mcpField
C
ctf-reverse

ctf-reverse

github.com/wgpsecSecurity1.8k58 installsUpdated 5d ago
Repository

About ctf-reverse

ctf-reverse is a reverse-engineering methodology for CTF participants, with references spanning binary identification, static and dynamic analysis, and anti-analysis techniques. Its topic-based materials help select tools and methods for different file types, languages, and platforms.

Key features

  1. 01Choose analysis tools by file type
  2. 02Reference static and dynamic analysis methods
  3. 03Cover anti-debugging and anti-analysis bypasses
  4. 04Organize language, platform, and hardware topics
  5. 05Catalog common reverse-engineering challenge patterns

Use cases

  1. 01Plan analysis steps based on a binary format
  2. 02Select reference tools for debugging or symbolic execution
  3. 03Work through anti-debugging, obfuscation, or runtime patching challenges

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill ctf-reverse

After installing, type/ctf-reversein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

evals/
evals.json
recall.json
references/
anti-analysis-ctf.md
anti-analysis.md
field-notes.md
languages-compiled.md
languages-platforms.md
languages.md
patterns-ctf-2.md
patterns-ctf-3.md
patterns-ctf.md
patterns-runtime.md
patterns.md
platforms-hardware.md
platforms.md
tools-advanced.md
tools-dynamic.md
tools-emulation.md
tools.md

Details

From the project README

CTF 逆向工程

深入参考

以下参考资料按需加载，根据识别出的具体方向选择对应文件：

分类决策树

拿到逆向题？
├─ 识别文件类型: file binary
│  ├─ ELF → GDB + Ghidra
│  ├─ PE/DLL → x64dbg + IDA
│  ├─ Mach-O → lldb + Hopper
│  ├─ APK → apktool + jadx (Flutter → Blutter)
│  ├─ .NET → dnSpy / ILSpy
│  ├─ Python .pyc → uncompyle6 / decompyle3
│  ├─ WASM → wasm-decompile / wasm2wat
│  └─ 未知 → binwalk + strings + hexdump
├─ 分析策略
│  ├─ 静态优先 → Ghidra反编译 → 找 main/check 函数
│  ├─ 动态辅助 → GDB断点 / Frida hook
│  ├─ 符号执行 → angr（自动探路）
│  └─ 反混淆 → D-810 / GOOMBA / Miasm
├─ 有反调试？ → [references/anti-analysis.md](references/anti-analysis.md)
│  ├─ ptrace → LD_PRELOAD hook
│  ├─ /proc/self/status → 修改返回值
│  └─ 时间检测 → 跳过或 patch
└─ 常见模式
   ├─ 逐字符校验 → 逐字节爆破/约束求解
   ├─ 矩阵变换 → numpy/Z3 逆运算
   ├─ 自定义VM → 提取opcode表 → 反汇编
   └─ 迷宫 → BFS/DFS 自动求解

快速启动命令

# 基础分析
file binary && checksec binary
strings -n 6 binary | grep -iE "flag|pass|correct"
objdump -d binary | head -100

# GDB 调试
gdb -q binary -ex 'b main' -ex 'r'

# Ghidra 无头分析
analyzeHeadless /tmp/proj proj -import binary -postScript ExportDecompiled.java

# angr 符号执行
python3 -c "
import angr
p = angr.Project('./binary')
s = p.factory.entry_state()
sm = p.factory.simgr(s)
sm.explore(find=0x TARGET_ADDR)
print(sm.found[0].posix.dumps(0))
"

常见反调试绕过

技术绕过方法
ptrace(PTRACE_TRACEME)LD_PRELOAD hook 返回0
/proc/self/status修改 TracerPid
时间检测patch 掉 rdtsc/clock
IsDebuggerPresent (Win)PEB.BeingDebugged = 0

工具速查

工具用途
Ghidra免费反编译器（支持多架构）
GDB + pwndbgLinux 动态调试
Frida运行时 hook（跨平台）
angr符号执行引擎
dogbolt.org在线多反编译器对比

Comments

Markdown supported