ctf-rev_skill

Overview

This skill solves CTF reverse-engineering challenges by applying systematic static and hybrid analysis to extract flags, keys, or passwords. It focuses on quickly identifying the validation path, tracing data flow, and recovering or deriving the required input rather than fully documenting every function. It is optimized for crackmes, key validators, obfuscated binaries, and algorithm recovery tasks.

How this skill works

The skill inspects the binary to find entry points, input handlers, and validation logic, then performs decompilation and pattern recognition to identify transformations and comparisons. It uses a mix of static code comprehension and targeted dynamic observation to recover expected values or invert transformations. When possible, it formulates constraints for solvers or constructs direct reversals (decode/decrypt/solve) to produce the flag.

When to use it

• You have a crackme, serial/key validator, or binary that prints success/failure messages
• There is obfuscated or packed code that resists pure static analysis
• You need to recover a key, flag, or password from hardcoded comparisons or transformations
• The challenge implements a standard crypto/encoding algorithm that can be recognized and inverted
• You want a reproducible, goal-directed workflow to find the minimal code to analyze

Best practices

• Start with a 5–10 minute reconnaissance: strings, imports, function counts, and likely win messages
• Find the success path first (top-down) or trace input forward (bottom-up) depending on clarity
• Rename variables, add comments/bookmarks, and extract constants to document only the critical path
• Use dynamic breakpoints to observe intermediate values when static analysis is blocked or confusing
• If transformations yield constraints, export them to a solver (z3) or brute-force when keyspace is small

Example use cases

• A crackme where validate_key encrypts input and compares to hardcoded bytes — derive the plaintext key
• An obfuscated binary that deobfuscates a string at runtime — set breakpoints to capture the cleartext
• A program implementing custom XOR/rotation obfuscation — recognize pattern and invert operations
• A validator with arithmetic constraints on characters — extract equations and solve with a constraint solver
• A binary that uses a known cipher (RC4/AES) with a recoverable key — identify algorithm and decrypt