[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6XF0H829EXWT65P5QQW5SVJ":3,"skill-same:01M6XF0H829EXWT65P5QQW5SVJ":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":34,"linkOnly":35,"markdownContent":36,"markdownBody":37,"frontMatter":38,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":45,"install":46,"resources":59},"01M6XF0H829EXWT65P5QQW5SVJ","binary-analysis-patterns",null,"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fbinary-analysis-patterns\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33],"analysis","binary analysis","binary analysis patterns","patterns","binary","code","analyzing","assembly","community","logic","techniques","for","unknown","program","2026","2026-11-10 10:12:30",false,"---\nname: binary-analysis-patterns\ndescription: \"Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\"\nrisk: unknown\nsource: community\ndate_added: \"2026-02-27\"\n---\n\n# Binary Analysis Patterns\n\nComprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\n\n## Use this skill when\n\n- Working on binary analysis patterns tasks or workflows\n- Needing guidance, best practices, or checklists for binary analysis patterns\n\n## Do not use this skill when\n\n- The task is unrelated to binary analysis patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Disassembly Fundamentals\n\n### x86-64 Instruction Patterns\n\n#### Function Prologue\u002FEpilogue\n```asm\n; Standard prologue\npush rbp           ; Save base pointer\nmov rbp, rsp       ; Set up stack frame\nsub rsp, 0x20      ; Allocate local variables\n\n; Leaf function (no calls)\n; May skip frame pointer setup\nsub rsp, 0x18      ; Just allocate locals\n\n; Standard epilogue\nmov rsp, rbp       ; Restore stack pointer\npop rbp            ; Restore base pointer\nret\n\n; Leave instruction (equivalent)\nleave              ; mov rsp, rbp; pop rbp\nret\n```\n\n#### Calling Conventions\n\n**System V AMD64 (Linux, macOS)**\n```asm\n; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack\n; Return: RAX (and RDX for 128-bit)\n; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11\n; Callee-saved: RBX, RBP, R12-R15\n\n; Example: func(a, b, c, d, e, f, g)\nmov rdi, [a]       ; 1st arg\nmov rsi, [b]       ; 2nd arg\nmov rdx, [c]       ; 3rd arg\nmov rcx, [d]       ; 4th arg\nmov r8, [e]        ; 5th arg\nmov r9, [f]        ; 6th arg\npush [g]           ; 7th arg on stack\ncall func\n```\n\n**Microsoft x64 (Windows)**\n```asm\n; Arguments: RCX, RDX, R8, R9, then stack\n; Shadow space: 32 bytes reserved on stack\n; Return: RAX\n\n; Example: func(a, b, c, d, e)\nsub rsp, 0x28      ; Shadow space + alignment\nmov rcx, [a]       ; 1st arg\nmov rdx, [b]       ; 2nd arg\nmov r8, [c]        ; 3rd arg\nmov r9, [d]        ; 4th arg\nmov [rsp+0x20], [e] ; 5th arg on stack\ncall func\nadd rsp, 0x28\n```\n\n### ARM Assembly Patterns\n\n#### ARM64 (AArch64) Calling Convention\n```asm\n; Arguments: X0-X7\n; Return: X0 (and X1 for 128-bit)\n; Frame pointer: X29\n; Link register: X30\n\n; Function prologue\nstp x29, x30, [sp, #-16]!  ; Save FP and LR\nmov x29, sp                 ; Set frame pointer\n\n; Function epilogue\nldp x29, x30, [sp], #16    ; Restore FP and LR\nret\n```\n\n#### ARM32 Calling Convention\n```asm\n; Arguments: R0-R3, then stack\n; Return: R0 (and R1 for 64-bit)\n; Link register: LR (R14)\n\n; Function prologue\npush {fp, lr}\nadd fp, sp, #4\n\n; Function epilogue\npop {fp, pc}    ; Return by popping PC\n```\n\n## Control Flow Patterns\n\n### Conditional Branches\n\n```asm\n; if (a == b)\ncmp eax, ebx\njne skip_block\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - signed\ncmp eax, ebx\njge skip_block    ; Jump if greater or equal\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - unsigned\ncmp eax, ebx\njae skip_block    ; Jump if above or equal\n; ... if body ...