ReVa Skills & Analysis Workflows

ReVa provides a set of Claude Code marketplace skills — structured analysis workflows that guide an AI assistant through common reverse engineering tasks. Each skill encodes expert methodology as a repeatable, step-by-step process that the assistant follows while using ReVa's MCP tools.

Skills are invoked as slash commands in Claude Code (e.g., /ReVa:binary-triage). They do not replace ReVa's tools; rather, they orchestrate tool usage into coherent workflows.

Installing Skills

The ReVa skills are included in the ReVa repository under ReVa/skills/. When you clone the repository or install the extension, the skills are available as slash commands in Claude Code when working in the project directory.

To install the skills globally:

claude skills add /path/to/reverse-engineering-assistant/ReVa/skills

Once installed, the skills are available as slash commands in any Claude Code conversation.

/ReVa:binary-triage — Initial Binary Survey

The binary-triage skill performs a systematic initial survey of a binary to quickly understand what it does and identify areas of interest. This is typically the first skill you run when examining a new binary. It produces a structured triage report that serves as the foundation for deeper analysis.

8-Step Workflow

The triage follows eight systematic steps:

  1. Identify the program — Determine the target program using get-current-program or list-project-files. Gather basic metadata: architecture, compiler, image base, address size.
  2. Survey memory layout — Examine memory sections (.text, .data, .rodata, .bss) to understand the program's structure, identify code vs. data regions, and note unusual section names or permissions.
  3. Survey strings — Search for interesting strings across multiple categories: network indicators (URLs, IPs, hostnames), file paths, API references, error messages, debug strings, and suspicious keywords.
  4. Survey symbols and imports — Examine imported functions, categorized by type:
    • Network — socket, connect, send, recv, HTTP functions
    • File I/O — open, read, write, file manipulation
    • Process — exec, fork, CreateProcess, thread functions
    • Crypto — encryption, hashing, SSL/TLS functions
    • Anti-analysis — debugger detection, timing checks
  5. Survey functions — Count total functions, analyze the ratio of named to unnamed functions, identify unusually large or complex functions.
  6. Cross-reference analysis — Follow cross-references for key findings from previous steps to understand how interesting items are connected.
  7. Selective initial decompilation — Decompile entry points and functions flagged as suspicious to get an initial understanding of behavior.
  8. Document findings and create task list — Compile all findings into a structured report and create a prioritized list of areas for deeper investigation.

Output Format

The triage produces a structured report covering:

/ReVa:deep-analysis — Focused Investigation

The deep-analysis skill performs focused, depth-first investigation of specific reverse engineering questions. Unlike the broad survey of binary-triage, deep-analysis dives deep into a particular question or area, iteratively improving the program database as it goes.

Use this skill when you have a specific question like:

Core Analysis Loop

The skill operates as an iterative loop, typically running 3–7 iterations with a budget of 10–15 tool calls. Each iteration follows seven steps:

  1. READ — Gather current context by reading decompilation, checking cross-references, examining data types, or following call graphs.
  2. UNDERSTAND — Analyze what you see. Form hypotheses about what the code does, what data structures are in play, what algorithms are being used.
  3. IMPROVE — Make small, incremental improvements to the program database: rename variables and functions, correct data types, fix function prototypes. Each improvement makes the next read more informative.
  4. VERIFY — Re-read the modified function or area to confirm the improvement is correct and the decompilation now makes more sense.
  5. FOLLOW THREADS — Pursue evidence by following cross-references to callers and callees, tracing data flow, or examining related functions.
  6. TRACK PROGRESS — Document findings using bookmarks in the Ghidra database so that progress is preserved and key locations are marked.
  7. ON-TASK CHECK — Evaluate whether the current investigation thread is still relevant to the original question. Avoid going down rabbit holes.

Output Format

The skill returns a structured JSON result containing:

/ReVa:ctf-rev — CTF Reverse Engineering

The ctf-rev skill is designed for solving Capture The Flag (CTF) reverse engineering challenges — crackmes, binary bombs, key validators, obfuscated code, and any challenge that requires understanding a program to extract a flag, key, or password.

Three Core Questions

The skill is built around three fundamental questions that guide the analysis:

  1. What does the program EXPECT? — What input format, structure, and validation does the program require? What are the constraints on valid input?
  2. What does the program DO? — What transformations, comparisons, and algorithms does the program apply to the input? How does it decide if input is correct?
  3. How do I REVERSE it? — Is the transformation reversible? Can it be brute-forced? Can the answer be derived mathematically? Can a check be bypassed?

Analysis Strategies

The skill applies four main strategies, chosen based on the challenge structure:

Strategy Approach Best For
Top-Down Start from the win condition (success message, flag output) and work backwards through the code to determine what input produces that outcome. Key validators, password checkers
Bottom-Up Trace user input forward through the program's data flow to understand what transformations are applied and where the validation occurs. Complex input processing, multi-stage checks
Pattern Recognition Identify standard algorithms (XOR ciphers, base64, hash comparisons, TEA/XTEA) by their constants, structure, and behavior. Crypto challenges, encoding schemes
Constraint Solving Frame the validation as a set of mathematical constraints and solve them symbolically or through enumeration. Character-by-character checks, mathematical puzzles

Workflow Phases

The analysis proceeds in three phases:

  1. Initial Assessment — Quick triage: identify the binary type, find entry points, locate success/failure strings, map the high-level control flow.
  2. Focused Investigation — Deep dive into the validation logic, algorithm recovery, and constraint identification using the most appropriate strategy.
  3. Solution Extraction — Construct the flag, key, or password from the analysis. Verify the solution against the program's logic.

