1243,1249,1266 'hex':1265 'hint':1301 'ida':1202 'idaapi':1209 'idaapi.get':1285 'idapython':1205 'idautil':1211 'idautils.functions':1227 'idautils.heads':1231 'idautils.strings':1278 'idautils.xrefsto':1282 'idc':1213 'idc.find':1234 'idc.get':1246,1252,1293 'idc.print':1240 'identif':1326,1350 'identifi':1022,1052,1319,1344 'import':1208,1210,1212 'imports/exports':1315 'improv':1126 'imul':641 'inc':512,775,801,803 'independ':1394 'index':615 'initi':1310 'inlin':1371,1377 'input':90,1438 'insn':1241 'instead':1382 'instruct':84,114,169 'int':489,657 'int/float':1103 'integerdatatype.datatype':1141,1154 'interest':1320 'j':631,634,638,646 'ja':563 'jae':473 'java':1128 'je':578,584,590,772 'jge':454,507 'jl':533,545 'jmp':515,522,566,593,749,777,805,1381 'jne':440 'jnz':913 'jump':457,476,552,567 'jz':732,798 'ldp':379 'lea':833,840,847,994 'lead':941,954 'leaf':139 'leav':168,171 'length':784 'limit':1400 'link':357,406,718 'linux':183 'list':719,725,733,750,752 'load':987 'local':137,153,970,982,989,1042 'logic':19,37 'long':669 'long/double/pointer':1115 'loop':485,500,508,510,516,518,523,525,528,534,539,546,726,751,766,779,788,807 'lr':370,387,408,414 'maco':184 'manipul':902 'map':1336 'match':1170,1368,1409 'max':561 'may':143,1366,1374 'memcpi':810 'memori':1164 'messag':1323 'microsoft':268 'miss':1446 'mnem':1242 'modulo':892 'mov':126,156,172,230,235,240,245,250,255,301,306,311,316,321,371,555,607,621,647,681,685,701,737,789,792,814,817,820,864,975,983,1005,1011,1035,1048,1058,1104,1116 'movsb':813,824 'movsd':1119 'movss':1107 'movsx':1078,1095 'movzx':692,709,1070,1091 'multi':627 'multi-dimension':626 'multipl':828 'mystruct':1151 'n':493,504,506 'name':1222,1254,1257,1263,1295,1303 'need':50,75 'negat':885 'new':1149 'next':743,745,1160 'node':723,730,736,741,742 'null':724,731,1157,1161 'offset':659,663,666,671,675,690,699,707,716,747 'open':108 'oper':758,1067,1088,1101,1113 'operand':1247 'optim':1363,1380,1391 'outcom':97 'output':1418 'outsid':81 'pad':665 'param':1032,1040,1047 'paramet':1023 'pass':1304 'pattern':4,6,22,24,46,59,73,115,337,430,486,550,554,598,756,761,786,826,966,1169,1204 'pc':423,427 'permiss':1439 'pitfal':1362 'point':1328 'pointer':125,146,161,166,355,376 'pointerdatatype.datatype':1159 'pop':162,175,421,426 'popcnt':958,959 'popul':956 'posit':1393 'position-independ':1392 'power':860,893 'practic':53,94,1306 'print':1196,1258 'pro':1203 'process':735 'program':18,36,1338 'prologu':120,361,411 'prologue/epilogue':117 'provid':98 'ptr':684 'push':121,260,412 'python':1172,1207 'qword':976 'r0':395,400 'r0-r3':394 'r1':402 'r11':212 'r12':219 'r12-r15':218 'r14':409 'r15':220 'r3':396 'r8':191,211,251,275,312 'r8-r11':210 'r9':192,256,276,317 'rax':196,205,287,622,650,702,835,836,842,843,849,850,979,984,995,1006,1012,1055,1059,1117 'rbp':122,127,158,163,174,176,217,973,977,985,997,1003,1036,1049 'rbp-0x40':996,1002 'rbx':216,609,612,623,649 'rcx':190,206,246,273,302,610,614,624,770,821 'rdi':187,209,231,682,687,695,703,712,728,729,738,739,769,793,804,815,1028,1038,1073,1081,1094,1098,1106,1109,1118,1121 'rdx':189,198,207,241,274,307 'reconstruct':17,35 'recoveri':968,1020,1063,1343 'ref':1186 'ref.getfromaddress':1201 'refer':1332 'regist':358,407,1025 'relat':1398 'relev':92 'renam':1267,1274,1357 'rep':812,823 'requir':89,107,1437 'reserv':283 'resources/implementation-playbook.md':109 'restor':159,164,384 'result':1060 'ret':167,177,388,1061,1385 'return':195,286,347,399,424,1053 'revers':948 'review':1430 'right':891 'rip':1397 'rip-rel':1396 'rsi':188,208,236,791,802,818,1043,1051 'rsp':128,134,149,157,173,296,322,333 's.ea':1283 'safeti':1440 'sar':886 'save':123,204,215,367,1039 'scan':947 'scope':83,1411 'script':1131,1171 'second':1046 'sequenti':571 'set':129,374,915,916,921,963 'setup':147 'shadow':279,298 'shift':890 'short':673,1090 'sign':450,863,868,1083 'sign-extend':1082 'signatur':1019,1134 'size':640 'skill':40,64,1403 'skill-binary-analysis-patterns' 'skip':144,441,445,455,464,474,483 