\nskip_block:\n```\n\n### Loop Patterns\n\n```asm\n; for (int i = 0; i \u003C n; i++)\nxor ecx, ecx           ; i = 0\nloop_start:\ncmp ecx, [n]           ; i \u003C n\njge loop_end\n; ... loop body ...\ninc ecx                ; i++\njmp loop_start\nloop_end:\n\n; while (condition)\njmp loop_check\nloop_body:\n; ... body ...\nloop_check:\ncmp eax, ebx\njl loop_body\n\n; do-while\nloop_body:\n; ... body ...\ncmp eax, ebx\njl loop_body\n```\n\n### Switch Statement Patterns\n\n```asm\n; Jump table pattern\nmov eax, [switch_var]\ncmp eax, max_case\nja default_case\njmp [jump_table + eax*8]\n\n; Sequential comparison (small switch)\ncmp eax, 1\nje case_1\ncmp eax, 2\nje case_2\ncmp eax, 3\nje case_3\njmp default_case\n```\n\n## Data Structure Patterns\n\n### Array Access\n\n```asm\n; array[i] - 4-byte elements\nmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index\n\n; array[i] - 8-byte elements\nmov rax, [rbx + rcx*8]\n\n; Multi-dimensional array[i][j]\n; arr[i][j] = base + (i * cols + j) * element_size\nimul eax, [cols]\nadd eax, [j]\nmov edx, [rbx + rax*4]\n```\n\n### Structure Access\n\n```c\nstruct Example {\n    int a;      \u002F\u002F offset 0\n    char b;     \u002F\u002F offset 4\n    \u002F\u002F padding  \u002F\u002F offset 5-7\n    long c;     \u002F\u002F offset 8\n    short d;    \u002F\u002F offset 16\n};\n```\n\n```asm\n; Accessing struct fields\nmov rdi, [struct_ptr]\nmov eax, [rdi]         ; s->a (offset 0)\nmovzx eax, byte [rdi+4] ; s->b (offset 4)\nmov rax, [rdi+8]       ; s->c (offset 8)\nmovzx eax, word [rdi+16] ; s->d (offset 16)\n```\n\n### Linked List Traversal\n\n```asm\n; while (node != NULL)\nlist_loop:\ntest rdi, rdi          ; node == NULL?\njz list_done\n; ... process node ...\nmov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)\njmp list_loop\nlist_done:\n```\n\n## Common Code Patterns\n\n### String Operations\n\n```asm\n; strlen pattern\nxor ecx, ecx\nstrlen_loop:\ncmp byte [rdi + rcx], 0\nje strlen_done\ninc ecx\njmp strlen_loop\nstrlen_done:\n; ecx contains length\n\n; strcpy pattern\nstrcpy_loop:\nmov al, [rsi]\nmov [rdi], al\ntest al, al\njz strcpy_done\ninc rsi\ninc rdi\njmp strcpy_loop\nstrcpy_done:\n\n; memcpy using rep movsb\nmov rdi, dest\nmov rsi, src\nmov rcx, count\nrep movsb\n```\n\n### Arithmetic Patterns\n\n```asm\n; Multiplication by constant\n; x * 3\nlea eax, [rax + rax*2]\n\n; x * 5\nlea eax, [rax + rax*4]\n\n; x * 10\nlea eax, [rax + rax*4]  ; x * 5\nadd eax, eax            ; * 2\n\n; Division by power of 2 (signed)\nmov eax, [x]\ncdq                     ; Sign extend to EDX:EAX\nand edx, 7              ; For divide by 8\nadd eax, edx            ; Adjust for negative\nsar eax, 3              ; Arithmetic shift right\n\n; Modulo power of 2\nand eax, 7              ; x % 8\n```\n\n### Bit Manipulation\n\n```asm\n; Test specific bit\ntest eax, 0x80          ; Test bit 7\njnz bit_set\n\n; Set bit\nor eax, 0x10            ; Set bit 4\n\n; Clear bit\nand eax, ~0x10          ; Clear bit 4\n\n; Toggle bit\nxor eax, 0x10           ; Toggle bit 4\n\n; Count leading zeros\nbsr eax, ecx            ; Bit scan reverse\nxor eax, 31             ; Convert to leading zeros\n\n; Population count (popcnt)\npopcnt eax, ecx         ; Count set bits\n```\n\n## Decompilation Patterns\n\n### Variable Recovery\n\n```asm\n; Local variable at rbp-8\nmov qword [rbp-8], rax  ; Store to local\nmov rax, [rbp-8]        ; Load from local\n\n; Stack-allocated array\nlea rax, [rbp-0x40]     ; Array starts at rbp-0x40\nmov [rax], edx          ; array[0] = value\nmov [rax+4], ecx        ; array[1] = value\n```\n\n### Function Signature Recovery\n\n```asm\n; Identify parameters by register usage\nfunc:\n    ; rdi used as first param (System V)\n    mov [rbp-8], rdi    ; Save param to local\n    ; rsi used as second param\n    mov [rbp-16], rsi\n    ; Identify return by RAX at end\n    mov rax, [result]\n    ret\n```\n\n### Type Recovery\n\n```asm\n; 1-byte operations suggest char\u002Fbool\nmovzx eax, byte [rdi]   ; Zero-extend byte\nmovsx eax, byte [rdi]   ; Sign-extend byte\n\n; 2-byte operations suggest short\nmovzx eax, word [rdi]\nmovsx eax, word [rdi]\n\n; 4-byte operations suggest int\u002Ffloat\nmov eax, [rdi]\nmovss xmm0, [rdi]       ; Float\n\n; 8-byte operations suggest long\u002Fdouble\u002Fpointer\nmov rax, [rdi]\nmovsd xmm0, [rdi]       ; Double\n```\n\n## Ghidra Analysis Tips\n\n### Improving Decompilation\n\n```java\n\u002F\u002F In Ghidra scripting\n\u002F\u002F Fix function signature\nFunction func = getFunctionAt(toAddr(0x401000));\nfunc.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);\n\n\u002F\u002F Create structure type\nStructureDataType struct = new StructureDataType(\"MyStruct\", 0);\nstruct.add(IntegerDataType.dataType, \"field_a\", null);\nstruct.add(PointerDataType.dataType, \"next\", null);\n\n\u002F\u002F Apply to memory\ncreateData(toAddr(0x601000), struct);\n```\n\n### Pattern Matching Scripts\n\n```python\n# Find all calls to dangerous functions\nfor func in currentProgram.getFunctionManager().getFunctions(True):\n    for ref in getReferencesTo(func.getEntryPoint()):\n        if func.getName() in [\"strcpy\", \"sprintf\", \"gets\"]:\n            print(f\"Dangerous call at {ref.getFromAddress()}\")\n```\n\n## IDA Pro Patterns\n\n### IDAPython Analysis\n\n```python\nimport idaapi\nimport idautils\nimport idc\n\n# Find all function calls\ndef find_calls(func_name):\n    for func_ea in idautils.Functions():\n        for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):\n            if idc.print_insn_mnem(head) == \"call\":\n                target = idc.get_operand_value(head, 0)\n                if idc.get_func_name(target) == func_name:\n                    print(f\"Call to {func_name} at {hex(head)}\")\n\n# Rename functions based on strings\ndef auto_rename():\n    for s in idautils.Strings():\n        for xref in idautils.XrefsTo(s.ea):\n            func = idaapi.get_func(xref.frm)\n            if func and \"sub_\" in idc.get_func_name(func.start_ea):\n                # Use string as hint for naming\n                pass\n```\n\n## Best Practices\n\n### Analysis Workflow\n\n1. **Initial triage**: File type, architecture, imports\u002Fexports\n2. **String analysis**: Identify interesting strings, error messages\n3. **Function identification**: Entry points, exports, cross-references\n4. **Control flow mapping**: Understand program structure\n5. **Data structure recovery**: Identify structs, arrays, globals\n6. **Algorithm identification**: Crypto, hashing, compression\n7. **Documentation**: Comments, renamed symbols, type definitions\n\n### Common Pitfalls\n\n- **Optimizer artifacts**: Code may not match source structure\n- **Inline functions**: Functions may be expanded inline\n- **Tail call optimization**: `jmp` instead of `call` + `ret`\n- **Dead code**: Unreachable code from optimization\n- **Position-independent code**: RIP-relative addressing\n","# Binary Analysis Patterns\n\nComprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.