/ReVa:ctf-pwn — CTF Binary Exploitation

The ctf-pwn skill solves CTF binary exploitation challenges by discovering and exploiting memory corruption vulnerabilities to read flags. It covers buffer overflows, format string bugs, heap exploitation, ROP chains, and other common exploitation techniques.

Seven Core Questions

The skill follows an exploitation-focused question sequence:

  1. What data do I control? — Identify all input vectors: stdin, argv, files, network, environment variables.
  2. Where does my data go? — Trace controlled data into memory: stack buffers, heap allocations, global variables.
  3. What is nearby in memory? — Examine what sits adjacent to the buffer: return addresses, function pointers, vtable pointers, other buffers.
  4. Can I overflow? — Determine if the buffer has bounds checking. Calculate exact offsets to targets of interest.
  5. What can I overwrite? — Identify exploitable targets: return addresses, GOT entries, function pointers, heap metadata.
  6. Where can I redirect execution? — Find useful code to jump to: win functions, gadgets for ROP, libc functions, shellcode locations.
  7. How do I read the flag? — Determine the flag location and the mechanism to output it: existing print functions, system() calls, read/write primitives.

Exploitation Phases

  1. Binary Reconnaissance — Identify architecture, protections (NX, ASLR, canaries, PIE, RELRO), input mechanisms, and interesting functions.
  2. Vulnerability Analysis — Locate the vulnerability, determine its type, and calculate key values (buffer sizes, offsets, alignment).
  3. Exploitation Strategy — Choose the exploitation technique based on available protections and vulnerability type.
  4. Payload Construction — Build the exploit payload with exact offsets, addresses, and any ROP chains or format strings needed.
  5. Exploitation Validation — Verify the exploit plan against the binary's constraints and output a pwntools script skeleton.

Supported Techniques

Technique Description
Stack Buffer Overflow Overwrite return address or saved registers to redirect execution
Format String Exploit printf-family functions with attacker-controlled format strings for arbitrary read/write
ROP Chains Chain return-oriented programming gadgets to bypass NX protections
ret2libc Redirect execution to libc functions (system, execve) without shellcode
Heap Exploitation Exploit heap metadata corruption (use-after-free, double-free, overflow)
Integer Overflow Exploit integer arithmetic bugs to bypass size checks or cause under/overflows

Note The ctf-pwn skill focuses on static analysis and exploit planning. It produces exploit strategies and pwntools script skeletons for execution outside of Ghidra.

/ReVa:ctf-crypto — CTF Cryptography

The ctf-crypto skill solves CTF cryptography challenges by identifying, analyzing, and exploiting weak or custom cryptographic implementations found in binaries. It focuses on implementation weaknesses rather than mathematical cryptanalysis — the vulnerabilities are in the code, not in the math.

Four-Phase Framework

  1. Crypto Detection — Determine if and where cryptography is used. Search for crypto-related strings, constants (S-boxes, round constants, magic numbers), and characteristic code patterns.
  2. Algorithm Identification — Identify the specific algorithm. Is it a standard algorithm (AES, DES, RC4, RSA) or a custom cipher? Match constants and structures to known algorithms.
  3. Implementation Analysis — Examine how the algorithm is implemented. Look for weaknesses: hardcoded keys, weak random number generation, ECB mode usage, custom modifications to standard algorithms.
  4. Key Extraction or Breaking — Exploit the identified weakness to recover the key or plaintext. This may involve extracting hardcoded values, predicting RNG output, or reversing a custom cipher.

Core Methodologies

Methodology Description
String & Constant Analysis Search for crypto keywords, locate magic constant arrays (S-boxes, round constants), and identify algorithm signatures.
Pattern Recognition Identify algorithms by their structural patterns: XOR loops, Feistel networks, substitution-permutation networks, modular arithmetic.
Data Flow Analysis Trace key material through the program: where keys are loaded, how they are derived, where they are used, and whether they are exposed.
Weakness Discovery Find exploitable implementation flaws: hardcoded keys, weak or predictable RNG seeds, reused nonces, missing authentication, custom cipher designs.
Reverse Engineering Decryption Understand the complete encryption/decryption logic to build a standalone decryption routine or extract the key directly.

Common Weakness Patterns

Pattern Vulnerability Exploitation
Weak Custom Cipher Home-grown encryption using simple XOR or substitution Reverse the algorithm and decrypt directly
Hardcoded Key Encryption key embedded in the binary as a constant Extract the key from the binary's data sections
Weak RNG Predictable random number generator (time-seeded, linear) Predict or brute-force the RNG seed to derive the key
Weak Key Derivation Key derived from limited or predictable input Enumerate or compute the key space
Implementation Bugs Off-by-one errors, wrong block modes, partial encryption Exploit the specific flaw to bypass or weaken encryption
Obfuscated Standard Standard algorithm with renamed functions or shuffled code Identify the algorithm by constants, then apply standard attacks

Choosing the Right Skill

Scenario Skill
First look at an unknown binary /ReVa:binary-triage
"What does function X do?" or "Fix types in function Y" /ReVa:deep-analysis
CTF challenge: find the flag/key/password /ReVa:ctf-rev
CTF challenge: exploit a memory corruption bug /ReVa:ctf-pwn
CTF challenge: break or bypass encryption /ReVa:ctf-crypto
General analysis without a specific skill Use ReVa tools directly without a skill

Tip Skills can be combined. A common pattern is to start with /ReVa:binary-triage for an overview, then use /ReVa:deep-analysis to investigate specific findings. For CTF challenges, the specialized CTF skills often work best as a starting point.


Provided by: ReVa

Related Topics: