ARM64、ARMv7、x86_64 上的 ELF 二进制的代理二进制逆向工程——基于假设驱动的分析，使用 radare2、Ghidra、GDB、QEMU
概览
你从嵌入式设备中提取了一个二进制。这是个ELF，可能是ARM，你需要弄清楚它的作用。Binary RE为Claude提供了工具——radare2用于反汇编，Ghidra用于反编译，GDB用于动态分析，QEMU用于仿真——这些都是通过假设检验驱动的，而不是盲目探索。 - 二元RE——结构化的房地产工作流，基于假设驱动分析 - 跨架构静态分析（ARM64、ARMv7、x86_64、MIPS）- 通过QEMU用户模式仿真进行动态追踪 - 用于调试的GDB集成 - Ghhidra 无头反编译 - 用于风险操作的人工环控门 - 固件分析——无需源代码即可理解设备行为 - 协议逆向工程——绘制网络通信图 - 安全研究——发现嵌入式系统中的漏洞 - 硬件黑客——分析机器人/物联网设备内部结构 LLM推动分析;人类提供上下文。
概述（AI 翻译）
你从嵌入式设备中提取了一个二进制。这是个ELF，可能是ARM，你需要弄清楚它的作用。Binary RE为Claude提供了工具——radare2用于反汇编，Ghidra用于反编译，GDB用于动态分析，QEMU用于仿真——这些都是通过假设检验驱动的，而不是盲目探索。
安装
这个插件提供的
技能
binary-re——结构化的房地产工作流程，基于假设驱动分析
子技能
| 名称 | 描述 |
|---|---|
binary-re:triage |
快速二进制指纹识别——架构、ABI、依赖关系和通过rabin2的字符串。优先使用任何未知二进制。 |
binary-re:static-analysis |
通过radare2和Ghidra进行深度代码分析——函数、交叉引用、反编译和CFGs，无需执行。 |
binary-re:dynamic-analysis |
通过QEMU、GDB和Frida进行运行时行为观察——系统调用追踪、断点和内存检查;需要人工批准。 |
binary-re:synthesis |
将分析结果汇编成结构化报告，包含经过验证的假设和证据链。 |
本页由 AI 翻译，技术细节请以原文为准。
README
以下为原文 README 节选，完整内容请查看原文。
Binary Reverse Engineering Plugin
You pulled a binary off an embedded device. It’s an ELF, probably ARM, and you need to figure out what it does. Binary RE gives Claude the tools to help — radare2 for disassembly, Ghidra for decompilation, GDB for dynamic analysis, QEMU for emulation — driven by hypothesis-testing, not blind exploration.
Installation
/plugin marketplace add 2389-research/claude-plugins
/plugin install binary-re@2389-research
What this plugin provides
Skills
binary-re– structured RE workflow with hypothesis-driven analysis
Sub-skills
| Name | Description |
|---|---|
binary-re:triage |
Fast binary fingerprinting — architecture, ABI, dependencies, and strings via rabin2. Use first on any unknown binary. |
binary-re:static-analysis |
Deep code analysis via radare2 and Ghidra — functions, cross-references, decompilation, and CFGs without execution. |
binary-re:dynamic-analysis |
Runtime behavior observation via QEMU, GDB, and Frida — syscall tracing, breakpoints, and memory inspection; requires human approval. |
binary-re:synthesis |
Compiles analysis findings into structured reports with validated hypotheses and evidence chains. |
binary-re:tool-setup |
Installs and configures radare2, Ghidra, GDB, QEMU, Frida, and cross-compilation toolchains. |
Capabilities
- Cross-architecture static analysis (ARM64, ARMv7, x86_64, MIPS)
- Dynamic tracing via QEMU user-mode emulation
- GDB integration for debugging
- Ghidra headless decompilation
- Human-in-the-loop gates for risky operations
Quick example
User: "Analyze this binary from an IoT device - ARM, Linux-based"
Claude: [Triggers binary-re skill]
Let me start with triage to understand what we're working with.
Phase 1: Initial Triage
┌─────────────────────────────────────────┐
│ Architecture: ARM 32-bit LE (v7) │
│ Libc: musl 1.2.3 │
│ Dependencies: libcurl, libssl, libz │
│ Stripped: Yes │
│ Strings: 847 (including URLs, paths) │
└─────────────────────────────────────────┘
FACTS recorded:
- Links against libcurl.so.4 (network client)
- Contains string "api.vendor.com/telemetry"
- Imports socket, connect, SSL_read functions
HYPOTHESIS: This is a telemetry client that phones home over HTTPS
Confidence: 0.7
Evidence: curl+ssl imports, telemetry URL string
Do you want me to proceed with static analysis of network-related
functions, or should we try dynamic analysis under QEMU first?
Tool requirements
# Required
sudo apt install radare2 qemu-user gdb-multiarch
# Recommended
# Ghidra from https://ghidra-sre.org/
pip install frida-tools
# ARM sysroots
sudo apt install libc6-armhf-cross libc6-arm64-cross
Use cases
- Firmware analysis – understand device behavior without source
- Protocol reverse engineering – map network communications
- Security research – find vulnerabilities in embedded systems
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add 2389-research/binary-re