\n\n## Use this skill when\n\n- Working on binary analysis patterns tasks or workflows\n- Needing guidance, best practices, or checklists for binary analysis patterns\n\n## Do not use this skill when\n\n- The task is unrelated to binary analysis patterns\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Disassembly Fundamentals\n\n### x86-64 Instruction Patterns\n\n#### Function Prologue\u002FEpilogue\n```asm\n; Standard prologue\npush rbp           ; Save base pointer\nmov rbp, rsp       ; Set up stack frame\nsub rsp, 0x20      ; Allocate local variables\n\n; Leaf function (no calls)\n; May skip frame pointer setup\nsub rsp, 0x18      ; Just allocate locals\n\n; Standard epilogue\nmov rsp, rbp       ; Restore stack pointer\npop rbp            ; Restore base pointer\nret\n\n; Leave instruction (equivalent)\nleave              ; mov rsp, rbp; pop rbp\nret\n```\n\n#### Calling Conventions\n\n**System V AMD64 (Linux, macOS)**\n```asm\n; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack\n; Return: RAX (and RDX for 128-bit)\n; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11\n; Callee-saved: RBX, RBP, R12-R15\n\n; Example: func(a, b, c, d, e, f, g)\nmov rdi, [a]       ; 1st arg\nmov rsi, [b]       ; 2nd arg\nmov rdx, [c]       ; 3rd arg\nmov rcx, [d]       ; 4th arg\nmov r8, [e]        ; 5th arg\nmov r9, [f]        ; 6th arg\npush [g]           ; 7th arg on stack\ncall func\n```\n\n**Microsoft x64 (Windows)**\n```asm\n; Arguments: RCX, RDX, R8, R9, then stack\n; Shadow space: 32 bytes reserved on stack\n; Return: RAX\n\n; Example: func(a, b, c, d, e)\nsub rsp, 0x28      ; Shadow space + alignment\nmov rcx, [a]       ; 1st arg\nmov rdx, [b]       ; 2nd arg\nmov r8, [c]        ; 3rd arg\nmov r9, [d]        ; 4th arg\nmov [rsp+0x20], [e] ; 5th arg on stack\ncall func\nadd rsp, 0x28\n```\n\n### ARM Assembly Patterns\n\n#### ARM64 (AArch64) Calling Convention\n```asm\n; Arguments: X0-X7\n; Return: X0 (and X1 for 128-bit)\n; Frame pointer: X29\n; Link register: X30\n\n; Function prologue\nstp x29, x30, [sp, #-16]!  ; Save FP and LR\nmov x29, sp                 ; Set frame pointer\n\n; Function epilogue\nldp x29, x30, [sp], #16    ; Restore FP and LR\nret\n```\n\n#### ARM32 Calling Convention\n```asm\n; Arguments: R0-R3, then stack\n; Return: R0 (and R1 for 64-bit)\n; Link register: LR (R14)\n\n; Function prologue\npush {fp, lr}\nadd fp, sp, #4\n\n; Function epilogue\npop {fp, pc}    ; Return by popping PC\n```\n\n## Control Flow Patterns\n\n### Conditional Branches\n\n```asm\n; if (a == b)\ncmp eax, ebx\njne skip_block\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - signed\ncmp eax, ebx\njge skip_block    ; Jump if greater or equal\n; ... if body ...\nskip_block:\n\n; if (a \u003C b) - unsigned\ncmp eax, ebx\njae skip_block    ; Jump if above or equal\n; ... if body ...\nskip_block:\n```\n\n### Loop Patterns\n\n```asm\n; for (int i = 0; i \u003C n; i++)\nxor ecx, ecx           ; i = 0\nloop_start:\ncmp ecx, [n]           ; i \u003C n\njge loop_end\n; ... loop body ...\ninc ecx                ; i++\njmp loop_start\nloop_end:\n\n; while (condition)\njmp loop_check\nloop_body:\n; ... body ...\nloop_check:\ncmp eax, ebx\njl loop_body\n\n; do-while\nloop_body:\n; ... body ...\ncmp eax, ebx\njl loop_body\n```\n\n### Switch Statement Patterns\n\n```asm\n; Jump table pattern\nmov eax, [switch_var]\ncmp eax, max_case\nja default_case\njmp [jump_table + eax*8]\n\n; Sequential comparison (small switch)\ncmp eax, 1\nje case_1\ncmp eax, 2\nje case_2\ncmp eax, 3\nje case_3\njmp default_case\n```\n\n## Data Structure Patterns\n\n### Array Access\n\n```asm\n; array[i] - 4-byte elements\nmov eax, [rbx + rcx*4]        ; rbx=base, rcx=index\n\n; array[i] - 8-byte elements\nmov rax, [rbx + rcx*8]\n\n; Multi-dimensional array[i][j]\n; arr[i][j] = base + (i * cols + j) * element_size\nimul eax, [cols]\nadd eax, [j]\nmov edx, [rbx + rax*4]\n```\n\n### Structure Access\n\n```c\nstruct Example {\n    int a;      \u002F\u002F offset 0\n    char b;     \u002F\u002F offset 4\n    \u002F\u002F padding  \u002F\u002F offset 5-7\n    long c;     \u002F\u002F offset 8\n    short d;    \u002F\u002F offset 16\n};\n```\n\n```asm\n; Accessing struct fields\nmov rdi, [struct_ptr]\nmov eax, [rdi]         ; s->a (offset 0)\nmovzx eax, byte [rdi+4] ; s->b (offset 4)\nmov rax, [rdi+8]       ; s->c (offset 8)\nmovzx eax, word [rdi+16] ; s->d (offset 16)\n```\n\n### Linked List Traversal\n\n```asm\n; while (node != NULL)\nlist_loop:\ntest rdi, rdi          ; node == NULL?