binary-analysis-patterns

1# Binary Analysis Patterns
2 
3Comprehensive patterns and techniques for analyzing compiled binaries, understanding assembly code, and reconstructing program logic.
4 
5## Use this skill when
6 
7- Working on binary analysis patterns tasks or workflows
8- Needing guidance, best practices, or checklists for binary analysis patterns
9 
10## Do not use this skill when
11 
12- The task is unrelated to binary analysis patterns
13- You need a different domain or tool outside this scope
14 
15## Instructions
16 
17- Clarify goals, constraints, and required inputs.
18- Apply relevant best practices and validate outcomes.
19- Provide actionable steps and verification.
20 
21## Disassembly Fundamentals
22 
23### x86-64 Instruction Patterns
24 
25#### Function Prologue/Epilogue
26```asm
27; Standard prologue
28push rbp           ; Save base pointer
29mov rbp, rsp       ; Set up stack frame
30sub rsp, 0x20      ; Allocate local variables
31 
32; Leaf function (no calls)
33; May skip frame pointer setup
34sub rsp, 0x18      ; Just allocate locals
35 
36; Standard epilogue
37mov rsp, rbp       ; Restore stack pointer
38pop rbp            ; Restore base pointer
39ret
40 
41; Leave instruction (equivalent)
42leave              ; mov rsp, rbp; pop rbp
43ret
44```
45 
46#### Calling Conventions
47 
48**System V AMD64 (Linux, macOS)**
49```asm
50; Arguments: RDI, RSI, RDX, RCX, R8, R9, then stack
51; Return: RAX (and RDX for 128-bit)
52; Caller-saved: RAX, RCX, RDX, RSI, RDI, R8-R11
53; Callee-saved: RBX, RBP, R12-R15
54 
55; Example: func(a, b, c, d, e, f, g)
56mov rdi, [a]       ; 1st arg
57…