Skip to content
Get packs

Binary Analysis Patterns

Teaches the agent common assembly and decompilation patterns for reading compiled programs

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
2 files

What it does

When installed, the agent gets a reference guide for reading compiled programs (executables) without their source code. It knows how common code constructs such as if statements, loops, switch tables, struct field access, and string functions look in assembly, and it can help interpret disassembly output or suggest how to clean up decompiled code in tools like Ghidra or IDA Pro. The skill itself is documentation and example snippets; it does not run any program on its own.

Great for

  • Security researchers or students learning to read assembly and decompiler output
  • Developers investigating how a compiled binary behaves when source code is unavailable
  • Reverse engineers working in Ghidra or IDA Pro who want pattern-recognition help

Skip it if

  • Anyone expecting a turnkey tool that disassembles or decompiles files automatically; the skill only supplies guidance, and the user still needs Ghidra, IDA Pro, or similar software
  • Analysis of untrusted malware without an isolated environment, since the agent may reason about dangerous samples and the skill gives no safety procedures for handling them

Try asking

  • “Explain what this assembly snippet from a disassembly listing is doing: cmp eax, ebx followed by jge”
  • “Help me recognize whether this block is a switch jump table or a sequence of comparisons”
  • “Suggest how to rename functions in this IDA Pro database based on the strings they reference”
  • “Write a Ghidra script that finds calls to strcpy and gets in this binary”
Step-by-step guide: how to use Binary Analysis PatternsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    binary-analysis-patterns.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip binary-analysis-patterns.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip binary-analysis-patterns.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Provide the actual disassembly or decompiled output, plus the architecture and calling convention, so the agent can reason about specific instructions rather than generic idioms
  • Treat the agent's interpretations as hypotheses and verify them against the binary in your disassembler
  • Run analysis of suspicious or malicious samples inside an isolated virtual machine, not on your main system

What's inside

  • references/details.md
  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.