\njz list_done\n; ... process node ...\nmov rdi, [rdi+8]       ; node = node->next (assuming next at offset 8)\njmp list_loop\nlist_done:\n```\n\n## Common Code Patterns\n\n### String Operations\n\n```asm\n; strlen pattern\nxor ecx, ecx\nstrlen_loop:\ncmp byte [rdi + rcx], 0\nje strlen_done\ninc ecx\njmp strlen_loop\nstrlen_done:\n; ecx contains length\n\n; strcpy pattern\nstrcpy_loop:\nmov al, [rsi]\nmov [rdi], al\ntest al, al\njz strcpy_done\ninc rsi\ninc rdi\njmp strcpy_loop\nstrcpy_done:\n\n; memcpy using rep movsb\nmov rdi, dest\nmov rsi, src\nmov rcx, count\nrep movsb\n```\n\n### Arithmetic Patterns\n\n```asm\n; Multiplication by constant\n; x * 3\nlea eax, [rax + rax*2]\n\n; x * 5\nlea eax, [rax + rax*4]\n\n; x * 10\nlea eax, [rax + rax*4]  ; x * 5\nadd eax, eax            ; * 2\n\n; Division by power of 2 (signed)\nmov eax, [x]\ncdq                     ; Sign extend to EDX:EAX\nand edx, 7              ; For divide by 8\nadd eax, edx            ; Adjust for negative\nsar eax, 3              ; Arithmetic shift right\n\n; Modulo power of 2\nand eax, 7              ; x % 8\n```\n\n### Bit Manipulation\n\n```asm\n; Test specific bit\ntest eax, 0x80          ; Test bit 7\njnz bit_set\n\n; Set bit\nor eax, 0x10            ; Set bit 4\n\n; Clear bit\nand eax, ~0x10          ; Clear bit 4\n\n; Toggle bit\nxor eax, 0x10           ; Toggle bit 4\n\n; Count leading zeros\nbsr eax, ecx            ; Bit scan reverse\nxor eax, 31             ; Convert to leading zeros\n\n; Population count (popcnt)\npopcnt eax, ecx         ; Count set bits\n```\n\n## Decompilation Patterns\n\n### Variable Recovery\n\n```asm\n; Local variable at rbp-8\nmov qword [rbp-8], rax  ; Store to local\nmov rax, [rbp-8]        ; Load from local\n\n; Stack-allocated array\nlea rax, [rbp-0x40]     ; Array starts at rbp-0x40\nmov [rax], edx          ; array[0] = value\nmov [rax+4], ecx        ; array[1] = value\n```\n\n### Function Signature Recovery\n\n```asm\n; Identify parameters by register usage\nfunc:\n    ; rdi used as first param (System V)\n    mov [rbp-8], rdi    ; Save param to local\n    ; rsi used as second param\n    mov [rbp-16], rsi\n    ; Identify return by RAX at end\n    mov rax, [result]\n    ret\n```\n\n### Type Recovery\n\n```asm\n; 1-byte operations suggest char\u002Fbool\nmovzx eax, byte [rdi]   ; Zero-extend byte\nmovsx eax, byte [rdi]   ; Sign-extend byte\n\n; 2-byte operations suggest short\nmovzx eax, word [rdi]\nmovsx eax, word [rdi]\n\n; 4-byte operations suggest int\u002Ffloat\nmov eax, [rdi]\nmovss xmm0, [rdi]       ; Float\n\n; 8-byte operations suggest long\u002Fdouble\u002Fpointer\nmov rax, [rdi]\nmovsd xmm0, [rdi]       ; Double\n```\n\n## Ghidra Analysis Tips\n\n### Improving Decompilation\n\n```java\n\u002F\u002F In Ghidra scripting\n\u002F\u002F Fix function signature\nFunction func = getFunctionAt(toAddr(0x401000));\nfunc.