Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.
Add this skill
npx mdskills install sickn33/binary-analysis-patternsComprehensive reference for x86/ARM disassembly patterns with strong control flow and data structure coverage
1---2name: binary-analysis-patterns3description: Master binary analysis patterns including disassembly, decompilation, control flow analysis, and code pattern recognition. Use when analyzing executables, understanding compiled code, or performing static analysis on binaries.4---56# Binary Analysis Patterns78Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.910## Use this skill when1112- Working on binary analysis patterns tasks or workflows13- Needing guidance, best practices, or checklists for binary analysis patterns1415## Do not use this skill when1617- The task is unrelated to binary analysis patterns18- You need a different domain or tool outside this scope1920## Instructions2122- Clarify goals, constraints, and required inputs.23- Apply relevant best practices and validate outcomes.24- Provide actionable steps and verification.25- If detailed examples are required, open `resources/implementation-playbook.md`.2627## Disassembly Fundamentals2829### x86-64 Instruction Patterns3031#### Function Prologue/Epilogue32```asm33; Standard prologue34push rbp ; Save base pointer35mov rbp, rsp ; Set up stack frame36sub rsp, 0x20 ; Allocate local variables3738; Leaf function (no calls)39; May skip frame pointer setup40sub rsp, 0x18 ; Just allocate locals4142; Standard epilogue43mov rsp, rbp ; Restore stack pointer44pop rbp ; Restore base pointer45ret4647; Leave instruction (equivalent)48leave ; mov rsp, rbp; pop rbp49ret50```5152#### Calling Conventions5354**System V AMD64 (Linux, macOS)**55```asm56; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack57; Return: RAX (and RDX for 128-bit)58; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R1159; Callee-saved: RBX, RBP, R12-R156061; Example: func(a, b, c, d, e, f, g)62mov rdi, [a] ; 1st arg63mov rsi, [b] ; 2nd arg64mov rdx, [c] ; 3rd arg65mov rcx, [d] ; 4th arg66mov r8, [e] ; 5th arg67mov r9, [f] ; 6th arg68push [g] ; 7th arg on stack69call func70```7172**Microsoft x64 (Windows)**73```asm74; Arguments: RCX, RDX, R8, R9, then stack75; Shadow space: 32 bytes reserved on stack76; Return: RAX7778; Example: func(a, b, c, d, e)79sub rsp, 0x28 ; Shadow space + alignment80mov rcx, [a] ; 1st arg81mov rdx, [b] ; 2nd arg82mov r8, [c] ; 3rd arg83mov r9, [d] ; 4th arg84mov [rsp+0x20], [e] ; 5th arg on stack85call func86add rsp, 0x2887```8889### ARM Assembly Patterns9091#### ARM64 (AArch64) Calling Convention92```asm93; Arguments: X0-X794; Return: X0 (and X1 for 128-bit)95; Frame pointer: X2996; Link register: X309798; Function prologue99stp x29, x30, [sp, #-16]! ; Save FP and LR100mov x29, sp ; Set frame pointer101102; Function epilogue103ldp x29, x30, [sp], #16 ; Restore FP and LR104ret105```106107#### ARM32 Calling Convention108```asm109; Arguments: R0-R3, then stack110; Return: R0 (and R1 for 64-bit)111; Link register: LR (R14)112113; Function prologue114push {fp, lr}115add fp, sp, #4116117; Function epilogue118pop {fp, pc} ; Return by popping PC119```120121## Control Flow Patterns122123### Conditional Branches124125```asm126; if (a == b)127cmp eax, ebx128jne skip_block129; ... if body ...130skip_block:131132; if (a < b) - signed133cmp eax, ebx134jge skip_block ; Jump if greater or equal135; ... if body ...136skip_block:137138; if (a < b) - unsigned139cmp eax, ebx140jae skip_block ; Jump if above or equal141; ... if body ...142skip_block:143```144145### Loop Patterns146147```asm148; for (int i = 0; i < n; i++)149xor ecx, ecx ; i = 0150loop_start:151cmp ecx, [n] ; i < n152jge loop_end153; ... loop body ...154inc ecx ; i++155jmp loop_start156loop_end:157158; while (condition)159jmp loop_check160loop_body:161; ... body ...162loop_check:163cmp eax, ebx164jl loop_body165166; do-while167loop_body:168; ... body ...169cmp eax, ebx170jl loop_body171```172173### Switch Statement Patterns174175```asm176; Jump table pattern177mov eax, [switch_var]178cmp eax, max_case179ja default_case180jmp [jump_table + eax*8]181182; Sequential comparison (small switch)183cmp eax, 1184je case_1185cmp eax, 2186je case_2187cmp eax, 3188je case_3189jmp default_case190```191192## Data Structure Patterns193194### Array Access195196```asm197; array[i] - 4-byte elements198mov eax, [rbx + rcx*4] ; rbx=base, rcx=index199200; array[i] - 8-byte elements201mov rax, [rbx + rcx*8]202203; Multi-dimensional array[i][j]204; arr[i][j] = base + (i * cols + j) * element_size205imul eax, [cols]206add eax, [j]207mov edx, [rbx + rax*4]208```209210### Structure Access211212```c213struct Example {214 int a; // offset 0215 char b; // offset 4216 // padding // offset 5-7217 long c; // offset 8218 short d; // offset 16219};220```221222```asm223; Accessing struct fields224mov rdi, [struct_ptr]225mov eax, [rdi] ; s->a (offset 0)226movzx eax, byte [rdi+4] ; s->b (offset 4)227mov rax, [rdi+8] ; s->c (offset 8)228movzx eax, word [rdi+16] ; s->d (offset 16)229```230231### Linked List Traversal232233```asm234; while (node != NULL)235list_loop:236test rdi, rdi ; node == NULL?237jz list_done238; ... process node ...239mov rdi, [rdi+8] ; node = node->next (assuming next at offset 8)240jmp list_loop241list_done:242```243244## Common Code Patterns245246### String Operations247248```asm249; strlen pattern250xor ecx, ecx251strlen_loop:252cmp byte [rdi + rcx], 0253je strlen_done254inc ecx255jmp strlen_loop256strlen_done:257; ecx contains length258259; strcpy pattern260strcpy_loop:261mov al, [rsi]262mov [rdi], al263test al, al264jz strcpy_done265inc rsi266inc rdi267jmp strcpy_loop268strcpy_done:269270; memcpy using rep movsb271mov rdi, dest272mov rsi, src273mov rcx, count274rep movsb275```276277### Arithmetic Patterns278279```asm280; Multiplication by constant281; x * 3282lea eax, [rax + rax*2]283284; x * 5285lea eax, [rax + rax*4]286287; x * 10288lea eax, [rax + rax*4] ; x * 5289add eax, eax ; * 2290291; Division by power of 2 (signed)292mov eax, [x]293cdq ; Sign extend to EDX:EAX294and edx, 7 ; For divide by 8295add eax, edx ; Adjust for negative296sar eax, 3 ; Arithmetic shift right297298; Modulo power of 2299and eax, 7 ; x % 8300```301302### Bit Manipulation303304```asm305; Test specific bit306test eax, 0x80 ; Test bit 7307jnz bit_set308309; Set bit310or eax, 0x10 ; Set bit 4311312; Clear bit313and eax, ~0x10 ; Clear bit 4314315; Toggle bit316xor eax, 0x10 ; Toggle bit 4317318; Count leading zeros319bsr eax, ecx ; Bit scan reverse320xor eax, 31 ; Convert to leading zeros321322; Population count (popcnt)323popcnt eax, ecx ; Count set bits324```325326## Decompilation Patterns327328### Variable Recovery329330```asm331; Local variable at rbp-8332mov qword [rbp-8], rax ; Store to local333mov rax, [rbp-8] ; Load from local334335; Stack-allocated array336lea rax, [rbp-0x40] ; Array starts at rbp-0x40337mov [rax], edx ; array[0] = value338mov [rax+4], ecx ; array[1] = value339```340341### Function Signature Recovery342343```asm344; Identify parameters by register usage345func:346 ; rdi used as first param (System V)347 mov [rbp-8], rdi ; Save param to local348 ; rsi used as second param349 mov [rbp-16], rsi350 ; Identify return by RAX at end351 mov rax, [result]352 ret353```354355### Type Recovery356357```asm358; 1-byte operations suggest char/bool359movzx eax, byte [rdi] ; Zero-extend byte360movsx eax, byte [rdi] ; Sign-extend byte361362; 2-byte operations suggest short363movzx eax, word [rdi]364movsx eax, word [rdi]365366; 4-byte operations suggest int/float367mov eax, [rdi]368movss xmm0, [rdi] ; Float369370; 8-byte operations suggest long/double/pointer371mov rax, [rdi]372movsd xmm0, [rdi] ; Double373```374375## Ghidra Analysis Tips376377### Improving Decompilation378379```java380// In Ghidra scripting381// Fix function signature382Function func = getFunctionAt(toAddr(0x401000));383func.setReturnType(IntegerDataType.dataType, SourceType.USER_DEFINED);384385// Create structure type386StructureDataType struct = new StructureDataType("MyStruct", 0);387struct.add(IntegerDataType.dataType, "field_a", null);388struct.add(PointerDataType.dataType, "next", null);389390// Apply to memory391createData(toAddr(0x601000), struct);392```393394### Pattern Matching Scripts395396```python397# Find all calls to dangerous functions398for func in currentProgram.getFunctionManager().getFunctions(True):399 for ref in getReferencesTo(func.getEntryPoint()):400 if func.getName() in ["strcpy", "sprintf", "gets"]:401 print(f"Dangerous call at {ref.getFromAddress()}")402```403404## IDA Pro Patterns405406### IDAPython Analysis407408```python409import idaapi410import idautils411import idc412413# Find all function calls414def find_calls(func_name):415 for func_ea in idautils.Functions():416 for head in idautils.Heads(func_ea, idc.find_func_end(func_ea)):417 if idc.print_insn_mnem(head) == "call":418 target = idc.get_operand_value(head, 0)419 if idc.get_func_name(target) == func_name:420 print(f"Call to {func_name} at {hex(head)}")421422# Rename functions based on strings423def auto_rename():424 for s in idautils.Strings():425 for xref in idautils.XrefsTo(s.ea):426 func = idaapi.get_func(xref.frm)427 if func and "sub_" in idc.get_func_name(func.start_ea):428 # Use string as hint for naming429 pass430```431432## Best Practices433434### Analysis Workflow4354361. **Initial triage**: File type, architecture, imports/exports4372. **String analysis**: Identify interesting strings, error messages4383. **Function identification**: Entry points, exports, cross-references4394. **Control flow mapping**: Understand program structure4405. **Data structure recovery**: Identify structs, arrays, globals4416. **Algorithm identification**: Crypto, hashing, compression4427. **Documentation**: Comments, renamed symbols, type definitions443444### Common Pitfalls445446- **Optimizer artifacts**: Code may not match source structure447- **Inline functions**: Functions may be expanded inline448- **Tail call optimization**: `jmp` instead of `call` + `ret`449- **Dead code**: Unreachable code from optimization450- **Position-independent code**: RIP-relative addressing451
Full transparency — inspect the skill content before installing.