x86-cpp-reversing

A Claude Code skill for reverse-engineering 32-bit little-endian x86 (IA-32) binaries and disassembly compiled from C++. Recovers class layouts, vtables, virtual dispatch, and RTTI/inheritance hierarchies from ELF or PE binaries, and covers the workflows that come up once you have that structure: recovering a custom file format, mapping a data file's indexed entries back to the code/entity that uses them, and recognizing obfuscation or anti-debugging tricks along the way.

Built for agent use: SKILL.md is the entry point an agent reads, written so that mechanical, well-specified work (ABI struct layouts, relocation resolution, symbol demangling) is front-loaded into structured JSON via scripts/recon.py rather than spent as reasoning effort on raw disassembly. Everything degrades gracefully to manual objdump/readelf/nm/GDB recipes if the fancier tooling (radare2, LIEF, Triton) isn't available.

What it covers

Requirements

• Always available: objdump, readelf, nm, c++filt, gdb (standard binutils/GDB, present on almost any Linux box).
• Recommended, not required: radare2 + r2pipe, and pip install lief capstone pwntools -- unlocks the automated/structured recipes; without them, references/tool-recipes.md has manual fallbacks for everything.
• Optional, for scripts/backward_slice.py only: triton-library (the JonathanSalwan/Triton binary-analysis project) in a dedicated virtualenv -- do not pip install triton-library into your regular environment if you have any ML tooling installed (PyTorch, vLLM, etc.), since OpenAI's unrelated GPU-kernel-compiler package is also importable as triton and the two collide. See AGENTS.md and the script's own docstring.

Installing as a Claude Code skill

git clone git@github.com:gavmor/x86-cpp-reversing-skill.git ~/.agents/skills/x86-cpp-reversing
ln -s ~/.agents/skills/x86-cpp-reversing ~/.claude/skills/x86-cpp-reversing

Claude Code will pick it up automatically for prompts like "what does this .exe do," "recover the class hierarchy from this binary," or "why does this crash inside a virtual call" -- see SKILL.md's description for the full trigger conditions.

Repo layout

SKILL.md                    entry point: workflow, triage steps, anti-rationalization table, exit criteria
AGENTS.md                   instructions for agents editing this repo's own content
scripts/recon.py            LIEF-based static triage + Itanium ABI vtable/RTTI recovery
scripts/backward_slice.py   Triton-based backward slicing (needs its own venv, see above)
references/itanium-abi.md   ELF/Itanium ABI details
references/msvc-abi.md      PE/MSVC ABI details
references/tool-recipes.md  concrete commands, by task (triage through §14)
references/obfuscation.md   recognizing deliberate obfuscation
references/anti-debugging.md recognizing anti-debugging techniques

Contributing

If you're extending this skill's own content (not just using it against a target binary), read AGENTS.md first -- in particular, its norm on verifying external tool/library/paper citations against the primary source before they land in references/*.md.