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);\n\n\u002F\u002F Create structure type\nStructureDataType struct = new StructureDataType(\"MyStruct\", 0);\nstruct.add(IntegerDataType.dataType, \"field_a\", null);\nstruct.add(PointerDataType.dataType, \"next\", null);\n\n\u002F\u002F Apply to memory\ncreateData(toAddr(0x601000), struct);\n```\n\n### Pattern Matching Scripts\n\n```python\n# Find all calls to dangerous functions\nfor func in currentProgram.getFunctionManager().getFunctions(True):\n    for ref in getReferencesTo(func.getEntryPoint()):\n        if func.getName() in [\"strcpy\", \"sprintf\", \"gets\"]:\n            print(f\"Dangerous call at {ref.getFromAddress()}\")\n```\n\n## IDA Pro Patterns\n\n### IDAPython Analysis\n\n```python\nimport idaapi\nimport idautils\nimport idc\n\n# Find all function calls\ndef find_calls(func_name):\n    for func_ea in idautils.Functions():\n        for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):\n            if idc.print_insn_mnem(head) == \"call\":\n                target = idc.get_operand_value(head, 0)\n                if idc.get_func_name(target) == func_name:\n                    print(f\"Call to {func_name} at {hex(head)}\")\n\n# Rename functions based on strings\ndef auto_rename():\n    for s in idautils.Strings():\n        for xref in idautils.XrefsTo(s.ea):\n            func = idaapi.get_func(xref.frm)\n            if func and \"sub_\" in idc.get_func_name(func.start_ea):\n                # Use string as hint for naming\n                pass\n```\n\n## Best Practices\n\n### Analysis Workflow\n\n1. **Initial triage**: File type, architecture, imports\u002Fexports\n2. **String analysis**: Identify interesting strings, error messages\n3. **Function identification**: Entry points, exports, cross-references\n4. **Control flow mapping**: Understand program structure\n5. **Data structure recovery**: Identify structs, arrays, globals\n6. **Algorithm identification**: Crypto, hashing, compression\n7. **Documentation**: Comments, renamed symbols, type definitions\n\n### Common Pitfalls\n\n- **Optimizer artifacts**: Code may not match source structure\n- **Inline functions**: Functions may be expanded inline\n- **Tail call optimization**: `jmp` instead of `call` + `ret`\n- **Dead code**: Unreachable code from optimization\n- **Position-independent code**: RIP-relative addressing\n",{"name":5,"risk":31,"source":27,"date_added":39,"description":7},"2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcopilot\u002Fbinary-analysis-patterns","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill binary-analysis-patterns",{"tool":52,"command":53},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill binary-analysis-patterns",{"tool":55,"command":56},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill binary-analysis-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fbinary-analysis-patterns\u002FSKILL.md",true,[],[61,85,111,121,134,153],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":72,"publishedAt":34},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[67],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[73,74,75,76,77,78,79,80,81,82,83,84],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":91,"publishedAt":34},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[92,93,94,95,96,97,75,98,99,100,101,102,103,104,105,106,107,108,109,110],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":34},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[118,119,92,103,104,105,106,96,75,108,120,109,110,102,100,99,98,107,97,95],"trend radar","radar","pulse",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":34},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[128,129,130,131,132,133],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":145,"publishedAt":34},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[140],{"categoryNo":141,"categoryName":142,"taxonomyType":143,"taxonomyTypeDesc":144},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[136,81,146,147,148,84,103,149,150,151,94,152,107],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":34},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[155,160,161,162,107,163,150,164,165,166,167,168],"status","play","go","latest","github","discover","control","cmd","volume"]