'small':573 'sourc':1369 'source-sickn33' 'sourcetype.user':1142 'sp':365,373,382,417 'space':280,299 'specif':905,1425 'sprintf':1194 'src':819 'stack':131,160,194,265,278,285,329,398,991 'stack-alloc':990 'standard':119,154 'start':501,517,1000 'statement':549 'step':100 'stop':1431 'store':980 'stp':362 'strcpi':785,787,799,806,808,1193 'string':757,1271,1299,1317,1321 'strlen':760,765,773,778,780 'struct':655,679,683,1148,1168,1345 'struct.add':1153,1158 'structur':597,652,1145,1339,1342,1370 'structuredatatyp':1147,1150 'sub':133,148,295,1291 'substitut':1421 'success':1443 'suggest':1068,1089,1102,1114 'switch':548,557,574 'symbol':1358 'system':180,1033 'tabl':553,568 'tail':1378 'target':1245,1255 'task':47,67,1407 'techniqu':8,26 'test':727,795,904,907,910,1427 'tip':1125 'toaddr':1138,1166 'toggl':932,937 'tool':80 'topic-agent-skills' 'topic-agentic-skills' 'topic-ai-agent-skills' 'topic-ai-agents' 'topic-ai-coding' 'topic-ai-workflows' 'topic-antigravity' 'topic-antigravity-skills' 'topic-claude-code' 'topic-claude-code-skills' 'topic-codex-cli' 'topic-codex-skills' 'travers':720 'treat':1416 'triag':1311 'true':1184 'type':1062,1146,1313,1359 'understand':13,31,1337 'unreach':1388 'unrel':69 'unsign':469 'usag':1026 'use':38,62,811,1029,1044,1298,1401 'v':181,1034 'valid':96,1426 'valu':1010,1017,1248 'var':558 'variabl':138,967,971 'verif':102 'window':270 'word':711,1093,1097 'work':42 'workflow':49,1308 'x':831,838,845,852,866,899 'x0':345,348 'x0-x7':344 'x1':350 'x20':324 'x29':356,363,372,380 'x30':359,364,381 'x64':269 'x7':346 'x86':112 'xmm0':1108,1120 'xor':495,762,934,949 'xref':1280 'xref.frm':1287 'zero':942,955,1075 'zero-extend':1074","prices":[{"id":"c0df6108-0342-4acc-84a0-aaac3e9e588d","listingId":"5c13c2f6-d9e0-4aae-b93e-8b38e69096c6","amountUsd":"0","unit":"free","nativeCurrency":null,"nativeAmount":null,"chain":null,"payTo":null,"paymentMethod":"skill-free","isPrimary":true,"details":{"org":"sickn33","category":"antigravity-awesome-skills","install_from":"skills.sh"},"createdAt":"2026-04-18T21:33:34.762Z"}],"sources":[{"listingId":"5c13c2f6-d9e0-4aae-b93e-8b38e69096c6","source":"github","sourceId":"sickn33/antigravity-awesome-skills/binary-analysis-patterns","sourceUrl":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/binary-analysis-patterns","isPrimary":false,"firstSeenAt":"2026-04-18T21:33:34.762Z","lastSeenAt":"2026-04-24T12:50:40.806Z"}],"details":{"listingId":"5c13c2f6-d9e0-4aae-b93e-8b38e69096c6","quickStartSnippet":null,"exampleRequest":null,"exampleResponse":null,"schema":null,"openapiUrl":null,"agentsTxtUrl":null,"citations":[],"useCases":[],"bestFor":[],"notFor":[],"kindDetails":{"org":"sickn33","slug":"binary-analysis-patterns","github":{"repo":"sickn33/antigravity-awesome-skills","stars":34882,"topics":["agent-skills","agentic-skills","ai-agent-skills","ai-agents","ai-coding","ai-workflows","antigravity","antigravity-skills","claude-code","claude-code-skills","codex-cli","codex-skills","cursor","cursor-skills","developer-tools","gemini-cli","gemini-skills","kiro","mcp","skill-library"],"license":"mit","html_url":"https://github.com/sickn33/antigravity-awesome-skills","pushed_at":"2026-04-24T06:41:17Z","description":"Installable GitHub library of 1,400+ agentic skills for Claude Code, Cursor, Codex CLI, Gemini CLI, Antigravity, and more. Includes installer CLI, bundles, workflows, and official/community skill collections.","skill_md_sha":"7721e24f268d7b2d91afebf1b530b6503648c6fa","skill_md_path":"skills/binary-analysis-patterns/SKILL.md","default_branch":"main","skill_tree_url":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/binary-analysis-patterns"},"layout":"multi","source":"github","category":"antigravity-awesome-skills","frontmatter":{"name":"binary-analysis-patterns","description":"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic."},"skills_sh_url":"https://skills.sh/sickn33/antigravity-awesome-skills/binary-analysis-patterns"},"updatedAt":"2026-04-24T12:50:40.806Z"}}